diff --git a/google/cloud/chronicle/v1beta/BUILD.bazel b/google/cloud/chronicle/v1beta/BUILD.bazel index 4e41b02dac..e72ecb285a 100644 --- a/google/cloud/chronicle/v1beta/BUILD.bazel +++ b/google/cloud/chronicle/v1beta/BUILD.bazel @@ -47,6 +47,7 @@ proto_library( "parser.proto", "reference_list.proto", "rule.proto", + "rule_execution_error.proto", "threat_collection.proto", "user_data.proto", "user_data_entries.proto", @@ -170,6 +171,8 @@ java_gapic_test( "com.google.cloud.chronicle.v1beta.ParserServiceClientTest", "com.google.cloud.chronicle.v1beta.ReferenceListServiceClientHttpJsonTest", "com.google.cloud.chronicle.v1beta.ReferenceListServiceClientTest", + "com.google.cloud.chronicle.v1beta.RuleExecutionErrorServiceClientHttpJsonTest", + "com.google.cloud.chronicle.v1beta.RuleExecutionErrorServiceClientTest", "com.google.cloud.chronicle.v1beta.RuleServiceClientHttpJsonTest", "com.google.cloud.chronicle.v1beta.RuleServiceClientTest", "com.google.cloud.chronicle.v1beta.ThreatCollectionServiceClientHttpJsonTest", diff --git a/google/cloud/chronicle/v1beta/chronicle_v1beta.yaml b/google/cloud/chronicle/v1beta/chronicle_v1beta.yaml index 4e33edb5bb..210143fd7a 100644 --- a/google/cloud/chronicle/v1beta/chronicle_v1beta.yaml +++ b/google/cloud/chronicle/v1beta/chronicle_v1beta.yaml @@ -25,6 +25,7 @@ apis: - name: google.cloud.chronicle.v1beta.NativeDashboardService - name: google.cloud.chronicle.v1beta.ParserService - name: google.cloud.chronicle.v1beta.ReferenceListService +- name: google.cloud.chronicle.v1beta.RuleExecutionErrorService - name: google.cloud.chronicle.v1beta.RuleService - name: google.cloud.chronicle.v1beta.ThreatCollectionService - name: google.cloud.chronicle.v1beta.UserDataService @@ -216,6 +217,12 @@ authentication: https://www.googleapis.com/auth/chronicle, https://www.googleapis.com/auth/chronicle.readonly, https://www.googleapis.com/auth/cloud-platform + - selector: google.cloud.chronicle.v1beta.RuleExecutionErrorService.ListRuleExecutionErrors + oauth: + canonical_scopes: |- + https://www.googleapis.com/auth/chronicle, + https://www.googleapis.com/auth/chronicle.readonly, + https://www.googleapis.com/auth/cloud-platform - selector: 'google.cloud.chronicle.v1beta.RuleService.*' oauth: canonical_scopes: |- diff --git a/google/cloud/chronicle/v1beta/chronicle_v1beta_grpc_service_config.json b/google/cloud/chronicle/v1beta/chronicle_v1beta_grpc_service_config.json index 20934439bb..ea5150cacb 100644 --- a/google/cloud/chronicle/v1beta/chronicle_v1beta_grpc_service_config.json +++ b/google/cloud/chronicle/v1beta/chronicle_v1beta_grpc_service_config.json @@ -144,7 +144,8 @@ { "service": "google.cloud.chronicle.v1beta.EntityService", "method": "FindRelatedEntities" }, { "service": "google.cloud.chronicle.v1beta.ThreatCollectionService", "method": "FetchRelatedThreatCollections" }, { "service": "google.cloud.chronicle.v1beta.UserDataService", "method" : "GetSearchQuery" }, - { "service": "google.cloud.chronicle.v1beta.UserDataService", "method" : "ListSearchQueries" } + { "service": "google.cloud.chronicle.v1beta.UserDataService", "method" : "ListSearchQueries" }, + { "service": "google.cloud.chronicle.v1beta.RuleExecutionErrorService", "method": "ListRuleExecutionErrors" } ], "timeout": "600s", "retryPolicy": { diff --git a/google/cloud/chronicle/v1beta/rule_execution_error.proto b/google/cloud/chronicle/v1beta/rule_execution_error.proto new file mode 100644 index 0000000000..04874e9e43 --- /dev/null +++ b/google/cloud/chronicle/v1beta/rule_execution_error.proto @@ -0,0 +1,156 @@ +// Copyright 2026 Google LLC +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +syntax = "proto3"; + +package google.cloud.chronicle.v1beta; + +import "google/api/annotations.proto"; +import "google/api/client.proto"; +import "google/api/field_behavior.proto"; +import "google/api/resource.proto"; +import "google/rpc/status.proto"; +import "google/type/interval.proto"; + +option csharp_namespace = "Google.Cloud.Chronicle.V1Beta"; +option go_package = "cloud.google.com/go/chronicle/apiv1beta/chroniclepb;chroniclepb"; +option java_multiple_files = true; +option java_outer_classname = "RuleExecutionErrorProto"; +option java_package = "com.google.cloud.chronicle.v1beta"; +option php_namespace = "Google\\Cloud\\Chronicle\\V1beta"; +option ruby_package = "Google::Cloud::Chronicle::V1beta"; +option (google.api.resource_definition) = { + type: "chronicle.googleapis.com/CuratedRule" + pattern: "projects/{project}/locations/{location}/instances/{instance}/curatedRules/{curatedRule}" +}; + +// RuleExecutionErrorService contains endpoints related to rule execution +// errors. +service RuleExecutionErrorService { + option (google.api.default_host) = "chronicle.googleapis.com"; + option (google.api.oauth_scopes) = + "https://www.googleapis.com/auth/chronicle," + "https://www.googleapis.com/auth/chronicle.readonly," + "https://www.googleapis.com/auth/cloud-platform"; + + // Lists rule execution errors. + rpc ListRuleExecutionErrors(ListRuleExecutionErrorsRequest) + returns (ListRuleExecutionErrorsResponse) { + option (google.api.http) = { + get: "/v1beta/{parent=projects/*/locations/*/instances/*}/ruleExecutionErrors" + }; + option (google.api.method_signature) = "parent"; + } +} + +// Request message for ListRuleExecutionErrors. +message ListRuleExecutionErrorsRequest { + // Required. The instance to list rule execution errors from. + // Format: + // projects/{project}/locations/{location}/instances/{instance} + string parent = 1 [ + (google.api.field_behavior) = REQUIRED, + (google.api.resource_reference) = { + child_type: "chronicle.googleapis.com/RuleExecutionError" + } + ]; + + // The maximum number of rule execution errors to return. The service may + // return fewer than this value. If unspecified, at most 1000 rule execution + // errors will be returned. The maximum value is 10000; values above 10000 + // will be coerced to 10000. + int32 page_size = 2; + + // A page token, received from a previous `ListRuleExecutionErrors` call. + // Provide this to retrieve the subsequent page. + // + // When paginating, all other parameters provided to `ListRuleExecutionErrors` + // must match the call that provided the page token. + string page_token = 3; + + // A filter that can be used to retrieve specific rule execution errors. + // Only the following filters are allowed: + // ``` + // rule = "{Rule.name}" + // curated_rule = "{CuratedRule.name}" + // ``` + // The value for rule or curated_rule must be a valid rule resource name or a + // valid curated rule resource name specified in quotes. + // + // For 'rule', an optional 'revision_id' can be specified which can be used to + // fetch errors for a given revision of the rule. A '-' is also allowed to + // fetch errors across all revisions of the rule. If unspecified, only errors + // corresponding to the most recent revision of the rule will be returned. So + // these variations are all allowed: + // ``` + // rule = "{Rule.name}" + // rule = "{Rule.name}@{Rule.revision_id}" + // rule = "{Rule.name}@-" + // ``` + // Revision IDs are not supported for curated rules. + string filter = 4; +} + +// Response message for ListRuleExecutionErrors. +message ListRuleExecutionErrorsResponse { + // List of rule execution errors. + repeated RuleExecutionError rule_execution_errors = 1; + + // A token, which can be sent as `page_token` to retrieve the next page. + // If this field is omitted, there are no subsequent pages. + string next_page_token = 2; +} + +// The RuleExecutionError resource represents an error generated from +// running/deploying a rule. +message RuleExecutionError { + option (google.api.resource) = { + type: "chronicle.googleapis.com/RuleExecutionError" + pattern: "projects/{project}/locations/{location}/instances/{instance}/ruleExecutionErrors/{rule_execution_error}" + }; + + // The resource name of the source that generated the rule execution error. + oneof source { + // Output only. The resource name of the rule that generated the rule + // execution error. + string rule = 4 [ + (google.api.field_behavior) = OUTPUT_ONLY, + (google.api.resource_reference) = { + type: "chronicle.googleapis.com/Rule" + } + ]; + + // Output only. The resource name of the curated rule that generated the + // rule execution error. + string curated_rule = 5 [ + (google.api.field_behavior) = OUTPUT_ONLY, + (google.api.resource_reference) = { + type: "chronicle.googleapis.com/CuratedRule" + } + ]; + } + + // Output only. The resource name of the rule execution error. + // Format: + // projects/{project}/locations/{location}/instances/{instance}/ruleExecutionErrors/{rule_execution_error} + string name = 1 [(google.api.field_behavior) = OUTPUT_ONLY]; + + // Output only. The error status corresponding with the rule execution error. + google.rpc.Status error = 2 [(google.api.field_behavior) = OUTPUT_ONLY]; + + // Output only. The event time range that the rule execution error corresponds + // with. + google.type.Interval time_range = 3 + [(google.api.field_behavior) = OUTPUT_ONLY]; +}