gcp-iam-catalog Roles Permissions
🔐

roles/chronicle.admin

Title Chronicle API Admin
Stage GA
Role Type Predefined
Permissions 638
Description Full access to the Chronicle API services, including global settings.
🔍
chronicle.ais.createFeedback
chronicle.ais.translateUdmQuery
chronicle.ais.translateYlRule
chronicle.alertGroupingRules.delete
chronicle.alertGroupingRules.get
chronicle.alertGroupingRules.update
chronicle.analyticValues.list
chronicle.analytics.list
chronicle.announcements.delete
chronicle.announcements.get
chronicle.announcements.update
chronicle.attachments.delete
chronicle.attachments.get
chronicle.attachments.update
chronicle.bigQueryAccess.provide
chronicle.bigQueryExport.get
chronicle.bigQueryExport.provision
chronicle.bigQueryExport.update
chronicle.calculatedFieldDefinitions.delete
chronicle.calculatedFieldDefinitions.get
chronicle.calculatedFieldDefinitions.update
chronicle.caseAlerts.get
chronicle.caseAlerts.metadataUpdate
chronicle.caseAlerts.move
chronicle.caseAlerts.updateSla
chronicle.caseCloseDefinitions.delete
chronicle.caseCloseDefinitions.get
chronicle.caseCloseDefinitions.update
chronicle.caseComments.delete
chronicle.caseComments.get
chronicle.caseComments.update
chronicle.caseQueueFilters.delete
chronicle.caseQueueFilters.get
chronicle.caseQueueFilters.update
chronicle.caseStageDefinitions.delete
chronicle.caseStageDefinitions.get
chronicle.caseStageDefinitions.update
chronicle.caseTagDefinitions.delete
chronicle.caseTagDefinitions.get
chronicle.caseTagDefinitions.update
chronicle.caseWallRecords.get
chronicle.caseWallRecords.update
chronicle.cases.close
chronicle.cases.countPriorities
chronicle.cases.generateReport
chronicle.cases.get
chronicle.cases.removeTag
chronicle.cases.reopen
chronicle.cases.update
chronicle.cases.updateTag
chronicle.chatMessages.create
chronicle.chatMessages.get
chronicle.chatMessages.pin
chronicle.collectors.create
chronicle.collectors.delete
chronicle.collectors.get
chronicle.collectors.list
chronicle.collectors.update
chronicle.connectorInstanceLogs.get
chronicle.connectorInstances.delete
chronicle.connectorInstances.get
chronicle.connectorInstances.update
chronicle.connectorRevisions.delete
chronicle.connectorRevisions.get
chronicle.connectorRevisions.update
chronicle.connectors.delete
chronicle.connectors.get
chronicle.connectors.update
chronicle.contentPacks.create
chronicle.contentPacks.delete
chronicle.contentPacks.export
chronicle.contentPacks.get
chronicle.contentPacks.install
chronicle.contextProperties.delete
chronicle.contextProperties.get
chronicle.contextProperties.update
chronicle.conversations.create
chronicle.conversations.delete
chronicle.conversations.get
chronicle.conversations.list
chronicle.conversations.update
chronicle.coverageDetails.get
chronicle.coverageDetails.list
chronicle.curatedRuleSetCategories.countAllCuratedRuleSetDetections
chronicle.curatedRuleSetCategories.get
chronicle.curatedRuleSetCategories.list
chronicle.curatedRuleSetDeployments.batchUpdate
chronicle.curatedRuleSetDeployments.get
chronicle.curatedRuleSetDeployments.list
chronicle.curatedRuleSetDeployments.update
chronicle.curatedRuleSets.countCuratedRuleSetDetections
chronicle.curatedRuleSets.get
chronicle.curatedRuleSets.list
chronicle.curatedRules.get
chronicle.curatedRules.list
chronicle.customFieldValues.get
chronicle.customFieldValues.update
chronicle.customFields.delete
chronicle.customFields.get
chronicle.customFields.update
chronicle.customLists.delete
chronicle.customLists.get
chronicle.customLists.update
chronicle.dashboardCharts.get
chronicle.dashboardCharts.list
chronicle.dashboardQueries.execute
chronicle.dashboardQueries.get
chronicle.dashboardQueries.list
chronicle.dashboardScheduledReports.create
chronicle.dashboardScheduledReports.delete
chronicle.dashboardScheduledReports.duplicate
chronicle.dashboardScheduledReports.fetchHistory
chronicle.dashboardScheduledReports.get
chronicle.dashboardScheduledReports.list
chronicle.dashboardScheduledReports.trigger
chronicle.dashboardScheduledReports.update
chronicle.dashboards.copy
chronicle.dashboards.create
chronicle.dashboards.delete
chronicle.dashboards.edit
chronicle.dashboards.get
chronicle.dashboards.list
chronicle.dashboards.schedule
chronicle.dataAccessLabels.create
chronicle.dataAccessLabels.delete
chronicle.dataAccessLabels.get
chronicle.dataAccessLabels.list
chronicle.dataAccessLabels.update
chronicle.dataAccessScopes.create
chronicle.dataAccessScopes.delete
chronicle.dataAccessScopes.get
chronicle.dataAccessScopes.list
chronicle.dataAccessScopes.permit
chronicle.dataAccessScopes.update
chronicle.dataExports.cancel
chronicle.dataExports.create
chronicle.dataExports.fetchLogTypesAvailableForExport
chronicle.dataExports.fetchServiceAccountForDataExport
chronicle.dataExports.get
chronicle.dataExports.list
chronicle.dataExports.update
chronicle.dataTableOperationErrors.get
chronicle.dataTableRows.asyncBulkAppend
chronicle.dataTableRows.asyncBulkCreate
chronicle.dataTableRows.asyncBulkDelete
chronicle.dataTableRows.asyncBulkReplace
chronicle.dataTableRows.asyncBulkUpdate
chronicle.dataTableRows.bulkCreate
chronicle.dataTableRows.bulkDelete
chronicle.dataTableRows.bulkGet
chronicle.dataTableRows.bulkReplace
chronicle.dataTableRows.bulkUpdate
chronicle.dataTableRows.create
chronicle.dataTableRows.delete
chronicle.dataTableRows.get
chronicle.dataTableRows.list
chronicle.dataTableRows.update
chronicle.dataTables.bulkCreateDataTableAsync
chronicle.dataTables.create
chronicle.dataTables.delete
chronicle.dataTables.get
chronicle.dataTables.list
chronicle.dataTables.update
chronicle.dataTaps.create
chronicle.dataTaps.delete
chronicle.dataTaps.get
chronicle.dataTaps.list
chronicle.dataTaps.update
chronicle.emailTemplates.delete
chronicle.emailTemplates.get
chronicle.emailTemplates.update
chronicle.enrichmentCombination.get
chronicle.enrichmentControls.create
chronicle.enrichmentControls.delete
chronicle.enrichmentControls.disable
chronicle.enrichmentControls.get
chronicle.enrichmentControls.list
chronicle.entities.batchCreate
chronicle.entities.batchDelete
chronicle.entities.batchValidate
chronicle.entities.create
chronicle.entities.delete
chronicle.entities.find
chronicle.entities.findRelatedEntities
chronicle.entities.get
chronicle.entities.import
chronicle.entities.list
chronicle.entities.modifyEntityRiskScore
chronicle.entities.queryEntityRiskScoreModifications
chronicle.entities.searchEntities
chronicle.entities.summarize
chronicle.entities.summarizeFromQuery
chronicle.entitiesBlocklists.delete
chronicle.entitiesBlocklists.get
chronicle.entitiesBlocklists.update
chronicle.entityRiskScores.queryEntityRiskScores
chronicle.environmentGroups.delete
chronicle.environmentGroups.get
chronicle.environmentGroups.update
chronicle.environments.delete
chronicle.environments.get
chronicle.environments.update
chronicle.events.batchGet
chronicle.events.fetchEnrichedEvent
chronicle.events.findUdmFieldValues
chronicle.events.get
chronicle.events.import
chronicle.events.queryProductSourceStats
chronicle.events.searchRawLogs
chronicle.events.udmSearch
chronicle.events.validateQuery
chronicle.extensionValidationReports.get
chronicle.extensionValidationReports.list
chronicle.featuredContentNativeDashboards.get
chronicle.featuredContentNativeDashboards.install
chronicle.featuredContentNativeDashboards.list
chronicle.featuredContentRules.list
chronicle.featuredContentSearchQueries.get
chronicle.featuredContentSearchQueries.install
chronicle.featuredContentSearchQueries.list
chronicle.feedPacks.get
chronicle.feedPacks.list
chronicle.feedServiceAccounts.fetch
chronicle.feedSourceTypeSchemas.list
chronicle.feeds.create
chronicle.feeds.delete
chronicle.feeds.disable
chronicle.feeds.enable
chronicle.feeds.generateSecret
chronicle.feeds.get
chronicle.feeds.list
chronicle.feeds.update
chronicle.findingsGraphs.exploreNode
chronicle.findingsGraphs.initializeGraph
chronicle.findingsRefinementDeployments.get
chronicle.findingsRefinementDeployments.list
chronicle.findingsRefinementDeployments.update
chronicle.findingsRefinements.computeActivity
chronicle.findingsRefinements.computeAllActivities
chronicle.findingsRefinements.create
chronicle.findingsRefinements.get
chronicle.findingsRefinements.list
chronicle.findingsRefinements.test
chronicle.findingsRefinements.update
chronicle.formDynamicParameters.get
chronicle.formDynamicParameters.update
chronicle.forwarders.create
chronicle.forwarders.delete
chronicle.forwarders.generate
chronicle.forwarders.get
chronicle.forwarders.importStatsEvents
chronicle.forwarders.list
chronicle.forwarders.update
chronicle.globalDataAccessScopes.permit
chronicle.ingestionLogLabels.get
chronicle.ingestionLogLabels.list
chronicle.ingestionLogNamespaces.get
chronicle.ingestionLogNamespaces.list
chronicle.instances.generateCollectionAgentAuth
chronicle.instances.generateSoarAuthJwt
chronicle.instances.generateWorkspaceConnectionToken
chronicle.instances.get
chronicle.instances.graduatePocInstance
chronicle.instances.logTypeClassifier
chronicle.instances.report
chronicle.instances.soarAdmin
chronicle.instances.update
chronicle.instances.verifyNonce
chronicle.integrationActionRevisions.delete
chronicle.integrationActionRevisions.get
chronicle.integrationActionRevisions.update
chronicle.integrationActions.delete
chronicle.integrationActions.get
chronicle.integrationActions.run
chronicle.integrationActions.update
chronicle.integrationInstances.delete
chronicle.integrationInstances.get
chronicle.integrationInstances.update
chronicle.integrationLogicalOperatorRevisions.delete
chronicle.integrationLogicalOperatorRevisions.get
chronicle.integrationLogicalOperatorRevisions.update
chronicle.integrationLogicalOperators.delete
chronicle.integrationLogicalOperators.execute
chronicle.integrationLogicalOperators.get
chronicle.integrationLogicalOperators.update
chronicle.integrations.delete
chronicle.integrations.get
chronicle.integrations.update
chronicle.investigationSteps.get
chronicle.investigationSteps.list
chronicle.investigations.fetchAssociated
chronicle.investigations.get
chronicle.investigations.list
chronicle.investigations.trigger
chronicle.involvedEntities.get
chronicle.involvedEntities.update
chronicle.iocAssociations.batchGet
chronicle.iocAssociations.fetchRelated
chronicle.iocAssociations.get
chronicle.iocMatches.get
chronicle.iocMatches.list
chronicle.iocState.get
chronicle.iocState.update
chronicle.iocs.batchGet
chronicle.iocs.fetchRelated
chronicle.iocs.findFirstAndLastSeen
chronicle.iocs.findIocs
chronicle.iocs.get
chronicle.iocs.searchCuratedDetectionsForIoc
chronicle.jobInstanceLogs.get
chronicle.jobInstances.delete
chronicle.jobInstances.get
chronicle.jobInstances.run
chronicle.jobInstances.update
chronicle.jobRevisions.delete
chronicle.jobRevisions.get
chronicle.jobRevisions.update
chronicle.jobs.delete
chronicle.jobs.get
chronicle.jobs.update
chronicle.labsExperimentExecutions.get
chronicle.labsExperimentExecutions.list
chronicle.labsExperimentExecutions.update
chronicle.labsExperiments.execute
chronicle.labsExperiments.get
chronicle.labsExperiments.list
chronicle.labsExperiments.update
chronicle.legacies.legacyBatchGetCases
chronicle.legacies.legacyBatchGetCollections
chronicle.legacies.legacyFetchAlertsView
chronicle.legacies.legacyFetchUdmSearchCsv
chronicle.legacies.legacyFetchUdmSearchView
chronicle.legacies.legacyFindAssetEvents
chronicle.legacies.legacyFindRawLogs
chronicle.legacies.legacyFindUdmEvents
chronicle.legacies.legacyGetAlert
chronicle.legacies.legacyGetCuratedRulesTrends
chronicle.legacies.legacyGetDetection
chronicle.legacies.legacyGetEventForDetection
chronicle.legacies.legacyGetRuleCounts
chronicle.legacies.legacyGetRulesTrends
chronicle.legacies.legacyRunTestRule
chronicle.legacies.legacySearchArtifactEvents
chronicle.legacies.legacySearchArtifactIoCDetails
chronicle.legacies.legacySearchAssetEvents
chronicle.legacies.legacySearchCuratedDetections
chronicle.legacies.legacySearchCustomerStats
chronicle.legacies.legacySearchDetections
chronicle.legacies.legacySearchDomainsRecentlyRegistered
chronicle.legacies.legacySearchDomainsTimingStats
chronicle.legacies.legacySearchEnterpriseWideAlerts
chronicle.legacies.legacySearchEnterpriseWideIoCs
chronicle.legacies.legacySearchFindings
chronicle.legacies.legacySearchIngestionStats
chronicle.legacies.legacySearchIoCInsights
chronicle.legacies.legacySearchRawLogs
chronicle.legacies.legacySearchRuleDetectionCountBuckets
chronicle.legacies.legacySearchRuleDetectionEvents
chronicle.legacies.legacySearchRuleResults
chronicle.legacies.legacySearchRulesAlerts
chronicle.legacies.legacySearchUserEvents
chronicle.legacies.legacyStreamDetectionAlerts
chronicle.legacies.legacyTestRuleStreaming
chronicle.legacies.legacyUpdateAlert
chronicle.legacyCaseFederationPlatforms.delete
chronicle.legacyCaseFederationPlatforms.get
chronicle.legacyCaseFederationPlatforms.update
chronicle.legacyCases.createManual
chronicle.legacyCases.createSimulated
chronicle.legacyCases.deleteSimulated
chronicle.legacyCases.exportJson
chronicle.legacyCases.get
chronicle.legacyCases.getSimulated
chronicle.legacyCases.importJson
chronicle.legacyCases.ingest
chronicle.legacyCases.ingestAlertTestCase
chronicle.legacyCases.runManualAction
chronicle.legacyCases.simulate
chronicle.legacyConfiguration.getMaximumAlertsGroupingConfiguration
chronicle.legacyFederatedCases.batchPatchFederatedCases
chronicle.legacyFederatedCases.fetchCasesToSync
chronicle.legacyFederatedCases.get
chronicle.legacyPlaybooks.delete
chronicle.legacyPlaybooks.export
chronicle.legacyPlaybooks.get
chronicle.legacyPlaybooks.import
chronicle.legacyPlaybooks.update
chronicle.legacyPublisher.get
chronicle.legacyPublisher.update
chronicle.legacySdk.get
chronicle.legacySdk.update
chronicle.legacySearches.searchCases
chronicle.legacySearches.searchEntities
chronicle.legacySoarAdvancedReports.delete
chronicle.legacySoarAdvancedReports.get
chronicle.legacySoarAdvancedReports.share
chronicle.legacySoarAdvancedReports.update
chronicle.legacySoarAudits.legacySoarAudit
chronicle.legacySoarDashboards.delete
chronicle.legacySoarDashboards.get
chronicle.legacySoarDashboards.update
chronicle.legacySoarIdpMappingGroups.delete
chronicle.legacySoarIdpMappingGroups.get
chronicle.legacySoarIdpMappingGroups.update
chronicle.legacySoarPermissionGroups.get
chronicle.legacySoarReports.delete
chronicle.legacySoarReports.get
chronicle.legacySoarReports.update
chronicle.legacySoarSettings.get
chronicle.legacySoarSettings.update
chronicle.legacySoarUsers.delete
chronicle.legacySoarUsers.get
chronicle.legacySystem.getLicenseStatus
chronicle.legacySystem.getMaximumDataRetentionValue
chronicle.legacySystem.getSystemVersion
chronicle.legacySystemMetadata.get
chronicle.legacySystemMetadata.placeholders
chronicle.logProcessingPipelines.associateStreams
chronicle.logProcessingPipelines.create
chronicle.logProcessingPipelines.delete
chronicle.logProcessingPipelines.dissociateStreams
chronicle.logProcessingPipelines.fetchAssociatedPipeline
chronicle.logProcessingPipelines.fetchSampleLogsByStreams
chronicle.logProcessingPipelines.get
chronicle.logProcessingPipelines.list
chronicle.logProcessingPipelines.testPipeline
chronicle.logProcessingPipelines.update
chronicle.logTypeSchemas.list
chronicle.logTypeSettings.get
chronicle.logTypeSettings.list
chronicle.logTypeSettings.update
chronicle.logTypes.create
chronicle.logTypes.get
chronicle.logTypes.list
chronicle.logTypes.update
chronicle.logs.export
chronicle.logs.get
chronicle.logs.import
chronicle.logs.list
chronicle.managerRevisions.delete
chronicle.managerRevisions.get
chronicle.managerRevisions.update
chronicle.managers.delete
chronicle.managers.get
chronicle.managers.update
chronicle.mappingRules.delete
chronicle.mappingRules.get
chronicle.mappingRules.update
chronicle.marketplaceIntegrations.get
chronicle.marketplaceIntegrations.install
chronicle.marketplaceIntegrations.uninstall
chronicle.messages.create
chronicle.messages.delete
chronicle.messages.get
chronicle.messages.list
chronicle.messages.update
chronicle.moduleSettings.get
chronicle.moduleSettings.rebranding
chronicle.moduleSettingsProperties.get
chronicle.moduleSettingsProperties.testSettings
chronicle.moduleSettingsProperties.update
chronicle.multitenantDirectories.get
chronicle.nativeDashboards.create
chronicle.nativeDashboards.delete
chronicle.nativeDashboards.duplicate
chronicle.nativeDashboards.get
chronicle.nativeDashboards.list
chronicle.nativeDashboards.update
chronicle.notebooks.get
chronicle.notebooks.list
chronicle.notificationSettings.get
chronicle.notificationSettings.update
chronicle.ontologyRecords.get
chronicle.ontologyRecords.update
chronicle.operations.cancel
chronicle.operations.delete
chronicle.operations.get
chronicle.operations.list
chronicle.operations.streamSearch
chronicle.operations.wait
chronicle.parserExtensions.activate
chronicle.parserExtensions.create
chronicle.parserExtensions.delete
chronicle.parserExtensions.generateKeyValueMappings
chronicle.parserExtensions.get
chronicle.parserExtensions.legacySubmitParserExtension
chronicle.parserExtensions.list
chronicle.parserExtensions.removeSyslog
chronicle.parsers.activate
chronicle.parsers.activateReleaseCandidate
chronicle.parsers.copyPrebuiltParser
chronicle.parsers.create
chronicle.parsers.deactivate
chronicle.parsers.delete
chronicle.parsers.generateEventTypesSuggestions
chronicle.parsers.get
chronicle.parsers.list
chronicle.parsers.runParser
chronicle.parsers.update
chronicle.parsingErrors.list
chronicle.preferenceSets.get
chronicle.preferenceSets.update
chronicle.propertySchemaDefinitions.delete
chronicle.propertySchemaDefinitions.get
chronicle.propertySchemaDefinitions.update
chronicle.referenceLists.create
chronicle.referenceLists.get
chronicle.referenceLists.list
chronicle.referenceLists.update
chronicle.referenceLists.verifyReferenceList
chronicle.remoteAgents.delete
chronicle.remoteAgents.get
chronicle.remoteAgents.update
chronicle.requestTemplates.delete
chronicle.requestTemplates.get
chronicle.requestTemplates.update
chronicle.retrohunts.create
chronicle.retrohunts.get
chronicle.retrohunts.list
chronicle.riskConfigs.get
chronicle.riskConfigs.update
chronicle.ruleDeployments.get
chronicle.ruleDeployments.list
chronicle.ruleDeployments.update
chronicle.ruleExecutionErrors.list
chronicle.rules.create
chronicle.rules.delete
chronicle.rules.get
chronicle.rules.list
chronicle.rules.listRevisions
chronicle.rules.update
chronicle.rules.verifyRuleText
chronicle.savedColumnSets.create
chronicle.savedColumnSets.delete
chronicle.savedColumnSets.get
chronicle.savedColumnSets.list
chronicle.savedColumnSets.update
chronicle.searchQueries.create
chronicle.searchQueries.delete
chronicle.searchQueries.get
chronicle.searchQueries.list
chronicle.searchQueries.update
chronicle.shareConfigs.get
chronicle.shareConfigs.update
chronicle.slaDefinitions.delete
chronicle.slaDefinitions.get
chronicle.slaDefinitions.update
chronicle.soarDomains.delete
chronicle.soarDomains.get
chronicle.soarDomains.update
chronicle.soarNetworks.delete
chronicle.soarNetworks.get
chronicle.soarNetworks.update
chronicle.socRoles.delete
chronicle.socRoles.get
chronicle.socRoles.update
chronicle.summaryTables.create
chronicle.summaryTables.delete
chronicle.summaryTables.get
chronicle.summaryTables.list
chronicle.summaryTables.update
chronicle.systemNotifications.get
chronicle.systemNotifications.update
chronicle.tasks.delete
chronicle.tasks.get
chronicle.tasks.update
chronicle.tenants.create
chronicle.tenants.list
chronicle.tenants.update
chronicle.threatCollectionFilterSet.get
chronicle.threatCollections.fetchEntityMetadata
chronicle.threatCollections.fetchIocMatchMetadata
chronicle.threatCollections.fetchRelated
chronicle.threatCollections.get
chronicle.threatCollections.list
chronicle.transformerDefinitions.create
chronicle.transformerDefinitions.delete
chronicle.transformerDefinitions.execute
chronicle.transformerDefinitions.get
chronicle.transformerDefinitions.list
chronicle.transformerDefinitions.update
chronicle.transformerRevisions.delete
chronicle.transformerRevisions.get
chronicle.transformerRevisions.update
chronicle.uniqueEntities.get
chronicle.uniqueEntities.update
chronicle.userLocalizations.get
chronicle.userLocalizations.update
chronicle.userNotifications.get
chronicle.userNotifications.update
chronicle.validationErrors.list
chronicle.validationReports.get
chronicle.views.get
chronicle.views.update
chronicle.visualFamilies.delete
chronicle.visualFamilies.get
chronicle.visualFamilies.update
chronicle.watchlists.create
chronicle.watchlists.delete
chronicle.watchlists.get
chronicle.watchlists.list
chronicle.watchlists.update
chronicle.webhooks.delete
chronicle.webhooks.get
chronicle.webhooks.update
chronicle.workdeskContacts.delete
chronicle.workdeskContacts.get
chronicle.workdeskContacts.update
chronicle.workdeskLinks.delete
chronicle.workdeskLinks.get
chronicle.workdeskLinks.update
chronicle.workdeskNotes.delete
chronicle.workdeskNotes.get
chronicle.workdeskNotes.update
cloudasset.assets.exportResource
cloudasset.assets.queryAccessPolicy
cloudasset.assets.queryIamPolicy
cloudasset.assets.queryOSInventories
cloudasset.assets.queryResource
cloudasset.assets.searchAllIamPolicies
cloudasset.assets.searchAllResources
cloudasset.assets.searchEnrichmentResourceOwners
resourcemanager.organizations.get
resourcemanager.projects.get
resourcemanager.projects.list
securitycenter.attackpaths.list
securitycenter.exposurepathexplan.get
securitycenter.findings.bulkMuteUpdate
securitycenter.findings.group
securitycenter.findings.list
securitycenter.findings.listFindingPropertyNames
securitycenter.findings.setMute
securitycenter.findings.setState
securitycenter.findings.update
securitycenter.findingsecuritymarks.update
securitycenter.simulations.get
securitycenter.userinterfacemetadata.get
securitycenter.valuedresources.list
🔍