category: Analytics & SIEM provider: Google sectionorder: - Connect - Collect commonfields: id: Google Chronicle Backstory Streaming API version: -1 configuration: - displaypassword: User's Service Account JSON name: credentials hiddenusername: true required: true type: 9 section: Connect - section: Connect display: Use V1 Alpha API name: use_v1_alpha defaultvalue: "false" type: 8 required: false additionalinfo: |- Select this option to use the V1 Alpha API. Note: If this option is selected, Update the Region and provide the v1 Alpha API supported Service Account JSON and Project Instance ID. - display: API URL Format additionalinfo: "Select the API URL format to use for API requests. Default value is '..'. Only applicable if the \"Use V1 Alpha API\" parameter is selected." name: url_format required: false type: 15 options: - "-" - ".." section: Connect - section: Connect display: Google SecOps Project Instance ID name: project_instance_id type: 0 required: false additionalinfo: |- Provide the Project Instance ID of the Google SecOps. Only applicable if the "Use V1 Alpha API" parameter is selected. Note: User can retrieve the Customer ID(Project Instance ID) in the Profile section of the Google SecOps page. - display: Google SecOps Project Number additionalinfo: |- Provide the Project Number of the Google SecOps. Only applicable if the "Use V1 Alpha API" parameter is selected. Note: User can retrieve the Project Number in the Profile section of the Google SecOps page. If Project Number is not provided, then Project ID(from Service Account JSON) will be used. name: project_number required: false type: 0 section: Connect - additionalinfo: Select the region based on the location of the Google SecOps instance. If the region is not listed in the dropdown, choose the "Other" option and specify the region in the "Other Region" text field. defaultvalue: General display: Region name: region options: - General - Europe - Asia - Europe-west2 - Africa-south1 - Asia-northeast1 - Asia-south1 - Asia-southeast1 - Asia-southeast2 - Australia-southeast1 - EU - Europe-west3 - Europe-west6 - Europe-west9 - Europe-west12 - ME-central1 - ME-central2 - ME-west1 - Northamerica-northeast2 - Southamerica-east1 - US - Other type: 15 section: Connect - additionalinfo: Specify the region based on the location of the Google SecOps instance. Only applicable if the "Other" option is selected in the Region dropdown. display: Other Region hidden: false name: other_region required: false type: 0 section: Connect - display: Incident type name: incidentType type: 13 section: Connect required: false - additionalinfo: |- The date or relative timestamp from where to start fetching detections. Default will be the current time. Note: The API is designed to retrieve data for the past 7 days only. Requests for data beyond that timeframe will result in errors. Supported formats: N minutes, N hours, N days, N weeks, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ For example: 10 minutes, 5 hours, 6 days, 1 week, 2024-12-31, 01 Mar 2024, 01 Feb 2024 04:45:33, 2024-04-17T14:05:44Z defaultvalue: now display: First fetch time name: first_fetch type: 0 section: Collect required: false - additionalinfo: Maximum number of detections to fetch in a single batch. Available options are 100, 75, 50, 25 and 10 (If not selected, defaults to 100). display: Max Fetch name: max_fetch type: 15 section: Collect defaultvalue: '100' advanced: true options: - '100' - '75' - '50' - '25' - '10' required: false - defaultvalue: 'true' display: Long running instance hidden: true name: longRunning type: 8 section: Connect required: false - additionalinfo: Select Google SecOps Alert types to be considered for Fetch Incidents. Available options are Curated Rule Detection Alerts and Rule Detection Alerts (If not selected, fetches all detections). display: Google SecOps Alert Type name: alert_type options: - Curated Rule Detection Alerts - Rule Detection Alerts type: 16 section: Collect advanced: true required: false - additionalinfo: Select the severity of detections to be considered for Fetch Incidents. Available options are 'Critical', 'High', 'Medium', 'Low', 'Informational' and 'Unspecified' (If not selected, fetches all detections). display: Severity of Detection name: detection_severity options: - Critical - High - Medium - Low - Informational - Unspecified type: 16 section: Collect advanced: true required: false - additionalinfo: Only detections with the given rule names will be allowed for ingestion. display: Rule Names for Detection Ingestion name: rule_names type: 16 section: Collect advanced: true required: false - display: If selected, detections with the above rule names will be denied for ingestion. name: exclude_rule_names type: 8 section: Collect advanced: true required: false - additionalinfo: Only the detections with the given rule IDs will be allowed for ingestion. display: Rule IDs for Detection Ingestion name: rule_ids type: 16 section: Collect advanced: true required: false - display: If selected, detections with above rule IDs will be denied for ingestion. name: exclude_rule_ids type: 8 section: Collect advanced: true required: false - additionalinfo: Select the default severity for incident when detection does not specify a severity. Available options are 'Critical', 'High', 'Medium', 'Low', 'Informational' and 'Unspecified' (If not selected, defaults to Unspecified). display: Default Severity of Incident name: default_severity type: 15 section: Collect defaultvalue: Unspecified advanced: true options: - Critical - High - Medium - Low - Informational - Unspecified required: false - display: Trust any certificate (not secure) name: insecure type: 8 section: Connect advanced: true required: false - display: Use system proxy settings name: proxy type: 8 section: Connect advanced: true required: false description: Use the Google SecOps Streaming API integration to ingest detections created by both user-created rules and Google SecOps Rules as XSOAR incidents. display: Google SecOps Streaming API name: Google Chronicle Backstory Streaming API script: dockerimage: demisto/googleapi-python3:1.0.0.11185775 longRunning: true isFetchSamples: true runonce: false script: '-' subtype: python3 type: python fromversion: 6.10.0 tests: - No tests (auto formatted) defaultmapperin: 'Chronicle-mapper' defaultclassifier: 'Chronicle'