Entity related alerts via UDM and REST API

Take a look at these threads to see if it can help put you in the right direction: 

The UDM Search Query Strategy

In Google SecOps, alerts are stored as UDM events where metadata.event_type = "ALERT". To query alerts for a specific entity, you must target the generalized entity fields (principal, target, src, or observer) or use the specialized graph.entity structures if you have Entity Context Graph (ECG) enabled.

Depending on your entity type (e.g., an IP address or Hostname), use one of the following UDM query patterns:

metadata.event_type = "ALERT" AND (principal.ip = "x.x.x.x" OR target.ip = "x.x.x.x" OR src.ip = "x.x.x.x")

If you want to pull detections that Google SecOps has automatically associated with a centralized entity profile:

metadata.event_type = "ALERT" AND graph.entity.ip = "x.x.x.x"

Fetching via REST API
To programmatically execute this search and grab the alerts, use the Chronicle Detection Engine API / Search API v2. You will pass the structured UDM query through a POST request.

{
  "query": "metadata.event_type = \"ALERT\" AND (principal.ip = \"x.x.x.x\" OR target.ip = \"x.x.x.x\")",
  "startTime": "2026-06-15T00:00:00Z",
  "endTime": "2026-06-16T15:00:00Z",
  "limit": 50
}