Google SecOps Platform Integration Guide

Overview

The Google SecOps Platform integration allows your NINA workflows to connect with the Google SecOps Security Operations Platform API to manage the full range of platform-level capabilities: dashboards, data tables, data exports, access control, long-running operations, investigations, Labs & AI experiments, and instance-wide system settings.

Capabilities

This integration provides access to 38 resources with 186 operations covering:

• Access Control: Data access labels, data access scopes, and SOC roles
• Context & Properties: Instance-level context property key-value store
• Dashboards: Native dashboards, legacy dashboards, scheduled reports, chart and query management
• Data Tables: Data table lifecycle and row-level bulk operations
• Data Export: BigQuery export provisioning and data export job management
• Investigations: Investigation lifecycle, comments, and step graph
• Labs & AI: Labs experiments, executions, notebooks, and AI conversation threads
• Operations: Long-running operation tracking and cancellation
• System Settings: Module settings, announcements, notifications, views, feature flags, federation groups, metric definitions, tenant configurations, and more

---

Credential Configuration

Before using the Google SecOps Platform integration in your workflows, you must configure credentials for authentication.

Authentication Method

Google SecOps Platform uses Google Service Account (OAuth2 JWT) authentication. You provide the full JSON key of a GCP service account, and the integration automatically negotiates a short-lived OAuth2 access token using the https://www.googleapis.com/auth/cloud-platform scope. No user interaction or redirect URLs are required.

Field	Description	Required
serviceAccountJson	Full content of the Google service account JSON key file	Yes
region	Google SecOps API region prefix (e.g. us, eu)	Yes
project	GCP project ID where the Google SecOps instance lives	Yes
location	GCP location of the Google SecOps instance (e.g. us, europe-west2)	Yes
instance	Google SecOps instance UUID	Yes

How It Works

1. You paste the service account JSON key when creating the credential in NINA.
2. On each API call the integration uses golang.org/x/oauth2/google to exchange the key for a short-lived bearer token scoped to https://www.googleapis.com/auth/cloud-platform.
3. Tokens are refreshed automatically — no manual rotation is needed at runtime.
4. All requests are sent to https://{region}-chronicle.googleapis.com.

---

Google SecOps API Regions

Choose the region that matches where your Google SecOps instance was provisioned. Using the wrong region returns 404 NOT_FOUND for every call.

Region label	region value	Base URL
United States	us	https://us-chronicle.googleapis.com
Europe	eu	https://eu-chronicle.googleapis.com
Singapore	asia-southeast1	https://asia-southeast1-chronicle.googleapis.com
India	asia-south1	https://asia-south1-chronicle.googleapis.com
Canada	northamerica-northeast2	https://northamerica-northeast2-chronicle.googleapis.com
Middle East	me-west1	https://me-west1-chronicle.googleapis.com

---

How to Obtain a Service Account Key

1. Open the Google Cloud Console and select the GCP project that owns your Google SecOps instance.
2. Navigate to IAM & Admin → Service Accounts.
3. Click Create Service Account (or select an existing one dedicated to NINA).
   • Name: e.g. nina-chronicle-platform
   • Description: "NINA Google SecOps Platform integration"
4. Click Create and continue.
5. On the Grant this service account access to the project step, assign the required IAM roles (see table below).
6. Click Done.
7. Select the service account, open the Keys tab, click Add Key → Create new key, choose JSON, and click Create.
8. The JSON key file downloads automatically. Store it securely — it cannot be retrieved again.

---

Required IAM Roles

The roles required depend on which resources and operations you use. Grant only what your workflows need.

IAM Role	Role ID	Grants access to
Google SecOps API Viewer	roles/chronicle.viewer	All read-only (list, get) operations across every resource
Google SecOps API Editor	roles/chronicle.editor	Create, update, and delete operations on most resources
Google SecOps API Admin	roles/chronicle.admin	All operations including access control, SOC roles, tenant management, and feature flags
Google SecOps SOAR Admin	roles/chronicle.soarAdmin	Investigations, investigation comments, and investigation steps
Google SecOps Limited Viewer	roles/chronicle.limitedViewer	Read-only access restricted by data access scopes

Minimum recommended configuration:

• Read-only workflows (list/get only): roles/chronicle.viewer
• Full platform management: roles/chronicle.editor
• Access control management (labels, scopes, SOC roles): roles/chronicle.admin
• Investigations: roles/chronicle.soarAdmin in addition to viewer or editor
• Data export jobs: roles/chronicle.admin — the dataExports.list endpoint requires elevated permissions beyond standard viewer

Note: Google SecOps IAM roles are granted at the GCP project level. Open IAM & Admin → IAM in the Cloud Console, find the service account, click Edit, and add the required roles.

---

Where to Find Each Credential Value

Field	Where to find it
serviceAccountJson	The JSON file downloaded in step 7 above — paste the entire file content
region	Shown in your Google SecOps URL: https://{region}-chronicle.googleapis.com
project	GCP project ID shown in the Cloud Console header (e.g. my-org-chronicle-prod)
location	The GCP region used when the Google SecOps instance was provisioned; visible in Google SecOps's instance settings or the resource name path
instance	The UUID in the Google SecOps instance resource name: projects/{project}/locations/{location}/instances/{instance} — visible in Google SecOps Settings → Instance

---

Creating a Google SecOps Platform Credential in NINA

1. Navigate to Credentials in NINA.
2. Click Add New Credential.
3. Set Integration Service to Google SecOps Platform.
4. Fill in the five fields:
   • serviceAccountJson: Paste the full contents of the JSON key file.
   • region: e.g. eu
   • project: e.g. my-org-chronicle-prod
   • location: e.g. europe-west2
   • instance: e.g. fca7f167-b9d1-43b1-9d03-0257d31dcb63
5. Click Test Connection to verify. The connector calls GET .../operations?pageSize=1 as a lightweight probe.
6. Click Save.

Shared credentials: All Google SecOps connectors (chronicle-cases, chronicle-events, chronicle-entities, chronicle-platform, etc.) use the same five credential fields and the same service account. One credential can be reused across all Google SecOps integrations.

---

Supported Resources

Resource	Description	Operations
dataAccessLabels	Data access labels for data visibility control	5
dataAccessScopes	Data access scopes combining labels for user visibility	5
socRoles	SOC roles assigning permissions to users	5
contextProperties	Instance-level key-value context properties	6
dashboardCharts	Dashboard chart definitions	2
dashboardQueries	Dashboard query execution and retrieval	2
dashboardScheduledReports	Scheduled dashboard report delivery	8
dashboards	Legacy dashboards and migration operations	9
nativeDashboards	Native dashboards, charts, import/export, IAM	14
dataTableOperationErrors	Error details for failed data table operations	1
dataTables	Data table lifecycle management	6
dataTableRows	Row-level operations including bulk create/update/delete	15
bigQueryExport	BigQuery export provisioning and access	2
dataExports	Data export job management	7
investigations	Investigation lifecycle management	5
investigationComments	Comments on investigations	5
investigationSteps	Investigation graph step nodes	2
labsExperiments	Labs AI experiment execution and management	6
labsExperimentExecutions	Labs experiment execution tracking	3
notebooks	Labs notebooks	2
conversations	User-scoped AI conversation threads	5
conversationMessages	Messages within AI conversations	5
operations	Long-running operation tracking and cancellation	5
moduleSettings	Instance module settings and properties	6
savedColumnSets	Instance-scoped saved column configurations	5
userSavedColumnSets	User-scoped saved column configurations	5
announcements	System announcements displayed to users	5
systemNotifications	System notification management	3
views	View configurations	4
features	Feature flag management	4
federationGroups	Multi-instance federation groups	5
metricDefinitions	Custom metric definitions	4
sharedPreferenceSets	Shared preference sets	5
tenants	Tenant configurations	4
errorNotificationConfigs	Error notification delivery configurations	5
userSettings	Per-user settings (preferences, conversation history)	3
userModuleSettings	Per-user module settings overrides	1
managedDomainSettings	Managed domain settings for federated deployments	2

---

Resource Details

dataAccessLabels

Manage Google SecOps data access labels used to control visibility of data within an instance. Requires roles/chronicle.admin.

Operations

Operation	Method	Description
create	POST	Create a new data access label
delete	DELETE	Delete a label by resource name
get	GET	Get a single label by resource name
list	GET	List all labels in the instance
patch	PATCH	Update an existing label

create

Parameters:

Name	Type	Required	Description
displayName	string	Yes	Human-readable name for the label
description	string	No	Optional description

Example:

{
  "displayName": "PII Data",
  "description": "Label for personally identifiable information"
}

delete

Parameters:

Name	Type	Required	Description
name	string	Yes	Resource name, e.g. projects/my-project/locations/us/instances/uuid/dataAccessLabels/label-id

Example:

{
  "name": "projects/my-project/locations/us/instances/fca7f167-b9d1-43b1-9d03-0257d31dcb63/dataAccessLabels/pii-data"
}

get

Parameters:

Name	Type	Required	Description
name	string	Yes	Resource name of the data access label

Example:

{
  "name": "projects/my-project/locations/us/instances/fca7f167-b9d1-43b1-9d03-0257d31dcb63/dataAccessLabels/pii-data"
}

list

Parameters:

Name	Type	Required	Description
pageSize	number	No	Maximum number of results per page (default: server-defined)
pageToken	string	No	Page token from a previous response for pagination

Example:

{
  "pageSize": 50
}

patch

Parameters:

Name	Type	Required	Description
name	string	Yes	Resource name of the label to update
displayName	string	No	New display name
description	string	No	New description
updateMask	string	No	Comma-separated fields to update, e.g. displayName,description

Example:

{
  "name": "projects/my-project/locations/us/instances/fca7f167-b9d1-43b1-9d03-0257d31dcb63/dataAccessLabels/pii-data",
  "displayName": "PII — Updated",
  "updateMask": "displayName"
}

---

dataAccessScopes

Manage Google SecOps data access scopes. A scope combines one or more labels to define what data a user or role can see. Requires roles/chronicle.admin.

Operations

Operation	Method	Description
create	POST	Create a new data access scope
delete	DELETE	Delete a scope by resource name
get	GET	Get a single scope by resource name
list	GET	List all scopes in the instance
patch	PATCH	Update an existing scope

create

Parameters:

Name	Type	Required	Description
displayName	string	Yes	Human-readable name for the scope
dataAccessLabels	array	No	List of label resource names to include in the scope

Example:

{
  "displayName": "EU Security Team Scope",
  "dataAccessLabels": [
    "projects/my-project/locations/eu/instances/fca7f167-b9d1-43b1-9d03-0257d31dcb63/dataAccessLabels/eu-events"
  ]
}

delete

Parameters:

Name	Type	Required	Description
name	string	Yes	Resource name of the data access scope

Example:

{
  "name": "projects/my-project/locations/eu/instances/fca7f167-b9d1-43b1-9d03-0257d31dcb63/dataAccessScopes/eu-security-scope"
}

get

Parameters:

Name	Type	Required	Description
name	string	Yes	Resource name of the data access scope

Example:

{
  "name": "projects/my-project/locations/eu/instances/fca7f167-b9d1-43b1-9d03-0257d31dcb63/dataAccessScopes/eu-security-scope"
}

list

Parameters:

Name	Type	Required	Description
pageSize	number	No	Maximum number of results per page
pageToken	string	No	Page token for pagination

Example:

{
  "pageSize": 25
}

patch

Parameters:

Name	Type	Required	Description
name	string	Yes	Resource name of the scope to update
dataAccessLabels	array	No	Replacement list of label resource names
updateMask	string	No	Comma-separated fields to update

Example:

{
  "name": "projects/my-project/locations/eu/instances/fca7f167-b9d1-43b1-9d03-0257d31dcb63/dataAccessScopes/eu-security-scope",
  "dataAccessLabels": [
    "projects/my-project/locations/eu/instances/fca7f167-b9d1-43b1-9d03-0257d31dcb63/dataAccessLabels/eu-events",
    "projects/my-project/locations/eu/instances/fca7f167-b9d1-43b1-9d03-0257d31dcb63/dataAccessLabels/pii-data"
  ],
  "updateMask": "dataAccessLabels"
}

---

socRoles

Manage Google SecOps SOC roles that assign permissions to users within an instance. Requires roles/chronicle.admin.

Operations

Operation	Method	Description
create	POST	Create a new SOC role
delete	DELETE	Delete a SOC role
get	GET	Get a single SOC role
list	GET	List all SOC roles
patch	PATCH	Update an existing SOC role

create

Parameters:

Name	Type	Required	Description
displayName	string	Yes	Human-readable name for the role
permissions	array	No	List of Google SecOps permission strings to assign

Example:

{
  "displayName": "Tier 1 Analyst",
  "permissions": ["chronicle.events.list", "chronicle.cases.get"]
}

delete

Parameters:

Name	Type	Required	Description
name	string	Yes	Resource name of the SOC role

Example:

{
  "name": "projects/my-project/locations/us/instances/fca7f167-b9d1-43b1-9d03-0257d31dcb63/socRoles/tier1-analyst"
}

get

Parameters:

Name	Type	Required	Description
name	string	Yes	Resource name of the SOC role

Example:

{
  "name": "projects/my-project/locations/us/instances/fca7f167-b9d1-43b1-9d03-0257d31dcb63/socRoles/tier1-analyst"
}

list

Parameters:

Name	Type	Required	Description
pageSize	number	No	Maximum number of results per page
pageToken	string	No	Page token for pagination

Example:

{
  "pageSize": 50
}

patch

Parameters:

Name	Type	Required	Description
name	string	Yes	Resource name of the SOC role to update
displayName	string	No	New display name
permissions	array	No	Replacement permission list
updateMask	string	No	Comma-separated fields to update

Example:

{
  "name": "projects/my-project/locations/us/instances/fca7f167-b9d1-43b1-9d03-0257d31dcb63/socRoles/tier1-analyst",
  "permissions": ["chronicle.events.list", "chronicle.cases.get", "chronicle.alerts.list"],
  "updateMask": "permissions"
}

---

contextProperties

Manage instance-level key-value context properties used to customise the Google SecOps workspace. Requires roles/chronicle.editor.

Operations

Operation	Method	Description
clearAll	DELETE	Delete all instance-level context properties at once
create	POST	Create a new context property
delete	DELETE	Delete a single context property
get	GET	Get a single context property
list	GET	List all context properties
patch	PATCH	Update a context property

clearAll

No parameters. Destructive — removes all properties in one call.

Example:

{}

create

Parameters:

Name	Type	Required	Description
key	string	Yes	Property key (identifier)
value	string	Yes	Property value

Example:

{
  "key": "soc.tier1.maxAlerts",
  "value": "100"
}

delete

Parameters:

Name	Type	Required	Description
name	string	Yes	Resource name of the context property

Example:

{
  "name": "projects/my-project/locations/us/instances/fca7f167-b9d1-43b1-9d03-0257d31dcb63/contextProperties/soc.tier1.maxAlerts"
}

get

Parameters:

Name	Type	Required	Description
name	string	Yes	Resource name of the context property

Example:

{
  "name": "projects/my-project/locations/us/instances/fca7f167-b9d1-43b1-9d03-0257d31dcb63/contextProperties/soc.tier1.maxAlerts"
}

list

Parameters:

Name	Type	Required	Description
pageSize	number	No	Maximum number of results per page
pageToken	string	No	Page token for pagination

Example:

{
  "pageSize": 100
}

patch

Parameters:

Name	Type	Required	Description
name	string	Yes	Resource name of the property to update
value	string	No	New value
updateMask	string	No	Comma-separated fields to update

Example:

{
  "name": "projects/my-project/locations/us/instances/fca7f167-b9d1-43b1-9d03-0257d31dcb63/contextProperties/soc.tier1.maxAlerts",
  "value": "200",
  "updateMask": "value"
}

---

dashboardCharts

Retrieve dashboard chart definitions. Requires roles/chronicle.viewer.

Operations

Operation	Method	Description
batchGet	GET	Retrieve multiple charts in one request
get	GET	Get a single chart by resource name

batchGet

Parameters:

Name	Type	Required	Description
names	array	Yes	List of chart resource names to retrieve

Example:

{
  "names": [
    "projects/my-project/locations/us/instances/fca7f167-b9d1-43b1-9d03-0257d31dcb63/dashboardCharts/chart-001",
    "projects/my-project/locations/us/instances/fca7f167-b9d1-43b1-9d03-0257d31dcb63/dashboardCharts/chart-002"
  ]
}

get

Parameters:

Name	Type	Required	Description
name	string	Yes	Resource name of the dashboard chart

Example:

{
  "name": "projects/my-project/locations/us/instances/fca7f167-b9d1-43b1-9d03-0257d31dcb63/dashboardCharts/chart-001"
}

---

dashboardQueries

Execute and retrieve Google SecOps dashboard queries. Requires roles/chronicle.viewer for get; roles/chronicle.editor for execute.

Operations

Operation	Method	Description
execute	POST	Execute a dashboard query
get	GET	Get a dashboard query configuration

execute

Parameters:

Name	Type	Required	Description
name	string	Yes	Resource name of the dashboard query to execute
timeRange	object	No	Time range object with startTime and endTime (RFC3339)

Example:

{
  "name": "projects/my-project/locations/us/instances/fca7f167-b9d1-43b1-9d03-0257d31dcb63/dashboardQueries/query-001",
  "timeRange": {
    "startTime": "2026-07-01T00:00:00Z",
    "endTime": "2026-07-08T00:00:00Z"
  }
}

get

Parameters:

Name	Type	Required	Description
name	string	Yes	Resource name of the dashboard query

Example:

{
  "name": "projects/my-project/locations/us/instances/fca7f167-b9d1-43b1-9d03-0257d31dcb63/dashboardQueries/query-001"
}

---

dashboardScheduledReports

Manage scheduled dashboard report generation and email delivery. v1alpha only. Requires roles/chronicle.editor.

Operations

Operation	Method	Description
create	POST	Create a new scheduled report
delete	DELETE	Delete a scheduled report
duplicate	POST	Copy a scheduled report
fetchHistory	GET	List execution history of a scheduled report
get	GET	Get a single scheduled report
list	GET	List all scheduled reports
patch	PATCH	Update a scheduled report
trigger	POST	Run a report immediately

create

Parameters:

Name	Type	Required	Description
dashboardName	string	Yes	Resource name of the dashboard to report on
schedule	string	Yes	Cron expression (e.g. 0 8 * * 1 = every Monday at 08:00 UTC)
recipients	array	No	Email addresses to deliver the report to

Example:

{
  "dashboardName": "projects/my-project/locations/us/instances/fca7f167-b9d1-43b1-9d03-0257d31dcb63/nativeDashboards/weekly-overview",
  "schedule": "0 8 * * 1",
  "recipients": ["[email protected]", "[email protected]"]
}

delete

Parameters:

Name	Type	Required	Description
name	string	Yes	Resource name of the scheduled report

duplicate

Parameters:

Name	Type	Required	Description
name	string	Yes	Resource name of the scheduled report to copy

fetchHistory

Parameters:

Name	Type	Required	Description
name	string	Yes	Resource name of the scheduled report
pageSize	number	No	Maximum number of history entries per page
pageToken	string	No	Page token for pagination

Example:

{
  "name": "projects/my-project/locations/us/instances/fca7f167-b9d1-43b1-9d03-0257d31dcb63/dashboardScheduledReports/weekly-report",
  "pageSize": 20
}

get

Parameters:

Name	Type	Required	Description
name	string	Yes	Resource name of the scheduled report

list

Parameters:

Name	Type	Required	Description
pageSize	number	No	Maximum number of results per page
pageToken	string	No	Page token for pagination

Note: This endpoint does not accept pageSize on some Google SecOps instance tiers and may return INVALID_ARGUMENT. If that occurs, call without pageSize.

patch

Parameters:

Name	Type	Required	Description
name	string	Yes	Resource name of the report to update
schedule	string	No	New cron schedule
recipients	array	No	New recipient list
updateMask	string	No	Comma-separated fields to update

trigger

Parameters:

Name	Type	Required	Description
name	string	Yes	Resource name of the scheduled report to trigger immediately

Example:

{
  "name": "projects/my-project/locations/us/instances/fca7f167-b9d1-43b1-9d03-0257d31dcb63/dashboardScheduledReports/weekly-report"
}

---

dashboards

Manage Google SecOps legacy dashboards and migration to native dashboards. v1alpha only. Requires roles/chronicle.editor.

Operations

Operation	Method	Description
batchMigrate	POST	Migrate multiple legacy dashboards to native dashboards
copy	POST	Copy a legacy dashboard
create	POST	Create a new legacy dashboard
delete	DELETE	Delete a legacy dashboard
fetchMigratable	GET	List dashboards eligible for migration
fetchMigrationJobs	GET	List migration job statuses
fetchMigrationMetrics	GET	Retrieve migration progress metrics
get	GET	Get a legacy dashboard
list	GET	List all legacy dashboards

batchMigrate

Parameters:

Name	Type	Required	Description
names	array	Yes	List of legacy dashboard resource names to migrate

Example:

{
  "names": [
    "projects/my-project/locations/us/instances/fca7f167-b9d1-43b1-9d03-0257d31dcb63/dashboards/legacy-dash-001"
  ]
}

copy

Parameters:

Name	Type	Required	Description
name	string	Yes	Resource name of the dashboard to copy

create

Parameters:

Name	Type	Required	Description
displayName	string	Yes	Display name for the new dashboard

delete

Parameters:

Name	Type	Required	Description
name	string	Yes	Resource name of the dashboard to delete

fetchMigratable

Parameters:

Name	Type	Required	Description
pageSize	number	No	Maximum number of results per page
pageToken	string	No	Page token for pagination

fetchMigrationJobs

Parameters:

Name	Type	Required	Description
pageSize	number	No	Maximum number of results per page
pageToken	string	No	Page token for pagination

fetchMigrationMetrics

No parameters.

get

Parameters:

Name	Type	Required	Description
name	string	Yes	Resource name of the dashboard

list

Parameters:

Name	Type	Required	Description
pageSize	number	No	Maximum number of results per page
pageToken	string	No	Page token for pagination

---

nativeDashboards

Manage Google SecOps native dashboards, including chart management, import/export, duplication, and IAM policies. Requires roles/chronicle.viewer for reads; roles/chronicle.editor for writes; roles/chronicle.admin for IAM policy operations.

Operations

Operation	Method	Description
addChart	POST	Add a chart to a native dashboard
create	POST	Create a new native dashboard
delete	DELETE	Delete a native dashboard
duplicate	POST	Copy a native dashboard
duplicateChart	POST	Duplicate a chart within a dashboard
editChart	POST	Edit an existing chart
export	POST	Export a dashboard definition
get	GET	Get a native dashboard
getIamPolicy	GET	Retrieve IAM policy for a dashboard (v1alpha)
import	POST	Import a dashboard from an exported definition
list	GET	List all native dashboards
patch	PATCH	Update a native dashboard
removeChart	DELETE	Remove a chart from a dashboard
setIamPolicy	POST	Set IAM policy for a dashboard (v1alpha)

addChart

Parameters:

Name	Type	Required	Description
name	string	Yes	Resource name of the native dashboard
chart	object	Yes	Chart configuration object

Example:

{
  "name": "projects/my-project/locations/us/instances/fca7f167-b9d1-43b1-9d03-0257d31dcb63/nativeDashboards/security-overview",
  "chart": {
    "title": "Alert Volume by Severity",
    "chartType": "BAR"
  }
}

create

Parameters:

Name	Type	Required	Description
displayName	string	Yes	Display name for the new dashboard

Example:

{
  "displayName": "SOC Weekly Summary"
}

delete

Parameters:

Name	Type	Required	Description
name	string	Yes	Resource name of the dashboard to delete

duplicate

Parameters:

Name	Type	Required	Description
name	string	Yes	Resource name of the dashboard to duplicate

duplicateChart

Parameters:

Name	Type	Required	Description
name	string	Yes	Resource name of the native dashboard
chartId	string	Yes	ID of the chart to duplicate

editChart

Parameters:

Name	Type	Required	Description
name	string	Yes	Resource name of the native dashboard
chartId	string	Yes	ID of the chart to edit
chart	object	Yes	Updated chart configuration

export

Parameters:

Name	Type	Required	Description
name	string	Yes	Resource name of the dashboard to export

get

Parameters:

Name	Type	Required	Description
name	string	Yes	Resource name of the native dashboard

getIamPolicy

Parameters:

Name	Type	Required	Description
resource	string	Yes	Resource name of the native dashboard

import

Parameters:

Name	Type	Required	Description
dashboard	object	Yes	Dashboard definition object obtained from a prior export call

list

Parameters:

Name	Type	Required	Description
pageSize	number	No	Maximum number of results per page
pageToken	string	No	Page token for pagination

patch

Parameters:

Name	Type	Required	Description
name	string	Yes	Resource name of the dashboard to update
displayName	string	No	New display name
updateMask	string	No	Comma-separated fields to update

removeChart

Parameters:

Name	Type	Required	Description
name	string	Yes	Resource name of the native dashboard
chartId	string	Yes	ID of the chart to remove

setIamPolicy

Parameters:

Name	Type	Required	Description
resource	string	Yes	Resource name of the native dashboard
policy	object	Yes	IAM policy object with bindings and etag

---

dataTableOperationErrors

Retrieve error details for failed data table background operations. Requires roles/chronicle.viewer.

Operations

Operation	Method	Description
get	GET	Get error details for a failed data table operation

get

Parameters:

Name	Type	Required	Description
name	string	Yes	Resource name of the operation error

Example:

{
  "name": "projects/my-project/locations/us/instances/fca7f167-b9d1-43b1-9d03-0257d31dcb63/dataTableOperationErrors/op-err-001"
}

---

dataTables

Manage Google SecOps data tables used to store reference and enrichment data. Requires roles/chronicle.editor.

Operations

Operation	Method	Description
create	POST	Create a new data table
delete	DELETE	Delete a data table
get	GET	Get a data table
list	GET	List all data tables
patch	PATCH	Update a data table
upload	POST	Upload data to a table from file content (v1alpha)

create

Parameters:

Name	Type	Required	Description
displayName	string	Yes	Display name for the data table
header	object	No	Column schema definition

Example:

{
  "displayName": "Known Bad IPs",
  "header": {
    "columns": [
      {"name": "ip", "type": "STRING"},
      {"name": "threat_type", "type": "STRING"},
      {"name": "first_seen", "type": "TIMESTAMP"}
    ]
  }
}

delete

Parameters:

Name	Type	Required	Description
name	string	Yes	Resource name of the data table

get

Parameters:

Name	Type	Required	Description
name	string	Yes	Resource name of the data table

list

Parameters:

Name	Type	Required	Description
pageSize	number	No	Maximum number of results per page
pageToken	string	No	Page token for pagination

patch

Parameters:

Name	Type	Required	Description
name	string	Yes	Resource name of the data table to update
displayName	string	No	New display name
updateMask	string	No	Comma-separated fields to update

upload

Parameters:

Name	Type	Required	Description
name	string	Yes	Resource name of the data table
data	string	No	CSV or JSON data content to upload

---

dataTableRows

Manage individual rows within Google SecOps data tables, including synchronous and asynchronous bulk operations. Requires roles/chronicle.editor.

Operations

Operation	Method	Description
bulkCreate	POST	Synchronously bulk-create rows
bulkCreateAsync	POST	Asynchronously bulk-create rows
bulkDelete	POST	Synchronously bulk-delete rows (v1alpha)
bulkDeleteAsync	POST	Asynchronously bulk-delete rows (v1alpha)
bulkGet	GET	Retrieve multiple rows in one request
bulkReplace	PATCH	Synchronously replace multiple rows
bulkReplaceAsync	PATCH	Asynchronously replace multiple rows
bulkUpdate	PATCH	Synchronously update multiple rows
bulkUpdateAsync	PATCH	Asynchronously update multiple rows
create	POST	Create a single row
delete	DELETE	Delete a single row
get	GET	Get a single row
list	GET	List rows in a data table
patch	PATCH	Update a single row
upload	POST	Upload rows from file content (v1alpha)

bulkCreate

Parameters:

Name	Type	Required	Description
parent	string	Yes	Resource name of the parent data table
rows	array	Yes	List of row objects to create

Example:

{
  "parent": "projects/my-project/locations/us/instances/fca7f167-b9d1-43b1-9d03-0257d31dcb63/dataTables/known-bad-ips",
  "rows": [
    {"values": {"ip": "10.0.0.1", "threat_type": "C2", "first_seen": "2026-07-01T00:00:00Z"}},
    {"values": {"ip": "192.168.1.5", "threat_type": "scanner", "first_seen": "2026-07-02T00:00:00Z"}}
  ]
}

bulkGet

Parameters:

Name	Type	Required	Description
parent	string	Yes	Resource name of the parent data table
names	array	Yes	List of row resource names to retrieve

create

Parameters:

Name	Type	Required	Description
parent	string	Yes	Resource name of the parent data table
values	object	Yes	Column name-to-value mapping for the new row

delete

Parameters:

Name	Type	Required	Description
name	string	Yes	Resource name of the row to delete

get

Parameters:

Name	Type	Required	Description
name	string	Yes	Resource name of the row

list

Parameters:

Name	Type	Required	Description
parent	string	Yes	Resource name of the parent data table
pageSize	number	No	Maximum number of results per page
pageToken	string	No	Page token for pagination

patch

Parameters:

Name	Type	Required	Description
name	string	Yes	Resource name of the row to update
values	object	No	New column values
updateMask	string	No	Comma-separated fields to update

Async operations: bulkCreateAsync, bulkReplaceAsync, bulkUpdateAsync, bulkDeleteAsync return a long-running operation name. Use the operations.get operation to poll for completion.

---

bigQueryExport

Provision and manage BigQuery export for Google SecOps data. Requires roles/chronicle.admin.

Operations

Operation	Method	Description
provision	POST	Provision BigQuery export for the instance
provideBigQueryAccess	POST	Grant BigQuery access to a service account (v1alpha)

provision

Parameters:

Name	Type	Required	Description
bigQueryDataset	string	No	Target BigQuery dataset resource name

Example:

{
  "bigQueryDataset": "projects/my-bq-project/datasets/chronicle_export"
}

provideBigQueryAccess

Parameters:

Name	Type	Required	Description
serviceAccount	string	Yes	Service account email to grant BigQuery access

Example:

{
  "serviceAccount": "[email protected]"
}

---

dataExports

Manage Google SecOps data export jobs for exporting event and entity data. Requires roles/chronicle.admin for most operations. The list operation additionally requires the dataexport.jobs.list IAM permission, which may not be granted on all instance tiers.

Operations

Operation	Method	Description
cancel	DELETE	Cancel an in-progress export
create	POST	Create a new data export job
fetchAvailableLogTypes	GET	List log types available for export (v1alpha)
fetchServiceAccount	GET	Retrieve the service account used for exports
get	GET	Get export job status
list	GET	List all export jobs
patch	PATCH	Update an export job (v1alpha)

cancel

Parameters:

Name	Type	Required	Description
name	string	Yes	Resource name of the data export to cancel

create

Parameters:

Name	Type	Required	Description
startTime	string	Yes	Export start time (RFC3339)
endTime	string	Yes	Export end time (RFC3339)
destination	object	No	Export destination configuration (e.g. GCS bucket)

Example:

{
  "startTime": "2026-07-01T00:00:00Z",
  "endTime": "2026-07-08T00:00:00Z",
  "destination": {
    "gcsBucket": "gs://my-chronicle-exports"
  }
}

fetchAvailableLogTypes

No parameters.

fetchServiceAccount

No parameters.

Example:

{}

get

Parameters:

Name	Type	Required	Description
name	string	Yes	Resource name of the data export

list

Parameters:

Name	Type	Required	Description
pageSize	number	No	Maximum number of results per page
pageToken	string	No	Page token for pagination

Permission note: dataExports.list requires the dataexport.jobs.list permission in addition to roles/chronicle.admin. If your service account returns PERMISSION_DENIED, verify that this specific permission is present in your IAM policy.

patch

Parameters:

Name	Type	Required	Description
name	string	Yes	Resource name of the data export to update
updateMask	string	No	Comma-separated fields to update

---

investigations

Manage Google SecOps investigations and their lifecycle. v1alpha only. Requires roles/chronicle.soarAdmin.

Operations

Operation	Method	Description
fetchAssociated	GET	Fetch items associated with an investigation
get	GET	Get an investigation
list	GET	List investigations
transitionReviewState	POST	Change the review state of an investigation
trigger	POST	Start a new investigation

fetchAssociated

Parameters:

Name	Type	Required	Description
name	string	Yes	Resource name of the investigation
pageSize	number	No	Maximum number of results per page
pageToken	string	No	Page token for pagination

get

Parameters:

Name	Type	Required	Description
name	string	Yes	Resource name of the investigation

Example:

{
  "name": "projects/my-project/locations/us/instances/fca7f167-b9d1-43b1-9d03-0257d31dcb63/investigations/inv-20260701-001"
}

list

Parameters:

Name	Type	Required	Description
pageSize	number	No	Maximum number of results per page
pageToken	string	No	Page token for pagination
filter	string	No	AIP-160 filter expression (e.g. state="OPEN")

Example:

{
  "pageSize": 25,
  "filter": "state=\"OPEN\""
}

transitionReviewState

Parameters:

Name	Type	Required	Description
name	string	Yes	Resource name of the investigation
state	string	Yes	Target review state (e.g. REVIEWED, CLOSED)

trigger

Parameters:

Name	Type	Required	Description
triggerSpec	object	Yes	Specification describing what to investigate

---

investigationComments

Manage comments on Google SecOps investigations. v1alpha only. Requires roles/chronicle.soarAdmin.

Operations

Operation	Method	Description
create	POST	Add a comment to an investigation
delete	DELETE	Delete a comment
get	GET	Get a single comment
list	GET	List comments on an investigation
patch	PATCH	Update a comment

create

Parameters:

Name	Type	Required	Description
parent	string	Yes	Resource name of the parent investigation
content	string	Yes	Comment text

Example:

{
  "parent": "projects/my-project/locations/us/instances/fca7f167-b9d1-43b1-9d03-0257d31dcb63/investigations/inv-20260701-001",
  "content": "Confirmed false positive — closing after verification."
}

delete

Parameters:

Name	Type	Required	Description
name	string	Yes	Resource name of the comment

get

Parameters:

Name	Type	Required	Description
name	string	Yes	Resource name of the comment

list

Parameters:

Name	Type	Required	Description
parent	string	Yes	Resource name of the parent investigation
pageSize	number	No	Maximum number of results per page
pageToken	string	No	Page token for pagination

patch

Parameters:

Name	Type	Required	Description
name	string	Yes	Resource name of the comment to update
content	string	No	New comment text
updateMask	string	No	Comma-separated fields to update

---

investigationSteps

Read investigation graph step nodes within a Google SecOps investigation. v1alpha only. Read-only. Requires roles/chronicle.soarAdmin.

Operations

Operation	Method	Description
get	GET	Get a single investigation step
list	GET	List steps in an investigation

get

Parameters:

Name	Type	Required	Description
name	string	Yes	Resource name of the investigation step

list

Parameters:

Name	Type	Required	Description
parent	string	Yes	Resource name of the parent investigation
pageSize	number	No	Maximum number of results per page
pageToken	string	No	Page token for pagination

---

labsExperiments

Manage Google SecOps Labs AI experiments. v1alpha only. Requires roles/chronicle.editor.

Operations

Operation	Method	Description
execute	POST	Execute a labs experiment
fetchAgentSession	GET	Retrieve an active AI agent session
get	GET	Get a labs experiment
list	GET	List all labs experiments
patch	PATCH	Update a labs experiment
sendAgentMessage	POST	Send a message to the AI agent

execute

Parameters:

Name	Type	Required	Description
name	string	Yes	Resource name of the labs experiment
input	object	No	Input parameters for the experiment

Example:

{
  "name": "projects/my-project/locations/us/instances/fca7f167-b9d1-43b1-9d03-0257d31dcb63/labsExperiments/threat-summary",
  "input": {"alertId": "alert-20260708-001"}
}

fetchAgentSession

Parameters:

Name	Type	Required	Description
name	string	Yes	Resource name of the labs experiment

get

Parameters:

Name	Type	Required	Description
name	string	Yes	Resource name of the labs experiment

list

Parameters:

Name	Type	Required	Description
pageSize	number	No	Maximum number of results per page
pageToken	string	No	Page token for pagination

patch

Parameters:

Name	Type	Required	Description
name	string	Yes	Resource name of the experiment to update
updateMask	string	No	Comma-separated fields to update

sendAgentMessage

Parameters:

Name	Type	Required	Description
name	string	Yes	Resource name of the labs experiment
message	string	Yes	Message text to send to the AI agent

---

labsExperimentExecutions

Track and manage executions of Google SecOps Labs experiments. v1alpha only. Requires roles/chronicle.viewer.

Operations

Operation	Method	Description
get	GET	Get status and result of an execution
list	GET	List all executions for an experiment
patch	PATCH	Update metadata on an execution

get

Parameters:

Name	Type	Required	Description
name	string	Yes	Resource name of the execution

list

Parameters:

Name	Type	Required	Description
parent	string	Yes	Resource name of the parent labs experiment
pageSize	number	No	Maximum number of results per page
pageToken	string	No	Page token for pagination

patch

Parameters:

Name	Type	Required	Description
name	string	Yes	Resource name of the execution to update
updateMask	string	No	Comma-separated fields to update

---

notebooks

Read Google SecOps Labs notebooks. v1alpha only. Read-only. Requires roles/chronicle.viewer.

Operations

Operation	Method	Description
get	GET	Get a notebook
list	GET	List all notebooks

get

Parameters:

Name	Type	Required	Description
name	string	Yes	Resource name of the notebook

list

Parameters:

Name	Type	Required	Description
pageSize	number	No	Maximum number of results per page
pageToken	string	No	Page token for pagination

---

conversations

Manage user-scoped AI conversation threads. v1alpha only. Requires roles/chronicle.editor. Conversations are scoped to the authenticated service account user.

Operations

Operation	Method	Description
create	POST	Start a new AI conversation
delete	DELETE	Delete a conversation
get	GET	Get a conversation
list	GET	List conversations for the current user
patch	PATCH	Update a conversation (e.g. rename)

create

Parameters:

Name	Type	Required	Description
title	string	No	Optional title for the conversation

delete

Parameters:

Name	Type	Required	Description
name	string	Yes	Resource name of the conversation

get

Parameters:

Name	Type	Required	Description
name	string	Yes	Resource name of the conversation

list

Parameters:

Name	Type	Required	Description
pageSize	number	No	Maximum number of results per page
pageToken	string	No	Page token for pagination

patch

Parameters:

Name	Type	Required	Description
name	string	Yes	Resource name of the conversation to update
title	string	No	New title
updateMask	string	No	Comma-separated fields to update

---

conversationMessages

Manage messages within user-scoped AI conversation threads. v1alpha only. Requires roles/chronicle.editor.

Operations

Operation	Method	Description
create	POST	Send a message
delete	DELETE	Delete a message
get	GET	Get a message
list	GET	List messages in a conversation
patch	PATCH	Update a message

create

Parameters:

Name	Type	Required	Description
parent	string	Yes	Resource name of the parent conversation
content	string	Yes	Message text

Example:

{
  "parent": "projects/my-project/locations/us/instances/fca7f167-b9d1-43b1-9d03-0257d31dcb63/users/-/conversations/conv-001",
  "content": "Summarise the top 5 alerts from the past 24 hours."
}

delete / get / patch

Same pattern as investigationComments — provide name for single-item operations, parent + optional pagination for list.

---

operations

Manage Google SecOps long-running operations. Requires roles/chronicle.viewer for reads; roles/chronicle.editor for cancel/delete.

Operations

Operation	Method	Description
cancel	DELETE	Cancel a long-running operation
delete	DELETE	Delete a completed operation record
get	GET	Get operation status and result
list	GET	List long-running operations
streamSearch	POST	Stream search results from an operation (v1alpha)

cancel

Parameters:

Name	Type	Required	Description
name	string	Yes	Resource name of the operation to cancel

Example:

{
  "name": "projects/my-project/locations/us/instances/fca7f167-b9d1-43b1-9d03-0257d31dcb63/operations/op-20260708-001"
}

delete

Parameters:

Name	Type	Required	Description
name	string	Yes	Resource name of the completed operation

get

Parameters:

Name	Type	Required	Description
name	string	Yes	Resource name of the operation

list

Parameters:

Name	Type	Required	Description
pageSize	number	No	Maximum number of results per page
pageToken	string	No	Page token for pagination
filter	string	No	Filter expression (e.g. done=true)

Example:

{
  "pageSize": 20,
  "filter": "done=false"
}

streamSearch

Parameters:

Name	Type	Required	Description
name	string	Yes	Resource name of the operation to stream results from

---

moduleSettings

Read and configure Google SecOps instance module settings. Requires roles/chronicle.admin.

Operations

Operation	Method	Description
get	GET	Get module settings for the instance
listProperties	GET	List all module setting properties
batchUpdateProperties	POST	Update multiple properties in one request
testSettings	POST	Test settings without applying them
rebrandingSettings	POST	Update instance rebranding settings
patchProperty	PATCH	Update a single module property

get

Parameters:

Name	Type	Required	Description
name	string	No	Resource name of the module settings (defaults to instance settings)

Example:

{}

listProperties

Parameters:

Name	Type	Required	Description
pageSize	number	No	Maximum number of results per page
pageToken	string	No	Page token for pagination

batchUpdateProperties

Parameters:

Name	Type	Required	Description
requests	array	Yes	List of property update request objects

testSettings

Parameters:

Name	Type	Required	Description
settings	object	Yes	Settings configuration to validate

rebrandingSettings

Parameters:

Name	Type	Required	Description
logoUrl	string	No	URL of the custom logo
primaryColor	string	No	Primary brand colour in hex (e.g. #1a73e8)

Example:

{
  "logoUrl": "https://cdn.example.com/logo.png",
  "primaryColor": "#1a73e8"
}

patchProperty

Parameters:

Name	Type	Required	Description
name	string	Yes	Resource name of the property to update
value	string	No	New value
updateMask	string	No	Comma-separated fields to update

---

savedColumnSets

Manage instance-scoped saved column set configurations. Requires roles/chronicle.editor.

Known limitation: The list operation does not accept pageSize on some Google SecOps instance tiers and returns INVALID_ARGUMENT. Call without pageSize if this occurs.

Operations

Operation	Method	Description
create	POST	Create a new saved column set
delete	DELETE	Delete a saved column set
get	GET	Get a saved column set
list	GET	List all saved column sets
patch	PATCH	Update a saved column set

create

Parameters:

Name	Type	Required	Description
displayName	string	Yes	Display name for the column set
columns	array	No	List of column definition objects

delete / get

Provide name (resource name of the column set).

list

Parameters:

Name	Type	Required	Description
pageToken	string	No	Page token for pagination

patch

Parameters:

Name	Type	Required	Description
name	string	Yes	Resource name of the column set to update
displayName	string	No	New display name
updateMask	string	No	Comma-separated fields to update

---

userSavedColumnSets

Manage user-scoped saved column sets. Requires roles/chronicle.editor. Scoped to the authenticated service account user (users/-).

Same operations as savedColumnSets (create, delete, get, list, patch) with identical parameter shapes. The resource path is users/{user}/savedColumnSets instead of savedColumnSets.

---

announcements

Manage system announcements displayed to Google SecOps users. Requires roles/chronicle.admin.

Operations

Operation	Method	Description
create	POST	Create a new announcement
delete	DELETE	Delete an announcement
get	GET	Get a single announcement
list	GET	List all announcements
patch	PATCH	Update an announcement

create

Parameters:

Name	Type	Required	Description
title	string	Yes	Announcement title
content	string	Yes	Announcement body text

Example:

{
  "title": "Scheduled Maintenance — 2026-07-15 02:00 UTC",
  "content": "Google SecOps will be unavailable for approximately 30 minutes during the maintenance window."
}

list

Parameters:

Name	Type	Required	Description
pageSize	number	No	Maximum number of results per page
pageToken	string	No	Page token for pagination

patch

Parameters:

Name	Type	Required	Description
name	string	Yes	Resource name of the announcement to update
title	string	No	New title
content	string	No	New body text
updateMask	string	No	Comma-separated fields to update

---

systemNotifications

Manage Google SecOps system notifications. Requires roles/chronicle.viewer for list; roles/chronicle.editor for count and markAsRead.

Operations

Operation	Method	Description
count	POST	Count unread system notifications
list	GET	List system notifications
markAsRead	POST	Mark one or more notifications as read

count

No parameters.

list

Parameters:

Name	Type	Required	Description
pageSize	number	No	Maximum number of results per page
pageToken	string	No	Page token for pagination

markAsRead

Parameters:

Name	Type	Required	Description
names	array	Yes	List of notification resource names to mark as read

Example:

{
  "names": [
    "projects/my-project/locations/us/instances/fca7f167-b9d1-43b1-9d03-0257d31dcb63/systemNotifications/notif-001"
  ]
}

---

views

Manage Google SecOps view configurations. Requires roles/chronicle.viewer for reads; roles/chronicle.editor for saveOverviewTemplate.

Operations

Operation	Method	Description
fetchPredefined	GET	Retrieve predefined system views
get	GET	Get a view by resource name
list	GET	List all views
saveOverviewTemplate	POST	Save an overview template as a view

fetchPredefined

No parameters.

Note: This endpoint requires a mandatory scope field on some instance configurations. If you receive INVALID_ARGUMENT: The scope field is required, provide the scope as a query parameter in an extended workflow.

get

Parameters:

Name	Type	Required	Description
name	string	Yes	Resource name of the view

list

Parameters:

Name	Type	Required	Description
pageSize	number	No	Maximum number of results per page
pageToken	string	No	Page token for pagination

saveOverviewTemplate

Parameters:

Name	Type	Required	Description
template	object	Yes	Overview template definition object

---

features

Manage Google SecOps feature flags. v1alpha only. Requires roles/chronicle.admin.

Operations

Operation	Method	Description
disable	DELETE	Disable a feature flag
get	GET	Get a feature flag
list	GET	List all feature flags
patch	PATCH	Enable or configure a feature flag

disable

Parameters:

Name	Type	Required	Description
name	string	Yes	Resource name of the feature to disable

get / list

Standard name / pagination parameters.

patch

Parameters:

Name	Type	Required	Description
name	string	Yes	Resource name of the feature
enabled	boolean	No	Whether the feature should be enabled
updateMask	string	No	Comma-separated fields to update

---

federationGroups

Manage Google SecOps federation groups for multi-instance federation. v1alpha only. Requires roles/chronicle.admin.

Operations

Operation	Method	Description
create	POST	Create a federation group
delete	DELETE	Delete a federation group
get	GET	Get a federation group
list	GET	List all federation groups
patch	PATCH	Update a federation group

create

Parameters:

Name	Type	Required	Description
displayName	string	Yes	Display name for the federation group

Standard delete/get/list/patch parameter shapes apply.

---

metricDefinitions

Manage custom metric definitions. v1alpha only. Requires roles/chronicle.editor.

Operations

Operation	Method	Description
create	POST	Create a metric definition
get	GET	Get a metric definition
list	GET	List all metric definitions
patch	PATCH	Update a metric definition

create

Parameters:

Name	Type	Required	Description
displayName	string	Yes	Display name for the metric
query	string	Yes	UDM query string defining the metric

Example:

{
  "displayName": "High Severity Alerts per Hour",
  "query": "metadata.event_type = \"ALERT\" AND security_result.severity = \"HIGH\""
}

---

sharedPreferenceSets

Manage shared preference sets. v1alpha only. Requires roles/chronicle.editor.

Operations

Operation	Method	Description
create	POST	Create a shared preference set
delete	DELETE	Delete a shared preference set
get	GET	Get a shared preference set
list	GET	List all shared preference sets
patch	PATCH	Update a shared preference set

Standard parameter shapes — displayName required for create.

---

tenants

Manage tenant configurations for multi-tenant Google SecOps deployments. v1alpha only. Requires roles/chronicle.admin.

Operations

Operation	Method	Description
create	POST	Create a tenant
get	GET	Get a tenant
list	GET	List all tenants
patch	PATCH	Update a tenant

create

Parameters:

Name	Type	Required	Description
displayName	string	Yes	Display name for the tenant

---

errorNotificationConfigs

Manage error notification delivery configurations. v1alpha only. Requires roles/chronicle.admin.

Operations

Operation	Method	Description
create	POST	Create an error notification config
delete	DELETE	Delete a config
get	GET	Get a config
list	GET	List all configs
patch	PATCH	Update a config

create

Parameters:

Name	Type	Required	Description
notificationTarget	string	Yes	Delivery target — email address or Pub/Sub topic

Example:

{
  "notificationTarget": "[email protected]"
}

---

userSettings

Manage per-user Google SecOps settings. v1alpha only. Requires roles/chronicle.editor. These operations act on the authenticated service account's own user profile.

Operations

Operation	Method	Description
clearConversationHistory	POST	Clear the AI conversation history for the current user
getPreferenceSet	GET	Retrieve the preference set for the current user
updatePreferenceSet	PATCH	Update the preference set for the current user

clearConversationHistory

No parameters.

getPreferenceSet

No parameters.

updatePreferenceSet

Parameters:

Name	Type	Required	Description
preferences	object	Yes	Preference key-value pairs to update
updateMask	string	No	Comma-separated fields to update

---

userModuleSettings

Manage per-user module settings overrides. v1alpha only. Requires roles/chronicle.editor.

Operations

Operation	Method	Description
patch	PATCH	Update per-user module settings

patch

Parameters:

Name	Type	Required	Description
name	string	Yes	Resource name of the user module settings
updateMask	string	No	Comma-separated fields to update

---

managedDomainSettings

Manage domain settings for federated Google SecOps deployments. v1alpha only. Requires roles/chronicle.admin.

Operations

Operation	Method	Description
addManagedDomain	POST	Add a managed domain to the instance
removeManagedDomain	DELETE	Remove a managed domain from the instance

addManagedDomain

Parameters:

Name	Type	Required	Description
domain	string	Yes	Domain name to add (e.g. example.com)

Example:

{
  "domain": "example.com"
}

removeManagedDomain

Parameters:

Name	Type	Required	Description
domain	string	Yes	Domain name to remove

---

Best Practices

1. Use updateMask on every PATCH: Always supply updateMask to limit which fields are modified. Omitting it may cause the server to reset unspecified fields to their defaults.

2. Paginate large collections: Use pageSize and pageToken for all list operations. Do not assume a single call returns all results. The server-defined default page size is often small (10–50 items).

3. Poll long-running operations: dataTables.bulkCreateAsync, bulkReplaceAsync, bulkUpdateAsync, bulkDeleteAsync, and data export jobs all return a long-running operation name. Call operations.get in a loop (with back-off) until done=true.

4. Understand pageSize limitations: Some endpoints (savedColumnSets.list, dashboardScheduledReports.list) reject the pageSize parameter on certain Google SecOps instance tiers and return INVALID_ARGUMENT. Call those endpoints without pageSize if you encounter this error.

5. Grant minimum required permissions: Use roles/chronicle.viewer for read-only workflows, roles/chronicle.editor for write workflows, and roles/chronicle.admin only for access control, tenant, and system settings operations. Avoid granting admin universally.

6. Rotate service account keys regularly: Service account JSON keys do not expire automatically. Implement a key rotation schedule (e.g. every 90 days) and update the NINA credential accordingly.

7. Do not hard-code resource names: Resource names contain the project, location, instance UUID, and resource ID. Build them dynamically from the credential fields rather than hardcoding, so the same workflow works across environments (dev, staging, prod).

8. Handle rate limits with retry logic: The Google SecOps API enforces per-project quota. The connector retries HTTP 429 responses up to 3 times with exponential back-off (1 s → 2 s → 4 s). If you sustain high call volumes, implement additional workflow-level throttling.

9. Use roles/chronicle.soarAdmin for investigations: The investigations, investigationComments, and investigationSteps resources require the SOAR Admin role. A viewer or editor role alone will return PERMISSION_DENIED for these resources.

10. Scope conversations and userSettings correctly: These resources operate on the service account's own user identity (users/-). They are not suitable for managing other users' data.

---

Troubleshooting

Error	Cause	Solution
PERMISSION_DENIED on any operation	Service account lacks the required IAM role	Grant the appropriate Google SecOps IAM role (viewer, editor, admin, or soarAdmin) at the GCP project level
PERMISSION_DENIED on dataExports.list	SA has roles/chronicle.admin but is missing the dataexport.jobs.list permission	Verify the specific IAM permission is present; some instance tiers require explicit binding
INVALID_ARGUMENT: Request contains an invalid argument on savedColumnSets.list	Endpoint does not accept pageSize on this instance tier	Remove the pageSize parameter and paginate using only pageToken
INVALID_ARGUMENT: The scope field is required on views.fetchPredefined	The API requires a scope field that is not available generically	Pass the required scope value in your workflow parameters
NOT_FOUND on any resource	Wrong project, location, instance UUID, or resource ID	Double-check all five credential fields and the full resource name path
404 NOT_FOUND on every call	Wrong region credential value	The region prefix in the credential must match the region of your Google SecOps instance exactly
UNAUTHENTICATED / token error	Invalid or expired service account JSON	Verify the JSON key is correct and not revoked; regenerate if necessary
INVALID_ARGUMENT: error in getting Data export on fetchAvailableLogTypes	v1alpha endpoint not supported on this instance tier	This operation is not available on all Google SecOps tiers; skip or handle gracefully
429 Too Many Requests	API quota exceeded	Implement workflow-level throttling; the connector already retries 3 times with back-off
Empty list response	No resources exist yet, or filter is too restrictive	Verify the resource type has been populated; create a resource and retry
Long-running operation never completes	Async bulk operation timed out or failed	Call operations.get to check status; call dataTableOperationErrors.get for row-level error details
FAILED_PRECONDITION on contextProperties.clearAll	Concurrent modification or precondition not met	Retry after a short delay; avoid concurrent clearAll calls

Support

For issues with this integration, provide the following when contacting support:

• The resource and operation you were calling (e.g. dataTables.bulkCreate)
• The full error message and status code returned
• The Google SecOps region and instance UUID (not the service account key)
• Whether the issue is reproducible with a smaller payload or simpler parameters

For Google SecOps API documentation, visit the Google SecOps API reference.

---

Updated: 2026-07-08