{ "parameters": { "access_token": { "type": "string", "description": "OAuth access token.", "location": "query" }, "alt": { "type": "string", "description": "Data format for response.", "default": "json", "enum": [ "json", "media", "proto" ], "enumDescriptions": [ "Responses with Content-Type of application/json", "Media download with context-dependent Content-Type", "Responses with Content-Type of application/x-protobuf" ], "location": "query" }, "callback": { "type": "string", "description": "JSONP", "location": "query" }, "fields": { "type": "string", "description": "Selector specifying which fields to include in a partial response.", "location": "query" }, "key": { "type": "string", "description": "API key. Your API key identifies your project and provides you with API access, quota, and reports. Required unless you provide an OAuth 2.0 token.", "location": "query" }, "oauth_token": { "type": "string", "description": "OAuth 2.0 token for the current user.", "location": "query" }, "prettyPrint": { "type": "boolean", "description": "Returns response with indentations and line breaks.", "default": "true", "location": "query" }, "quotaUser": { "type": "string", "description": "Available to use for quota purposes for server-side applications. Can be any arbitrary string assigned to a user, but should not exceed 40 characters.", "location": "query" }, "upload_protocol": { "type": "string", "description": "Upload protocol for media (e.g. \"raw\", \"multipart\").", "location": "query" }, "uploadType": { "type": "string", "description": "Legacy upload protocol for media (e.g. \"media\", \"multipart\").", "location": "query" }, "$.xgafv": { "type": "string", "description": "V1 error format.", "enum": [ "1", "2" ], "enumDescriptions": [ "v1 error format", "v2 error format" ], "location": "query" } }, "canonicalName": "Threat Intelligence Service", "kind": "discovery#restDescription", "mtlsRootUrl": "https://threatintelligence.mtls.googleapis.com/", "protocol": "rest", "endpoints": [ { "endpointUrl": "https://threatintelligence.us-central1.rep.googleapis.com/", "location": "us-central1", "description": "Regional Endpoint" } ], "baseUrl": "https://threatintelligence.googleapis.com/", "documentationLink": "https://docs.cloud.google.com/threatintelligence/", "schemas": { "Configuration": { "id": "Configuration", "description": "A configuration represents a behavior an engine should follow when producing new findings.", "type": "object", "properties": { "name": { "description": "Identifier. Server generated name for the configuration. format is projects/{project}/configurations/{configuration}", "type": "string" }, "displayName": { "description": "Output only. Human readable name for the configuration.", "readOnly": true, "type": "string" }, "audit": { "description": "Output only. Audit information for the configuration.", "readOnly": true, "$ref": "Audit" }, "provider": { "description": "Required. Name of the service that provides the configuration.", "type": "string" }, "state": { "description": "Optional. State of the configuration.", "type": "string", "enumDescriptions": [ "Configuration state is unspecified. This is not expected to occur.", "Configuration is enabled for the customer.", "Configuration is disabled for the customer.", "Configuration is deprecated, no new configs are allowed to be created." ], "enum": [ "STATE_UNSPECIFIED", "ENABLED", "DISABLED", "DEPRECATED" ] }, "detail": { "description": "Required. Domain specific details for the configuration.", "$ref": "ConfigurationDetail" }, "version": { "description": "Optional. A user-manipulatable version. Does not adhere to a specific format", "type": "string" }, "description": { "description": "Optional. A description of the configuration.", "type": "string" } } }, "Audit": { "id": "Audit", "description": "Tracks basic CRUD facts.", "type": "object", "properties": { "updateTime": { "description": "Output only. Time of creation or last update.", "readOnly": true, "type": "string", "format": "google-datetime" }, "createTime": { "description": "Output only. Time of creation.", "readOnly": true, "type": "string", "format": "google-datetime" }, "creator": { "description": "Output only. Agent that created or updated the record, could be a UserId or a JobId.", "readOnly": true, "type": "string" }, "updater": { "description": "Output only. Agent that last updated the record, could be a UserId or a JobId.", "readOnly": true, "type": "string" } } }, "ConfigurationDetail": { "id": "ConfigurationDetail", "description": "Wrapper class that contains the union struct for all the various configuration detail specific classes.", "type": "object", "properties": { "customerProfile": { "description": "Customer Profile detail config.", "$ref": "CustomerProfileConfig" }, "detailType": { "description": "Output only. Name of the detail type. Will be set by the server during creation to the name of the field that is set in the detail union.", "readOnly": true, "type": "string" } } }, "CustomerProfileConfig": { "id": "CustomerProfileConfig", "description": "CustomerProfileConfig is the configuration for the customer profile.", "type": "object", "properties": { "org": { "description": "Required. The name of the organization.", "type": "string" }, "orgSummary": { "description": "Optional. A summary of the organization.", "type": "string" }, "industries": { "description": "Optional. The industries the organization is involved in.", "type": "array", "items": { "$ref": "CustomerProfileIndustry" } }, "parentCompanies": { "description": "Optional. The parent companies of the organization.", "type": "array", "items": { "$ref": "CustomerProfileCompany" } }, "products": { "description": "Optional. Product information for the organization.", "type": "array", "items": { "$ref": "CustomerProfileProduct" } }, "locations": { "description": "Optional. Locations the organization is present or conducts business in.", "type": "array", "items": { "$ref": "CustomerProfileLocation" } }, "executives": { "description": "Optional. Executives of the organization.", "type": "array", "items": { "$ref": "CustomerProfilePerson" } }, "webPresences": { "description": "Optional. Web presence of the organization.", "type": "array", "items": { "$ref": "CustomerProfileWebPresence" } }, "technologyPresence": { "description": "Optional. Technology presence of the organization.", "type": "string" }, "securityConsiderations": { "description": "Optional. Security considerations for the organization.", "$ref": "CustomerProfileSecurityConsiderations" }, "contactInfo": { "description": "Optional. Contact information for the organization.", "type": "array", "items": { "$ref": "CustomerProfileContactInfo" } }, "citations": { "description": "Optional. Citations for the organization profile.", "type": "array", "items": { "$ref": "CustomerProfileCitation" } }, "summary": { "description": "Optional. A summarized version of the customer profile.", "$ref": "CustomerProfileSummary" } } }, "CustomerProfileIndustry": { "id": "CustomerProfileIndustry", "description": "Industry information for the customer profile.", "type": "object", "properties": { "industry": { "description": "Required. The name of the industry.", "type": "string" }, "citationIds": { "description": "Optional. The citation ids for the industry.", "type": "array", "items": { "type": "string" } } } }, "CustomerProfileCompany": { "id": "CustomerProfileCompany", "description": "Company information for the customer profile.", "type": "object", "properties": { "company": { "description": "Required. The name of the company.", "type": "string" }, "citationIds": { "description": "Optional. The citation ids for the company.", "type": "array", "items": { "type": "string" } } } }, "CustomerProfileProduct": { "id": "CustomerProfileProduct", "description": "Product information for the customer profile.", "type": "object", "properties": { "product": { "description": "Required. The name of the product.", "type": "string" }, "brand": { "description": "Required. The brand of the product.", "type": "string" }, "citationIds": { "description": "Optional. The citation ids for the product.", "type": "array", "items": { "type": "string" } } } }, "CustomerProfileLocation": { "id": "CustomerProfileLocation", "description": "Location information for the customer profile.", "type": "object", "properties": { "facilityType": { "description": "Optional. The type of location.", "type": "string" }, "brand": { "description": "Required. The brand of the location.", "type": "string" }, "address": { "description": "Required. The address of the location.", "type": "string" }, "citationIds": { "description": "Optional. The citation ids for the location.", "type": "array", "items": { "type": "string" } } } }, "CustomerProfilePerson": { "id": "CustomerProfilePerson", "description": "Person information for the customer profile.", "type": "object", "properties": { "name": { "description": "Required. The name of the person.", "type": "string" }, "title": { "description": "Optional. The title of the person.", "type": "string" }, "citationIds": { "description": "Optional. The citation ids for the person.", "type": "array", "items": { "type": "string" } } } }, "CustomerProfileWebPresence": { "id": "CustomerProfileWebPresence", "description": "Web presence information for the customer profile.", "type": "object", "properties": { "domain": { "description": "Required. The domain name of the web presence.", "type": "string" }, "citationIds": { "description": "Optional. The citation ids for the web presence.", "type": "array", "items": { "type": "string" } } } }, "CustomerProfileSecurityConsiderations": { "id": "CustomerProfileSecurityConsiderations", "description": "Security considerations for the customer profile.", "type": "object", "properties": { "note": { "description": "Optional. A note about the security considerations.", "type": "string" }, "considerations": { "description": "Optional. A series of considerations for the security of the organization, such as \"high risk of compromise\" or \"vulnerable to cyberbullying\".", "type": "array", "items": { "type": "string" } } } }, "CustomerProfileContactInfo": { "id": "CustomerProfileContactInfo", "description": "Contact information for the customer profile.", "type": "object", "properties": { "email": { "description": "The email address of the contact.", "type": "string" }, "phone": { "description": "The phone number of the contact.", "type": "string" }, "address": { "description": "The address of the contact.", "type": "string" }, "other": { "description": "The other contact information.", "type": "string" }, "label": { "description": "Optional. The name of the contact.", "type": "string" }, "citationIds": { "description": "Optional. The citation ids for the contact information.", "type": "array", "items": { "type": "string" } } } }, "CustomerProfileCitation": { "id": "CustomerProfileCitation", "description": "Citation information for the customer profile.", "type": "object", "properties": { "citationId": { "description": "Required. The citation id for the citation. Should be unique within the profile.", "type": "string" }, "uri": { "description": "Optional. The url of the citation.", "type": "string" }, "retrievalTime": { "description": "The time the citation was retrieved.", "type": "string", "format": "google-datetime" }, "source": { "description": "Required. The source of the citation.", "type": "string" }, "document": { "description": "Required. The name of the document the citation is from.", "type": "string" } } }, "CustomerProfileSummary": { "id": "CustomerProfileSummary", "description": "A summarized version of the customer profile. Generated by the backend.", "type": "object", "properties": { "title": { "description": "Optional. The official name of the customer.", "$ref": "CustomerProfileCitedString" }, "entityType": { "description": "Optional. The entity type of the customer.", "$ref": "CustomerProfileCitedString" }, "industry": { "description": "Optional. The industry the customer is in.", "$ref": "CustomerProfileCitedString" }, "founded": { "description": "Optional. The date the customer was founded.", "$ref": "CustomerProfileCitedString" }, "headquarters": { "description": "Optional. The headquarters of the customer.", "$ref": "CustomerProfileCitedString" }, "areaServed": { "description": "Optional. The area the customer serves.", "$ref": "CustomerProfileCitedString" }, "keyPeopleSummary": { "description": "Optional. A narrative summary of key people.", "$ref": "CustomerProfileCitedString" }, "productsSummary": { "description": "Optional. A narrative summary of products.", "$ref": "CustomerProfileCitedString" }, "servicesSummary": { "description": "Optional. A narrative summary of services.", "$ref": "CustomerProfileCitedString" }, "brands": { "description": "Optional. A narrative summary of brands.", "$ref": "CustomerProfileCitedString" }, "parentCompany": { "description": "Optional. The parent company of the customer.", "$ref": "CustomerProfileCitedString" }, "primaryWebsite": { "description": "Optional. The primary website of the customer.", "$ref": "CustomerProfileCitedString" } } }, "CustomerProfileCitedString": { "id": "CustomerProfileCitedString", "description": "A string with citation ids.", "type": "object", "properties": { "value": { "description": "Required. The value of the string.", "type": "string" }, "citationIds": { "description": "Optional. The citation ids for the string.", "type": "array", "items": { "type": "string" } } } }, "ListConfigurationsResponse": { "id": "ListConfigurationsResponse", "description": "Response message for ListConfigurations.", "type": "object", "properties": { "configurations": { "description": "List of configurations.", "type": "array", "items": { "$ref": "Configuration" } }, "nextPageToken": { "description": "Page token.", "type": "string" } } }, "ListConfigurationRevisionsResponse": { "id": "ListConfigurationRevisionsResponse", "description": "Response message for ListConfigurationRevisions.", "type": "object", "properties": { "revisions": { "description": "The Configuration Revisions associated with the specified Configuration", "type": "array", "items": { "$ref": "ConfigurationRevision" } }, "nextPageToken": { "description": "A token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.", "type": "string" } } }, "ConfigurationRevision": { "id": "ConfigurationRevision", "description": "A ConfigurationRevision is a snapshot of a Configuration at a point in time. It is immutable.", "type": "object", "properties": { "name": { "description": "Identifier. The name of the ConfigurationRevision Format: projects//configurations//revisions/", "type": "string" }, "snapshot": { "description": "The snapshot of the configuration", "$ref": "Configuration" }, "createTime": { "description": "Output only. The time the Revision was created", "readOnly": true, "type": "string", "format": "google-datetime" } } }, "UpsertConfigurationResponse": { "id": "UpsertConfigurationResponse", "description": "Response message for UpsertConfiguration.", "type": "object", "properties": { "configuration": { "description": "Output only. Created configuration ID with server assigned id.", "readOnly": true, "type": "string" } } }, "GenerateOrgProfileConfigurationRequest": { "id": "GenerateOrgProfileConfigurationRequest", "description": "Request message for GenerateOrgProfileConfiguration.", "type": "object", "properties": { "domain": { "description": "Required. The domain of the organization to generate the profile for.", "type": "string" }, "displayName": { "description": "Required. The display name of the organization to generate the profile for.", "type": "string" } } }, "Operation": { "id": "Operation", "description": "This resource represents a long-running operation that is the result of a network API call.", "type": "object", "properties": { "name": { "description": "The server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`.", "type": "string" }, "metadata": { "description": "Service-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any.", "type": "object", "additionalProperties": { "type": "any", "description": "Properties of the object. Contains field @type with type URL." } }, "done": { "description": "If the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available.", "type": "boolean" }, "error": { "description": "The error result of the operation in case of failure or cancellation.", "$ref": "Status" }, "response": { "description": "The normal, successful response of the operation. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`.", "type": "object", "additionalProperties": { "type": "any", "description": "Properties of the object. Contains field @type with type URL." } } } }, "Status": { "id": "Status", "description": "The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors).", "type": "object", "properties": { "code": { "description": "The status code, which should be an enum value of google.rpc.Code.", "type": "integer", "format": "int32" }, "message": { "description": "A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.", "type": "string" }, "details": { "description": "A list of messages that carry the error details. There is a common set of message types for APIs to use.", "type": "array", "items": { "type": "object", "additionalProperties": { "type": "any", "description": "Properties of the object. Contains field @type with type URL." } } } } }, "Finding": { "id": "Finding", "description": "A ‘stateless’ and a point in time event that a check produced a result of interest.", "type": "object", "properties": { "name": { "description": "Identifier. Server generated name for the finding (leave clear during creation). Format: projects/{project}/findings/{finding}", "type": "string" }, "provider": { "description": "Required. Logical source of this finding (name of the sub-engine).", "type": "string" }, "displayName": { "description": "Required. A short descriptive title for the finding \u003c= 250 chars. EX: \"Actor 'baddy' offering $1000 for credentials of 'goodguy'\".", "type": "string" }, "detail": { "description": "Required. Holder of the domain specific details of the finding.", "$ref": "FindingDetail" }, "severity": { "description": "Optional. Deprecated: Use the `severity_analysis` field instead. Base severity score from the finding source.", "deprecated": true, "type": "number", "format": "float" }, "reoccurrenceTimes": { "description": "Output only. When identical finding (same labels and same details) has re-occurred.", "readOnly": true, "type": "array", "items": { "type": "string", "format": "google-datetime" } }, "relevanceAnalysis": { "description": "Output only. High-Precision Relevance Analysis verdict for the finding.", "readOnly": true, "$ref": "RelevanceAnalysis" }, "severityAnalysis": { "description": "Output only. High-Precision Severity Analysis verdict for the finding.", "readOnly": true, "$ref": "SeverityAnalysis" }, "aiSummary": { "description": "Optional. AI summary of the finding.", "type": "string" }, "audit": { "description": "Output only. Audit data about the finding.", "readOnly": true, "$ref": "Audit" }, "alert": { "description": "Optional. Name of the alert that this finding is bound to.", "type": "string" }, "configurations": { "description": "Optional. Configuration names that are bound to this finding.", "type": "array", "items": { "type": "string" } } } }, "FindingDetail": { "id": "FindingDetail", "description": "Wrapper class that contains the union struct for all the various findings detail specific classes.", "type": "object", "properties": { "initialAccessBroker": { "description": "Initial Access Broker finding detail type.", "$ref": "InitialAccessBrokerFindingDetail" }, "dataLeak": { "description": "Data Leak finding detail type.", "$ref": "DataLeakFindingDetail" }, "insiderThreat": { "description": "Insider Threat finding detail type.", "$ref": "InsiderThreatFindingDetail" }, "detailType": { "description": "Output only. Name of the detail type. Will be set by the server during creation to the name of the field that is set in the detail union.", "readOnly": true, "type": "string" } } }, "InitialAccessBrokerFindingDetail": { "id": "InitialAccessBrokerFindingDetail", "description": "A detail object for an Initial Access Broker (IAB) finding.", "type": "object", "properties": { "matchScore": { "description": "Required. Reference to the match score of the IAB finding. This is a float value between 0 and 1 calculated by the matching engine based on the similarity of the document and the user provided configurations.", "type": "number", "format": "float" }, "severity": { "description": "Required. The severity of the IAB finding. This indicates the potential impact of the threat.", "type": "string", "enumDescriptions": [ "", "", "", "", "" ], "enum": [ "SEVERITY_UNSPECIFIED", "LOW", "MEDIUM", "HIGH", "CRITICAL" ] }, "documentId": { "description": "Required. The unique identifier of the document that triggered the IAB finding. This ID can be used to retrieve the content of the document for further analysis.", "type": "string" } } }, "DataLeakFindingDetail": { "id": "DataLeakFindingDetail", "description": "A detail object for a Data Leak finding.", "type": "object", "properties": { "matchScore": { "description": "Required. Reference to the match score of the Data Leak finding. This is a float value greater than 0 and less than or equal to 1 calculated by the matching engine based on the similarity of the document and the user provided configurations.", "type": "number", "format": "float" }, "severity": { "description": "Required. The severity of the Data Leak finding. This indicates the potential impact of the threat.", "type": "string", "enumDescriptions": [ "Default value, should never be set.", "Low severity.", "Medium severity.", "High severity.", "Critical severity." ], "enum": [ "SEVERITY_UNSPECIFIED", "LOW", "MEDIUM", "HIGH", "CRITICAL" ] }, "documentId": { "description": "Required. The unique identifier of the document that triggered the Data Leak finding. This ID can be used to retrieve the content of the document for further analysis.", "type": "string" } } }, "InsiderThreatFindingDetail": { "id": "InsiderThreatFindingDetail", "description": "A detail object for a InsiderThreat finding.", "type": "object", "properties": { "matchScore": { "description": "Required. Reference to the match score of the InsiderThreat finding. This is a float value greater than 0 and less than or equal to 1 calculated by the matching engine based on the similarity of the document and the user provided configurations.", "type": "number", "format": "float" }, "severity": { "description": "Required. The severity of the InsiderThreat finding. This indicates the potential impact of the threat.", "type": "string", "enumDescriptions": [ "Default value, should never be set.", "Low severity.", "Medium severity.", "High severity.", "Critical severity." ], "enum": [ "SEVERITY_UNSPECIFIED", "LOW", "MEDIUM", "HIGH", "CRITICAL" ] }, "documentId": { "description": "Required. The unique identifier of the document that triggered the InsiderThreat finding. This ID can be used to retrieve the content of the document for further analysis.", "type": "string" } } }, "RelevanceAnalysis": { "id": "RelevanceAnalysis", "description": "Structured relevance analysis for a threat.", "type": "object", "properties": { "relevant": { "description": "Indicates whether the threat is considered relevant.", "type": "boolean" }, "confidence": { "description": "The level of confidence in the given verdict.", "type": "string", "enumDescriptions": [ "Default value. Confidence level is not specified.", "Low confidence in the verdict.", "Medium confidence in the verdict.", "High confidence in the verdict." ], "enum": [ "CONFIDENCE_LEVEL_UNSPECIFIED", "CONFIDENCE_LEVEL_LOW", "CONFIDENCE_LEVEL_MEDIUM", "CONFIDENCE_LEVEL_HIGH" ] }, "reasoning": { "description": "Human-readable explanation from the matcher, detailing why a particular result is considered relevant or not relevant.", "type": "string" }, "evidence": { "description": "Evidence supporting the verdict, including matched and unmatched items.", "$ref": "Evidence" }, "relevanceLevel": { "description": "The level of relevance.", "type": "string", "enumDescriptions": [ "Default value, should never be set.", "Low Relevance.", "Medium Relevance.", "High Relevance." ], "enum": [ "RELEVANCE_LEVEL_UNSPECIFIED", "RELEVANCE_LEVEL_LOW", "RELEVANCE_LEVEL_MEDIUM", "RELEVANCE_LEVEL_HIGH" ] } } }, "Evidence": { "id": "Evidence", "description": "Details the evidence used to determine the relevance verdict.", "type": "object", "properties": { "commonThemes": { "description": "A list of semantic themes or concepts found to be common, related, or aligned between the sources, supporting the verdict.", "type": "array", "items": { "type": "string" } }, "distinctThemes": { "description": "A list of semantic themes or descriptions unique to one source or semantically distant.", "type": "array", "items": { "type": "string" } } } }, "SeverityAnalysis": { "id": "SeverityAnalysis", "description": "Structured severity analysis for a threat.", "type": "object", "properties": { "severityLevel": { "description": "The level of severity.", "type": "string", "enumDescriptions": [ "Default value, should never be set.", "Low Severity.", "Medium Severity.", "High Severity." ], "enum": [ "SEVERITY_LEVEL_UNSPECIFIED", "SEVERITY_LEVEL_LOW", "SEVERITY_LEVEL_MEDIUM", "SEVERITY_LEVEL_HIGH" ] }, "confidence": { "description": "The level of confidence in the given verdict.", "type": "string", "enumDescriptions": [ "Default value. Confidence level is not specified.", "Low confidence in the verdict.", "Medium confidence in the verdict.", "High confidence in the verdict." ], "enum": [ "CONFIDENCE_LEVEL_UNSPECIFIED", "CONFIDENCE_LEVEL_LOW", "CONFIDENCE_LEVEL_MEDIUM", "CONFIDENCE_LEVEL_HIGH" ] }, "reasoning": { "description": "Human-readable explanation from the model, detailing why a particular result is considered to have a certain severity.", "type": "string" } } }, "ListFindingsResponse": { "id": "ListFindingsResponse", "description": "Response message for ListFindings.", "type": "object", "properties": { "findings": { "description": "List of findings.", "type": "array", "items": { "$ref": "Finding" } }, "nextPageToken": { "description": "Page token.", "type": "string" } } }, "SearchFindingsResponse": { "id": "SearchFindingsResponse", "description": "Response message for SearchFindings.", "type": "object", "properties": { "findings": { "description": "List of findings.", "type": "array", "items": { "$ref": "Finding" } }, "nextPageToken": { "description": "Page token.", "type": "string" } } }, "Alert": { "id": "Alert", "description": "Stateful object representing a group of Findings. Key feature to an Alert is that it expresses the user's intent towards the findings of that group, even those that haven't occurred yet.", "type": "object", "properties": { "name": { "description": "Identifier. Server generated name for the alert. format is projects/{project}/alerts/{alert}", "type": "string" }, "findings": { "description": "Output only. Findings that are covered by this alert.", "readOnly": true, "type": "array", "items": { "type": "string" } }, "state": { "description": "Output only. State of the alert.", "readOnly": true, "type": "string", "enumDescriptions": [ "Default value, should never be set.", "alert is new.", "alert was read by a human.", "alert has been triaged.", "alert has been escalated.", "alert has been resolved.", "alert is a duplicate of another alert.", "alert is a false positive and should be ignored.", "alert is not actionable.", "alert is benign.", "alert is tracked externally." ], "enum": [ "STATE_UNSPECIFIED", "NEW", "READ", "TRIAGED", "ESCALATED", "RESOLVED", "DUPLICATE", "FALSE_POSITIVE", "NOT_ACTIONABLE", "BENIGN", "TRACKED_EXTERNALLY" ] }, "audit": { "description": "Output only. Audit information for the alert.", "readOnly": true, "$ref": "Audit" }, "displayName": { "description": "Output only. A short title for the alert.", "readOnly": true, "type": "string" }, "detail": { "description": "Output only. Details object for the alert, not all alerts will have a details object.", "readOnly": true, "$ref": "AlertDetail" }, "duplicateOf": { "description": "Output only. alert name of the alert this alert is a duplicate of. Format: projects/{project}/alerts/{alert}", "readOnly": true, "type": "string" }, "duplicatedBy": { "description": "Output only. alert names of the alerts that are duplicates of this alert. Format: projects/{project}/alerts/{alert}", "readOnly": true, "type": "array", "items": { "type": "string" } }, "etag": { "description": "Optional. If included when updating an alert, this should be set to the current etag of the alert. If the etags do not match, the update will be rejected and an ABORTED error will be returned.", "type": "string" }, "externalId": { "description": "Output only. External ID for the alert. This is used internally to provide protection against out of order updates.", "readOnly": true, "type": "string" }, "aiSummary": { "description": "Optional. AI summary of the alert.", "type": "string" }, "relevanceAnalysis": { "description": "Output only. High-Precision Relevance Analysis verdict for the alert.", "readOnly": true, "$ref": "RelevanceAnalysis" }, "severityAnalysis": { "description": "Output only. High-Precision Severity Analysis for the alert.", "readOnly": true, "$ref": "SeverityAnalysis" }, "priorityAnalysis": { "description": "Output only. High-Precision Priority Analysis for the alert.", "readOnly": true, "$ref": "PriorityAnalysis" }, "findingCount": { "description": "Output only. The number of findings associated with this alert.", "readOnly": true, "type": "string", "format": "int64" }, "configurations": { "description": "Output only. The resource names of the Configurations bound to this alert. Format: projects/{project}/configurations/{configuration}", "readOnly": true, "type": "array", "items": { "type": "string" } } } }, "AlertDetail": { "id": "AlertDetail", "description": "Container for different types of alert details.", "type": "object", "properties": { "initialAccessBroker": { "description": "Initial Access Broker alert detail type.", "$ref": "InitialAccessBrokerAlertDetail" }, "dataLeak": { "description": "Data Leak alert detail type.", "$ref": "DataLeakAlertDetail" }, "insiderThreat": { "description": "Insider Threat alert detail type.", "$ref": "InsiderThreatAlertDetail" }, "detailType": { "description": "Output only. Name of the detail type. Will be set by the server during creation to the name of the field that is set in the detail union.", "readOnly": true, "type": "string" } } }, "InitialAccessBrokerAlertDetail": { "id": "InitialAccessBrokerAlertDetail", "description": "Captures the specific details of InitialAccessBroker (IAB) alert.", "type": "object", "properties": { "severity": { "description": "Required. The severity of the Initial Access Broker (IAB) alert. Allowed values are: * `LOW` * `MEDIUM` * `HIGH` * `CRITICAL`", "type": "string" }, "discoveryDocumentIds": { "description": "Required. Array of ids to accommodate multiple discovery documents", "type": "array", "items": { "type": "string" } } } }, "DataLeakAlertDetail": { "id": "DataLeakAlertDetail", "description": "Captures the specific details of Data Leak alert.", "type": "object", "properties": { "severity": { "description": "Required. The severity of the Data Leak alert. Allowed values are: * `LOW` * `MEDIUM` * `HIGH` * `CRITICAL`", "type": "string" }, "discoveryDocumentIds": { "description": "Required. Array of ids to accommodate multiple discovery documents", "type": "array", "items": { "type": "string" } } } }, "InsiderThreatAlertDetail": { "id": "InsiderThreatAlertDetail", "description": "Captures the specific details of InsiderThreat alert.", "type": "object", "properties": { "severity": { "description": "Required. The severity of the Insider Threat alert. Allowed values are: * `LOW` * `MEDIUM` * `HIGH` * `CRITICAL`", "type": "string" }, "discoveryDocumentIds": { "description": "Required. Array of ids to accommodate multiple discovery documents", "type": "array", "items": { "type": "string" } } } }, "PriorityAnalysis": { "id": "PriorityAnalysis", "description": "Structured priority analysis for a threat.", "type": "object", "properties": { "priorityLevel": { "description": "The level of Priority.", "type": "string", "enumDescriptions": [ "Default value, should never be set.", "Low Priority.", "Medium Priority.", "High Priority.", "Critical Priority." ], "enum": [ "PRIORITY_LEVEL_UNSPECIFIED", "PRIORITY_LEVEL_LOW", "PRIORITY_LEVEL_MEDIUM", "PRIORITY_LEVEL_HIGH", "PRIORITY_LEVEL_CRITICAL" ] }, "confidence": { "description": "The level of confidence in the given verdict.", "type": "string", "enumDescriptions": [ "Default value. Confidence level is not specified.", "Low confidence in the verdict.", "Medium confidence in the verdict.", "High confidence in the verdict." ], "enum": [ "CONFIDENCE_LEVEL_UNSPECIFIED", "CONFIDENCE_LEVEL_LOW", "CONFIDENCE_LEVEL_MEDIUM", "CONFIDENCE_LEVEL_HIGH" ] }, "reasoning": { "description": "Human-readable explanation from the model, detailing why a particular result is considered to have a certain priority.", "type": "string" } } }, "ListAlertsResponse": { "id": "ListAlertsResponse", "description": "Response message for ListAlerts.", "type": "object", "properties": { "alerts": { "description": "List of alerts.", "type": "array", "items": { "$ref": "Alert" } }, "nextPageToken": { "description": "Page token.", "type": "string" } } }, "EnumerateAlertFacetsResponse": { "id": "EnumerateAlertFacetsResponse", "description": "Response message for EnumerateAlertFacets.", "type": "object", "properties": { "facets": { "description": "List of facets and the counts.", "type": "array", "items": { "$ref": "Facet" } } } }, "Facet": { "id": "Facet", "description": "Facet represents a sub element of a resource for filtering. The results from this method are used to populate the filterable facets in the UI.", "type": "object", "properties": { "facet": { "description": "Name of the facet. This is also the string that needs to be used in the filtering expression.", "type": "string" }, "facetCounts": { "description": "List of counts for the facet (if categorical).", "type": "array", "items": { "$ref": "FacetCount" } }, "facetType": { "description": "The type of the facet. Options include \"string\", \"int\", \"float\", \"bool\", \"enum\", \"timestamp\", \"user\" and are useful to show the right sort of UI controls when building a AIP-160 style filtering string.", "type": "string" }, "minValue": { "description": "Min value of the facet stringified based on type. This is only populated for facets that have a clear ordering, for types like enum it will be left empty. Timestamps will be formatted using RFC3339.", "type": "string" }, "maxValue": { "description": "Max value of the facet stringified based on type. Will be populated and formatted the same as min_value.", "type": "string" }, "totalCount": { "description": "Total number of records that contain this facet with ANY value.", "type": "string", "format": "int64" } } }, "FacetCount": { "id": "FacetCount", "description": "FacetCount represents a count of records with each facet value.", "type": "object", "properties": { "value": { "description": "Value of the facet stringified. Timestamps will be formatted using RFC3339.", "type": "string" }, "count": { "description": "Count of records with the value.", "type": "integer", "format": "int32" } } }, "MarkAlertAsReadRequest": { "id": "MarkAlertAsReadRequest", "description": "Request message for MarkAlertAsRead.", "type": "object", "properties": {} }, "MarkAlertAsTriagedRequest": { "id": "MarkAlertAsTriagedRequest", "description": "Request message for MarkAlertAsTriaged.", "type": "object", "properties": {} }, "MarkAlertAsEscalatedRequest": { "id": "MarkAlertAsEscalatedRequest", "description": "Request message for MarkAlertAsEscalated.", "type": "object", "properties": {} }, "MarkAlertAsResolvedRequest": { "id": "MarkAlertAsResolvedRequest", "description": "Request message for MarkAlertAsResolved.", "type": "object", "properties": {} }, "MarkAlertAsFalsePositiveRequest": { "id": "MarkAlertAsFalsePositiveRequest", "description": "Request message for MarkAlertAsFalsePositive.", "type": "object", "properties": {} }, "MarkAlertAsNotActionableRequest": { "id": "MarkAlertAsNotActionableRequest", "description": "Request message for MarkAlertAsNotActionable.", "type": "object", "properties": {} }, "MarkAlertAsBenignRequest": { "id": "MarkAlertAsBenignRequest", "description": "Request message for MarkAlertAsBenign.", "type": "object", "properties": {} }, "MarkAlertAsTrackedExternallyRequest": { "id": "MarkAlertAsTrackedExternallyRequest", "description": "Request message for MarkAlertAsTrackedExternally.", "type": "object", "properties": {} }, "MarkAlertAsDuplicateRequest": { "id": "MarkAlertAsDuplicateRequest", "description": "Request message for MarkAlertAsDuplicate.", "type": "object", "properties": { "duplicateOf": { "description": "Optional. Name of the alert to mark as a duplicate of. Format: projects/{project}/alerts/{alert}", "type": "string" } } }, "AlertDocument": { "id": "AlertDocument", "description": "A document that is associated with an alert.", "type": "object", "properties": { "name": { "description": "Identifier. Server generated name for the alert document. format is projects/{project}/alerts/{alert}/documents/{document}", "type": "string" }, "content": { "description": "Output only. The content of the document.", "readOnly": true, "type": "string" }, "author": { "description": "Output only. The author of the document.", "readOnly": true, "type": "string" }, "createTime": { "description": "Output only. The timestamp of the original external publication of the document.", "readOnly": true, "type": "string", "format": "google-datetime" }, "languageCode": { "description": "Output only. The language code of the document.", "readOnly": true, "type": "string" }, "title": { "description": "Output only. The title of the document, if available.", "readOnly": true, "type": "string" }, "aiSummary": { "description": "Output only. AI summary of the document.", "readOnly": true, "type": "string" }, "translation": { "description": "Output only. The translation of the document, if available.", "readOnly": true, "$ref": "AlertDocumentTranslation" }, "source": { "description": "Output only. Source of the intel item, e.g. DarkMarket.", "readOnly": true, "type": "string" }, "sourceUri": { "description": "Output only. URI of the intel item from the source.", "readOnly": true, "type": "string" }, "ingestTime": { "description": "Output only. Time when GTI received the intel.", "readOnly": true, "type": "string", "format": "google-datetime" }, "collectionTime": { "description": "Output only. Time when the origin source collected the intel.", "readOnly": true, "type": "string", "format": "google-datetime" }, "sourceUpdateTime": { "description": "Output only. Time when the intel was last updated by the source.", "readOnly": true, "type": "string", "format": "google-datetime" } } }, "AlertDocumentTranslation": { "id": "AlertDocumentTranslation", "description": "The translation of an alert document.", "type": "object", "properties": { "translatedTitle": { "description": "Output only. The translated title of the document.", "readOnly": true, "type": "string" }, "translatedContent": { "description": "Output only. The translated content of the document.", "readOnly": true, "type": "string" } } } }, "ownerName": "Google", "servicePath": "", "ownerDomain": "google.com", "version_module": true, "rootUrl": "https://threatintelligence.googleapis.com/", "resources": { "projects": { "methods": { "generateOrgProfile": { "id": "threatintelligence.projects.generateOrgProfile", "path": "v1beta/{+name}:generateOrgProfile", "flatPath": "v1beta/projects/{projectsId}:generateOrgProfile", "httpMethod": "POST", "parameters": { "name": { "description": "Required. The name of the project to generate the profile for. Format: projects/{project}", "pattern": "^projects/[^/]+$", "location": "path", "required": true, "type": "string" } }, "parameterOrder": [ "name" ], "request": { "$ref": "GenerateOrgProfileConfigurationRequest" }, "response": { "$ref": "Operation" }, "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "description": "Triggers the generation of a Customer Profile for a project." } }, "resources": { "configurations": { "methods": { "get": { "id": "threatintelligence.projects.configurations.get", "path": "v1beta/{+name}", "flatPath": "v1beta/projects/{projectsId}/configurations/{configurationsId}", "httpMethod": "GET", "parameters": { "name": { "description": "Required. Name of the configuration to get. Format: vaults/{vault}/configurations/{configuration}", "pattern": "^projects/[^/]+/configurations/[^/]+$", "location": "path", "required": true, "type": "string" } }, "parameterOrder": [ "name" ], "response": { "$ref": "Configuration" }, "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "description": "Get a configuration by name." }, "list": { "id": "threatintelligence.projects.configurations.list", "path": "v1beta/{+parent}/configurations", "flatPath": "v1beta/projects/{projectsId}/configurations", "httpMethod": "GET", "parameters": { "parent": { "description": "Required. Parent of the configuration. Format: vaults/{vault}", "pattern": "^projects/[^/]+$", "location": "path", "required": true, "type": "string" }, "filter": { "description": "Optional. Filter criteria.", "location": "query", "type": "string" }, "orderBy": { "description": "Optional. Order by criteria in the csv format: \"field1,field2 desc\" or \"field1,field2\" or \"field1 asc, field2\".", "location": "query", "type": "string" }, "pageToken": { "description": "Optional. Page token.", "location": "query", "type": "string" }, "pageSize": { "description": "Optional. Page size.", "location": "query", "type": "integer", "format": "int32" } }, "parameterOrder": [ "parent" ], "response": { "$ref": "ListConfigurationsResponse" }, "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "description": "Get a list of configurations that meet the filter criteria." }, "upsert": { "id": "threatintelligence.projects.configurations.upsert", "path": "v1beta/{+parent}/configurations:upsert", "flatPath": "v1beta/projects/{projectsId}/configurations:upsert", "httpMethod": "POST", "parameters": { "parent": { "description": "Required. Parent of the configuration.", "pattern": "^projects/[^/]+$", "location": "path", "required": true, "type": "string" }, "publishTime": { "description": "Optional. Time that the configuration should be considered to have been published. This is an advanced feature used when onboarding and bulk loading data from other systems. Do not set this field without consulting with the API team.", "location": "query", "type": "string", "format": "google-datetime" } }, "parameterOrder": [ "parent" ], "request": { "$ref": "Configuration" }, "response": { "$ref": "UpsertConfigurationResponse" }, "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "description": "Creates or updates a configuration." } }, "resources": { "revisions": { "methods": { "list": { "id": "threatintelligence.projects.configurations.revisions.list", "path": "v1beta/{+parent}/revisions", "flatPath": "v1beta/projects/{projectsId}/configurations/{configurationsId}/revisions", "httpMethod": "GET", "parameters": { "parent": { "description": "Required. The name of the Configuration to retrieve Revisions for", "pattern": "^projects/[^/]+/configurations/[^/]+$", "location": "path", "required": true, "type": "string" }, "filter": { "description": "Optional. An AIP-160 filter string", "location": "query", "type": "string" }, "orderBy": { "description": "Optional. Specify ordering of response", "location": "query", "type": "string" }, "pageSize": { "description": "Optional. Page Size", "location": "query", "type": "integer", "format": "int32" }, "pageToken": { "description": "Optional. A page token provided by the API", "location": "query", "type": "string" } }, "parameterOrder": [ "parent" ], "response": { "$ref": "ListConfigurationRevisionsResponse" }, "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "description": "List configuration revisions that meet the filter criteria." } } } } }, "findings": { "methods": { "get": { "id": "threatintelligence.projects.findings.get", "path": "v1beta/{+name}", "flatPath": "v1beta/projects/{projectsId}/findings/{findingsId}", "httpMethod": "GET", "parameters": { "name": { "description": "Required. Name of the finding to get.", "pattern": "^projects/[^/]+/findings/[^/]+$", "location": "path", "required": true, "type": "string" } }, "parameterOrder": [ "name" ], "response": { "$ref": "Finding" }, "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "description": "Get a finding by name. The `name` field should have the format: `projects/{project}/findings/{finding}`" }, "list": { "id": "threatintelligence.projects.findings.list", "path": "v1beta/{+parent}/findings", "flatPath": "v1beta/projects/{projectsId}/findings", "httpMethod": "GET", "parameters": { "parent": { "description": "Required. Parent of the findings.", "pattern": "^projects/[^/]+$", "location": "path", "required": true, "type": "string" }, "filter": { "description": "Optional. Filter criteria.", "location": "query", "type": "string" }, "orderBy": { "description": "Optional. Order by criteria in the csv format: \"field1,field2 desc\" or \"field1,field2\" or \"field1 asc, field2\".", "location": "query", "type": "string" }, "pageToken": { "description": "Optional. Page token.", "location": "query", "type": "string" }, "pageSize": { "description": "Optional. Page size.", "location": "query", "type": "integer", "format": "int32" } }, "parameterOrder": [ "parent" ], "response": { "$ref": "ListFindingsResponse" }, "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "description": "Get a list of findings that meet the filter criteria. The `parent` field in ListFindingsRequest should have the format: projects/{project}" }, "search": { "id": "threatintelligence.projects.findings.search", "path": "v1beta/{+parent}/findings:search", "flatPath": "v1beta/projects/{projectsId}/findings:search", "httpMethod": "GET", "parameters": { "parent": { "description": "Required. Parent of the findings. Format: vaults/{vault}", "pattern": "^projects/[^/]+$", "location": "path", "required": true, "type": "string" }, "query": { "description": "Optional. Query on what findings will be returned. This supports the same filter criteria as FindingService.ListFindings as well as the following relationship query `has_alert`. Example: - `has_alert(\"name=\\\"projects/gti-12345/alerts/alert-12345\\\"\")`", "location": "query", "type": "string" }, "orderBy": { "description": "Optional. Order by criteria in the csv format: \"field1,field2 desc\" or \"field1,field2\" or \"field1 asc, field2\".", "location": "query", "type": "string" }, "pageToken": { "description": "Optional. Page token.", "location": "query", "type": "string" }, "pageSize": { "description": "Optional. Page size.", "location": "query", "type": "integer", "format": "int32" } }, "parameterOrder": [ "parent" ], "response": { "$ref": "SearchFindingsResponse" }, "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "description": "SearchFindings is a more powerful version of ListFindings that supports complex queries like \"findings for alerts\" using functions such as `has_alert` in the query string. The `parent` field in SearchFindingsRequest should have the format: projects/{project} Example to search for findings for a specific issue: `has_alert(\"name=\\\"projects/gti-12345/alerts/alert-12345\\\"\")`" } } }, "alerts": { "methods": { "get": { "id": "threatintelligence.projects.alerts.get", "path": "v1beta/{+name}", "flatPath": "v1beta/projects/{projectsId}/alerts/{alertsId}", "httpMethod": "GET", "parameters": { "name": { "description": "Required. Name of the alert to get. Format: projects/{project}/alerts/{alert}", "pattern": "^projects/[^/]+/alerts/[^/]+$", "location": "path", "required": true, "type": "string" } }, "parameterOrder": [ "name" ], "response": { "$ref": "Alert" }, "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "description": "Get an alert by name." }, "list": { "id": "threatintelligence.projects.alerts.list", "path": "v1beta/{+parent}/alerts", "flatPath": "v1beta/projects/{projectsId}/alerts", "httpMethod": "GET", "parameters": { "parent": { "description": "Required. Parent of the alerts. Format: projects/{project}", "pattern": "^projects/[^/]+$", "location": "path", "required": true, "type": "string" }, "filter": { "description": "Optional. Filter criteria. Supported fields for filtering include: * `audit.create_time` * `audit.creator` * `audit.update_time` * `audit.updater` * `detail.data_leak.discovery_document_ids` * `detail.data_leak.severity` * `detail.detail_type` * `detail.initial_access_broker.discovery_document_ids` * `detail.initial_access_broker.severity` * `detail.insider_threat.discovery_document_ids` * `detail.insider_threat.severity` * `finding_count` * `priority_analysis.priority_level` * `relevance_analysis.confidence` * `relevance_analysis.relevance_level` * `relevance_analysis.relevant` * `severity_analysis.severity_level` * `state` Examples: * `detail.detail_type = \"initial_access_broker\"` * `detail.detail_type != \"data_leak\"` * `detail.insider_threat.severity = \"HIGH\"` * `audit.create_time \u003e= \"2026-04-03T00:00:00Z\" AND audit.create_time \u003c \"2026-04-06T00:00:00Z\"` * `state = \"NEW\" OR state = \"TRIAGED\"` * `severity_analysis.severity_level = \"SEVERITY_LEVEL_CRITICAL\"`", "location": "query", "type": "string" }, "orderBy": { "description": "Optional. Order by criteria in the csv format: \"field1, field2 desc\" or \"field1, field2\" or \"field1 asc, field2\". If a field is specified without `asc` or `desc`, ascending order is used by default. Supported fields for ordering are identical to those supported for filtering. Examples: * `audit.create_time desc` * `audit.update_time asc` * `audit.create_time desc, severity_analysis.severity_level desc`", "location": "query", "type": "string" }, "pageToken": { "description": "Optional. Page token to retrieve the next page of results.", "location": "query", "type": "string" }, "pageSize": { "description": "Optional. Page size. Default to 100 alerts per page. Maximum is 1000 alerts per page.", "location": "query", "type": "integer", "format": "int32" } }, "parameterOrder": [ "parent" ], "response": { "$ref": "ListAlertsResponse" }, "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "description": "Get a list of alerts that meet the filter criteria." }, "enumerateFacets": { "id": "threatintelligence.projects.alerts.enumerateFacets", "path": "v1beta/{+parent}/alerts:enumerateFacets", "flatPath": "v1beta/projects/{projectsId}/alerts:enumerateFacets", "httpMethod": "GET", "parameters": { "parent": { "description": "Required. Parent of the alerts.", "pattern": "^projects/[^/]+$", "location": "path", "required": true, "type": "string" }, "filter": { "description": "Optional. Filter on what alerts will be enumerated.", "location": "query", "type": "string" } }, "parameterOrder": [ "parent" ], "response": { "$ref": "EnumerateAlertFacetsResponse" }, "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "description": "EnumerateAlertFacets returns the facets and the number of alerts that meet the filter criteria and have that value for each facet." }, "read": { "id": "threatintelligence.projects.alerts.read", "path": "v1beta/{+name}:read", "flatPath": "v1beta/projects/{projectsId}/alerts/{alertsId}:read", "httpMethod": "POST", "parameters": { "name": { "description": "Required. Name of the alert to mark as read. Format: projects/{project}/alerts/{alert}", "pattern": "^projects/[^/]+/alerts/[^/]+$", "location": "path", "required": true, "type": "string" } }, "parameterOrder": [ "name" ], "request": { "$ref": "MarkAlertAsReadRequest" }, "response": { "$ref": "Alert" }, "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "description": "Marks an alert as read - READ." }, "triage": { "id": "threatintelligence.projects.alerts.triage", "path": "v1beta/{+name}:triage", "flatPath": "v1beta/projects/{projectsId}/alerts/{alertsId}:triage", "httpMethod": "POST", "parameters": { "name": { "description": "Required. Name of the alert to mark as a triaged. Format: projects/{project}/alerts/{alert}", "pattern": "^projects/[^/]+/alerts/[^/]+$", "location": "path", "required": true, "type": "string" } }, "parameterOrder": [ "name" ], "request": { "$ref": "MarkAlertAsTriagedRequest" }, "response": { "$ref": "Alert" }, "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "description": "Marks an alert as triaged - TRIAGED." }, "escalate": { "id": "threatintelligence.projects.alerts.escalate", "path": "v1beta/{+name}:escalate", "flatPath": "v1beta/projects/{projectsId}/alerts/{alertsId}:escalate", "httpMethod": "POST", "parameters": { "name": { "description": "Required. Name of the alert to mark as escalated. Format: projects/{project}/alerts/{alert}", "pattern": "^projects/[^/]+/alerts/[^/]+$", "location": "path", "required": true, "type": "string" } }, "parameterOrder": [ "name" ], "request": { "$ref": "MarkAlertAsEscalatedRequest" }, "response": { "$ref": "Alert" }, "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "description": "Marks an alert as escalated - ESCALATED." }, "resolve": { "id": "threatintelligence.projects.alerts.resolve", "path": "v1beta/{+name}:resolve", "flatPath": "v1beta/projects/{projectsId}/alerts/{alertsId}:resolve", "httpMethod": "POST", "parameters": { "name": { "description": "Required. Name of the alert to mark as resolved. Format: projects/{project}/alerts/{alert}", "pattern": "^projects/[^/]+/alerts/[^/]+$", "location": "path", "required": true, "type": "string" } }, "parameterOrder": [ "name" ], "request": { "$ref": "MarkAlertAsResolvedRequest" }, "response": { "$ref": "Alert" }, "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "description": "Marks an alert to closed state - RESOLVED." }, "falsePositive": { "id": "threatintelligence.projects.alerts.falsePositive", "path": "v1beta/{+name}:falsePositive", "flatPath": "v1beta/projects/{projectsId}/alerts/{alertsId}:falsePositive", "httpMethod": "POST", "parameters": { "name": { "description": "Required. Name of the alert to mark as a false positive. Format: projects/{project}/alerts/{alert}", "pattern": "^projects/[^/]+/alerts/[^/]+$", "location": "path", "required": true, "type": "string" } }, "parameterOrder": [ "name" ], "request": { "$ref": "MarkAlertAsFalsePositiveRequest" }, "response": { "$ref": "Alert" }, "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "description": "Marks an alert as a false positive - FALSE_POSITIVE." }, "notActionable": { "id": "threatintelligence.projects.alerts.notActionable", "path": "v1beta/{+name}:notActionable", "flatPath": "v1beta/projects/{projectsId}/alerts/{alertsId}:notActionable", "httpMethod": "POST", "parameters": { "name": { "description": "Required. Name of the alert to mark as a not actionable. Format: projects/{project}/alerts/{alert}", "pattern": "^projects/[^/]+/alerts/[^/]+$", "location": "path", "required": true, "type": "string" } }, "parameterOrder": [ "name" ], "request": { "$ref": "MarkAlertAsNotActionableRequest" }, "response": { "$ref": "Alert" }, "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "description": "Marks an alert as not actionable - NOT_ACTIONABLE." }, "benign": { "id": "threatintelligence.projects.alerts.benign", "path": "v1beta/{+name}:benign", "flatPath": "v1beta/projects/{projectsId}/alerts/{alertsId}:benign", "httpMethod": "POST", "parameters": { "name": { "description": "Required. Name of the alert to mark as a benign. Format: projects/{project}/alerts/{alert}", "pattern": "^projects/[^/]+/alerts/[^/]+$", "location": "path", "required": true, "type": "string" } }, "parameterOrder": [ "name" ], "request": { "$ref": "MarkAlertAsBenignRequest" }, "response": { "$ref": "Alert" }, "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "description": "Marks an alert as benign - BENIGN." }, "trackExternally": { "id": "threatintelligence.projects.alerts.trackExternally", "path": "v1beta/{+name}:trackExternally", "flatPath": "v1beta/projects/{projectsId}/alerts/{alertsId}:trackExternally", "httpMethod": "POST", "parameters": { "name": { "description": "Required. Name of the alert to mark as tracked externally. Format: projects/{project}/alerts/{alert}", "pattern": "^projects/[^/]+/alerts/[^/]+$", "location": "path", "required": true, "type": "string" } }, "parameterOrder": [ "name" ], "request": { "$ref": "MarkAlertAsTrackedExternallyRequest" }, "response": { "$ref": "Alert" }, "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "description": "Marks an alert as tracked externally - TRACKED_EXTERNALLY." }, "duplicate": { "id": "threatintelligence.projects.alerts.duplicate", "path": "v1beta/{+name}:duplicate", "flatPath": "v1beta/projects/{projectsId}/alerts/{alertsId}:duplicate", "httpMethod": "POST", "parameters": { "name": { "description": "Required. Name of the alert to mark as a duplicate. Format: projects/{project}/alerts/{alert}", "pattern": "^projects/[^/]+/alerts/[^/]+$", "location": "path", "required": true, "type": "string" } }, "parameterOrder": [ "name" ], "request": { "$ref": "MarkAlertAsDuplicateRequest" }, "response": { "$ref": "Alert" }, "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "description": "Marks an alert as a duplicate of another alert. - DUPLICATE." } }, "resources": { "documents": { "methods": { "get": { "id": "threatintelligence.projects.alerts.documents.get", "path": "v1beta/{+name}", "flatPath": "v1beta/projects/{projectsId}/alerts/{alertsId}/documents/{documentsId}", "httpMethod": "GET", "parameters": { "name": { "description": "Required. Name of the alert document to get. Format: projects/{project}/alerts/{alert}/documents/{document}", "pattern": "^projects/[^/]+/alerts/[^/]+/documents/[^/]+$", "location": "path", "required": true, "type": "string" } }, "parameterOrder": [ "name" ], "response": { "$ref": "AlertDocument" }, "scopes": [ "https://www.googleapis.com/auth/cloud-platform" ], "description": "Gets a specific document associated with an alert." } } } } } } } }, "basePath": "", "description": "threatintelligence.googleapis.com API.", "id": "threatintelligence:v1beta", "name": "threatintelligence", "batchPath": "batch", "version": "v1beta", "revision": "20260510", "icons": { "x16": "http://www.google.com/images/icons/product/search-16.gif", "x32": "http://www.google.com/images/icons/product/search-32.gif" }, "fullyEncodeReservedExpansion": true, "discoveryVersion": "v1", "auth": { "oauth2": { "scopes": { "https://www.googleapis.com/auth/cloud-platform": { "description": "See, edit, configure, and delete your Google Cloud data and see the email address for your Google Account." } } } }, "title": "Threat Intelligence API" }