prod/adsmarketingfrontend-pa-	values_changed root['revision'] new_value 20250511 old_value 20250506
prod/adsmarketingfrontend-pa-v1	values_changed root['revision'] new_value 20250511 old_value 20250506
prod/aerialview-	values_changed root['revision'] new_value 20250511 old_value 20250507
prod/aerialview-v1	values_changed root['revision'] new_value 20250511 old_value 20250507
prod/aerialview-v1beta	values_changed root['revision'] new_value 20250511 old_value 20250507
prod/aida-	values_changed root['revision'] new_value 20250510 old_value 20250509 iterable_item_added root['schemas']['GoogleXPitchforkAidaV1GenerationSampleMetadataAttributionMetadataCitation']['properties']['dataset']['enum'][759] GEMINI_V3_RED_INDEX root['schemas']['GoogleXPitchforkAidaV1GenerationSampleMetadataAttributionMetadataCitation']['properties']['dataset']['enumDescriptions'][759] Gemini V3 red index (b/416272639).
prod/aida-v1	values_changed root['revision'] new_value 20250510 old_value 20250509 iterable_item_added root['schemas']['GoogleXPitchforkAidaV1GenerationSampleMetadataAttributionMetadataCitation']['properties']['dataset']['enum'][759] GEMINI_V3_RED_INDEX root['schemas']['GoogleXPitchforkAidaV1GenerationSampleMetadataAttributionMetadataCitation']['properties']['dataset']['enumDescriptions'][759] Gemini V3 red index (b/416272639).
prod/aiui-	values_changed root['revision'] new_value 20250511 old_value 20250508
prod/aiui-v1	values_changed root['revision'] new_value 20250511 old_value 20250508
prod/alpha-ml-	values_changed root['revision'] new_value 20250510 old_value 20250503
prod/alpha-ml-v1	values_changed root['revision'] new_value 20250510 old_value 20250503
prod/analyticssuitefrontend-pa-	values_changed root['revision'] new_value 20250512 old_value 20250508
prod/analyticssuitefrontend-pa-v1	values_changed root['revision'] new_value 20250512 old_value 20250508
prod/androidbuild-pa-	dictionary_item_added root['resources']['builds']['resources']['attempts']['resources']['artifacts']['methods']['patch'] root['schemas']['ObjectId'] root['schemas']['UpdateBuildArtifactRequest'] root['schemas']['UpdateBuildArtifactResponse'] values_changed root['revision'] new_value 20250512 old_value 20250508
prod/androidbuild-pa-v4	dictionary_item_added root['resources']['builds']['resources']['attempts']['resources']['artifacts']['methods']['patch'] root['schemas']['ObjectId'] root['schemas']['UpdateBuildArtifactRequest'] root['schemas']['UpdateBuildArtifactResponse'] values_changed root['revision'] new_value 20250512 old_value 20250508
prod/ap-rbmopenmaap-	values_changed root['revision'] new_value 20250512 old_value 20250506
prod/ap-rbmopenmaap-v1	values_changed root['revision'] new_value 20250512 old_value 20250506
prod/apigeeconnect-	values_changed root['revision'] new_value 20250509 old_value 20250502
prod/apigeeconnect-v1	values_changed root['revision'] new_value 20250509 old_value 20250502
prod/arcore-	values_changed root['revision'] new_value 20250511 old_value 20250507
prod/arcore-v1	values_changed root['revision'] new_value 20250511 old_value 20250507
prod/arcore-v1beta2	values_changed root['revision'] new_value 20250511 old_value 20250507
prod/arcorecloudanchor-	values_changed root['revision'] new_value 20250511 old_value 20250507
prod/arcorecloudanchor-v1beta2	values_changed root['revision'] new_value 20250511 old_value 20250507
prod/asia-south1-chronicle-	dictionary_item_added root['schemas']['ThreatCollectionItem'] root['schemas']['SecurityResult']['properties']['threatCollections'] root['schemas']['SecurityResult']['properties']['campaigns']['deprecated'] root['schemas']['SecurityResult']['properties']['reports']['deprecated'] values_changed root['revision'] new_value 20250508 old_value 20250505 root['schemas']['SecurityResult']['properties']['about']['description'] new_value If the security result is about a specific entity (Noun), add it here. This field is not populated when the SecurityResult appears in a detection. old_value If the security result is about a specific entity (Noun), add it here. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['action']['description'] new_value Actions taken for this event. This field is not populated when the SecurityResult appears in a detection. old_value Actions taken for this event. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['actionDetails']['description'] new_value The detail of the action taken as provided by the vendor. This field is not populated when the SecurityResult appears in a detection. old_value The detail of the action taken as provided by the vendor. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['analyticsMetadata']['description'] new_value Stores metadata about each risk analytic metric the rule uses. This field is not populated when the SecurityResult appears in a detection. old_value Stores metadata about each risk analytic metric the rule uses. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['associations']['description'] new_value Associations related to the threat. old_value Associations related to the threat. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['attackDetails']['description'] new_value MITRE ATT&CK details. This field is not populated when the SecurityResult appears in a detection. old_value MITRE ATT&CK details. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['campaigns']['description'] new_value Campaigns using this IOC threat. This is deprecated. Use threat_collections instead. old_value Campaigns using this IOC threat. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['category']['description'] new_value The security category. This field is not populated when the SecurityResult appears in a detection. old_value The security category. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['categoryDetails']['description'] new_value For vendor-specific categories. For web categorization, put type in here such as "gambling" or "porn". This field is not populated when the SecurityResult appears in a detection. old_value For vendor-specific categories. For web categorization, put type in here such as "gambling" or "porn". This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['confidence']['description'] new_value The confidence level of the result as estimated by the product. This field is not populated when the SecurityResult appears in a detection. old_value The confidence level of the result as estimated by the product. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['confidenceDetails']['description'] new_value Additional detail with regards to the confidence of a security event as estimated by the product vendor. This field is not populated when the SecurityResult appears in a detection. old_value Additional detail with regards to the confidence of a security event as estimated by the product vendor. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['confidenceScore']['description'] new_value The confidence score of the security result. This field is not populated when the SecurityResult appears in a detection. old_value The confidence score of the security result. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['detectionFields']['description'] new_value An ordered list of values, that represent fields in detections for a security finding. This list represents mapping of names of requested entities to their values (the security result matched variables). This is only populated when the SecurityResult appears in a detection. old_value An ordered list of values, that represent fields in detections for a security finding. This list represents mapping of names of requested entities to their values (the security result matched variables). This is only populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['firstDiscoveredTime']['description'] new_value First time the IoC threat was discovered in the provider. This field is not populated when the SecurityResult appears in a detection. old_value First time the IoC threat was discovered in the provider. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['lastDiscoveredTime']['description'] new_value Last time the IoC was seen in the provider data. This field is not populated when the SecurityResult appears in a detection. old_value Last time the IoC was seen in the provider data. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['lastUpdatedTime']['description'] new_value Last time the IoC threat was updated in the provider. This field is not populated when the SecurityResult appears in a detection. old_value Last time the IoC threat was updated in the provider. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['outcomes']['description'] new_value A list of outcomes that represent the results of this security finding. This list represents a mapping of names of the requested outcomes, to a stringified version of their values. This is only populated when the SecurityResult appears in a detection. old_value A list of outcomes that represent the results of this security finding. This list represents a mapping of names of the requested outcomes, to a stringified version of their values. This is only populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['priority']['description'] new_value The priority of the result. This field is not populated when the SecurityResult appears in a detection. old_value The priority of the result. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['priorityDetails']['description'] new_value Vendor-specific information about the security result priority. This field is not populated when the SecurityResult appears in a detection. old_value Vendor-specific information about the security result priority. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['reports']['description'] new_value Reports that reference this IOC threat. These are the report IDs. This is deprecated. Use threat_collections instead. old_value Reports that reference this IOC threat. These are the report IDs. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['ruleAuthor']['description'] new_value Author of the security rule. This field is not populated when the SecurityResult appears in a detection. old_value Author of the security rule. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['severityDetails']['description'] new_value Vendor-specific severity. This field is not populated when the SecurityResult appears in a detection. old_value Vendor-specific severity. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['threatFeedName']['description'] new_value Vendor feed name for a threat indicator feed. This field is not populated when the SecurityResult appears in a detection. old_value Vendor feed name for a threat indicator feed. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['threatId']['description'] new_value Vendor-specific ID for a threat. This field is not populated when the SecurityResult appears in a detection. old_value Vendor-specific ID for a threat. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['threatIdNamespace']['description'] new_value The attribute threat_id_namespace qualifies threat_id with an id namespace to get an unique id. The attribute threat_id by itself is not unique across Chronicle as it is a vendor specific id. This field is not populated when the SecurityResult appears in a detection. old_value The attribute threat_id_namespace qualifies threat_id with an id namespace to get an unique id. The attribute threat_id by itself is not unique across Chronicle as it is a vendor specific id. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['threatName']['description'] new_value A vendor-assigned classification common across multiple customers (for example, "W32/File-A", "Slammer"). This field is not populated when the SecurityResult appears in a detection. old_value A vendor-assigned classification common across multiple customers (for example, "W32/File-A", "Slammer"). This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['threatStatus']['description'] new_value Current status of the threat This field is not populated when the SecurityResult appears in a detection. old_value Current status of the threat This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['threatVerdict']['description'] new_value GCTI threat verdict on the security result entity. This field is not populated when the SecurityResult appears in a detection. old_value GCTI threat verdict on the security result entity. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['urlBackToProduct']['description'] new_value URL that takes the user to the source product console for this event. This field is not populated when the SecurityResult appears in a detection. old_value URL that takes the user to the source product console for this event. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['variables']['description'] new_value A list of outcomes and match variables that represent the results of this security finding. This list represents a mapping of names of the requested outcomes or match variables, to their values. This is only populated when the SecurityResult appears in a detection. old_value A list of outcomes and match variables that represent the results of this security finding. This list represents a mapping of names of the requested outcomes or match variables, to their values. This is only populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['verdictInfo']['description'] new_value Verdict information about the IoC from the provider. This field is not populated when the SecurityResult appears in a detection. old_value Verdict information about the IoC from the provider. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
prod/asia-south1-chronicle-v1	dictionary_item_added root['schemas']['ThreatCollectionItem'] root['schemas']['SecurityResult']['properties']['threatCollections'] root['schemas']['SecurityResult']['properties']['campaigns']['deprecated'] root['schemas']['SecurityResult']['properties']['reports']['deprecated'] values_changed root['revision'] new_value 20250508 old_value 20250505 root['schemas']['SecurityResult']['properties']['about']['description'] new_value If the security result is about a specific entity (Noun), add it here. This field is not populated when the SecurityResult appears in a detection. old_value If the security result is about a specific entity (Noun), add it here. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['action']['description'] new_value Actions taken for this event. This field is not populated when the SecurityResult appears in a detection. old_value Actions taken for this event. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['actionDetails']['description'] new_value The detail of the action taken as provided by the vendor. This field is not populated when the SecurityResult appears in a detection. old_value The detail of the action taken as provided by the vendor. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['analyticsMetadata']['description'] new_value Stores metadata about each risk analytic metric the rule uses. This field is not populated when the SecurityResult appears in a detection. old_value Stores metadata about each risk analytic metric the rule uses. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['associations']['description'] new_value Associations related to the threat. old_value Associations related to the threat. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['attackDetails']['description'] new_value MITRE ATT&CK details. This field is not populated when the SecurityResult appears in a detection. old_value MITRE ATT&CK details. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['campaigns']['description'] new_value Campaigns using this IOC threat. This is deprecated. Use threat_collections instead. old_value Campaigns using this IOC threat. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['category']['description'] new_value The security category. This field is not populated when the SecurityResult appears in a detection. old_value The security category. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['categoryDetails']['description'] new_value For vendor-specific categories. For web categorization, put type in here such as "gambling" or "porn". This field is not populated when the SecurityResult appears in a detection. old_value For vendor-specific categories. For web categorization, put type in here such as "gambling" or "porn". This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['confidence']['description'] new_value The confidence level of the result as estimated by the product. This field is not populated when the SecurityResult appears in a detection. old_value The confidence level of the result as estimated by the product. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['confidenceDetails']['description'] new_value Additional detail with regards to the confidence of a security event as estimated by the product vendor. This field is not populated when the SecurityResult appears in a detection. old_value Additional detail with regards to the confidence of a security event as estimated by the product vendor. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['confidenceScore']['description'] new_value The confidence score of the security result. This field is not populated when the SecurityResult appears in a detection. old_value The confidence score of the security result. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['detectionFields']['description'] new_value An ordered list of values, that represent fields in detections for a security finding. This list represents mapping of names of requested entities to their values (the security result matched variables). This is only populated when the SecurityResult appears in a detection. old_value An ordered list of values, that represent fields in detections for a security finding. This list represents mapping of names of requested entities to their values (the security result matched variables). This is only populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['firstDiscoveredTime']['description'] new_value First time the IoC threat was discovered in the provider. This field is not populated when the SecurityResult appears in a detection. old_value First time the IoC threat was discovered in the provider. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['lastDiscoveredTime']['description'] new_value Last time the IoC was seen in the provider data. This field is not populated when the SecurityResult appears in a detection. old_value Last time the IoC was seen in the provider data. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['lastUpdatedTime']['description'] new_value Last time the IoC threat was updated in the provider. This field is not populated when the SecurityResult appears in a detection. old_value Last time the IoC threat was updated in the provider. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['outcomes']['description'] new_value A list of outcomes that represent the results of this security finding. This list represents a mapping of names of the requested outcomes, to a stringified version of their values. This is only populated when the SecurityResult appears in a detection. old_value A list of outcomes that represent the results of this security finding. This list represents a mapping of names of the requested outcomes, to a stringified version of their values. This is only populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['priority']['description'] new_value The priority of the result. This field is not populated when the SecurityResult appears in a detection. old_value The priority of the result. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['priorityDetails']['description'] new_value Vendor-specific information about the security result priority. This field is not populated when the SecurityResult appears in a detection. old_value Vendor-specific information about the security result priority. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['reports']['description'] new_value Reports that reference this IOC threat. These are the report IDs. This is deprecated. Use threat_collections instead. old_value Reports that reference this IOC threat. These are the report IDs. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['ruleAuthor']['description'] new_value Author of the security rule. This field is not populated when the SecurityResult appears in a detection. old_value Author of the security rule. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['severityDetails']['description'] new_value Vendor-specific severity. This field is not populated when the SecurityResult appears in a detection. old_value Vendor-specific severity. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['threatFeedName']['description'] new_value Vendor feed name for a threat indicator feed. This field is not populated when the SecurityResult appears in a detection. old_value Vendor feed name for a threat indicator feed. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['threatId']['description'] new_value Vendor-specific ID for a threat. This field is not populated when the SecurityResult appears in a detection. old_value Vendor-specific ID for a threat. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['threatIdNamespace']['description'] new_value The attribute threat_id_namespace qualifies threat_id with an id namespace to get an unique id. The attribute threat_id by itself is not unique across Chronicle as it is a vendor specific id. This field is not populated when the SecurityResult appears in a detection. old_value The attribute threat_id_namespace qualifies threat_id with an id namespace to get an unique id. The attribute threat_id by itself is not unique across Chronicle as it is a vendor specific id. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['threatName']['description'] new_value A vendor-assigned classification common across multiple customers (for example, "W32/File-A", "Slammer"). This field is not populated when the SecurityResult appears in a detection. old_value A vendor-assigned classification common across multiple customers (for example, "W32/File-A", "Slammer"). This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['threatStatus']['description'] new_value Current status of the threat This field is not populated when the SecurityResult appears in a detection. old_value Current status of the threat This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['threatVerdict']['description'] new_value GCTI threat verdict on the security result entity. This field is not populated when the SecurityResult appears in a detection. old_value GCTI threat verdict on the security result entity. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['urlBackToProduct']['description'] new_value URL that takes the user to the source product console for this event. This field is not populated when the SecurityResult appears in a detection. old_value URL that takes the user to the source product console for this event. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['variables']['description'] new_value A list of outcomes and match variables that represent the results of this security finding. This list represents a mapping of names of the requested outcomes or match variables, to their values. This is only populated when the SecurityResult appears in a detection. old_value A list of outcomes and match variables that represent the results of this security finding. This list represents a mapping of names of the requested outcomes or match variables, to their values. This is only populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['verdictInfo']['description'] new_value Verdict information about the IoC from the provider. This field is not populated when the SecurityResult appears in a detection. old_value Verdict information about the IoC from the provider. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
prod/asia-south1-chronicle-v1alpha	dictionary_item_added root['resources']['projects']['resources']['locations']['resources']['instances']['resources']['dataTables']['resources']['dataTableRows']['methods']['list']['parameters']['filter'] root['schemas']['FileMetadataCodesignProvenance'] root['schemas']['FileMetadataImportsProvenance'] root['schemas']['FileMetadataPeResourceInfoProvenance'] root['schemas']['FileMetadataSectionProvenance'] root['schemas']['FileMetadataSignatureInfoProvenance'] root['schemas']['PeFileMetadataProvenance'] root['schemas']['SignerInfoProvenance'] root['schemas']['StringToInt64MapEntryProvenance'] root['schemas']['ThreatCollectionItem'] root['schemas']['X509Provenance'] root['schemas']['EventSample']['properties']['joinedDataTableRows'] root['schemas']['FieldProvenance']['properties']['nonlogSource'] root['schemas']['FileMetadataProvenance']['properties']['pe'] root['schemas']['GoogleCloudChronicleV1alphaLegacyFetchUdmSearchViewResponseStatsColumnMetadata']['properties']['latitude'] root['schemas']['GoogleCloudChronicleV1alphaLegacyFetchUdmSearchViewResponseStatsColumnMetadata']['properties']['longitude'] root['schemas']['SecurityResult']['properties']['threatCollections'] root['schemas']['SecurityResult']['properties']['campaigns']['deprecated'] root['schemas']['SecurityResult']['properties']['reports']['deprecated'] root['schemas']['UiPreferences']['properties']['enableLabs'] root['schemas']['ValueMetadata']['properties']['timestampVal'] values_changed root['revision'] new_value 20250508 old_value 20250505 root['schemas']['ExifInfoProvenance']['properties'] new_value company $ref FieldProvenance compilationTime $ref FieldProvenance entryPoint $ref FieldProvenance fileDescription $ref FieldProvenance originalFile $ref FieldProvenance product $ref FieldProvenance old_value root['schemas']['FaviconProvenance']['properties'] new_value dhash $ref FieldProvenance rawMd5 $ref FieldProvenance old_value root['schemas']['FileMetadataPEProvenance']['properties'] new_value compilationExiftoolTime $ref FieldProvenance compilationTime $ref FieldProvenance entryPoint $ref FieldProvenance entryPointExiftool $ref FieldProvenance imphash $ref FieldProvenance imports items $ref FileMetadataImportsProvenance type array resource items $ref FileMetadataPeResourceInfoProvenance type array resourcesLanguageCount deprecated True items $ref StringToInt64MapEntryProvenance type array resourcesLanguageCountStr items $ref LabelProvenance type array resourcesTypeCount deprecated True items $ref StringToInt64MapEntryProvenance type array resourcesTypeCountStr items $ref LabelProvenance type array section items $ref FileMetadataSectionProvenance type array signatureInfo $ref FileMetadataSignatureInfoProvenance deprecated True old_value root['schemas']['NtfsFileMetadataProvenance']['properties'] new_value changeTime $ref FieldProvenance filenameAccessTime $ref FieldProvenance filenameChangeTime $ref FieldProvenance filenameCreateTime $ref FieldProvenance filenameModifyTime $ref FieldProvenance old_value root['schemas']['PDFInfoProvenance']['properties'] new_value acroform $ref FieldProvenance autoaction $ref FieldProvenance embeddedFile $ref FieldProvenance encrypted $ref FieldProvenance endobjCount $ref FieldProvenance endstreamCount $ref FieldProvenance flash $ref FieldProvenance header $ref FieldProvenance javascript $ref FieldProvenance jbig2Compression $ref FieldProvenance js $ref FieldProvenance launchActionCount $ref FieldProvenance objCount $ref FieldProvenance objectStreamCount $ref FieldProvenance openaction $ref FieldProvenance pageCount $ref FieldProvenance startxref $ref FieldProvenance streamCount $ref FieldProvenance suspiciousColors $ref FieldProvenance trailer $ref FieldProvenance xfa $ref FieldProvenance xref $ref FieldProvenance old_value root['schemas']['PrevalenceProvenance']['properties'] new_value dayCount $ref FieldProvenance dayMax $ref FieldProvenance dayMaxSubDomains $ref FieldProvenance rollingMax $ref FieldProvenance rollingMaxSubDomains $ref FieldProvenance old_value root['schemas']['SecurityResult']['properties']['about']['description'] new_value If the security result is about a specific entity (Noun), add it here. This field is not populated when the SecurityResult appears in a detection. old_value If the security result is about a specific entity (Noun), add it here. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['action']['description'] new_value Actions taken for this event. This field is not populated when the SecurityResult appears in a detection. old_value Actions taken for this event. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['actionDetails']['description'] new_value The detail of the action taken as provided by the vendor. This field is not populated when the SecurityResult appears in a detection. old_value The detail of the action taken as provided by the vendor. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['analyticsMetadata']['description'] new_value Stores metadata about each risk analytic metric the rule uses. This field is not populated when the SecurityResult appears in a detection. old_value Stores metadata about each risk analytic metric the rule uses. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['associations']['description'] new_value Associations related to the threat. old_value Associations related to the threat. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['attackDetails']['description'] new_value MITRE ATT&CK details. This field is not populated when the SecurityResult appears in a detection. old_value MITRE ATT&CK details. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['campaigns']['description'] new_value Campaigns using this IOC threat. This is deprecated. Use threat_collections instead. old_value Campaigns using this IOC threat. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['category']['description'] new_value The security category. This field is not populated when the SecurityResult appears in a detection. old_value The security category. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['categoryDetails']['description'] new_value For vendor-specific categories. For web categorization, put type in here such as "gambling" or "porn". This field is not populated when the SecurityResult appears in a detection. old_value For vendor-specific categories. For web categorization, put type in here such as "gambling" or "porn". This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['confidence']['description'] new_value The confidence level of the result as estimated by the product. This field is not populated when the SecurityResult appears in a detection. old_value The confidence level of the result as estimated by the product. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['confidenceDetails']['description'] new_value Additional detail with regards to the confidence of a security event as estimated by the product vendor. This field is not populated when the SecurityResult appears in a detection. old_value Additional detail with regards to the confidence of a security event as estimated by the product vendor. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['confidenceScore']['description'] new_value The confidence score of the security result. This field is not populated when the SecurityResult appears in a detection. old_value The confidence score of the security result. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['detectionFields']['description'] new_value An ordered list of values, that represent fields in detections for a security finding. This list represents mapping of names of requested entities to their values (the security result matched variables). This is only populated when the SecurityResult appears in a detection. old_value An ordered list of values, that represent fields in detections for a security finding. This list represents mapping of names of requested entities to their values (the security result matched variables). This is only populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['firstDiscoveredTime']['description'] new_value First time the IoC threat was discovered in the provider. This field is not populated when the SecurityResult appears in a detection. old_value First time the IoC threat was discovered in the provider. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['lastDiscoveredTime']['description'] new_value Last time the IoC was seen in the provider data. This field is not populated when the SecurityResult appears in a detection. old_value Last time the IoC was seen in the provider data. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['lastUpdatedTime']['description'] new_value Last time the IoC threat was updated in the provider. This field is not populated when the SecurityResult appears in a detection. old_value Last time the IoC threat was updated in the provider. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['outcomes']['description'] new_value A list of outcomes that represent the results of this security finding. This list represents a mapping of names of the requested outcomes, to a stringified version of their values. This is only populated when the SecurityResult appears in a detection. old_value A list of outcomes that represent the results of this security finding. This list represents a mapping of names of the requested outcomes, to a stringified version of their values. This is only populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['priority']['description'] new_value The priority of the result. This field is not populated when the SecurityResult appears in a detection. old_value The priority of the result. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['priorityDetails']['description'] new_value Vendor-specific information about the security result priority. This field is not populated when the SecurityResult appears in a detection. old_value Vendor-specific information about the security result priority. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['reports']['description'] new_value Reports that reference this IOC threat. These are the report IDs. This is deprecated. Use threat_collections instead. old_value Reports that reference this IOC threat. These are the report IDs. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['ruleAuthor']['description'] new_value Author of the security rule. This field is not populated when the SecurityResult appears in a detection. old_value Author of the security rule. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['severityDetails']['description'] new_value Vendor-specific severity. This field is not populated when the SecurityResult appears in a detection. old_value Vendor-specific severity. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['threatFeedName']['description'] new_value Vendor feed name for a threat indicator feed. This field is not populated when the SecurityResult appears in a detection. old_value Vendor feed name for a threat indicator feed. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['threatId']['description'] new_value Vendor-specific ID for a threat. This field is not populated when the SecurityResult appears in a detection. old_value Vendor-specific ID for a threat. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['threatIdNamespace']['description'] new_value The attribute threat_id_namespace qualifies threat_id with an id namespace to get an unique id. The attribute threat_id by itself is not unique across Chronicle as it is a vendor specific id. This field is not populated when the SecurityResult appears in a detection. old_value The attribute threat_id_namespace qualifies threat_id with an id namespace to get an unique id. The attribute threat_id by itself is not unique across Chronicle as it is a vendor specific id. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['threatName']['description'] new_value A vendor-assigned classification common across multiple customers (for example, "W32/File-A", "Slammer"). This field is not populated when the SecurityResult appears in a detection. old_value A vendor-assigned classification common across multiple customers (for example, "W32/File-A", "Slammer"). This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['threatStatus']['description'] new_value Current status of the threat This field is not populated when the SecurityResult appears in a detection. old_value Current status of the threat This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['threatVerdict']['description'] new_value GCTI threat verdict on the security result entity. This field is not populated when the SecurityResult appears in a detection. old_value GCTI threat verdict on the security result entity. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['urlBackToProduct']['description'] new_value URL that takes the user to the source product console for this event. This field is not populated when the SecurityResult appears in a detection. old_value URL that takes the user to the source product console for this event. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['variables']['description'] new_value A list of outcomes and match variables that represent the results of this security finding. This list represents a mapping of names of the requested outcomes or match variables, to their values. This is only populated when the SecurityResult appears in a detection. old_value A list of outcomes and match variables that represent the results of this security finding. This list represents a mapping of names of the requested outcomes or match variables, to their values. This is only populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['verdictInfo']['description'] new_value Verdict information about the IoC from the provider. This field is not populated when the SecurityResult appears in a detection. old_value Verdict information about the IoC from the provider. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SignatureInfoProvenance']['properties'] new_value codesign $ref FileMetadataCodesignProvenance sigcheck $ref FileMetadataSignatureInfoProvenance old_value iterable_item_added root['schemas']['EdrEvent']['properties']['dataSource']['enum'][28] VECTRA root['schemas']['EdrEvent']['properties']['dataSource']['enum'][29] FORTINET root['schemas']['EnrichmentSource']['properties']['logType']['enum'][130] DOPPEL root['schemas']['EnrichmentSource']['properties']['logType']['enum'][231] TEAMT5_THREATSONAR_EDR root['schemas']['EnrichmentSource']['properties']['logType']['enum'][461] SECURITYBRIDGE_DEV root['schemas']['EnrichmentSource']['properties']['logType']['enum'][808] AZURE_ARCDATA root['schemas']['EnrichmentSource']['properties']['logType']['enum'][809] AZURE_DATAFACTORY root['schemas']['EnrichmentSource']['properties']['logType']['enum'][810] AZURE_DOCUMENTDB root['schemas']['EnrichmentSource']['properties']['logType']['enum'][997] AZURE_AUTHORIZATION root['schemas']['EnrichmentSource']['properties']['logType']['enum'][1275] AZURE_APPCONFIGURATION root['schemas']['EnrichmentSource']['properties']['logType']['enum'][1448] AZURE_APPPLATFORM root['schemas']['EnrichmentSource']['properties']['logType']['enum'][1450] AZURE_CHANGEANALYSIS root['schemas']['EnrichmentSource']['properties']['logType']['enum'][1451] AZURE_EVENTGRID root['schemas']['EnrichmentSource']['properties']['logType']['enum'][1452] AZURE_EVENTHUB root['schemas']['EnrichmentSource']['properties']['logType']['enum'][1453] AZURE_HYBRIDCOMPUTE root['schemas']['EnrichmentSource']['properties']['logType']['enum'][1522] REDMINE root['schemas']['EnrichmentSource']['properties']['logType']['enum'][1538] WORKDAY_USER_SIGNIN root['schemas']['EnrichmentSource']['properties']['logType']['enum'][1810] GCP_DNS_ATD root['schemas']['EnrichmentSource']['properties']['logType']['enum'][1987] GENIAN_NAC root['schemas']['EnrichmentSource']['properties']['logType']['enum'][1988] PENTA_WAPPLES root['schemas']['EnrichmentSource']['properties']['logType']['enum'][1989] S2W_QUAXAR root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][130] DOPPEL root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][231] TEAMT5_THREATSONAR_EDR root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][461] SECURITYBRIDGE_DEV root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][808] AZURE_ARCDATA root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][809] AZURE_DATAFACTORY root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][810] AZURE_DOCUMENTDB root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][997] AZURE_AUTHORIZATION root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][1275] AZURE_APPCONFIGURATION root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][1448] AZURE_APPPLATFORM root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][1450] AZURE_CHANGEANALYSIS root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][1451] AZURE_EVENTGRID root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][1452] AZURE_EVENTHUB root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][1453] AZURE_HYBRIDCOMPUTE root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][1522] REDMINE root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][1538] WORKDAY_USER_SIGNIN root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][1810] GCP_DNS_ATD root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][1987] GENIAN_NAC root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][1988] PENTA_WAPPLES root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][1989] S2W_QUAXAR root['schemas']['RawLog']['properties']['type']['enum'][130] DOPPEL root['schemas']['RawLog']['properties']['type']['enum'][231] TEAMT5_THREATSONAR_EDR root['schemas']['RawLog']['properties']['type']['enum'][461] SECURITYBRIDGE_DEV root['schemas']['RawLog']['properties']['type']['enum'][808] AZURE_ARCDATA root['schemas']['RawLog']['properties']['type']['enum'][809] AZURE_DATAFACTORY root['schemas']['RawLog']['properties']['type']['enum'][810] AZURE_DOCUMENTDB root['schemas']['RawLog']['properties']['type']['enum'][997] AZURE_AUTHORIZATION root['schemas']['RawLog']['properties']['type']['enum'][1275] AZURE_APPCONFIGURATION root['schemas']['RawLog']['properties']['type']['enum'][1448] AZURE_APPPLATFORM root['schemas']['RawLog']['properties']['type']['enum'][1450] AZURE_CHANGEANALYSIS root['schemas']['RawLog']['properties']['type']['enum'][1451] AZURE_EVENTGRID root['schemas']['RawLog']['properties']['type']['enum'][1452] AZURE_EVENTHUB root['schemas']['RawLog']['properties']['type']['enum'][1453] AZURE_HYBRIDCOMPUTE root['schemas']['RawLog']['properties']['type']['enum'][1522] REDMINE root['schemas']['RawLog']['properties']['type']['enum'][1538] WORKDAY_USER_SIGNIN root['schemas']['RawLog']['properties']['type']['enum'][1810] GCP_DNS_ATD root['schemas']['RawLog']['properties']['type']['enum'][1987] GENIAN_NAC root['schemas']['RawLog']['properties']['type']['enum'][1988] PENTA_WAPPLES root['schemas']['RawLog']['properties']['type']['enum'][1989] S2W_QUAXAR root['schemas']['SIEventData']['properties']['rawLogType']['enum'][130] DOPPEL root['schemas']['SIEventData']['properties']['rawLogType']['enum'][231] TEAMT5_THREATSONAR_EDR root['schemas']['SIEventData']['properties']['rawLogType']['enum'][461] SECURITYBRIDGE_DEV root['schemas']['SIEventData']['properties']['rawLogType']['enum'][808] AZURE_ARCDATA root['schemas']['SIEventData']['properties']['rawLogType']['enum'][809] AZURE_DATAFACTORY root['schemas']['SIEventData']['properties']['rawLogType']['enum'][810] AZURE_DOCUMENTDB root['schemas']['SIEventData']['properties']['rawLogType']['enum'][997] AZURE_AUTHORIZATION root['schemas']['SIEventData']['properties']['rawLogType']['enum'][1275] AZURE_APPCONFIGURATION root['schemas']['SIEventData']['properties']['rawLogType']['enum'][1448] AZURE_APPPLATFORM root['schemas']['SIEventData']['properties']['rawLogType']['enum'][1450] AZURE_CHANGEANALYSIS root['schemas']['SIEventData']['properties']['rawLogType']['enum'][1451] AZURE_EVENTGRID root['schemas']['SIEventData']['properties']['rawLogType']['enum'][1452] AZURE_EVENTHUB root['schemas']['SIEventData']['properties']['rawLogType']['enum'][1453] AZURE_HYBRIDCOMPUTE root['schemas']['SIEventData']['properties']['rawLogType']['enum'][1522] REDMINE root['schemas']['SIEventData']['properties']['rawLogType']['enum'][1538] WORKDAY_USER_SIGNIN root['schemas']['SIEventData']['properties']['rawLogType']['enum'][1810] GCP_DNS_ATD root['schemas']['SIEventData']['properties']['rawLogType']['enum'][1987] GENIAN_NAC root['schemas']['SIEventData']['properties']['rawLogType']['enum'][1988] PENTA_WAPPLES root['schemas']['SIEventData']['properties']['rawLogType']['enum'][1989] S2W_QUAXAR
prod/asia-south1-chronicle-v1beta	dictionary_item_added root['schemas']['ThreatCollectionItem'] root['schemas']['SecurityResult']['properties']['threatCollections'] root['schemas']['SecurityResult']['properties']['campaigns']['deprecated'] root['schemas']['SecurityResult']['properties']['reports']['deprecated'] values_changed root['revision'] new_value 20250508 old_value 20250505 root['schemas']['SecurityResult']['properties']['about']['description'] new_value If the security result is about a specific entity (Noun), add it here. This field is not populated when the SecurityResult appears in a detection. old_value If the security result is about a specific entity (Noun), add it here. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['action']['description'] new_value Actions taken for this event. This field is not populated when the SecurityResult appears in a detection. old_value Actions taken for this event. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['actionDetails']['description'] new_value The detail of the action taken as provided by the vendor. This field is not populated when the SecurityResult appears in a detection. old_value The detail of the action taken as provided by the vendor. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['analyticsMetadata']['description'] new_value Stores metadata about each risk analytic metric the rule uses. This field is not populated when the SecurityResult appears in a detection. old_value Stores metadata about each risk analytic metric the rule uses. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['associations']['description'] new_value Associations related to the threat. old_value Associations related to the threat. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['attackDetails']['description'] new_value MITRE ATT&CK details. This field is not populated when the SecurityResult appears in a detection. old_value MITRE ATT&CK details. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['campaigns']['description'] new_value Campaigns using this IOC threat. This is deprecated. Use threat_collections instead. old_value Campaigns using this IOC threat. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['category']['description'] new_value The security category. This field is not populated when the SecurityResult appears in a detection. old_value The security category. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['categoryDetails']['description'] new_value For vendor-specific categories. For web categorization, put type in here such as "gambling" or "porn". This field is not populated when the SecurityResult appears in a detection. old_value For vendor-specific categories. For web categorization, put type in here such as "gambling" or "porn". This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['confidence']['description'] new_value The confidence level of the result as estimated by the product. This field is not populated when the SecurityResult appears in a detection. old_value The confidence level of the result as estimated by the product. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['confidenceDetails']['description'] new_value Additional detail with regards to the confidence of a security event as estimated by the product vendor. This field is not populated when the SecurityResult appears in a detection. old_value Additional detail with regards to the confidence of a security event as estimated by the product vendor. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['confidenceScore']['description'] new_value The confidence score of the security result. This field is not populated when the SecurityResult appears in a detection. old_value The confidence score of the security result. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['detectionFields']['description'] new_value An ordered list of values, that represent fields in detections for a security finding. This list represents mapping of names of requested entities to their values (the security result matched variables). This is only populated when the SecurityResult appears in a detection. old_value An ordered list of values, that represent fields in detections for a security finding. This list represents mapping of names of requested entities to their values (the security result matched variables). This is only populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['firstDiscoveredTime']['description'] new_value First time the IoC threat was discovered in the provider. This field is not populated when the SecurityResult appears in a detection. old_value First time the IoC threat was discovered in the provider. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['lastDiscoveredTime']['description'] new_value Last time the IoC was seen in the provider data. This field is not populated when the SecurityResult appears in a detection. old_value Last time the IoC was seen in the provider data. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['lastUpdatedTime']['description'] new_value Last time the IoC threat was updated in the provider. This field is not populated when the SecurityResult appears in a detection. old_value Last time the IoC threat was updated in the provider. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['outcomes']['description'] new_value A list of outcomes that represent the results of this security finding. This list represents a mapping of names of the requested outcomes, to a stringified version of their values. This is only populated when the SecurityResult appears in a detection. old_value A list of outcomes that represent the results of this security finding. This list represents a mapping of names of the requested outcomes, to a stringified version of their values. This is only populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['priority']['description'] new_value The priority of the result. This field is not populated when the SecurityResult appears in a detection. old_value The priority of the result. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['priorityDetails']['description'] new_value Vendor-specific information about the security result priority. This field is not populated when the SecurityResult appears in a detection. old_value Vendor-specific information about the security result priority. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['reports']['description'] new_value Reports that reference this IOC threat. These are the report IDs. This is deprecated. Use threat_collections instead. old_value Reports that reference this IOC threat. These are the report IDs. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['ruleAuthor']['description'] new_value Author of the security rule. This field is not populated when the SecurityResult appears in a detection. old_value Author of the security rule. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['severityDetails']['description'] new_value Vendor-specific severity. This field is not populated when the SecurityResult appears in a detection. old_value Vendor-specific severity. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['threatFeedName']['description'] new_value Vendor feed name for a threat indicator feed. This field is not populated when the SecurityResult appears in a detection. old_value Vendor feed name for a threat indicator feed. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['threatId']['description'] new_value Vendor-specific ID for a threat. This field is not populated when the SecurityResult appears in a detection. old_value Vendor-specific ID for a threat. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['threatIdNamespace']['description'] new_value The attribute threat_id_namespace qualifies threat_id with an id namespace to get an unique id. The attribute threat_id by itself is not unique across Chronicle as it is a vendor specific id. This field is not populated when the SecurityResult appears in a detection. old_value The attribute threat_id_namespace qualifies threat_id with an id namespace to get an unique id. The attribute threat_id by itself is not unique across Chronicle as it is a vendor specific id. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['threatName']['description'] new_value A vendor-assigned classification common across multiple customers (for example, "W32/File-A", "Slammer"). This field is not populated when the SecurityResult appears in a detection. old_value A vendor-assigned classification common across multiple customers (for example, "W32/File-A", "Slammer"). This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['threatStatus']['description'] new_value Current status of the threat This field is not populated when the SecurityResult appears in a detection. old_value Current status of the threat This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['threatVerdict']['description'] new_value GCTI threat verdict on the security result entity. This field is not populated when the SecurityResult appears in a detection. old_value GCTI threat verdict on the security result entity. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['urlBackToProduct']['description'] new_value URL that takes the user to the source product console for this event. This field is not populated when the SecurityResult appears in a detection. old_value URL that takes the user to the source product console for this event. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['variables']['description'] new_value A list of outcomes and match variables that represent the results of this security finding. This list represents a mapping of names of the requested outcomes or match variables, to their values. This is only populated when the SecurityResult appears in a detection. old_value A list of outcomes and match variables that represent the results of this security finding. This list represents a mapping of names of the requested outcomes or match variables, to their values. This is only populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['verdictInfo']['description'] new_value Verdict information about the IoC from the provider. This field is not populated when the SecurityResult appears in a detection. old_value Verdict information about the IoC from the provider. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
prod/autofill-	values_changed root['revision'] new_value 20250511 old_value 20250507
prod/autofill-v1	values_changed root['revision'] new_value 20250511 old_value 20250507
prod/autopush-notifications-pa.sandbox-	dictionary_item_added root['schemas']['GoogleLogsTapandpayAndroid__TransitHceSessionEvent']['properties']['provisioningAndroidProfileOrigin'] values_changed root['revision'] new_value 20250512 old_value 20250510 root['schemas']['GoogleLogsTapandpayAndroid__TransitHceSessionEvent']['description'] new_value Event related to communication over NFC using close loop transit tap. Next id: 34 old_value Event related to communication over NFC using close loop transit tap. Next id: 33 iterable_item_added root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enum'][442] CONTENT_EXPLORATION_SFV root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enumDescriptions'][442] For exploring new short video content. go/discover-exploration-dd。
prod/autopush-notifications-pa.sandbox-v1	dictionary_item_added root['schemas']['GoogleLogsTapandpayAndroid__TransitHceSessionEvent']['properties']['provisioningAndroidProfileOrigin'] values_changed root['revision'] new_value 20250512 old_value 20250510 root['schemas']['GoogleLogsTapandpayAndroid__TransitHceSessionEvent']['description'] new_value Event related to communication over NFC using close loop transit tap. Next id: 34 old_value Event related to communication over NFC using close loop transit tap. Next id: 33 iterable_item_added root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enum'][442] CONTENT_EXPLORATION_SFV root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enumDescriptions'][442] For exploring new short video content. go/discover-exploration-dd。
prod/autopush-proddata-notifications-pa.sandbox-	dictionary_item_added root['schemas']['GoogleLogsTapandpayAndroid__TransitHceSessionEvent']['properties']['provisioningAndroidProfileOrigin'] values_changed root['revision'] new_value 20250512 old_value 20250510 root['schemas']['GoogleLogsTapandpayAndroid__TransitHceSessionEvent']['description'] new_value Event related to communication over NFC using close loop transit tap. Next id: 34 old_value Event related to communication over NFC using close loop transit tap. Next id: 33 iterable_item_added root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enum'][442] CONTENT_EXPLORATION_SFV root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enumDescriptions'][442] For exploring new short video content. go/discover-exploration-dd。
prod/autopush-proddata-notifications-pa.sandbox-v1	dictionary_item_added root['schemas']['GoogleLogsTapandpayAndroid__TransitHceSessionEvent']['properties']['provisioningAndroidProfileOrigin'] values_changed root['revision'] new_value 20250512 old_value 20250510 root['schemas']['GoogleLogsTapandpayAndroid__TransitHceSessionEvent']['description'] new_value Event related to communication over NFC using close loop transit tap. Next id: 34 old_value Event related to communication over NFC using close loop transit tap. Next id: 33 iterable_item_added root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enum'][442] CONTENT_EXPLORATION_SFV root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enumDescriptions'][442] For exploring new short video content. go/discover-exploration-dd。
prod/autopush-qual-playground-notifications-pa.sandbox-	dictionary_item_added root['schemas']['GoogleLogsTapandpayAndroid__TransitHceSessionEvent']['properties']['provisioningAndroidProfileOrigin'] values_changed root['revision'] new_value 20250512 old_value 20250510 root['schemas']['GoogleLogsTapandpayAndroid__TransitHceSessionEvent']['description'] new_value Event related to communication over NFC using close loop transit tap. Next id: 34 old_value Event related to communication over NFC using close loop transit tap. Next id: 33 iterable_item_added root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enum'][442] CONTENT_EXPLORATION_SFV root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enumDescriptions'][442] For exploring new short video content. go/discover-exploration-dd。
prod/autopush-qual-playground-notifications-pa.sandbox-v1	dictionary_item_added root['schemas']['GoogleLogsTapandpayAndroid__TransitHceSessionEvent']['properties']['provisioningAndroidProfileOrigin'] values_changed root['revision'] new_value 20250512 old_value 20250510 root['schemas']['GoogleLogsTapandpayAndroid__TransitHceSessionEvent']['description'] new_value Event related to communication over NFC using close loop transit tap. Next id: 34 old_value Event related to communication over NFC using close loop transit tap. Next id: 33 iterable_item_added root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enum'][442] CONTENT_EXPLORATION_SFV root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enumDescriptions'][442] For exploring new short video content. go/discover-exploration-dd。
prod/bifrost-echo-c2p-	values_changed root['revision'] new_value 20250506 old_value 20250107
prod/bifrost-echo-c2p-v1	values_changed root['revision'] new_value 20250506 old_value 20250429
prod/btx-pa-	values_changed root['revision'] new_value 20250511 old_value 20250508
prod/btx-pa-v1	values_changed root['revision'] new_value 20250511 old_value 20250508
prod/buildeventservice-	values_changed root['revision'] new_value 20250509 old_value 20250506
prod/buildeventservice-v1	values_changed root['revision'] new_value 20250509 old_value 20250506
prod/carddav-	values_changed root['revision'] new_value 20250511 old_value 20250507
prod/carddav-v1	values_changed root['revision'] new_value 20250511 old_value 20250507
prod/carestudio-	values_changed root['revision'] new_value 20250509 old_value 20250502
prod/carestudio-v1	values_changed root['revision'] new_value 20250509 old_value 20250502
prod/chromedevicetoken-	values_changed root['revision'] new_value 20250511 old_value 20250507
prod/chromedevicetoken-v1	values_changed root['revision'] new_value 20250511 old_value 20250507
prod/cloudaicompanion-v1	dictionary_item_added root['schemas']['GeminiGcpEnablementSetting']['properties']['disableWebGrounding'] values_changed root['revision'] new_value 20250511 old_value 20250504
prod/cloudaicompanion-v1alpha	values_changed root['revision'] new_value 20250511 old_value 20250504
prod/cloudaicompanion-v1beta	values_changed root['revision'] new_value 20250511 old_value 20250504
prod/cloudbi-pa-	values_changed root['revision'] new_value 20250509 old_value 20250507
prod/cloudbi-pa-v1	values_changed root['revision'] new_value 20250509 old_value 20250507
prod/cloudchannel-pa-	values_changed root['revision'] new_value 20250510 old_value 20250506
prod/cloudchannel-pa-v1	values_changed root['revision'] new_value 20250510 old_value 20250506
prod/cloudchannel-pa-v1alpha1	values_changed root['revision'] new_value 20250510 old_value 20250506
prod/cloudchannel-pa-v2	values_changed root['revision'] new_value 20250510 old_value 20250506
prod/cloudcode-pa-	dictionary_item_added root['schemas']['ConversationInteraction'] root['schemas']['StreamingLatency'] root['schemas']['CodeAssistMetric']['properties']['conversationInteraction'] root['schemas']['ConversationOffered']['properties']['streamingLatency'] root['schemas']['InlineCompletionAccepted']['properties']['responseAcceptedIndex'] root['schemas']['InlineCompletionOffered']['properties']['responseLatency'] root['schemas']['InlineCompletionOffered']['properties']['responseReceivedIndex'] values_changed root['revision'] new_value 20250511 old_value 20250504 root['schemas']['InlineCompletionAccepted']['properties']['responseLines']['description'] new_value Optional. The number of lines in the response. old_value The number of lines in the response. root['schemas']['InlineCompletionAccepted']['properties']['responseSize']['description'] new_value Optional. The size of the response (character count). old_value The size of the response (character count). root['schemas']['InlineCompletionOffered']['properties']['completionMethod']['description'] new_value Optional. The completion method used. old_value The completion method used. root['schemas']['InlineCompletionOffered']['properties']['displayLength']['description'] new_value Optional. How long the response was displayed to the user. old_value How long the response was displayed to the user. iterable_item_added root['schemas']['File']['properties']['includedReason']['enum'][10] CHAT_SUGGESTED_EDIT root['schemas']['File']['properties']['includedReason']['enum'][11] CHAT_FILE_REFERENCED root['schemas']['File']['properties']['includedReason']['enumDescriptions'][10] The file was included in a structured code edit (WorkspaceChange) in a SYSTEM response earlier in the current chat session. root['schemas']['File']['properties']['includedReason']['enumDescriptions'][11] The file was referenced by a SYSTEM response earlier in the current chat session, but not as a structured code edit (WorkspaceChange).
prod/cloudcode-pa-v1	values_changed root['revision'] new_value 20250511 old_value 20250504
prod/cloudcode-pa-v1internal	dictionary_item_added root['schemas']['ConversationInteraction'] root['schemas']['StreamingLatency'] root['schemas']['CodeAssistMetric']['properties']['conversationInteraction'] root['schemas']['ConversationOffered']['properties']['streamingLatency'] root['schemas']['InlineCompletionAccepted']['properties']['responseAcceptedIndex'] root['schemas']['InlineCompletionOffered']['properties']['responseLatency'] root['schemas']['InlineCompletionOffered']['properties']['responseReceivedIndex'] values_changed root['revision'] new_value 20250511 old_value 20250504 root['schemas']['InlineCompletionAccepted']['properties']['responseLines']['description'] new_value Optional. The number of lines in the response. old_value The number of lines in the response. root['schemas']['InlineCompletionAccepted']['properties']['responseSize']['description'] new_value Optional. The size of the response (character count). old_value The size of the response (character count). root['schemas']['InlineCompletionOffered']['properties']['completionMethod']['description'] new_value Optional. The completion method used. old_value The completion method used. root['schemas']['InlineCompletionOffered']['properties']['displayLength']['description'] new_value Optional. How long the response was displayed to the user. old_value How long the response was displayed to the user. iterable_item_added root['schemas']['File']['properties']['includedReason']['enum'][10] CHAT_SUGGESTED_EDIT root['schemas']['File']['properties']['includedReason']['enum'][11] CHAT_FILE_REFERENCED root['schemas']['File']['properties']['includedReason']['enumDescriptions'][10] The file was included in a structured code edit (WorkspaceChange) in a SYSTEM response earlier in the current chat session. root['schemas']['File']['properties']['includedReason']['enumDescriptions'][11] The file was referenced by a SYSTEM response earlier in the current chat session, but not as a structured code edit (WorkspaceChange).
prod/cloudmarketplace-	dictionary_item_added root['schemas']['BluebirdLiveModePrivacyNoticeTextDetails'] root['schemas']['BluebirdTextModePrivacyNoticeTextDetails'] root['schemas']['DataAccessTokenProto']['properties']['thinmint']['description'] root['schemas']['TextDetails']['properties']['bluebirdLiveModePrivacyNoticeTextDetails'] root['schemas']['TextDetails']['properties']['bluebirdTextModePrivacyNoticeTextDetails'] values_changed root['revision'] new_value 20250510 old_value 20250422 root['schemas']['TextDetails']['description'] new_value Next Id: 80 old_value Next Id: 78 iterable_item_added root['schemas']['UiContext']['properties']['contextId']['enum'][69] BLUEBIRD_LIVE_MODE_PRIVACY_NOTICE_CONSENT_SCREEN root['schemas']['UiContext']['properties']['contextId']['enum'][70] BLUEBIRD_TEXT_MODE_PRIVACY_NOTICE_CONSENT_SCREEN root['schemas']['UiContext']['properties']['contextId']['enum'][247] FITBIT_ANDROID_PHL_SUMMARIZATION_LAB_OFFBOARDING root['schemas']['UiContext']['properties']['contextId']['enum'][260] FITBIT_ANDROID_SYMPTOM_CHECKER_LAB_ONBOARDING root['schemas']['UiContext']['properties']['contextId']['enum'][261] FITBIT_ANDROID_SYMPTOM_CHECKER_LAB_OFFBOARDING root['schemas']['UiContext']['properties']['contextId']['enum'][264] FITBIT_ANDROID_UNUSUAL_TRENDS_LAB_ONBOARDING root['schemas']['UiContext']['properties']['contextId']['enum'][265] FITBIT_ANDROID_UNUSUAL_TRENDS_LAB_OFFBOARDING root['schemas']['UiContext']['properties']['contextId']['enum'][589] LABS_MARINER_WEB_SETTINGS_CHANGE root['schemas']['UiContext']['properties']['contextId']['enum'][890] PLAY_CONSOLE_WEB_HATS_SURVEY root['schemas']['UiContext']['properties']['contextId']['enum'][918] PLAY_GAMES_SERVICES_UNIFIED_GAMING_CONSENT_FLOW root['schemas']['UiContext']['properties']['contextId']['enumDescriptions'][69] Bluebird live mode privacy notice screen. root['schemas']['UiContext']['properties']['contextId']['enumDescriptions'][70] Bluebird text mode privacy notice screen. root['schemas']['UiContext']['properties']['contextId']['enumDescriptions'][246] Fitbit PHR Summarization Lab on Fitbit Android Onboarding flow. root['schemas']['UiContext']['properties']['contextId']['enumDescriptions'][247] Fitbit PHR Summarization Lab on Fitbit Android Offboarding flow. root['schemas']['UiContext']['properties']['contextId']['enumDescriptions'][264] Onboard to unusual trends on Fitbit Android (http://shortn/_d4f23V0irn). root['schemas']['UiContext']['properties']['contextId']['enumDescriptions'][265] Offboard from unusual trends on Fitbit Android (http://shortn/_d4f23V0irn). root['schemas']['UiContext']['properties']['contextId']['enumDescriptions'][589] User has changed the Mariner settings. root['schemas']['UiContext']['properties']['contextId']['enumDescriptions'][890] HATS survey in Play Console Web. root['schemas']['UiContext']['properties']['contextId']['enumDescriptions'][918] Play Unified gaming platform consent flow. See mock: https://screenshot.googleplex.com/4qK4TeRduBybot4. iterable_item_removed root['schemas']['UiContext']['properties']['contextId']['enumDescriptions'][244] Fitbit PHR Summarization Lab on Fitbit Android.
prod/cloudmarketplaceadmin-v1test	values_changed root['revision'] new_value 20250510 old_value 20250422
prod/cloudmarketplacepartner-v2test	values_changed root['revision'] new_value 20250510 old_value 20250422
prod/cloudprivatecatalog-	values_changed root['revision'] new_value 20250511 old_value 20250504
prod/cloudprivatecatalog-v1	values_changed root['revision'] new_value 20250511 old_value 20250504
prod/cloudprivatecatalog-v1alpha1	values_changed root['revision'] new_value 20250511 old_value 20250504
prod/cloudprivatecatalog-v1beta1	values_changed root['revision'] new_value 20250511 old_value 20250504
prod/cloudprivatecatalogproducer-	values_changed root['revision'] new_value 20250511 old_value 20250504
prod/cloudprivatecatalogproducer-v1	values_changed root['revision'] new_value 20250511 old_value 20250504
prod/cloudprivatecatalogproducer-v1beta1	values_changed root['revision'] new_value 20250511 old_value 20250504
prod/cloudrecommendations-	values_changed root['revision'] new_value 20250509 old_value 20250507
prod/cloudrecommendations-v1	values_changed root['revision'] new_value 20250509 old_value 20250507
prod/commerceproducer-	values_changed root['revision'] new_value 20250507 old_value 20250430
prod/commerceproducer-v1alpha	values_changed root['revision'] new_value 20250507 old_value 20250430
prod/connectgateway-	values_changed root['revision'] new_value 20250425 old_value 20250502
prod/connectgateway-v1	values_changed root['revision'] new_value 20250425 old_value 20250502
prod/connectgateway-v1beta1	values_changed root['revision'] new_value 20250425 old_value 20250502
prod/content-autofill-	values_changed root['revision'] new_value 20250511 old_value 20250507
prod/content-autofill-v1	values_changed root['revision'] new_value 20250511 old_value 20250507
prod/content-cloudchannel-pa-	values_changed root['revision'] new_value 20250510 old_value 20250506
prod/content-cloudchannel-pa-v1	values_changed root['revision'] new_value 20250510 old_value 20250506
prod/content-cloudchannel-pa-v1alpha1	values_changed root['revision'] new_value 20250510 old_value 20250506
prod/content-cloudchannel-pa-v2	values_changed root['revision'] new_value 20250510 old_value 20250506
prod/content-daily-cloudsearch-	values_changed root['revision'] new_value 20250512 old_value 20250510
prod/content-daily-cloudsearch-v1	values_changed root['revision'] new_value 20250512 old_value 20250510
prod/content-fit-	values_changed root['revision'] new_value 20250511 old_value 20250508
prod/content-fit-v2beta1	values_changed root['revision'] new_value 20250511 old_value 20250508
prod/content-quantum-	values_changed root['revision'] new_value 20250511 old_value 20250508
prod/content-quantum-v1alpha1	values_changed root['revision'] new_value 20250511 old_value 20250508
prod/content-resultstore-	values_changed root['revision'] new_value 20250509 old_value 20250506
prod/content-resultstore-v2	values_changed root['revision'] new_value 20250509 old_value 20250506
prod/content-sourcerepo-pa-	values_changed root['revision'] new_value 20250512 old_value 20250505
prod/content-sourcerepo-pa-v1	values_changed root['revision'] new_value 20250512 old_value 20250505
prod/contrails-	values_changed root['revision'] new_value 20250511 old_value 20250507
prod/contrails-v1	values_changed root['revision'] new_value 20250511 old_value 20250507
prod/contrails-v2	values_changed root['revision'] new_value 20250511 old_value 20250507
prod/corplearning-	values_changed root['revision'] new_value 20250511 old_value 20250508
prod/corplearning-v1	values_changed root['revision'] new_value 20250511 old_value 20250508
prod/cryptauthvault-	values_changed root['revision'] new_value 20250511 old_value 20250504
prod/cryptauthvault-v1	values_changed root['revision'] new_value 20250511 old_value 20250504
prod/daily-cloudsearch-	values_changed root['revision'] new_value 20250512 old_value 20250510
prod/daily-cloudsearch-v1	values_changed root['revision'] new_value 20250512 old_value 20250510
prod/daily-dynamicmail-pa.sandbox-	values_changed root['revision'] new_value 20250512 old_value 20250509
prod/daily-dynamicmail-pa.sandbox-v2	values_changed root['revision'] new_value 20250512 old_value 20250509
prod/dataconnectors-	values_changed root['revision'] new_value 20250109 old_value 20250116
prod/dataconnectors-v1alpha2	values_changed root['revision'] new_value 20250116 old_value 20250109
prod/datamanager-	values_changed root['documentationLink'] new_value https://developers.google.com/data-manager old_value https://developers.google.com/audience-partner/api/docs/start root['revision'] new_value 20250511 old_value 20250507
prod/datamanager-v1	values_changed root['documentationLink'] new_value https://developers.google.com/data-manager old_value https://developers.google.com/audience-partner/api/docs/start root['revision'] new_value 20250511 old_value 20250507
prod/developerscontentsearch-pa-	values_changed root['revision'] new_value 20250511 old_value 20250508
prod/developerscontentsearch-pa-v1	values_changed root['revision'] new_value 20250511 old_value 20250508
prod/directions-pa-	values_changed root['revision'] new_value 20250511 old_value 20250507
prod/directions-pa-v1	values_changed root['revision'] new_value 20250511 old_value 20250507
prod/directions-pa-v1alpha	values_changed root['revision'] new_value 20250511 old_value 20250507
prod/dynamiteintegration-pa-	dictionary_item_added root['schemas']['ActionCardDetails']['properties']['itemsCount'] values_changed root['revision'] new_value 20250508 old_value 20250504 iterable_item_added root['schemas']['DuetAiActionStaticPlanData']['properties']['generateUseCase']['enum'][51] REFINE_FORMATTING root['schemas']['DuetAiActionStaticPlanData']['properties']['generateUseCase']['enum'][96] DEPTH_GUIDED_EDIT_IMAGE
prod/dynamiteintegration-pa-v1	dictionary_item_added root['schemas']['ActionCardDetails']['properties']['itemsCount'] values_changed root['revision'] new_value 20250508 old_value 20250504 iterable_item_added root['schemas']['DuetAiActionStaticPlanData']['properties']['generateUseCase']['enum'][51] REFINE_FORMATTING root['schemas']['DuetAiActionStaticPlanData']['properties']['generateUseCase']['enum'][96] DEPTH_GUIDED_EDIT_IMAGE
prod/embeddedassistant-	values_changed root['revision'] new_value 20250512 old_value 20250508
prod/embeddedassistant-v1	values_changed root['revision'] new_value 20250512 old_value 20250508
prod/embeddedassistant-v1alpha2	values_changed root['revision'] new_value 20250512 old_value 20250508
prod/embeddedassistant-v1beta1	values_changed root['revision'] new_value 20250512 old_value 20250508
prod/emmapplecodevice-	values_changed root['revision'] new_value 20250511 old_value 20250506
prod/eu-rbmopenmaap-	values_changed root['revision'] new_value 20250512 old_value 20250506
prod/eu-rbmopenmaap-v1	values_changed root['revision'] new_value 20250512 old_value 20250506
prod/europe-west3-chronicle-	dictionary_item_added root['schemas']['ThreatCollectionItem'] root['schemas']['SecurityResult']['properties']['threatCollections'] root['schemas']['SecurityResult']['properties']['campaigns']['deprecated'] root['schemas']['SecurityResult']['properties']['reports']['deprecated'] values_changed root['revision'] new_value 20250508 old_value 20250505 root['schemas']['SecurityResult']['properties']['about']['description'] new_value If the security result is about a specific entity (Noun), add it here. This field is not populated when the SecurityResult appears in a detection. old_value If the security result is about a specific entity (Noun), add it here. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['action']['description'] new_value Actions taken for this event. This field is not populated when the SecurityResult appears in a detection. old_value Actions taken for this event. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['actionDetails']['description'] new_value The detail of the action taken as provided by the vendor. This field is not populated when the SecurityResult appears in a detection. old_value The detail of the action taken as provided by the vendor. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['analyticsMetadata']['description'] new_value Stores metadata about each risk analytic metric the rule uses. This field is not populated when the SecurityResult appears in a detection. old_value Stores metadata about each risk analytic metric the rule uses. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['associations']['description'] new_value Associations related to the threat. old_value Associations related to the threat. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['attackDetails']['description'] new_value MITRE ATT&CK details. This field is not populated when the SecurityResult appears in a detection. old_value MITRE ATT&CK details. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['campaigns']['description'] new_value Campaigns using this IOC threat. This is deprecated. Use threat_collections instead. old_value Campaigns using this IOC threat. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['category']['description'] new_value The security category. This field is not populated when the SecurityResult appears in a detection. old_value The security category. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['categoryDetails']['description'] new_value For vendor-specific categories. For web categorization, put type in here such as "gambling" or "porn". This field is not populated when the SecurityResult appears in a detection. old_value For vendor-specific categories. For web categorization, put type in here such as "gambling" or "porn". This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['confidence']['description'] new_value The confidence level of the result as estimated by the product. This field is not populated when the SecurityResult appears in a detection. old_value The confidence level of the result as estimated by the product. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['confidenceDetails']['description'] new_value Additional detail with regards to the confidence of a security event as estimated by the product vendor. This field is not populated when the SecurityResult appears in a detection. old_value Additional detail with regards to the confidence of a security event as estimated by the product vendor. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['confidenceScore']['description'] new_value The confidence score of the security result. This field is not populated when the SecurityResult appears in a detection. old_value The confidence score of the security result. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['detectionFields']['description'] new_value An ordered list of values, that represent fields in detections for a security finding. This list represents mapping of names of requested entities to their values (the security result matched variables). This is only populated when the SecurityResult appears in a detection. old_value An ordered list of values, that represent fields in detections for a security finding. This list represents mapping of names of requested entities to their values (the security result matched variables). This is only populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['firstDiscoveredTime']['description'] new_value First time the IoC threat was discovered in the provider. This field is not populated when the SecurityResult appears in a detection. old_value First time the IoC threat was discovered in the provider. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['lastDiscoveredTime']['description'] new_value Last time the IoC was seen in the provider data. This field is not populated when the SecurityResult appears in a detection. old_value Last time the IoC was seen in the provider data. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['lastUpdatedTime']['description'] new_value Last time the IoC threat was updated in the provider. This field is not populated when the SecurityResult appears in a detection. old_value Last time the IoC threat was updated in the provider. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['outcomes']['description'] new_value A list of outcomes that represent the results of this security finding. This list represents a mapping of names of the requested outcomes, to a stringified version of their values. This is only populated when the SecurityResult appears in a detection. old_value A list of outcomes that represent the results of this security finding. This list represents a mapping of names of the requested outcomes, to a stringified version of their values. This is only populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['priority']['description'] new_value The priority of the result. This field is not populated when the SecurityResult appears in a detection. old_value The priority of the result. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['priorityDetails']['description'] new_value Vendor-specific information about the security result priority. This field is not populated when the SecurityResult appears in a detection. old_value Vendor-specific information about the security result priority. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['reports']['description'] new_value Reports that reference this IOC threat. These are the report IDs. This is deprecated. Use threat_collections instead. old_value Reports that reference this IOC threat. These are the report IDs. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['ruleAuthor']['description'] new_value Author of the security rule. This field is not populated when the SecurityResult appears in a detection. old_value Author of the security rule. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['severityDetails']['description'] new_value Vendor-specific severity. This field is not populated when the SecurityResult appears in a detection. old_value Vendor-specific severity. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['threatFeedName']['description'] new_value Vendor feed name for a threat indicator feed. This field is not populated when the SecurityResult appears in a detection. old_value Vendor feed name for a threat indicator feed. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['threatId']['description'] new_value Vendor-specific ID for a threat. This field is not populated when the SecurityResult appears in a detection. old_value Vendor-specific ID for a threat. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['threatIdNamespace']['description'] new_value The attribute threat_id_namespace qualifies threat_id with an id namespace to get an unique id. The attribute threat_id by itself is not unique across Chronicle as it is a vendor specific id. This field is not populated when the SecurityResult appears in a detection. old_value The attribute threat_id_namespace qualifies threat_id with an id namespace to get an unique id. The attribute threat_id by itself is not unique across Chronicle as it is a vendor specific id. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['threatName']['description'] new_value A vendor-assigned classification common across multiple customers (for example, "W32/File-A", "Slammer"). This field is not populated when the SecurityResult appears in a detection. old_value A vendor-assigned classification common across multiple customers (for example, "W32/File-A", "Slammer"). This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['threatStatus']['description'] new_value Current status of the threat This field is not populated when the SecurityResult appears in a detection. old_value Current status of the threat This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['threatVerdict']['description'] new_value GCTI threat verdict on the security result entity. This field is not populated when the SecurityResult appears in a detection. old_value GCTI threat verdict on the security result entity. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['urlBackToProduct']['description'] new_value URL that takes the user to the source product console for this event. This field is not populated when the SecurityResult appears in a detection. old_value URL that takes the user to the source product console for this event. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['variables']['description'] new_value A list of outcomes and match variables that represent the results of this security finding. This list represents a mapping of names of the requested outcomes or match variables, to their values. This is only populated when the SecurityResult appears in a detection. old_value A list of outcomes and match variables that represent the results of this security finding. This list represents a mapping of names of the requested outcomes or match variables, to their values. This is only populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['verdictInfo']['description'] new_value Verdict information about the IoC from the provider. This field is not populated when the SecurityResult appears in a detection. old_value Verdict information about the IoC from the provider. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
prod/europe-west3-chronicle-v1	dictionary_item_added root['schemas']['ThreatCollectionItem'] root['schemas']['SecurityResult']['properties']['threatCollections'] root['schemas']['SecurityResult']['properties']['campaigns']['deprecated'] root['schemas']['SecurityResult']['properties']['reports']['deprecated'] values_changed root['revision'] new_value 20250508 old_value 20250505 root['schemas']['SecurityResult']['properties']['about']['description'] new_value If the security result is about a specific entity (Noun), add it here. This field is not populated when the SecurityResult appears in a detection. old_value If the security result is about a specific entity (Noun), add it here. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['action']['description'] new_value Actions taken for this event. This field is not populated when the SecurityResult appears in a detection. old_value Actions taken for this event. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['actionDetails']['description'] new_value The detail of the action taken as provided by the vendor. This field is not populated when the SecurityResult appears in a detection. old_value The detail of the action taken as provided by the vendor. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['analyticsMetadata']['description'] new_value Stores metadata about each risk analytic metric the rule uses. This field is not populated when the SecurityResult appears in a detection. old_value Stores metadata about each risk analytic metric the rule uses. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['associations']['description'] new_value Associations related to the threat. old_value Associations related to the threat. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['attackDetails']['description'] new_value MITRE ATT&CK details. This field is not populated when the SecurityResult appears in a detection. old_value MITRE ATT&CK details. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['campaigns']['description'] new_value Campaigns using this IOC threat. This is deprecated. Use threat_collections instead. old_value Campaigns using this IOC threat. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['category']['description'] new_value The security category. This field is not populated when the SecurityResult appears in a detection. old_value The security category. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['categoryDetails']['description'] new_value For vendor-specific categories. For web categorization, put type in here such as "gambling" or "porn". This field is not populated when the SecurityResult appears in a detection. old_value For vendor-specific categories. For web categorization, put type in here such as "gambling" or "porn". This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['confidence']['description'] new_value The confidence level of the result as estimated by the product. This field is not populated when the SecurityResult appears in a detection. old_value The confidence level of the result as estimated by the product. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['confidenceDetails']['description'] new_value Additional detail with regards to the confidence of a security event as estimated by the product vendor. This field is not populated when the SecurityResult appears in a detection. old_value Additional detail with regards to the confidence of a security event as estimated by the product vendor. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['confidenceScore']['description'] new_value The confidence score of the security result. This field is not populated when the SecurityResult appears in a detection. old_value The confidence score of the security result. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['detectionFields']['description'] new_value An ordered list of values, that represent fields in detections for a security finding. This list represents mapping of names of requested entities to their values (the security result matched variables). This is only populated when the SecurityResult appears in a detection. old_value An ordered list of values, that represent fields in detections for a security finding. This list represents mapping of names of requested entities to their values (the security result matched variables). This is only populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['firstDiscoveredTime']['description'] new_value First time the IoC threat was discovered in the provider. This field is not populated when the SecurityResult appears in a detection. old_value First time the IoC threat was discovered in the provider. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['lastDiscoveredTime']['description'] new_value Last time the IoC was seen in the provider data. This field is not populated when the SecurityResult appears in a detection. old_value Last time the IoC was seen in the provider data. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['lastUpdatedTime']['description'] new_value Last time the IoC threat was updated in the provider. This field is not populated when the SecurityResult appears in a detection. old_value Last time the IoC threat was updated in the provider. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['outcomes']['description'] new_value A list of outcomes that represent the results of this security finding. This list represents a mapping of names of the requested outcomes, to a stringified version of their values. This is only populated when the SecurityResult appears in a detection. old_value A list of outcomes that represent the results of this security finding. This list represents a mapping of names of the requested outcomes, to a stringified version of their values. This is only populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['priority']['description'] new_value The priority of the result. This field is not populated when the SecurityResult appears in a detection. old_value The priority of the result. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['priorityDetails']['description'] new_value Vendor-specific information about the security result priority. This field is not populated when the SecurityResult appears in a detection. old_value Vendor-specific information about the security result priority. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['reports']['description'] new_value Reports that reference this IOC threat. These are the report IDs. This is deprecated. Use threat_collections instead. old_value Reports that reference this IOC threat. These are the report IDs. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['ruleAuthor']['description'] new_value Author of the security rule. This field is not populated when the SecurityResult appears in a detection. old_value Author of the security rule. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['severityDetails']['description'] new_value Vendor-specific severity. This field is not populated when the SecurityResult appears in a detection. old_value Vendor-specific severity. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['threatFeedName']['description'] new_value Vendor feed name for a threat indicator feed. This field is not populated when the SecurityResult appears in a detection. old_value Vendor feed name for a threat indicator feed. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['threatId']['description'] new_value Vendor-specific ID for a threat. This field is not populated when the SecurityResult appears in a detection. old_value Vendor-specific ID for a threat. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['threatIdNamespace']['description'] new_value The attribute threat_id_namespace qualifies threat_id with an id namespace to get an unique id. The attribute threat_id by itself is not unique across Chronicle as it is a vendor specific id. This field is not populated when the SecurityResult appears in a detection. old_value The attribute threat_id_namespace qualifies threat_id with an id namespace to get an unique id. The attribute threat_id by itself is not unique across Chronicle as it is a vendor specific id. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['threatName']['description'] new_value A vendor-assigned classification common across multiple customers (for example, "W32/File-A", "Slammer"). This field is not populated when the SecurityResult appears in a detection. old_value A vendor-assigned classification common across multiple customers (for example, "W32/File-A", "Slammer"). This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['threatStatus']['description'] new_value Current status of the threat This field is not populated when the SecurityResult appears in a detection. old_value Current status of the threat This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['threatVerdict']['description'] new_value GCTI threat verdict on the security result entity. This field is not populated when the SecurityResult appears in a detection. old_value GCTI threat verdict on the security result entity. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['urlBackToProduct']['description'] new_value URL that takes the user to the source product console for this event. This field is not populated when the SecurityResult appears in a detection. old_value URL that takes the user to the source product console for this event. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['variables']['description'] new_value A list of outcomes and match variables that represent the results of this security finding. This list represents a mapping of names of the requested outcomes or match variables, to their values. This is only populated when the SecurityResult appears in a detection. old_value A list of outcomes and match variables that represent the results of this security finding. This list represents a mapping of names of the requested outcomes or match variables, to their values. This is only populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['verdictInfo']['description'] new_value Verdict information about the IoC from the provider. This field is not populated when the SecurityResult appears in a detection. old_value Verdict information about the IoC from the provider. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
prod/europe-west3-chronicle-v1alpha	dictionary_item_added root['resources']['projects']['resources']['locations']['resources']['instances']['resources']['dataTables']['resources']['dataTableRows']['methods']['list']['parameters']['filter'] root['schemas']['FileMetadataCodesignProvenance'] root['schemas']['FileMetadataImportsProvenance'] root['schemas']['FileMetadataPeResourceInfoProvenance'] root['schemas']['FileMetadataSectionProvenance'] root['schemas']['FileMetadataSignatureInfoProvenance'] root['schemas']['PeFileMetadataProvenance'] root['schemas']['SignerInfoProvenance'] root['schemas']['StringToInt64MapEntryProvenance'] root['schemas']['ThreatCollectionItem'] root['schemas']['X509Provenance'] root['schemas']['EventSample']['properties']['joinedDataTableRows'] root['schemas']['FieldProvenance']['properties']['nonlogSource'] root['schemas']['FileMetadataProvenance']['properties']['pe'] root['schemas']['GoogleCloudChronicleV1alphaLegacyFetchUdmSearchViewResponseStatsColumnMetadata']['properties']['latitude'] root['schemas']['GoogleCloudChronicleV1alphaLegacyFetchUdmSearchViewResponseStatsColumnMetadata']['properties']['longitude'] root['schemas']['SecurityResult']['properties']['threatCollections'] root['schemas']['SecurityResult']['properties']['campaigns']['deprecated'] root['schemas']['SecurityResult']['properties']['reports']['deprecated'] root['schemas']['UiPreferences']['properties']['enableLabs'] root['schemas']['ValueMetadata']['properties']['timestampVal'] values_changed root['revision'] new_value 20250508 old_value 20250505 root['schemas']['ExifInfoProvenance']['properties'] new_value company $ref FieldProvenance compilationTime $ref FieldProvenance entryPoint $ref FieldProvenance fileDescription $ref FieldProvenance originalFile $ref FieldProvenance product $ref FieldProvenance old_value root['schemas']['FaviconProvenance']['properties'] new_value dhash $ref FieldProvenance rawMd5 $ref FieldProvenance old_value root['schemas']['FileMetadataPEProvenance']['properties'] new_value compilationExiftoolTime $ref FieldProvenance compilationTime $ref FieldProvenance entryPoint $ref FieldProvenance entryPointExiftool $ref FieldProvenance imphash $ref FieldProvenance imports items $ref FileMetadataImportsProvenance type array resource items $ref FileMetadataPeResourceInfoProvenance type array resourcesLanguageCount deprecated True items $ref StringToInt64MapEntryProvenance type array resourcesLanguageCountStr items $ref LabelProvenance type array resourcesTypeCount deprecated True items $ref StringToInt64MapEntryProvenance type array resourcesTypeCountStr items $ref LabelProvenance type array section items $ref FileMetadataSectionProvenance type array signatureInfo $ref FileMetadataSignatureInfoProvenance deprecated True old_value root['schemas']['NtfsFileMetadataProvenance']['properties'] new_value changeTime $ref FieldProvenance filenameAccessTime $ref FieldProvenance filenameChangeTime $ref FieldProvenance filenameCreateTime $ref FieldProvenance filenameModifyTime $ref FieldProvenance old_value root['schemas']['PDFInfoProvenance']['properties'] new_value acroform $ref FieldProvenance autoaction $ref FieldProvenance embeddedFile $ref FieldProvenance encrypted $ref FieldProvenance endobjCount $ref FieldProvenance endstreamCount $ref FieldProvenance flash $ref FieldProvenance header $ref FieldProvenance javascript $ref FieldProvenance jbig2Compression $ref FieldProvenance js $ref FieldProvenance launchActionCount $ref FieldProvenance objCount $ref FieldProvenance objectStreamCount $ref FieldProvenance openaction $ref FieldProvenance pageCount $ref FieldProvenance startxref $ref FieldProvenance streamCount $ref FieldProvenance suspiciousColors $ref FieldProvenance trailer $ref FieldProvenance xfa $ref FieldProvenance xref $ref FieldProvenance old_value root['schemas']['PrevalenceProvenance']['properties'] new_value dayCount $ref FieldProvenance dayMax $ref FieldProvenance dayMaxSubDomains $ref FieldProvenance rollingMax $ref FieldProvenance rollingMaxSubDomains $ref FieldProvenance old_value root['schemas']['SecurityResult']['properties']['about']['description'] new_value If the security result is about a specific entity (Noun), add it here. This field is not populated when the SecurityResult appears in a detection. old_value If the security result is about a specific entity (Noun), add it here. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['action']['description'] new_value Actions taken for this event. This field is not populated when the SecurityResult appears in a detection. old_value Actions taken for this event. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['actionDetails']['description'] new_value The detail of the action taken as provided by the vendor. This field is not populated when the SecurityResult appears in a detection. old_value The detail of the action taken as provided by the vendor. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['analyticsMetadata']['description'] new_value Stores metadata about each risk analytic metric the rule uses. This field is not populated when the SecurityResult appears in a detection. old_value Stores metadata about each risk analytic metric the rule uses. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['associations']['description'] new_value Associations related to the threat. old_value Associations related to the threat. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['attackDetails']['description'] new_value MITRE ATT&CK details. This field is not populated when the SecurityResult appears in a detection. old_value MITRE ATT&CK details. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['campaigns']['description'] new_value Campaigns using this IOC threat. This is deprecated. Use threat_collections instead. old_value Campaigns using this IOC threat. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['category']['description'] new_value The security category. This field is not populated when the SecurityResult appears in a detection. old_value The security category. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['categoryDetails']['description'] new_value For vendor-specific categories. For web categorization, put type in here such as "gambling" or "porn". This field is not populated when the SecurityResult appears in a detection. old_value For vendor-specific categories. For web categorization, put type in here such as "gambling" or "porn". This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['confidence']['description'] new_value The confidence level of the result as estimated by the product. This field is not populated when the SecurityResult appears in a detection. old_value The confidence level of the result as estimated by the product. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['confidenceDetails']['description'] new_value Additional detail with regards to the confidence of a security event as estimated by the product vendor. This field is not populated when the SecurityResult appears in a detection. old_value Additional detail with regards to the confidence of a security event as estimated by the product vendor. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['confidenceScore']['description'] new_value The confidence score of the security result. This field is not populated when the SecurityResult appears in a detection. old_value The confidence score of the security result. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['detectionFields']['description'] new_value An ordered list of values, that represent fields in detections for a security finding. This list represents mapping of names of requested entities to their values (the security result matched variables). This is only populated when the SecurityResult appears in a detection. old_value An ordered list of values, that represent fields in detections for a security finding. This list represents mapping of names of requested entities to their values (the security result matched variables). This is only populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['firstDiscoveredTime']['description'] new_value First time the IoC threat was discovered in the provider. This field is not populated when the SecurityResult appears in a detection. old_value First time the IoC threat was discovered in the provider. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['lastDiscoveredTime']['description'] new_value Last time the IoC was seen in the provider data. This field is not populated when the SecurityResult appears in a detection. old_value Last time the IoC was seen in the provider data. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['lastUpdatedTime']['description'] new_value Last time the IoC threat was updated in the provider. This field is not populated when the SecurityResult appears in a detection. old_value Last time the IoC threat was updated in the provider. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['outcomes']['description'] new_value A list of outcomes that represent the results of this security finding. This list represents a mapping of names of the requested outcomes, to a stringified version of their values. This is only populated when the SecurityResult appears in a detection. old_value A list of outcomes that represent the results of this security finding. This list represents a mapping of names of the requested outcomes, to a stringified version of their values. This is only populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['priority']['description'] new_value The priority of the result. This field is not populated when the SecurityResult appears in a detection. old_value The priority of the result. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['priorityDetails']['description'] new_value Vendor-specific information about the security result priority. This field is not populated when the SecurityResult appears in a detection. old_value Vendor-specific information about the security result priority. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['reports']['description'] new_value Reports that reference this IOC threat. These are the report IDs. This is deprecated. Use threat_collections instead. old_value Reports that reference this IOC threat. These are the report IDs. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['ruleAuthor']['description'] new_value Author of the security rule. This field is not populated when the SecurityResult appears in a detection. old_value Author of the security rule. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['severityDetails']['description'] new_value Vendor-specific severity. This field is not populated when the SecurityResult appears in a detection. old_value Vendor-specific severity. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['threatFeedName']['description'] new_value Vendor feed name for a threat indicator feed. This field is not populated when the SecurityResult appears in a detection. old_value Vendor feed name for a threat indicator feed. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['threatId']['description'] new_value Vendor-specific ID for a threat. This field is not populated when the SecurityResult appears in a detection. old_value Vendor-specific ID for a threat. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['threatIdNamespace']['description'] new_value The attribute threat_id_namespace qualifies threat_id with an id namespace to get an unique id. The attribute threat_id by itself is not unique across Chronicle as it is a vendor specific id. This field is not populated when the SecurityResult appears in a detection. old_value The attribute threat_id_namespace qualifies threat_id with an id namespace to get an unique id. The attribute threat_id by itself is not unique across Chronicle as it is a vendor specific id. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['threatName']['description'] new_value A vendor-assigned classification common across multiple customers (for example, "W32/File-A", "Slammer"). This field is not populated when the SecurityResult appears in a detection. old_value A vendor-assigned classification common across multiple customers (for example, "W32/File-A", "Slammer"). This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['threatStatus']['description'] new_value Current status of the threat This field is not populated when the SecurityResult appears in a detection. old_value Current status of the threat This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['threatVerdict']['description'] new_value GCTI threat verdict on the security result entity. This field is not populated when the SecurityResult appears in a detection. old_value GCTI threat verdict on the security result entity. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['urlBackToProduct']['description'] new_value URL that takes the user to the source product console for this event. This field is not populated when the SecurityResult appears in a detection. old_value URL that takes the user to the source product console for this event. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['variables']['description'] new_value A list of outcomes and match variables that represent the results of this security finding. This list represents a mapping of names of the requested outcomes or match variables, to their values. This is only populated when the SecurityResult appears in a detection. old_value A list of outcomes and match variables that represent the results of this security finding. This list represents a mapping of names of the requested outcomes or match variables, to their values. This is only populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['verdictInfo']['description'] new_value Verdict information about the IoC from the provider. This field is not populated when the SecurityResult appears in a detection. old_value Verdict information about the IoC from the provider. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SignatureInfoProvenance']['properties'] new_value codesign $ref FileMetadataCodesignProvenance sigcheck $ref FileMetadataSignatureInfoProvenance old_value iterable_item_added root['schemas']['EdrEvent']['properties']['dataSource']['enum'][28] VECTRA root['schemas']['EdrEvent']['properties']['dataSource']['enum'][29] FORTINET root['schemas']['EnrichmentSource']['properties']['logType']['enum'][130] DOPPEL root['schemas']['EnrichmentSource']['properties']['logType']['enum'][231] TEAMT5_THREATSONAR_EDR root['schemas']['EnrichmentSource']['properties']['logType']['enum'][461] SECURITYBRIDGE_DEV root['schemas']['EnrichmentSource']['properties']['logType']['enum'][808] AZURE_ARCDATA root['schemas']['EnrichmentSource']['properties']['logType']['enum'][809] AZURE_DATAFACTORY root['schemas']['EnrichmentSource']['properties']['logType']['enum'][810] AZURE_DOCUMENTDB root['schemas']['EnrichmentSource']['properties']['logType']['enum'][997] AZURE_AUTHORIZATION root['schemas']['EnrichmentSource']['properties']['logType']['enum'][1275] AZURE_APPCONFIGURATION root['schemas']['EnrichmentSource']['properties']['logType']['enum'][1448] AZURE_APPPLATFORM root['schemas']['EnrichmentSource']['properties']['logType']['enum'][1450] AZURE_CHANGEANALYSIS root['schemas']['EnrichmentSource']['properties']['logType']['enum'][1451] AZURE_EVENTGRID root['schemas']['EnrichmentSource']['properties']['logType']['enum'][1452] AZURE_EVENTHUB root['schemas']['EnrichmentSource']['properties']['logType']['enum'][1453] AZURE_HYBRIDCOMPUTE root['schemas']['EnrichmentSource']['properties']['logType']['enum'][1522] REDMINE root['schemas']['EnrichmentSource']['properties']['logType']['enum'][1538] WORKDAY_USER_SIGNIN root['schemas']['EnrichmentSource']['properties']['logType']['enum'][1810] GCP_DNS_ATD root['schemas']['EnrichmentSource']['properties']['logType']['enum'][1987] GENIAN_NAC root['schemas']['EnrichmentSource']['properties']['logType']['enum'][1988] PENTA_WAPPLES root['schemas']['EnrichmentSource']['properties']['logType']['enum'][1989] S2W_QUAXAR root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][130] DOPPEL root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][231] TEAMT5_THREATSONAR_EDR root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][461] SECURITYBRIDGE_DEV root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][808] AZURE_ARCDATA root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][809] AZURE_DATAFACTORY root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][810] AZURE_DOCUMENTDB root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][997] AZURE_AUTHORIZATION root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][1275] AZURE_APPCONFIGURATION root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][1448] AZURE_APPPLATFORM root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][1450] AZURE_CHANGEANALYSIS root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][1451] AZURE_EVENTGRID root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][1452] AZURE_EVENTHUB root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][1453] AZURE_HYBRIDCOMPUTE root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][1522] REDMINE root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][1538] WORKDAY_USER_SIGNIN root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][1810] GCP_DNS_ATD root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][1987] GENIAN_NAC root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][1988] PENTA_WAPPLES root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][1989] S2W_QUAXAR root['schemas']['RawLog']['properties']['type']['enum'][130] DOPPEL root['schemas']['RawLog']['properties']['type']['enum'][231] TEAMT5_THREATSONAR_EDR root['schemas']['RawLog']['properties']['type']['enum'][461] SECURITYBRIDGE_DEV root['schemas']['RawLog']['properties']['type']['enum'][808] AZURE_ARCDATA root['schemas']['RawLog']['properties']['type']['enum'][809] AZURE_DATAFACTORY root['schemas']['RawLog']['properties']['type']['enum'][810] AZURE_DOCUMENTDB root['schemas']['RawLog']['properties']['type']['enum'][997] AZURE_AUTHORIZATION root['schemas']['RawLog']['properties']['type']['enum'][1275] AZURE_APPCONFIGURATION root['schemas']['RawLog']['properties']['type']['enum'][1448] AZURE_APPPLATFORM root['schemas']['RawLog']['properties']['type']['enum'][1450] AZURE_CHANGEANALYSIS root['schemas']['RawLog']['properties']['type']['enum'][1451] AZURE_EVENTGRID root['schemas']['RawLog']['properties']['type']['enum'][1452] AZURE_EVENTHUB root['schemas']['RawLog']['properties']['type']['enum'][1453] AZURE_HYBRIDCOMPUTE root['schemas']['RawLog']['properties']['type']['enum'][1522] REDMINE root['schemas']['RawLog']['properties']['type']['enum'][1538] WORKDAY_USER_SIGNIN root['schemas']['RawLog']['properties']['type']['enum'][1810] GCP_DNS_ATD root['schemas']['RawLog']['properties']['type']['enum'][1987] GENIAN_NAC root['schemas']['RawLog']['properties']['type']['enum'][1988] PENTA_WAPPLES root['schemas']['RawLog']['properties']['type']['enum'][1989] S2W_QUAXAR root['schemas']['SIEventData']['properties']['rawLogType']['enum'][130] DOPPEL root['schemas']['SIEventData']['properties']['rawLogType']['enum'][231] TEAMT5_THREATSONAR_EDR root['schemas']['SIEventData']['properties']['rawLogType']['enum'][461] SECURITYBRIDGE_DEV root['schemas']['SIEventData']['properties']['rawLogType']['enum'][808] AZURE_ARCDATA root['schemas']['SIEventData']['properties']['rawLogType']['enum'][809] AZURE_DATAFACTORY root['schemas']['SIEventData']['properties']['rawLogType']['enum'][810] AZURE_DOCUMENTDB root['schemas']['SIEventData']['properties']['rawLogType']['enum'][997] AZURE_AUTHORIZATION root['schemas']['SIEventData']['properties']['rawLogType']['enum'][1275] AZURE_APPCONFIGURATION root['schemas']['SIEventData']['properties']['rawLogType']['enum'][1448] AZURE_APPPLATFORM root['schemas']['SIEventData']['properties']['rawLogType']['enum'][1450] AZURE_CHANGEANALYSIS root['schemas']['SIEventData']['properties']['rawLogType']['enum'][1451] AZURE_EVENTGRID root['schemas']['SIEventData']['properties']['rawLogType']['enum'][1452] AZURE_EVENTHUB root['schemas']['SIEventData']['properties']['rawLogType']['enum'][1453] AZURE_HYBRIDCOMPUTE root['schemas']['SIEventData']['properties']['rawLogType']['enum'][1522] REDMINE root['schemas']['SIEventData']['properties']['rawLogType']['enum'][1538] WORKDAY_USER_SIGNIN root['schemas']['SIEventData']['properties']['rawLogType']['enum'][1810] GCP_DNS_ATD root['schemas']['SIEventData']['properties']['rawLogType']['enum'][1987] GENIAN_NAC root['schemas']['SIEventData']['properties']['rawLogType']['enum'][1988] PENTA_WAPPLES root['schemas']['SIEventData']['properties']['rawLogType']['enum'][1989] S2W_QUAXAR
prod/europe-west3-chronicle-v1beta	dictionary_item_added root['schemas']['ThreatCollectionItem'] root['schemas']['SecurityResult']['properties']['threatCollections'] root['schemas']['SecurityResult']['properties']['campaigns']['deprecated'] root['schemas']['SecurityResult']['properties']['reports']['deprecated'] values_changed root['revision'] new_value 20250508 old_value 20250505 root['schemas']['SecurityResult']['properties']['about']['description'] new_value If the security result is about a specific entity (Noun), add it here. This field is not populated when the SecurityResult appears in a detection. old_value If the security result is about a specific entity (Noun), add it here. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['action']['description'] new_value Actions taken for this event. This field is not populated when the SecurityResult appears in a detection. old_value Actions taken for this event. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['actionDetails']['description'] new_value The detail of the action taken as provided by the vendor. This field is not populated when the SecurityResult appears in a detection. old_value The detail of the action taken as provided by the vendor. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['analyticsMetadata']['description'] new_value Stores metadata about each risk analytic metric the rule uses. This field is not populated when the SecurityResult appears in a detection. old_value Stores metadata about each risk analytic metric the rule uses. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['associations']['description'] new_value Associations related to the threat. old_value Associations related to the threat. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['attackDetails']['description'] new_value MITRE ATT&CK details. This field is not populated when the SecurityResult appears in a detection. old_value MITRE ATT&CK details. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['campaigns']['description'] new_value Campaigns using this IOC threat. This is deprecated. Use threat_collections instead. old_value Campaigns using this IOC threat. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['category']['description'] new_value The security category. This field is not populated when the SecurityResult appears in a detection. old_value The security category. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['categoryDetails']['description'] new_value For vendor-specific categories. For web categorization, put type in here such as "gambling" or "porn". This field is not populated when the SecurityResult appears in a detection. old_value For vendor-specific categories. For web categorization, put type in here such as "gambling" or "porn". This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['confidence']['description'] new_value The confidence level of the result as estimated by the product. This field is not populated when the SecurityResult appears in a detection. old_value The confidence level of the result as estimated by the product. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['confidenceDetails']['description'] new_value Additional detail with regards to the confidence of a security event as estimated by the product vendor. This field is not populated when the SecurityResult appears in a detection. old_value Additional detail with regards to the confidence of a security event as estimated by the product vendor. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['confidenceScore']['description'] new_value The confidence score of the security result. This field is not populated when the SecurityResult appears in a detection. old_value The confidence score of the security result. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['detectionFields']['description'] new_value An ordered list of values, that represent fields in detections for a security finding. This list represents mapping of names of requested entities to their values (the security result matched variables). This is only populated when the SecurityResult appears in a detection. old_value An ordered list of values, that represent fields in detections for a security finding. This list represents mapping of names of requested entities to their values (the security result matched variables). This is only populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['firstDiscoveredTime']['description'] new_value First time the IoC threat was discovered in the provider. This field is not populated when the SecurityResult appears in a detection. old_value First time the IoC threat was discovered in the provider. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['lastDiscoveredTime']['description'] new_value Last time the IoC was seen in the provider data. This field is not populated when the SecurityResult appears in a detection. old_value Last time the IoC was seen in the provider data. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['lastUpdatedTime']['description'] new_value Last time the IoC threat was updated in the provider. This field is not populated when the SecurityResult appears in a detection. old_value Last time the IoC threat was updated in the provider. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['outcomes']['description'] new_value A list of outcomes that represent the results of this security finding. This list represents a mapping of names of the requested outcomes, to a stringified version of their values. This is only populated when the SecurityResult appears in a detection. old_value A list of outcomes that represent the results of this security finding. This list represents a mapping of names of the requested outcomes, to a stringified version of their values. This is only populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['priority']['description'] new_value The priority of the result. This field is not populated when the SecurityResult appears in a detection. old_value The priority of the result. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['priorityDetails']['description'] new_value Vendor-specific information about the security result priority. This field is not populated when the SecurityResult appears in a detection. old_value Vendor-specific information about the security result priority. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['reports']['description'] new_value Reports that reference this IOC threat. These are the report IDs. This is deprecated. Use threat_collections instead. old_value Reports that reference this IOC threat. These are the report IDs. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['ruleAuthor']['description'] new_value Author of the security rule. This field is not populated when the SecurityResult appears in a detection. old_value Author of the security rule. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['severityDetails']['description'] new_value Vendor-specific severity. This field is not populated when the SecurityResult appears in a detection. old_value Vendor-specific severity. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['threatFeedName']['description'] new_value Vendor feed name for a threat indicator feed. This field is not populated when the SecurityResult appears in a detection. old_value Vendor feed name for a threat indicator feed. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['threatId']['description'] new_value Vendor-specific ID for a threat. This field is not populated when the SecurityResult appears in a detection. old_value Vendor-specific ID for a threat. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['threatIdNamespace']['description'] new_value The attribute threat_id_namespace qualifies threat_id with an id namespace to get an unique id. The attribute threat_id by itself is not unique across Chronicle as it is a vendor specific id. This field is not populated when the SecurityResult appears in a detection. old_value The attribute threat_id_namespace qualifies threat_id with an id namespace to get an unique id. The attribute threat_id by itself is not unique across Chronicle as it is a vendor specific id. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['threatName']['description'] new_value A vendor-assigned classification common across multiple customers (for example, "W32/File-A", "Slammer"). This field is not populated when the SecurityResult appears in a detection. old_value A vendor-assigned classification common across multiple customers (for example, "W32/File-A", "Slammer"). This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['threatStatus']['description'] new_value Current status of the threat This field is not populated when the SecurityResult appears in a detection. old_value Current status of the threat This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['threatVerdict']['description'] new_value GCTI threat verdict on the security result entity. This field is not populated when the SecurityResult appears in a detection. old_value GCTI threat verdict on the security result entity. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['urlBackToProduct']['description'] new_value URL that takes the user to the source product console for this event. This field is not populated when the SecurityResult appears in a detection. old_value URL that takes the user to the source product console for this event. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['variables']['description'] new_value A list of outcomes and match variables that represent the results of this security finding. This list represents a mapping of names of the requested outcomes or match variables, to their values. This is only populated when the SecurityResult appears in a detection. old_value A list of outcomes and match variables that represent the results of this security finding. This list represents a mapping of names of the requested outcomes or match variables, to their values. This is only populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['verdictInfo']['description'] new_value Verdict information about the IoC from the provider. This field is not populated when the SecurityResult appears in a detection. old_value Verdict information about the IoC from the provider. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
prod/firebaseabt-pa-	values_changed root['revision'] new_value 20250511 old_value 20250507
prod/firebaseabt-pa-v1	values_changed root['revision'] new_value 20250511 old_value 20250507
prod/firebaseabt-pa-v2	values_changed root['revision'] new_value 20250511 old_value 20250507
prod/firebaseextensions-	values_changed root['revision'] new_value 20250511 old_value 20250507
prod/firebaseextensions-v1beta	values_changed root['revision'] new_value 20250511 old_value 20250507
prod/firebaseextensionspublisher-	values_changed root['revision'] new_value 20250511 old_value 20250507
prod/firebaseextensionspublisher-v1beta	values_changed root['revision'] new_value 20250511 old_value 20250507
prod/firebasetargeting-pa-	values_changed root['revision'] new_value 20250511 old_value 20250507
prod/firebasetargeting-pa-v1	values_changed root['revision'] new_value 20250511 old_value 20250507
prod/fit-	values_changed root['revision'] new_value 20250511 old_value 20250508
prod/fit-v2beta1	values_changed root['revision'] new_value 20250511 old_value 20250508
prod/floodforecasting-	values_changed root['revision'] new_value 20250511 old_value 20250504
prod/floodforecasting-v1	values_changed root['revision'] new_value 20250511 old_value 20250504
prod/generativelanguage-	values_changed root['revision'] new_value 20250512 old_value 20250509
prod/generativelanguage-v1	values_changed root['revision'] new_value 20250512 old_value 20250509
prod/generativelanguage-v1alpha	dictionary_item_added root['schemas']['CachedContent']['properties']['name']['readOnly'] values_changed root['resources']['cachedContents']['methods']['patch']['parameters']['name']['description'] new_value Output only. Identifier. The resource name referring to the cached content. Format: `cachedContents/{id}` old_value Optional. Identifier. The resource name referring to the cached content. Format: `cachedContents/{id}` root['revision'] new_value 20250512 old_value 20250509 root['schemas']['CachedContent']['properties']['name']['description'] new_value Output only. Identifier. The resource name referring to the cached content. Format: `cachedContents/{id}` old_value Optional. Identifier. The resource name referring to the cached content. Format: `cachedContents/{id}`
prod/generativelanguage-v1beta	dictionary_item_added root['schemas']['CachedContent']['properties']['name']['readOnly'] values_changed root['resources']['cachedContents']['methods']['patch']['parameters']['name']['description'] new_value Output only. Identifier. The resource name referring to the cached content. Format: `cachedContents/{id}` old_value Optional. Identifier. The resource name referring to the cached content. Format: `cachedContents/{id}` root['revision'] new_value 20250512 old_value 20250509 root['schemas']['CachedContent']['properties']['name']['description'] new_value Output only. Identifier. The resource name referring to the cached content. Format: `cachedContents/{id}` old_value Optional. Identifier. The resource name referring to the cached content. Format: `cachedContents/{id}`
prod/generativelanguage-v1beta1	values_changed root['revision'] new_value 20250512 old_value 20250509
prod/generativelanguage-v1beta2	values_changed root['revision'] new_value 20250512 old_value 20250509
prod/generativelanguage-v1beta3	values_changed root['revision'] new_value 20250512 old_value 20250509
prod/geoar-	values_changed root['revision'] new_value 20250511 old_value 20250507
prod/geoar-v1	values_changed root['revision'] new_value 20250511 old_value 20250507
prod/geocoding-backend-	values_changed root['revision'] new_value 20250511 old_value 20250507
prod/geofeedtaskrouting-	values_changed root['revision'] new_value 20250511 old_value 20250507
prod/geofeedtaskrouting-v1alpha	values_changed root['revision'] new_value 20250511 old_value 20250507
prod/growth-pa-	values_changed root['revision'] new_value 20250509 old_value 20250506
prod/growth-pa-v1	values_changed root['revision'] new_value 20250509 old_value 20250506
prod/guidedhelp-pa-	values_changed root['revision'] new_value 20250511 old_value 20250508
prod/guidedhelp-pa-v1	values_changed root['revision'] new_value 20250511 old_value 20250508
prod/hourly-dynamicmail-pa.sandbox-	values_changed root['revision'] new_value 20250512 old_value 20250510
prod/hourly-dynamicmail-pa.sandbox-v2	values_changed root['revision'] new_value 20250512 old_value 20250510
prod/ipprotection-ppissuer-	values_changed root['revision'] new_value 20250512 old_value 20250508
prod/ipprotection-ppissuer-v1	values_changed root['revision'] new_value 20250512 old_value 20250508
prod/jibemessagestore-	values_changed root['revision'] new_value 20250506 old_value 20250502
prod/jibemessagestore-v1	values_changed root['revision'] new_value 20250506 old_value 20250502
prod/kidsmanagement-pa-	values_changed root['revision'] new_value 20250510 old_value 20250506
prod/kidsmanagement-pa-v1	values_changed root['revision'] new_value 20250510 old_value 20250506
prod/kidsnotification-pa-	values_changed root['revision'] new_value 20250511 old_value 20250507
prod/kidsnotification-pa-v1	values_changed root['revision'] new_value 20250511 old_value 20250507
prod/legalproductions-pa-	values_changed root['revision'] new_value 20250511 old_value 20250507
prod/legalproductions-pa-v1	values_changed root['revision'] new_value 20250511 old_value 20250507
prod/linkauthorization-	values_changed root['revision'] new_value 20250509 old_value 20250507
prod/linkauthorization-v1	values_changed root['revision'] new_value 20250509 old_value 20250507
prod/localservicespartner-	values_changed root['revision'] new_value 20250511 old_value 20250508
prod/localservicespartner-v1beta1	values_changed root['revision'] new_value 20250511 old_value 20250508
prod/mapsplatformdatasets-	values_changed root['revision'] new_value 20250511 old_value 20250430
prod/mapsplatformdatasets-v1	values_changed root['revision'] new_value 20250511 old_value 20250430
prod/mapsplatformdatasets-v1alpha	values_changed root['revision'] new_value 20250511 old_value 20250430
prod/media3p-	values_changed root['revision'] new_value 20250511 old_value 20250508
prod/media3p-v1	values_changed root['revision'] new_value 20250511 old_value 20250508
prod/mobilemlaccelerationcompatibility-	values_changed root['revision'] new_value 20250511 old_value 20250508
prod/mobilemlaccelerationcompatibility-v1	values_changed root['revision'] new_value 20250511 old_value 20250508
prod/monospace-pa-	values_changed root['revision'] new_value 20250512 old_value 20250509
prod/monospace-pa-v1	values_changed root['revision'] new_value 20250512 old_value 20250509
prod/myphonenumbers-pa-	values_changed root['revision'] new_value 20250509 old_value 20250507
prod/myphonenumbers-pa-v1	values_changed root['revision'] new_value 20250509 old_value 20250507
prod/northamerica-northeast2-chronicle-	dictionary_item_added root['schemas']['ThreatCollectionItem'] root['schemas']['SecurityResult']['properties']['threatCollections'] root['schemas']['SecurityResult']['properties']['campaigns']['deprecated'] root['schemas']['SecurityResult']['properties']['reports']['deprecated'] values_changed root['revision'] new_value 20250508 old_value 20250505 root['schemas']['SecurityResult']['properties']['about']['description'] new_value If the security result is about a specific entity (Noun), add it here. This field is not populated when the SecurityResult appears in a detection. old_value If the security result is about a specific entity (Noun), add it here. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['action']['description'] new_value Actions taken for this event. This field is not populated when the SecurityResult appears in a detection. old_value Actions taken for this event. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['actionDetails']['description'] new_value The detail of the action taken as provided by the vendor. This field is not populated when the SecurityResult appears in a detection. old_value The detail of the action taken as provided by the vendor. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['analyticsMetadata']['description'] new_value Stores metadata about each risk analytic metric the rule uses. This field is not populated when the SecurityResult appears in a detection. old_value Stores metadata about each risk analytic metric the rule uses. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['associations']['description'] new_value Associations related to the threat. old_value Associations related to the threat. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['attackDetails']['description'] new_value MITRE ATT&CK details. This field is not populated when the SecurityResult appears in a detection. old_value MITRE ATT&CK details. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['campaigns']['description'] new_value Campaigns using this IOC threat. This is deprecated. Use threat_collections instead. old_value Campaigns using this IOC threat. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['category']['description'] new_value The security category. This field is not populated when the SecurityResult appears in a detection. old_value The security category. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['categoryDetails']['description'] new_value For vendor-specific categories. For web categorization, put type in here such as "gambling" or "porn". This field is not populated when the SecurityResult appears in a detection. old_value For vendor-specific categories. For web categorization, put type in here such as "gambling" or "porn". This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['confidence']['description'] new_value The confidence level of the result as estimated by the product. This field is not populated when the SecurityResult appears in a detection. old_value The confidence level of the result as estimated by the product. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['confidenceDetails']['description'] new_value Additional detail with regards to the confidence of a security event as estimated by the product vendor. This field is not populated when the SecurityResult appears in a detection. old_value Additional detail with regards to the confidence of a security event as estimated by the product vendor. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['confidenceScore']['description'] new_value The confidence score of the security result. This field is not populated when the SecurityResult appears in a detection. old_value The confidence score of the security result. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['detectionFields']['description'] new_value An ordered list of values, that represent fields in detections for a security finding. This list represents mapping of names of requested entities to their values (the security result matched variables). This is only populated when the SecurityResult appears in a detection. old_value An ordered list of values, that represent fields in detections for a security finding. This list represents mapping of names of requested entities to their values (the security result matched variables). This is only populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['firstDiscoveredTime']['description'] new_value First time the IoC threat was discovered in the provider. This field is not populated when the SecurityResult appears in a detection. old_value First time the IoC threat was discovered in the provider. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['lastDiscoveredTime']['description'] new_value Last time the IoC was seen in the provider data. This field is not populated when the SecurityResult appears in a detection. old_value Last time the IoC was seen in the provider data. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['lastUpdatedTime']['description'] new_value Last time the IoC threat was updated in the provider. This field is not populated when the SecurityResult appears in a detection. old_value Last time the IoC threat was updated in the provider. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['outcomes']['description'] new_value A list of outcomes that represent the results of this security finding. This list represents a mapping of names of the requested outcomes, to a stringified version of their values. This is only populated when the SecurityResult appears in a detection. old_value A list of outcomes that represent the results of this security finding. This list represents a mapping of names of the requested outcomes, to a stringified version of their values. This is only populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['priority']['description'] new_value The priority of the result. This field is not populated when the SecurityResult appears in a detection. old_value The priority of the result. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['priorityDetails']['description'] new_value Vendor-specific information about the security result priority. This field is not populated when the SecurityResult appears in a detection. old_value Vendor-specific information about the security result priority. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['reports']['description'] new_value Reports that reference this IOC threat. These are the report IDs. This is deprecated. Use threat_collections instead. old_value Reports that reference this IOC threat. These are the report IDs. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['ruleAuthor']['description'] new_value Author of the security rule. This field is not populated when the SecurityResult appears in a detection. old_value Author of the security rule. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['severityDetails']['description'] new_value Vendor-specific severity. This field is not populated when the SecurityResult appears in a detection. old_value Vendor-specific severity. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['threatFeedName']['description'] new_value Vendor feed name for a threat indicator feed. This field is not populated when the SecurityResult appears in a detection. old_value Vendor feed name for a threat indicator feed. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['threatId']['description'] new_value Vendor-specific ID for a threat. This field is not populated when the SecurityResult appears in a detection. old_value Vendor-specific ID for a threat. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['threatIdNamespace']['description'] new_value The attribute threat_id_namespace qualifies threat_id with an id namespace to get an unique id. The attribute threat_id by itself is not unique across Chronicle as it is a vendor specific id. This field is not populated when the SecurityResult appears in a detection. old_value The attribute threat_id_namespace qualifies threat_id with an id namespace to get an unique id. The attribute threat_id by itself is not unique across Chronicle as it is a vendor specific id. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['threatName']['description'] new_value A vendor-assigned classification common across multiple customers (for example, "W32/File-A", "Slammer"). This field is not populated when the SecurityResult appears in a detection. old_value A vendor-assigned classification common across multiple customers (for example, "W32/File-A", "Slammer"). This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['threatStatus']['description'] new_value Current status of the threat This field is not populated when the SecurityResult appears in a detection. old_value Current status of the threat This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['threatVerdict']['description'] new_value GCTI threat verdict on the security result entity. This field is not populated when the SecurityResult appears in a detection. old_value GCTI threat verdict on the security result entity. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['urlBackToProduct']['description'] new_value URL that takes the user to the source product console for this event. This field is not populated when the SecurityResult appears in a detection. old_value URL that takes the user to the source product console for this event. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['variables']['description'] new_value A list of outcomes and match variables that represent the results of this security finding. This list represents a mapping of names of the requested outcomes or match variables, to their values. This is only populated when the SecurityResult appears in a detection. old_value A list of outcomes and match variables that represent the results of this security finding. This list represents a mapping of names of the requested outcomes or match variables, to their values. This is only populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['verdictInfo']['description'] new_value Verdict information about the IoC from the provider. This field is not populated when the SecurityResult appears in a detection. old_value Verdict information about the IoC from the provider. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
prod/northamerica-northeast2-chronicle-v1	dictionary_item_added root['schemas']['ThreatCollectionItem'] root['schemas']['SecurityResult']['properties']['threatCollections'] root['schemas']['SecurityResult']['properties']['campaigns']['deprecated'] root['schemas']['SecurityResult']['properties']['reports']['deprecated'] values_changed root['revision'] new_value 20250508 old_value 20250505 root['schemas']['SecurityResult']['properties']['about']['description'] new_value If the security result is about a specific entity (Noun), add it here. This field is not populated when the SecurityResult appears in a detection. old_value If the security result is about a specific entity (Noun), add it here. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['action']['description'] new_value Actions taken for this event. This field is not populated when the SecurityResult appears in a detection. old_value Actions taken for this event. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['actionDetails']['description'] new_value The detail of the action taken as provided by the vendor. This field is not populated when the SecurityResult appears in a detection. old_value The detail of the action taken as provided by the vendor. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['analyticsMetadata']['description'] new_value Stores metadata about each risk analytic metric the rule uses. This field is not populated when the SecurityResult appears in a detection. old_value Stores metadata about each risk analytic metric the rule uses. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['associations']['description'] new_value Associations related to the threat. old_value Associations related to the threat. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['attackDetails']['description'] new_value MITRE ATT&CK details. This field is not populated when the SecurityResult appears in a detection. old_value MITRE ATT&CK details. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['campaigns']['description'] new_value Campaigns using this IOC threat. This is deprecated. Use threat_collections instead. old_value Campaigns using this IOC threat. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['category']['description'] new_value The security category. This field is not populated when the SecurityResult appears in a detection. old_value The security category. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['categoryDetails']['description'] new_value For vendor-specific categories. For web categorization, put type in here such as "gambling" or "porn". This field is not populated when the SecurityResult appears in a detection. old_value For vendor-specific categories. For web categorization, put type in here such as "gambling" or "porn". This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['confidence']['description'] new_value The confidence level of the result as estimated by the product. This field is not populated when the SecurityResult appears in a detection. old_value The confidence level of the result as estimated by the product. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['confidenceDetails']['description'] new_value Additional detail with regards to the confidence of a security event as estimated by the product vendor. This field is not populated when the SecurityResult appears in a detection. old_value Additional detail with regards to the confidence of a security event as estimated by the product vendor. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['confidenceScore']['description'] new_value The confidence score of the security result. This field is not populated when the SecurityResult appears in a detection. old_value The confidence score of the security result. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['detectionFields']['description'] new_value An ordered list of values, that represent fields in detections for a security finding. This list represents mapping of names of requested entities to their values (the security result matched variables). This is only populated when the SecurityResult appears in a detection. old_value An ordered list of values, that represent fields in detections for a security finding. This list represents mapping of names of requested entities to their values (the security result matched variables). This is only populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['firstDiscoveredTime']['description'] new_value First time the IoC threat was discovered in the provider. This field is not populated when the SecurityResult appears in a detection. old_value First time the IoC threat was discovered in the provider. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['lastDiscoveredTime']['description'] new_value Last time the IoC was seen in the provider data. This field is not populated when the SecurityResult appears in a detection. old_value Last time the IoC was seen in the provider data. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['lastUpdatedTime']['description'] new_value Last time the IoC threat was updated in the provider. This field is not populated when the SecurityResult appears in a detection. old_value Last time the IoC threat was updated in the provider. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['outcomes']['description'] new_value A list of outcomes that represent the results of this security finding. This list represents a mapping of names of the requested outcomes, to a stringified version of their values. This is only populated when the SecurityResult appears in a detection. old_value A list of outcomes that represent the results of this security finding. This list represents a mapping of names of the requested outcomes, to a stringified version of their values. This is only populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['priority']['description'] new_value The priority of the result. This field is not populated when the SecurityResult appears in a detection. old_value The priority of the result. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['priorityDetails']['description'] new_value Vendor-specific information about the security result priority. This field is not populated when the SecurityResult appears in a detection. old_value Vendor-specific information about the security result priority. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['reports']['description'] new_value Reports that reference this IOC threat. These are the report IDs. This is deprecated. Use threat_collections instead. old_value Reports that reference this IOC threat. These are the report IDs. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['ruleAuthor']['description'] new_value Author of the security rule. This field is not populated when the SecurityResult appears in a detection. old_value Author of the security rule. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['severityDetails']['description'] new_value Vendor-specific severity. This field is not populated when the SecurityResult appears in a detection. old_value Vendor-specific severity. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['threatFeedName']['description'] new_value Vendor feed name for a threat indicator feed. This field is not populated when the SecurityResult appears in a detection. old_value Vendor feed name for a threat indicator feed. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['threatId']['description'] new_value Vendor-specific ID for a threat. This field is not populated when the SecurityResult appears in a detection. old_value Vendor-specific ID for a threat. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['threatIdNamespace']['description'] new_value The attribute threat_id_namespace qualifies threat_id with an id namespace to get an unique id. The attribute threat_id by itself is not unique across Chronicle as it is a vendor specific id. This field is not populated when the SecurityResult appears in a detection. old_value The attribute threat_id_namespace qualifies threat_id with an id namespace to get an unique id. The attribute threat_id by itself is not unique across Chronicle as it is a vendor specific id. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['threatName']['description'] new_value A vendor-assigned classification common across multiple customers (for example, "W32/File-A", "Slammer"). This field is not populated when the SecurityResult appears in a detection. old_value A vendor-assigned classification common across multiple customers (for example, "W32/File-A", "Slammer"). This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['threatStatus']['description'] new_value Current status of the threat This field is not populated when the SecurityResult appears in a detection. old_value Current status of the threat This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['threatVerdict']['description'] new_value GCTI threat verdict on the security result entity. This field is not populated when the SecurityResult appears in a detection. old_value GCTI threat verdict on the security result entity. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['urlBackToProduct']['description'] new_value URL that takes the user to the source product console for this event. This field is not populated when the SecurityResult appears in a detection. old_value URL that takes the user to the source product console for this event. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['variables']['description'] new_value A list of outcomes and match variables that represent the results of this security finding. This list represents a mapping of names of the requested outcomes or match variables, to their values. This is only populated when the SecurityResult appears in a detection. old_value A list of outcomes and match variables that represent the results of this security finding. This list represents a mapping of names of the requested outcomes or match variables, to their values. This is only populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['verdictInfo']['description'] new_value Verdict information about the IoC from the provider. This field is not populated when the SecurityResult appears in a detection. old_value Verdict information about the IoC from the provider. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
prod/northamerica-northeast2-chronicle-v1alpha	dictionary_item_added root['resources']['projects']['resources']['locations']['resources']['instances']['resources']['dataTables']['resources']['dataTableRows']['methods']['list']['parameters']['filter'] root['schemas']['FileMetadataCodesignProvenance'] root['schemas']['FileMetadataImportsProvenance'] root['schemas']['FileMetadataPeResourceInfoProvenance'] root['schemas']['FileMetadataSectionProvenance'] root['schemas']['FileMetadataSignatureInfoProvenance'] root['schemas']['PeFileMetadataProvenance'] root['schemas']['SignerInfoProvenance'] root['schemas']['StringToInt64MapEntryProvenance'] root['schemas']['ThreatCollectionItem'] root['schemas']['X509Provenance'] root['schemas']['EventSample']['properties']['joinedDataTableRows'] root['schemas']['FieldProvenance']['properties']['nonlogSource'] root['schemas']['FileMetadataProvenance']['properties']['pe'] root['schemas']['GoogleCloudChronicleV1alphaLegacyFetchUdmSearchViewResponseStatsColumnMetadata']['properties']['latitude'] root['schemas']['GoogleCloudChronicleV1alphaLegacyFetchUdmSearchViewResponseStatsColumnMetadata']['properties']['longitude'] root['schemas']['SecurityResult']['properties']['threatCollections'] root['schemas']['SecurityResult']['properties']['campaigns']['deprecated'] root['schemas']['SecurityResult']['properties']['reports']['deprecated'] root['schemas']['UiPreferences']['properties']['enableLabs'] root['schemas']['ValueMetadata']['properties']['timestampVal'] values_changed root['revision'] new_value 20250508 old_value 20250505 root['schemas']['ExifInfoProvenance']['properties'] new_value company $ref FieldProvenance compilationTime $ref FieldProvenance entryPoint $ref FieldProvenance fileDescription $ref FieldProvenance originalFile $ref FieldProvenance product $ref FieldProvenance old_value root['schemas']['FaviconProvenance']['properties'] new_value dhash $ref FieldProvenance rawMd5 $ref FieldProvenance old_value root['schemas']['FileMetadataPEProvenance']['properties'] new_value compilationExiftoolTime $ref FieldProvenance compilationTime $ref FieldProvenance entryPoint $ref FieldProvenance entryPointExiftool $ref FieldProvenance imphash $ref FieldProvenance imports items $ref FileMetadataImportsProvenance type array resource items $ref FileMetadataPeResourceInfoProvenance type array resourcesLanguageCount deprecated True items $ref StringToInt64MapEntryProvenance type array resourcesLanguageCountStr items $ref LabelProvenance type array resourcesTypeCount deprecated True items $ref StringToInt64MapEntryProvenance type array resourcesTypeCountStr items $ref LabelProvenance type array section items $ref FileMetadataSectionProvenance type array signatureInfo $ref FileMetadataSignatureInfoProvenance deprecated True old_value root['schemas']['NtfsFileMetadataProvenance']['properties'] new_value changeTime $ref FieldProvenance filenameAccessTime $ref FieldProvenance filenameChangeTime $ref FieldProvenance filenameCreateTime $ref FieldProvenance filenameModifyTime $ref FieldProvenance old_value root['schemas']['PDFInfoProvenance']['properties'] new_value acroform $ref FieldProvenance autoaction $ref FieldProvenance embeddedFile $ref FieldProvenance encrypted $ref FieldProvenance endobjCount $ref FieldProvenance endstreamCount $ref FieldProvenance flash $ref FieldProvenance header $ref FieldProvenance javascript $ref FieldProvenance jbig2Compression $ref FieldProvenance js $ref FieldProvenance launchActionCount $ref FieldProvenance objCount $ref FieldProvenance objectStreamCount $ref FieldProvenance openaction $ref FieldProvenance pageCount $ref FieldProvenance startxref $ref FieldProvenance streamCount $ref FieldProvenance suspiciousColors $ref FieldProvenance trailer $ref FieldProvenance xfa $ref FieldProvenance xref $ref FieldProvenance old_value root['schemas']['PrevalenceProvenance']['properties'] new_value dayCount $ref FieldProvenance dayMax $ref FieldProvenance dayMaxSubDomains $ref FieldProvenance rollingMax $ref FieldProvenance rollingMaxSubDomains $ref FieldProvenance old_value root['schemas']['SecurityResult']['properties']['about']['description'] new_value If the security result is about a specific entity (Noun), add it here. This field is not populated when the SecurityResult appears in a detection. old_value If the security result is about a specific entity (Noun), add it here. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['action']['description'] new_value Actions taken for this event. This field is not populated when the SecurityResult appears in a detection. old_value Actions taken for this event. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['actionDetails']['description'] new_value The detail of the action taken as provided by the vendor. This field is not populated when the SecurityResult appears in a detection. old_value The detail of the action taken as provided by the vendor. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['analyticsMetadata']['description'] new_value Stores metadata about each risk analytic metric the rule uses. This field is not populated when the SecurityResult appears in a detection. old_value Stores metadata about each risk analytic metric the rule uses. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['associations']['description'] new_value Associations related to the threat. old_value Associations related to the threat. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['attackDetails']['description'] new_value MITRE ATT&CK details. This field is not populated when the SecurityResult appears in a detection. old_value MITRE ATT&CK details. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['campaigns']['description'] new_value Campaigns using this IOC threat. This is deprecated. Use threat_collections instead. old_value Campaigns using this IOC threat. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['category']['description'] new_value The security category. This field is not populated when the SecurityResult appears in a detection. old_value The security category. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['categoryDetails']['description'] new_value For vendor-specific categories. For web categorization, put type in here such as "gambling" or "porn". This field is not populated when the SecurityResult appears in a detection. old_value For vendor-specific categories. For web categorization, put type in here such as "gambling" or "porn". This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['confidence']['description'] new_value The confidence level of the result as estimated by the product. This field is not populated when the SecurityResult appears in a detection. old_value The confidence level of the result as estimated by the product. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['confidenceDetails']['description'] new_value Additional detail with regards to the confidence of a security event as estimated by the product vendor. This field is not populated when the SecurityResult appears in a detection. old_value Additional detail with regards to the confidence of a security event as estimated by the product vendor. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['confidenceScore']['description'] new_value The confidence score of the security result. This field is not populated when the SecurityResult appears in a detection. old_value The confidence score of the security result. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['detectionFields']['description'] new_value An ordered list of values, that represent fields in detections for a security finding. This list represents mapping of names of requested entities to their values (the security result matched variables). This is only populated when the SecurityResult appears in a detection. old_value An ordered list of values, that represent fields in detections for a security finding. This list represents mapping of names of requested entities to their values (the security result matched variables). This is only populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['firstDiscoveredTime']['description'] new_value First time the IoC threat was discovered in the provider. This field is not populated when the SecurityResult appears in a detection. old_value First time the IoC threat was discovered in the provider. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['lastDiscoveredTime']['description'] new_value Last time the IoC was seen in the provider data. This field is not populated when the SecurityResult appears in a detection. old_value Last time the IoC was seen in the provider data. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['lastUpdatedTime']['description'] new_value Last time the IoC threat was updated in the provider. This field is not populated when the SecurityResult appears in a detection. old_value Last time the IoC threat was updated in the provider. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['outcomes']['description'] new_value A list of outcomes that represent the results of this security finding. This list represents a mapping of names of the requested outcomes, to a stringified version of their values. This is only populated when the SecurityResult appears in a detection. old_value A list of outcomes that represent the results of this security finding. This list represents a mapping of names of the requested outcomes, to a stringified version of their values. This is only populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['priority']['description'] new_value The priority of the result. This field is not populated when the SecurityResult appears in a detection. old_value The priority of the result. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['priorityDetails']['description'] new_value Vendor-specific information about the security result priority. This field is not populated when the SecurityResult appears in a detection. old_value Vendor-specific information about the security result priority. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['reports']['description'] new_value Reports that reference this IOC threat. These are the report IDs. This is deprecated. Use threat_collections instead. old_value Reports that reference this IOC threat. These are the report IDs. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['ruleAuthor']['description'] new_value Author of the security rule. This field is not populated when the SecurityResult appears in a detection. old_value Author of the security rule. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['severityDetails']['description'] new_value Vendor-specific severity. This field is not populated when the SecurityResult appears in a detection. old_value Vendor-specific severity. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['threatFeedName']['description'] new_value Vendor feed name for a threat indicator feed. This field is not populated when the SecurityResult appears in a detection. old_value Vendor feed name for a threat indicator feed. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['threatId']['description'] new_value Vendor-specific ID for a threat. This field is not populated when the SecurityResult appears in a detection. old_value Vendor-specific ID for a threat. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['threatIdNamespace']['description'] new_value The attribute threat_id_namespace qualifies threat_id with an id namespace to get an unique id. The attribute threat_id by itself is not unique across Chronicle as it is a vendor specific id. This field is not populated when the SecurityResult appears in a detection. old_value The attribute threat_id_namespace qualifies threat_id with an id namespace to get an unique id. The attribute threat_id by itself is not unique across Chronicle as it is a vendor specific id. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['threatName']['description'] new_value A vendor-assigned classification common across multiple customers (for example, "W32/File-A", "Slammer"). This field is not populated when the SecurityResult appears in a detection. old_value A vendor-assigned classification common across multiple customers (for example, "W32/File-A", "Slammer"). This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['threatStatus']['description'] new_value Current status of the threat This field is not populated when the SecurityResult appears in a detection. old_value Current status of the threat This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['threatVerdict']['description'] new_value GCTI threat verdict on the security result entity. This field is not populated when the SecurityResult appears in a detection. old_value GCTI threat verdict on the security result entity. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['urlBackToProduct']['description'] new_value URL that takes the user to the source product console for this event. This field is not populated when the SecurityResult appears in a detection. old_value URL that takes the user to the source product console for this event. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['variables']['description'] new_value A list of outcomes and match variables that represent the results of this security finding. This list represents a mapping of names of the requested outcomes or match variables, to their values. This is only populated when the SecurityResult appears in a detection. old_value A list of outcomes and match variables that represent the results of this security finding. This list represents a mapping of names of the requested outcomes or match variables, to their values. This is only populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['verdictInfo']['description'] new_value Verdict information about the IoC from the provider. This field is not populated when the SecurityResult appears in a detection. old_value Verdict information about the IoC from the provider. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SignatureInfoProvenance']['properties'] new_value codesign $ref FileMetadataCodesignProvenance sigcheck $ref FileMetadataSignatureInfoProvenance old_value iterable_item_added root['schemas']['EdrEvent']['properties']['dataSource']['enum'][28] VECTRA root['schemas']['EdrEvent']['properties']['dataSource']['enum'][29] FORTINET root['schemas']['EnrichmentSource']['properties']['logType']['enum'][130] DOPPEL root['schemas']['EnrichmentSource']['properties']['logType']['enum'][231] TEAMT5_THREATSONAR_EDR root['schemas']['EnrichmentSource']['properties']['logType']['enum'][461] SECURITYBRIDGE_DEV root['schemas']['EnrichmentSource']['properties']['logType']['enum'][808] AZURE_ARCDATA root['schemas']['EnrichmentSource']['properties']['logType']['enum'][809] AZURE_DATAFACTORY root['schemas']['EnrichmentSource']['properties']['logType']['enum'][810] AZURE_DOCUMENTDB root['schemas']['EnrichmentSource']['properties']['logType']['enum'][997] AZURE_AUTHORIZATION root['schemas']['EnrichmentSource']['properties']['logType']['enum'][1275] AZURE_APPCONFIGURATION root['schemas']['EnrichmentSource']['properties']['logType']['enum'][1448] AZURE_APPPLATFORM root['schemas']['EnrichmentSource']['properties']['logType']['enum'][1450] AZURE_CHANGEANALYSIS root['schemas']['EnrichmentSource']['properties']['logType']['enum'][1451] AZURE_EVENTGRID root['schemas']['EnrichmentSource']['properties']['logType']['enum'][1452] AZURE_EVENTHUB root['schemas']['EnrichmentSource']['properties']['logType']['enum'][1453] AZURE_HYBRIDCOMPUTE root['schemas']['EnrichmentSource']['properties']['logType']['enum'][1522] REDMINE root['schemas']['EnrichmentSource']['properties']['logType']['enum'][1538] WORKDAY_USER_SIGNIN root['schemas']['EnrichmentSource']['properties']['logType']['enum'][1810] GCP_DNS_ATD root['schemas']['EnrichmentSource']['properties']['logType']['enum'][1987] GENIAN_NAC root['schemas']['EnrichmentSource']['properties']['logType']['enum'][1988] PENTA_WAPPLES root['schemas']['EnrichmentSource']['properties']['logType']['enum'][1989] S2W_QUAXAR root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][130] DOPPEL root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][231] TEAMT5_THREATSONAR_EDR root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][461] SECURITYBRIDGE_DEV root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][808] AZURE_ARCDATA root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][809] AZURE_DATAFACTORY root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][810] AZURE_DOCUMENTDB root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][997] AZURE_AUTHORIZATION root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][1275] AZURE_APPCONFIGURATION root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][1448] AZURE_APPPLATFORM root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][1450] AZURE_CHANGEANALYSIS root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][1451] AZURE_EVENTGRID root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][1452] AZURE_EVENTHUB root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][1453] AZURE_HYBRIDCOMPUTE root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][1522] REDMINE root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][1538] WORKDAY_USER_SIGNIN root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][1810] GCP_DNS_ATD root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][1987] GENIAN_NAC root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][1988] PENTA_WAPPLES root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][1989] S2W_QUAXAR root['schemas']['RawLog']['properties']['type']['enum'][130] DOPPEL root['schemas']['RawLog']['properties']['type']['enum'][231] TEAMT5_THREATSONAR_EDR root['schemas']['RawLog']['properties']['type']['enum'][461] SECURITYBRIDGE_DEV root['schemas']['RawLog']['properties']['type']['enum'][808] AZURE_ARCDATA root['schemas']['RawLog']['properties']['type']['enum'][809] AZURE_DATAFACTORY root['schemas']['RawLog']['properties']['type']['enum'][810] AZURE_DOCUMENTDB root['schemas']['RawLog']['properties']['type']['enum'][997] AZURE_AUTHORIZATION root['schemas']['RawLog']['properties']['type']['enum'][1275] AZURE_APPCONFIGURATION root['schemas']['RawLog']['properties']['type']['enum'][1448] AZURE_APPPLATFORM root['schemas']['RawLog']['properties']['type']['enum'][1450] AZURE_CHANGEANALYSIS root['schemas']['RawLog']['properties']['type']['enum'][1451] AZURE_EVENTGRID root['schemas']['RawLog']['properties']['type']['enum'][1452] AZURE_EVENTHUB root['schemas']['RawLog']['properties']['type']['enum'][1453] AZURE_HYBRIDCOMPUTE root['schemas']['RawLog']['properties']['type']['enum'][1522] REDMINE root['schemas']['RawLog']['properties']['type']['enum'][1538] WORKDAY_USER_SIGNIN root['schemas']['RawLog']['properties']['type']['enum'][1810] GCP_DNS_ATD root['schemas']['RawLog']['properties']['type']['enum'][1987] GENIAN_NAC root['schemas']['RawLog']['properties']['type']['enum'][1988] PENTA_WAPPLES root['schemas']['RawLog']['properties']['type']['enum'][1989] S2W_QUAXAR root['schemas']['SIEventData']['properties']['rawLogType']['enum'][130] DOPPEL root['schemas']['SIEventData']['properties']['rawLogType']['enum'][231] TEAMT5_THREATSONAR_EDR root['schemas']['SIEventData']['properties']['rawLogType']['enum'][461] SECURITYBRIDGE_DEV root['schemas']['SIEventData']['properties']['rawLogType']['enum'][808] AZURE_ARCDATA root['schemas']['SIEventData']['properties']['rawLogType']['enum'][809] AZURE_DATAFACTORY root['schemas']['SIEventData']['properties']['rawLogType']['enum'][810] AZURE_DOCUMENTDB root['schemas']['SIEventData']['properties']['rawLogType']['enum'][997] AZURE_AUTHORIZATION root['schemas']['SIEventData']['properties']['rawLogType']['enum'][1275] AZURE_APPCONFIGURATION root['schemas']['SIEventData']['properties']['rawLogType']['enum'][1448] AZURE_APPPLATFORM root['schemas']['SIEventData']['properties']['rawLogType']['enum'][1450] AZURE_CHANGEANALYSIS root['schemas']['SIEventData']['properties']['rawLogType']['enum'][1451] AZURE_EVENTGRID root['schemas']['SIEventData']['properties']['rawLogType']['enum'][1452] AZURE_EVENTHUB root['schemas']['SIEventData']['properties']['rawLogType']['enum'][1453] AZURE_HYBRIDCOMPUTE root['schemas']['SIEventData']['properties']['rawLogType']['enum'][1522] REDMINE root['schemas']['SIEventData']['properties']['rawLogType']['enum'][1538] WORKDAY_USER_SIGNIN root['schemas']['SIEventData']['properties']['rawLogType']['enum'][1810] GCP_DNS_ATD root['schemas']['SIEventData']['properties']['rawLogType']['enum'][1987] GENIAN_NAC root['schemas']['SIEventData']['properties']['rawLogType']['enum'][1988] PENTA_WAPPLES root['schemas']['SIEventData']['properties']['rawLogType']['enum'][1989] S2W_QUAXAR
prod/northamerica-northeast2-chronicle-v1beta	dictionary_item_added root['schemas']['ThreatCollectionItem'] root['schemas']['SecurityResult']['properties']['threatCollections'] root['schemas']['SecurityResult']['properties']['campaigns']['deprecated'] root['schemas']['SecurityResult']['properties']['reports']['deprecated'] values_changed root['revision'] new_value 20250508 old_value 20250505 root['schemas']['SecurityResult']['properties']['about']['description'] new_value If the security result is about a specific entity (Noun), add it here. This field is not populated when the SecurityResult appears in a detection. old_value If the security result is about a specific entity (Noun), add it here. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['action']['description'] new_value Actions taken for this event. This field is not populated when the SecurityResult appears in a detection. old_value Actions taken for this event. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['actionDetails']['description'] new_value The detail of the action taken as provided by the vendor. This field is not populated when the SecurityResult appears in a detection. old_value The detail of the action taken as provided by the vendor. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['analyticsMetadata']['description'] new_value Stores metadata about each risk analytic metric the rule uses. This field is not populated when the SecurityResult appears in a detection. old_value Stores metadata about each risk analytic metric the rule uses. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['associations']['description'] new_value Associations related to the threat. old_value Associations related to the threat. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['attackDetails']['description'] new_value MITRE ATT&CK details. This field is not populated when the SecurityResult appears in a detection. old_value MITRE ATT&CK details. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['campaigns']['description'] new_value Campaigns using this IOC threat. This is deprecated. Use threat_collections instead. old_value Campaigns using this IOC threat. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['category']['description'] new_value The security category. This field is not populated when the SecurityResult appears in a detection. old_value The security category. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['categoryDetails']['description'] new_value For vendor-specific categories. For web categorization, put type in here such as "gambling" or "porn". This field is not populated when the SecurityResult appears in a detection. old_value For vendor-specific categories. For web categorization, put type in here such as "gambling" or "porn". This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['confidence']['description'] new_value The confidence level of the result as estimated by the product. This field is not populated when the SecurityResult appears in a detection. old_value The confidence level of the result as estimated by the product. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['confidenceDetails']['description'] new_value Additional detail with regards to the confidence of a security event as estimated by the product vendor. This field is not populated when the SecurityResult appears in a detection. old_value Additional detail with regards to the confidence of a security event as estimated by the product vendor. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['confidenceScore']['description'] new_value The confidence score of the security result. This field is not populated when the SecurityResult appears in a detection. old_value The confidence score of the security result. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['detectionFields']['description'] new_value An ordered list of values, that represent fields in detections for a security finding. This list represents mapping of names of requested entities to their values (the security result matched variables). This is only populated when the SecurityResult appears in a detection. old_value An ordered list of values, that represent fields in detections for a security finding. This list represents mapping of names of requested entities to their values (the security result matched variables). This is only populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['firstDiscoveredTime']['description'] new_value First time the IoC threat was discovered in the provider. This field is not populated when the SecurityResult appears in a detection. old_value First time the IoC threat was discovered in the provider. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['lastDiscoveredTime']['description'] new_value Last time the IoC was seen in the provider data. This field is not populated when the SecurityResult appears in a detection. old_value Last time the IoC was seen in the provider data. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['lastUpdatedTime']['description'] new_value Last time the IoC threat was updated in the provider. This field is not populated when the SecurityResult appears in a detection. old_value Last time the IoC threat was updated in the provider. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['outcomes']['description'] new_value A list of outcomes that represent the results of this security finding. This list represents a mapping of names of the requested outcomes, to a stringified version of their values. This is only populated when the SecurityResult appears in a detection. old_value A list of outcomes that represent the results of this security finding. This list represents a mapping of names of the requested outcomes, to a stringified version of their values. This is only populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['priority']['description'] new_value The priority of the result. This field is not populated when the SecurityResult appears in a detection. old_value The priority of the result. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['priorityDetails']['description'] new_value Vendor-specific information about the security result priority. This field is not populated when the SecurityResult appears in a detection. old_value Vendor-specific information about the security result priority. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['reports']['description'] new_value Reports that reference this IOC threat. These are the report IDs. This is deprecated. Use threat_collections instead. old_value Reports that reference this IOC threat. These are the report IDs. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['ruleAuthor']['description'] new_value Author of the security rule. This field is not populated when the SecurityResult appears in a detection. old_value Author of the security rule. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['severityDetails']['description'] new_value Vendor-specific severity. This field is not populated when the SecurityResult appears in a detection. old_value Vendor-specific severity. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['threatFeedName']['description'] new_value Vendor feed name for a threat indicator feed. This field is not populated when the SecurityResult appears in a detection. old_value Vendor feed name for a threat indicator feed. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['threatId']['description'] new_value Vendor-specific ID for a threat. This field is not populated when the SecurityResult appears in a detection. old_value Vendor-specific ID for a threat. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['threatIdNamespace']['description'] new_value The attribute threat_id_namespace qualifies threat_id with an id namespace to get an unique id. The attribute threat_id by itself is not unique across Chronicle as it is a vendor specific id. This field is not populated when the SecurityResult appears in a detection. old_value The attribute threat_id_namespace qualifies threat_id with an id namespace to get an unique id. The attribute threat_id by itself is not unique across Chronicle as it is a vendor specific id. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['threatName']['description'] new_value A vendor-assigned classification common across multiple customers (for example, "W32/File-A", "Slammer"). This field is not populated when the SecurityResult appears in a detection. old_value A vendor-assigned classification common across multiple customers (for example, "W32/File-A", "Slammer"). This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['threatStatus']['description'] new_value Current status of the threat This field is not populated when the SecurityResult appears in a detection. old_value Current status of the threat This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['threatVerdict']['description'] new_value GCTI threat verdict on the security result entity. This field is not populated when the SecurityResult appears in a detection. old_value GCTI threat verdict on the security result entity. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['urlBackToProduct']['description'] new_value URL that takes the user to the source product console for this event. This field is not populated when the SecurityResult appears in a detection. old_value URL that takes the user to the source product console for this event. This field is not populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['variables']['description'] new_value A list of outcomes and match variables that represent the results of this security finding. This list represents a mapping of names of the requested outcomes or match variables, to their values. This is only populated when the SecurityResult appears in a detection. old_value A list of outcomes and match variables that represent the results of this security finding. This list represents a mapping of names of the requested outcomes or match variables, to their values. This is only populated when the SecurityResult appears in a finding (a detection or alert). root['schemas']['SecurityResult']['properties']['verdictInfo']['description'] new_value Verdict information about the IoC from the provider. This field is not populated when the SecurityResult appears in a detection. old_value Verdict information about the IoC from the provider. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
prod/notifications-pa-	dictionary_item_added root['schemas']['LogsProtoPaymentsConsumerCore__ValuableMetadata']['properties']['valuablePassType'] root['schemas']['LogsProtoPaymentsConsumerCore__ValuableMetadata']['properties']['valuableType']['deprecated'] root['schemas']['LogsProtoPaymentsConsumerCore__ValuableMetadata']['properties']['valuableType']['description'] values_changed root['revision'] new_value 20250511 old_value 20250506 root['schemas']['GoogleLogsTapandpayAndroid__SaveValuableToAndroidPayEvent']['description'] new_value Event for save to Native Save flow in Pay module. old_value Event for save to Android Pay flow (http://go/s2ap-design) root['schemas']['AppsDynamite__ChimeNotificationPayload']['properties']['eventType']['enum'][5] new_value SINGLE_TOPIC_SUMMARY_NOTIFICATION old_value SUMMARY_NOTIFICATION root['schemas']['AppsDynamite__ChimeNotificationPayload']['properties']['eventType']['enumDescriptions'][5] new_value Notification for a summary of unread messages in a single topic in a thread or space. old_value Notification for a summary of unread messages in a thread or space. iterable_item_added root['schemas']['AppsDynamite__ChimeNotificationPayload']['properties']['eventType']['enum'][6] MULTIPLE_TOPIC_SUMMARY_NOTIFICATION root['schemas']['AppsDynamite__ChimeNotificationPayload']['properties']['eventType']['enumDescriptions'][6] Notification for a summary of unread messages across multiple topics in a space. root['schemas']['GoogleInternalTapandpayV1PassesTemplates__LocalResource']['properties']['iconType']['enum'][10] WALLET_WEAR_TRANSIT_AUTOLOAD root['schemas']['GoogleInternalTapandpayV1PassesTemplates__LocalResource']['properties']['iconType']['enum'][11] WALLET_WEAR_TRANSIT_AUTOLOAD_DARK_MODE root['schemas']['GoogleInternalTapandpayV1PassesTemplates__LocalResource']['properties']['iconType']['enum'][12] WALLET_ADD_CARD root['schemas']['GoogleInternalTapandpayV1PassesTemplates__LocalResource']['properties']['iconType']['enum'][13] WALLET_ADD_CARD_DARK_MODE root['schemas']['GoogleInternalTapandpayV1PassesTemplates__ViewConstraints']['properties']['viewConstraintFlag']['items']['enum'][23] PASS_EDITABLE root['schemas']['GoogleInternalTapandpayV1PassesTemplates__ViewConstraints']['properties']['viewConstraintFlag']['items']['enumDescriptions'][23] The pass is editable. root['schemas']['GoogleLogsTapandpayAndroid__SaveValuableToAndroidPayEvent']['properties']['action']['enum'][14] CLICK_VIEW_BUTTON root['schemas']['GoogleLogsTapandpayAndroid__SaveValuableToAndroidPayEvent']['properties']['action']['enum'][15] CLICK_CONTINUE_BUTTON root['schemas']['GoogleLogsTapandpayAndroid__SaveValuableToAndroidPayEvent']['properties']['action']['enum'][16] CLICK_CANCEL_BUTTON root['schemas']['GoogleLogsTapandpayAndroid__SaveValuableToAndroidPayEvent']['properties']['action']['enum'][17] CLICK_OPEN_APP_BUTTON root['schemas']['GoogleLogsTapandpayAndroid__SaveValuableToAndroidPayEvent']['properties']['action']['enum'][18] CLICK_INSTALL_APP_BUTTON root['schemas']['GoogleLogsTapandpayAndroid__SaveValuableToAndroidPayEvent']['properties']['action']['enum'][19] CLICK_GOT_IT_BUTTON root['schemas']['GoogleLogsTapandpayAndroid__SaveValuableToAndroidPayEvent']['properties']['action']['enum'][20] REMOVE_VALUABLE_FAILURE root['schemas']['GoogleLogsTapandpayAndroid__SaveValuableToAndroidPayEvent']['properties']['action']['enum'][21] REMOVE_VALUABLE_SUCCESS root['schemas']['GoogleLogsTapandpayAndroid__SaveValuableToAndroidPayEvent']['properties']['action']['enum'][22] ERROR_DIALOG_SHOWN root['schemas']['GoogleLogsTapandpayAndroid__ValuableDetailScreenEvent']['properties']['issuerLinkType']['enum'][5] PLAY_POINTS_HISTORY root['schemas']['GoogleLogsTapandpayAndroid__ValuableDetailScreenEvent']['properties']['issuerLinkType']['enum'][6] PLAY_POINTS_BENEFITS root['schemas']['GoogleLogsTapandpayAndroid__ValuableDetailScreenEvent']['properties']['issuerLinkType']['enum'][7] PLAY_POINTS_HELP root['schemas']['GoogleLogsTapandpayAndroid__ValuableDetailScreenEvent']['properties']['issuerLinkType']['enum'][8] PLAY_POINTS_TERMS_OF_SERVICE root['schemas']['GoogleLogsTapandpayAndroid__ValuableDetailScreenEvent']['properties']['issuerLinkType']['enumDescriptions'][5] Link types used by Play Points project. History of Play Points. root['schemas']['GoogleLogsTapandpayAndroid__ValuableDetailScreenEvent']['properties']['issuerLinkType']['enumDescriptions'][6] Benefits page of Play Points. root['schemas']['GoogleLogsTapandpayAndroid__ValuableDetailScreenEvent']['properties']['issuerLinkType']['enumDescriptions'][7] Help center article for Play Points program. root['schemas']['GoogleLogsTapandpayAndroid__ValuableDetailScreenEvent']['properties']['issuerLinkType']['enumDescriptions'][8] Terms of service for Play Points program. root['schemas']['PhotosMediaClient__CameraBurstInfo']['properties']['burstGroupType']['enum'][5] FILOLI root['schemas']['PhotosMediaClient__CameraBurstInfo']['properties']['burstGroupType']['enumDescriptions'][5] Auto Best Take(Filoli) burst. root['schemas']['Sidekick__SemanticProperties']['properties']['cardCategory']['enum'][1495] NEON_SECONDARY_SOURCE root['schemas']['Sidekick__SemanticProperties']['properties']['cardCategory']['enumDescriptions'][1495] Card category used for non-hero neon sources (not shown in main feed).
prod/notifications-pa-v1	dictionary_item_added root['schemas']['LogsProtoPaymentsConsumerCore__ValuableMetadata']['properties']['valuablePassType'] root['schemas']['LogsProtoPaymentsConsumerCore__ValuableMetadata']['properties']['valuableType']['deprecated'] root['schemas']['LogsProtoPaymentsConsumerCore__ValuableMetadata']['properties']['valuableType']['description'] values_changed root['revision'] new_value 20250511 old_value 20250506 root['schemas']['GoogleLogsTapandpayAndroid__SaveValuableToAndroidPayEvent']['description'] new_value Event for save to Native Save flow in Pay module. old_value Event for save to Android Pay flow (http://go/s2ap-design) root['schemas']['AppsDynamite__ChimeNotificationPayload']['properties']['eventType']['enum'][5] new_value SINGLE_TOPIC_SUMMARY_NOTIFICATION old_value SUMMARY_NOTIFICATION root['schemas']['AppsDynamite__ChimeNotificationPayload']['properties']['eventType']['enumDescriptions'][5] new_value Notification for a summary of unread messages in a single topic in a thread or space. old_value Notification for a summary of unread messages in a thread or space. iterable_item_added root['schemas']['AppsDynamite__ChimeNotificationPayload']['properties']['eventType']['enum'][6] MULTIPLE_TOPIC_SUMMARY_NOTIFICATION root['schemas']['AppsDynamite__ChimeNotificationPayload']['properties']['eventType']['enumDescriptions'][6] Notification for a summary of unread messages across multiple topics in a space. root['schemas']['GoogleInternalTapandpayV1PassesTemplates__LocalResource']['properties']['iconType']['enum'][10] WALLET_WEAR_TRANSIT_AUTOLOAD root['schemas']['GoogleInternalTapandpayV1PassesTemplates__LocalResource']['properties']['iconType']['enum'][11] WALLET_WEAR_TRANSIT_AUTOLOAD_DARK_MODE root['schemas']['GoogleInternalTapandpayV1PassesTemplates__LocalResource']['properties']['iconType']['enum'][12] WALLET_ADD_CARD root['schemas']['GoogleInternalTapandpayV1PassesTemplates__LocalResource']['properties']['iconType']['enum'][13] WALLET_ADD_CARD_DARK_MODE root['schemas']['GoogleInternalTapandpayV1PassesTemplates__ViewConstraints']['properties']['viewConstraintFlag']['items']['enum'][23] PASS_EDITABLE root['schemas']['GoogleInternalTapandpayV1PassesTemplates__ViewConstraints']['properties']['viewConstraintFlag']['items']['enumDescriptions'][23] The pass is editable. root['schemas']['GoogleLogsTapandpayAndroid__SaveValuableToAndroidPayEvent']['properties']['action']['enum'][14] CLICK_VIEW_BUTTON root['schemas']['GoogleLogsTapandpayAndroid__SaveValuableToAndroidPayEvent']['properties']['action']['enum'][15] CLICK_CONTINUE_BUTTON root['schemas']['GoogleLogsTapandpayAndroid__SaveValuableToAndroidPayEvent']['properties']['action']['enum'][16] CLICK_CANCEL_BUTTON root['schemas']['GoogleLogsTapandpayAndroid__SaveValuableToAndroidPayEvent']['properties']['action']['enum'][17] CLICK_OPEN_APP_BUTTON root['schemas']['GoogleLogsTapandpayAndroid__SaveValuableToAndroidPayEvent']['properties']['action']['enum'][18] CLICK_INSTALL_APP_BUTTON root['schemas']['GoogleLogsTapandpayAndroid__SaveValuableToAndroidPayEvent']['properties']['action']['enum'][19] CLICK_GOT_IT_BUTTON root['schemas']['GoogleLogsTapandpayAndroid__SaveValuableToAndroidPayEvent']['properties']['action']['enum'][20] REMOVE_VALUABLE_FAILURE root['schemas']['GoogleLogsTapandpayAndroid__SaveValuableToAndroidPayEvent']['properties']['action']['enum'][21] REMOVE_VALUABLE_SUCCESS root['schemas']['GoogleLogsTapandpayAndroid__SaveValuableToAndroidPayEvent']['properties']['action']['enum'][22] ERROR_DIALOG_SHOWN root['schemas']['GoogleLogsTapandpayAndroid__ValuableDetailScreenEvent']['properties']['issuerLinkType']['enum'][5] PLAY_POINTS_HISTORY root['schemas']['GoogleLogsTapandpayAndroid__ValuableDetailScreenEvent']['properties']['issuerLinkType']['enum'][6] PLAY_POINTS_BENEFITS root['schemas']['GoogleLogsTapandpayAndroid__ValuableDetailScreenEvent']['properties']['issuerLinkType']['enum'][7] PLAY_POINTS_HELP root['schemas']['GoogleLogsTapandpayAndroid__ValuableDetailScreenEvent']['properties']['issuerLinkType']['enum'][8] PLAY_POINTS_TERMS_OF_SERVICE root['schemas']['GoogleLogsTapandpayAndroid__ValuableDetailScreenEvent']['properties']['issuerLinkType']['enumDescriptions'][5] Link types used by Play Points project. History of Play Points. root['schemas']['GoogleLogsTapandpayAndroid__ValuableDetailScreenEvent']['properties']['issuerLinkType']['enumDescriptions'][6] Benefits page of Play Points. root['schemas']['GoogleLogsTapandpayAndroid__ValuableDetailScreenEvent']['properties']['issuerLinkType']['enumDescriptions'][7] Help center article for Play Points program. root['schemas']['GoogleLogsTapandpayAndroid__ValuableDetailScreenEvent']['properties']['issuerLinkType']['enumDescriptions'][8] Terms of service for Play Points program. root['schemas']['PhotosMediaClient__CameraBurstInfo']['properties']['burstGroupType']['enum'][5] FILOLI root['schemas']['PhotosMediaClient__CameraBurstInfo']['properties']['burstGroupType']['enumDescriptions'][5] Auto Best Take(Filoli) burst. root['schemas']['Sidekick__SemanticProperties']['properties']['cardCategory']['enum'][1495] NEON_SECONDARY_SOURCE root['schemas']['Sidekick__SemanticProperties']['properties']['cardCategory']['enumDescriptions'][1495] Card category used for non-hero neon sources (not shown in main feed).
prod/ogads-pa-	values_changed root['revision'] new_value 20250511 old_value 20250507
prod/ogads-pa-v1	values_changed root['revision'] new_value 20250511 old_value 20250507
prod/peoplestack-pa-	values_changed root['revision'] new_value 20250512 old_value 20250507 iterable_item_added root['resources']['autocomplete']['methods']['autocomplete']['parameters']['affinityType']['enum'][314] BH_APPROVALS_FRONTEND_AFFINITY root['resources']['autocomplete']['methods']['warmup']['parameters']['affinityType']['enum'][314] BH_APPROVALS_FRONTEND_AFFINITY root['schemas']['PeoplestackAutocompleteRequest']['properties']['affinityType']['enum'][314] BH_APPROVALS_FRONTEND_AFFINITY root['schemas']['PeoplestackBlockPersonRequest']['properties']['affinityType']['enum'][314] BH_APPROVALS_FRONTEND_AFFINITY root['schemas']['PeoplestackCreateGroupRequest']['properties']['affinityType']['enum'][314] BH_APPROVALS_FRONTEND_AFFINITY root['schemas']['PeoplestackDeleteGroupsRequest']['properties']['affinityType']['enum'][314] BH_APPROVALS_FRONTEND_AFFINITY root['schemas']['PeoplestackFlexorgsProtoInternalExternal']['properties']['application']['enum'][459] BH_APPROVALS_FRONTEND root['schemas']['PeoplestackFlexorgsProtoInternalExternal']['properties']['application']['enumDescriptions'][459] Bh Approvals Frontend Team contact: s2p-purchasing-eng@google.com root['schemas']['PeoplestackJoinGroupRequest']['properties']['affinityType']['enum'][314] BH_APPROVALS_FRONTEND_AFFINITY root['schemas']['PeoplestackLeaveGroupRequest']['properties']['affinityType']['enum'][314] BH_APPROVALS_FRONTEND_AFFINITY root['schemas']['PeoplestackLookupRequest']['properties']['affinityType']['enum'][314] BH_APPROVALS_FRONTEND_AFFINITY root['schemas']['PeoplestackMutateConnectionLabelRequest']['properties']['affinityType']['enum'][314] BH_APPROVALS_FRONTEND_AFFINITY root['schemas']['PeoplestackReadAllGroupsRequest']['properties']['affinityType']['enum'][314] BH_APPROVALS_FRONTEND_AFFINITY root['schemas']['PeoplestackReadGroupsRequest']['properties']['affinityType']['enum'][314] BH_APPROVALS_FRONTEND_AFFINITY root['schemas']['PeoplestackSmartAddressRequest']['properties']['affinityType']['enum'][314] BH_APPROVALS_FRONTEND_AFFINITY root['schemas']['PeoplestackUpdateGroupRequest']['properties']['affinityType']['enum'][314] BH_APPROVALS_FRONTEND_AFFINITY root['schemas']['PeoplestackWarmupRequest']['properties']['affinityType']['enum'][314] BH_APPROVALS_FRONTEND_AFFINITY root['schemas']['SocialClientsApplicationProto3Wrapper']['properties']['application']['enum'][459] BH_APPROVALS_FRONTEND root['schemas']['SocialClientsApplicationProto3Wrapper']['properties']['application']['enumDescriptions'][459] Bh Approvals Frontend Team contact: s2p-purchasing-eng@google.com
prod/performanceparameters-	values_changed root['revision'] new_value 20250511 old_value 20250508
prod/performanceparameters-v1	values_changed root['revision'] new_value 20250511 old_value 20250508
prod/ppissuer-	values_changed root['revision'] new_value 20250512 old_value 20250508
prod/ppissuer-v1	values_changed root['revision'] new_value 20250512 old_value 20250508
prod/preprod-hangouts-	values_changed root['revision'] new_value 20250511 old_value 20250506
prod/preprod-hangouts-v1	values_changed root['revision'] new_value 20250511 old_value 20250506
prod/privacysandboxmaven-	values_changed root['revision'] new_value 20250511 old_value 20250508
prod/privacysandboxmaven-v1	values_changed root['revision'] new_value 20250511 old_value 20250508
prod/quantum-	values_changed root['revision'] new_value 20250511 old_value 20250508
prod/quantum-v1alpha1	values_changed root['revision'] new_value 20250511 old_value 20250508
prod/rbmopenmaap-	values_changed root['revision'] new_value 20250512 old_value 20250506
prod/rbmopenmaap-v1	values_changed root['revision'] new_value 20250512 old_value 20250506
prod/resultstore-	values_changed root['revision'] new_value 20250509 old_value 20250506
prod/resultstore-v2	values_changed root['revision'] new_value 20250509 old_value 20250506
prod/routeoptimization-	dictionary_item_added root['resources']['projects']['methods']['optimizeToursLongRunning'] root['resources']['projects']['methods']['optimizeToursUri'] root['resources']['projects']['resources']['locations']['methods']['optimizeToursLongRunning'] root['resources']['projects']['resources']['locations']['methods']['optimizeToursUri'] root['schemas']['GoogleMapsRouteoptimizationV1OptimizeToursUriRequest'] root['schemas']['GoogleMapsRouteoptimizationV1ShipmentModelObjective'] root['schemas']['GoogleMapsRouteoptimizationV1Uri'] root['schemas']['GoogleMapsRouteoptimizationV1VehicleFullness'] root['schemas']['GoogleMapsRouteoptimizationV1VehicleLoadLimitLoadCost'] root['schemas']['GoogleMapsRouteoptimizationV1AggregatedMetrics']['properties']['performedMandatoryShipmentCount'] root['schemas']['GoogleMapsRouteoptimizationV1AggregatedMetrics']['properties']['performedShipmentPenaltyCostSum'] root['schemas']['GoogleMapsRouteoptimizationV1OptimizeToursRequest']['properties']['parent'] root['schemas']['GoogleMapsRouteoptimizationV1OptimizeToursResponse']['properties']['processedRequest'] root['schemas']['GoogleMapsRouteoptimizationV1ShipmentModel']['properties']['objectives'] root['schemas']['GoogleMapsRouteoptimizationV1ShipmentRoute']['properties']['vehicleFullness'] root['schemas']['GoogleMapsRouteoptimizationV1ShipmentRouteVisit']['properties']['injectedSolutionLocationToken'] root['schemas']['GoogleMapsRouteoptimizationV1ShipmentVisitRequest']['properties']['avoidUTurns'] root['schemas']['GoogleMapsRouteoptimizationV1SkippedShipment']['properties']['estimatedIncompatibleVehicleRatio'] root['schemas']['GoogleMapsRouteoptimizationV1SkippedShipment']['properties']['penaltyCost'] root['schemas']['GoogleMapsRouteoptimizationV1SkippedShipmentReason']['properties']['exampleVehicleIndices'] root['schemas']['GoogleMapsRouteoptimizationV1VehicleLoadLimit']['properties']['costPerKilometer'] root['schemas']['GoogleMapsRouteoptimizationV1VehicleLoadLimit']['properties']['costPerTraveledHour'] root['schemas']['GoogleMapsRouteoptimizationV1Waypoint']['properties']['vehicleStopover'] values_changed root['revision'] new_value 20250511 old_value 20250506 iterable_item_added root['schemas']['GoogleMapsRouteoptimizationV1OptimizeToursRequest']['properties']['solvingMode']['enum'][3] TRANSFORM_AND_RETURN_REQUEST root['schemas']['GoogleMapsRouteoptimizationV1OptimizeToursRequest']['properties']['solvingMode']['enumDescriptions'][3] This mode only works if `ShipmentModel.objectives` is not empty. The request is not solved. It is only validated and filled with costs corresponding to the given objectives. Also see the documentation of `ShipmentModel.objectives`. The resulting request is returned as `OptimizeToursResponse.processed_request`. Experimental: See https://developers.google.com/maps/tt/route-optimization/experimental/objectives/make-request for more details. root['schemas']['GoogleMapsRouteoptimizationV1SkippedShipmentReason']['properties']['code']['enum'][8] VEHICLE_IGNORED root['schemas']['GoogleMapsRouteoptimizationV1SkippedShipmentReason']['properties']['code']['enum'][9] SHIPMENT_IGNORED root['schemas']['GoogleMapsRouteoptimizationV1SkippedShipmentReason']['properties']['code']['enum'][10] SKIPPED_IN_INJECTED_SOLUTION_CONSTRAINT root['schemas']['GoogleMapsRouteoptimizationV1SkippedShipmentReason']['properties']['code']['enum'][11] VEHICLE_ROUTE_IS_FULLY_SEQUENCE_CONSTRAINED root['schemas']['GoogleMapsRouteoptimizationV1SkippedShipmentReason']['properties']['code']['enum'][12] ZERO_PENALTY_COST root['schemas']['GoogleMapsRouteoptimizationV1SkippedShipmentReason']['properties']['code']['enumDescriptions'][8] The vehicle's `ignore` field is true. Experimental: This field's behavior or existence may change in future. root['schemas']['GoogleMapsRouteoptimizationV1SkippedShipmentReason']['properties']['code']['enumDescriptions'][9] The shipment's `ignore` field is true. Experimental: This field's behavior or existence may change in future. root['schemas']['GoogleMapsRouteoptimizationV1SkippedShipmentReason']['properties']['code']['enumDescriptions'][10] The shipment is skipped in the `injected_solution_constraint`. Experimental: This field's behavior or existence may change in future. root['schemas']['GoogleMapsRouteoptimizationV1SkippedShipmentReason']['properties']['code']['enumDescriptions'][11] The vehicle route relaxation specified in the `injected_solution_constraint` doesn't permit any visit to be inserted. Experimental: This field's behavior or existence may change in future. root['schemas']['GoogleMapsRouteoptimizationV1SkippedShipmentReason']['properties']['code']['enumDescriptions'][12] The shipment has a zero penalty cost. While this can be useful as an advanced modelling choice, it may also explain after the fact why a shipment was skipped. Experimental: This field's behavior or existence may change in future.
prod/routeoptimization-v1	dictionary_item_added root['resources']['projects']['methods']['optimizeToursLongRunning'] root['resources']['projects']['methods']['optimizeToursUri'] root['resources']['projects']['resources']['locations']['methods']['optimizeToursLongRunning'] root['resources']['projects']['resources']['locations']['methods']['optimizeToursUri'] root['schemas']['GoogleMapsRouteoptimizationV1OptimizeToursUriRequest'] root['schemas']['GoogleMapsRouteoptimizationV1ShipmentModelObjective'] root['schemas']['GoogleMapsRouteoptimizationV1Uri'] root['schemas']['GoogleMapsRouteoptimizationV1VehicleFullness'] root['schemas']['GoogleMapsRouteoptimizationV1VehicleLoadLimitLoadCost'] root['schemas']['GoogleMapsRouteoptimizationV1AggregatedMetrics']['properties']['performedMandatoryShipmentCount'] root['schemas']['GoogleMapsRouteoptimizationV1AggregatedMetrics']['properties']['performedShipmentPenaltyCostSum'] root['schemas']['GoogleMapsRouteoptimizationV1OptimizeToursRequest']['properties']['parent'] root['schemas']['GoogleMapsRouteoptimizationV1OptimizeToursResponse']['properties']['processedRequest'] root['schemas']['GoogleMapsRouteoptimizationV1ShipmentModel']['properties']['objectives'] root['schemas']['GoogleMapsRouteoptimizationV1ShipmentRoute']['properties']['vehicleFullness'] root['schemas']['GoogleMapsRouteoptimizationV1ShipmentRouteVisit']['properties']['injectedSolutionLocationToken'] root['schemas']['GoogleMapsRouteoptimizationV1ShipmentVisitRequest']['properties']['avoidUTurns'] root['schemas']['GoogleMapsRouteoptimizationV1SkippedShipment']['properties']['estimatedIncompatibleVehicleRatio'] root['schemas']['GoogleMapsRouteoptimizationV1SkippedShipment']['properties']['penaltyCost'] root['schemas']['GoogleMapsRouteoptimizationV1SkippedShipmentReason']['properties']['exampleVehicleIndices'] root['schemas']['GoogleMapsRouteoptimizationV1VehicleLoadLimit']['properties']['costPerKilometer'] root['schemas']['GoogleMapsRouteoptimizationV1VehicleLoadLimit']['properties']['costPerTraveledHour'] root['schemas']['GoogleMapsRouteoptimizationV1Waypoint']['properties']['vehicleStopover'] values_changed root['revision'] new_value 20250511 old_value 20250506 iterable_item_added root['schemas']['GoogleMapsRouteoptimizationV1OptimizeToursRequest']['properties']['solvingMode']['enum'][3] TRANSFORM_AND_RETURN_REQUEST root['schemas']['GoogleMapsRouteoptimizationV1OptimizeToursRequest']['properties']['solvingMode']['enumDescriptions'][3] This mode only works if `ShipmentModel.objectives` is not empty. The request is not solved. It is only validated and filled with costs corresponding to the given objectives. Also see the documentation of `ShipmentModel.objectives`. The resulting request is returned as `OptimizeToursResponse.processed_request`. Experimental: See https://developers.google.com/maps/tt/route-optimization/experimental/objectives/make-request for more details. root['schemas']['GoogleMapsRouteoptimizationV1SkippedShipmentReason']['properties']['code']['enum'][8] VEHICLE_IGNORED root['schemas']['GoogleMapsRouteoptimizationV1SkippedShipmentReason']['properties']['code']['enum'][9] SHIPMENT_IGNORED root['schemas']['GoogleMapsRouteoptimizationV1SkippedShipmentReason']['properties']['code']['enum'][10] SKIPPED_IN_INJECTED_SOLUTION_CONSTRAINT root['schemas']['GoogleMapsRouteoptimizationV1SkippedShipmentReason']['properties']['code']['enum'][11] VEHICLE_ROUTE_IS_FULLY_SEQUENCE_CONSTRAINED root['schemas']['GoogleMapsRouteoptimizationV1SkippedShipmentReason']['properties']['code']['enum'][12] ZERO_PENALTY_COST root['schemas']['GoogleMapsRouteoptimizationV1SkippedShipmentReason']['properties']['code']['enumDescriptions'][8] The vehicle's `ignore` field is true. Experimental: This field's behavior or existence may change in future. root['schemas']['GoogleMapsRouteoptimizationV1SkippedShipmentReason']['properties']['code']['enumDescriptions'][9] The shipment's `ignore` field is true. Experimental: This field's behavior or existence may change in future. root['schemas']['GoogleMapsRouteoptimizationV1SkippedShipmentReason']['properties']['code']['enumDescriptions'][10] The shipment is skipped in the `injected_solution_constraint`. Experimental: This field's behavior or existence may change in future. root['schemas']['GoogleMapsRouteoptimizationV1SkippedShipmentReason']['properties']['code']['enumDescriptions'][11] The vehicle route relaxation specified in the `injected_solution_constraint` doesn't permit any visit to be inserted. Experimental: This field's behavior or existence may change in future. root['schemas']['GoogleMapsRouteoptimizationV1SkippedShipmentReason']['properties']['code']['enumDescriptions'][12] The shipment has a zero penalty cost. While this can be useful as an advanced modelling choice, it may also explain after the fact why a shipment was skipped. Experimental: This field's behavior or existence may change in future.
prod/routes-	values_changed root['revision'] new_value 20250511 old_value 20250507
prod/routes-v1	values_changed root['revision'] new_value 20250511 old_value 20250507
prod/routespreferred-	values_changed root['revision'] new_value 20250511 old_value 20250507
prod/routespreferred-v1	values_changed root['revision'] new_value 20250511 old_value 20250507
prod/routespreferred-v1alpha	values_changed root['revision'] new_value 20250511 old_value 20250507
prod/salesforceshopping-	values_changed root['revision'] new_value 20250511 old_value 20250508
prod/salesforceshopping-v1	values_changed root['revision'] new_value 20250511 old_value 20250508
prod/searchresearcherresults-	values_changed root['revision'] new_value 20250511 old_value 20250508
prod/searchresearcherresults-v1	values_changed root['revision'] new_value 20250511 old_value 20250508
prod/securitycentermanagement-	values_changed root['revision'] new_value 20250511 old_value 20250504
prod/securitycentermanagement-v1	values_changed root['revision'] new_value 20250511 old_value 20250504
prod/shoppingdataintegration-	values_changed root['revision'] new_value 20250511 old_value 20250508
prod/shoppingdataintegration-v1	values_changed root['revision'] new_value 20250511 old_value 20250508
prod/sourcerepo-pa-	values_changed root['revision'] new_value 20250512 old_value 20250505
prod/sourcerepo-pa-v1	values_changed root['revision'] new_value 20250512 old_value 20250505
prod/staging-identitytoolkit.sandbox-v1	values_changed root['revision'] new_value 20250512 old_value 20250502
prod/staging-identitytoolkit.sandbox-v2	values_changed root['revision'] new_value 20250512 old_value 20250501
prod/staging-identitytoolkit.sandbox-v2alpha1	values_changed root['revision'] new_value 20250512 old_value 20250501
prod/staging-identitytoolkit.sandbox-v2beta1	values_changed root['revision'] new_value 20250512 old_value 20250501
prod/staging-notifications-pa.sandbox-	dictionary_item_added root['schemas']['LogsProtoPaymentsConsumerCore__ValuableMetadata']['properties']['valuablePassType'] root['schemas']['LogsProtoPaymentsConsumerCore__ValuableMetadata']['properties']['valuableType']['deprecated'] root['schemas']['LogsProtoPaymentsConsumerCore__ValuableMetadata']['properties']['valuableType']['description'] values_changed root['revision'] new_value 20250511 old_value 20250509
prod/staging-notifications-pa.sandbox-v1	dictionary_item_added root['schemas']['LogsProtoPaymentsConsumerCore__ValuableMetadata']['properties']['valuablePassType'] root['schemas']['LogsProtoPaymentsConsumerCore__ValuableMetadata']['properties']['valuableType']['deprecated'] root['schemas']['LogsProtoPaymentsConsumerCore__ValuableMetadata']['properties']['valuableType']['description'] values_changed root['revision'] new_value 20250511 old_value 20250509
prod/staging-qual-qa-notifications-pa.sandbox-	dictionary_item_added root['schemas']['LogsProtoPaymentsConsumerCore__ValuableMetadata']['properties']['valuablePassType'] root['schemas']['LogsProtoPaymentsConsumerCore__ValuableMetadata']['properties']['valuableType']['deprecated'] root['schemas']['LogsProtoPaymentsConsumerCore__ValuableMetadata']['properties']['valuableType']['description'] values_changed root['revision'] new_value 20250512 old_value 20250509
prod/staging-qual-qa-notifications-pa.sandbox-v1	dictionary_item_added root['schemas']['LogsProtoPaymentsConsumerCore__ValuableMetadata']['properties']['valuablePassType'] root['schemas']['LogsProtoPaymentsConsumerCore__ValuableMetadata']['properties']['valuableType']['deprecated'] root['schemas']['LogsProtoPaymentsConsumerCore__ValuableMetadata']['properties']['valuableType']['description'] values_changed root['revision'] new_value 20250512 old_value 20250509
prod/subscribewithgoogle-	dictionary_item_added root['schemas']['TaxDetails'] root['schemas']['PriceDetails']['properties']['taxDetails'] root['schemas']['RecurrenceDetails']['properties']['planId'] values_changed root['revision'] new_value 20250508 old_value 20250506
prod/subscribewithgoogle-v1	dictionary_item_added root['schemas']['TaxDetails'] root['schemas']['PriceDetails']['properties']['taxDetails'] root['schemas']['RecurrenceDetails']['properties']['planId'] values_changed root['revision'] new_value 20250508 old_value 20250506
prod/transferappliance-v1alpha1	values_changed root['revision'] new_value 20250508 old_value 20250429
prod/travelpartnerprices-	values_changed root['revision'] new_value 20250511 old_value 20250508
prod/travelpartnerprices-v1	values_changed root['revision'] new_value 20250511 old_value 20250508
prod/us-rbmopenmaap-	values_changed root['revision'] new_value 20250512 old_value 20250506
prod/us-rbmopenmaap-v1	values_changed root['revision'] new_value 20250512 old_value 20250506
prod/us-west2-connectgateway-	values_changed root['revision'] new_value 20250509 old_value 20250502
prod/us-west2-connectgateway-v1	values_changed root['revision'] new_value 20250509 old_value 20250502
prod/us-west2-connectgateway-v1beta1	values_changed root['revision'] new_value 20250509 old_value 20250502
prod/vectortile-	values_changed root['revision'] new_value 20250511 old_value 20250507
prod/vectortile-v1	values_changed root['revision'] new_value 20250511 old_value 20250507
prod/workloadcertificate-	values_changed root['revision'] new_value 20240117 old_value 20240103
prod/workloadcertificate-v1alpha1	values_changed root['revision'] new_value 20240117 old_value 20240103
prod/workspaceui-pa-	values_changed root['revision'] new_value 20250507 old_value 20250505
prod/workspaceui-pa-v1	values_changed root['revision'] new_value 20250507 old_value 20250505
prod/workspacevideo-pa-	values_changed root['revision'] new_value 20250511 old_value 20250506
prod/workspacevideo-pa-v1	values_changed root['revision'] new_value 20250511 old_value 20250506