Since we can now change the deployment state of individual curated rules, I expected to read (GET) the same information using one of the following endpoints:https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.rules.deployments/list - this returns deployment state for custom rules only; https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.rules/getDeployment - this returns 404s when tried on curated rule IDs.Any guidance on how to GET there? 😁

Solved

Chronicle API Endpoint to GET deployment state of a curated rule

Forum|Forum|7 hours ago
July 23, 2026
5 replies
38 views

+11

ar3diu
Silver 2

Since we can now change the deployment state of individual curated rules, I expected to read (GET) the same information using one of the following endpoints:

https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.rules.deployments/list - this returns deployment state for custom rules only;
https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.rules/getDeployment - this returns 404s when tried on curated rule IDs.

Any guidance on how to GET there? 😁

Best answer by whathehack81

Hi ar3diu,

You are correct—the curatedRuleSetDeployments resource only returns deployment state at the curated rule-set and precision level. It does not expose an override applied to one individual curated rule.

For the individual rule state, use the unified Rules API rather than curatedRules or rules/{id}/deployment.

First, list Google-owned curated rules using the configuration view:

GET https://{endpoint}/v1alpha/projects/{project}/locations/{location}/instances/{instance}/rules?filter=rule_owner%3A%22GOOGLE%22&view=CONFIG_ONLY&pageSize=5000

Locate the specific rule’s unified resource name:

projects/{project}/locations/{location}/instances/{instance}/rules/ur_{rule_id}

Then retrieve that individual curated rule:

GET https://{endpoint}/v1alpha/projects/{project}/locations/{location}/instances/{instance}/rules/ur_{rule_id}?view=CONFIG_ONLY

The returned Rule configuration contains the individual state:

{

"displayName": "...",

"ruleOwner": "GOOGLE",

"alertingEnabled": false,

"liveModeEnabled": true,

"archived": false,

"executionState": "DEFAULT"

}

The important distinction is that the identifier must be the unified ur_... rule ID. A legacy curated-rule ID passed to:

/rules/{rule}/deployment

will return a 404 because that endpoint expects the legacy RuleDeployment child resource.

CONFIG_ONLY is specifically intended to return the per-rule configuration, including alerting and live-mode state. The unified Rules API is currently Pre-GA, so availability may depend on whether the unified rules feature is enabled for the instance. �

Google Cloud Documentation +2

R.Q

whathehack81

+14

cmorris
Staff
Forum|Forum|7 hours ago
July 23, 2026

Please try

https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.curatedRuleSetCategories.curatedRuleSets.curatedRuleSetDeployments

+11

ar3diu
Author
Silver 2
Forum|Forum|6 hours ago
July 23, 2026

@cmorris This is for curated rule sets. I need to read the deployment state of an individual curated rule from a curated rule set.

In my understanding, you could have a curated rule set where alerting is ON for all PRECISE rules and you configure this at the curated rule set level, but then go in the Rules tab and turn OFF alerting on one of the PRECISE rules in that specific rule set.

whathehack81
Bronze 1
Answer
Forum|Forum|6 hours ago
July 23, 2026