Returns the analyzedInvocations Resource.
aggregate(parent, filter=None, pageSize=None, pageToken=None, x__xgafv=None)
Aggregates AnalyzedSessions across MonitoredAgents. To aggregate across all MonitoredAgents in a location, use the following format for the parent field: `projects/{project}/locations/{location}/monitoredAgents/-`
Retrieves the next page of results.
Close httplib2 connections.
get(name, view=None, x__xgafv=None)
Gets the details of a specific AnalyzedSession.
list(parent, filter=None, orderBy=None, pageSize=None, pageToken=None, view=None, x__xgafv=None)
Lists AnalyzedSessions in a MonitoredAgent.
Retrieves the next page of results.
aggregate(parent, filter=None, pageSize=None, pageToken=None, x__xgafv=None)
Aggregates AnalyzedSessions across MonitoredAgents. To aggregate across all MonitoredAgents in a location, use the following format for the parent field: `projects/{project}/locations/{location}/monitoredAgents/-`
Args:
parent: string, Required. The parent MonitoredAgent resource. Use the `-` wildcard for the monitored_agent segment to aggregate across multiple agents in the location. Format: `projects/{project}/locations/{location}/monitoredAgents/{monitored_agent}` (required)
filter: string, Optional. Filter expression restricting which AnalyzedSessions are included in the aggregation. Supports a subset of the `ListAnalyzedSessionsRequest.filter` grammar: a closed `detection_time` window with both bounds required. The `severity` clause is not supported here. If empty, the aggregation covers the last 3 days. Example: ``` detection_time >= "2024-01-01T00:00:00Z" AND detection_time <= "2024-01-08T00:00:00Z" ```
pageSize: integer, Optional. The standard list page size. The maximum value is 100; values above 100 will be coerced to 100. If unspecified, at most 10 MonitoredAgents will be returned.
pageToken: string, Optional. The standard list page token.
x__xgafv: string, V1 error format.
Allowed values
1 - v1 error format
2 - v2 error format
Returns:
An object of the form:
{ # Contains aggregated AnalyzedSession statistics, grouped by MonitoredAgent.
"agentAggregates": [ # Aggregated statistics — exactly one entry per unique MonitoredAgent matched by the request.
{ # Contains aggregated statistics for one MonitoredAgent.
"agentDisplayName": "A String", # Output only. The human-readable display name of the MonitoredAgent.
"agentResourceName": "A String", # The resource name or identifier of the agent. Matches `AgentResource.agent` on the corresponding `MonitoredAgent`, so the format depends on that agent's `AgentResource.agent_type`: * `REASONING_ENGINE`: `projects/{project}/locations/{location}/reasoningEngines/{reasoning_engine}` * `CLOUD_RUN_SERVICE`, `GKE_WORKLOAD`, `GCE_INSTANCE`: the resource name of the agent's runtime. * `AGENT_TYPE_OTHER`: a stable identifier for the agent.
"agentStatus": "A String", # Output only. The enablement state of the MonitoredAgent (for example, ACTIVE, DISABLED, or ENABLING).
"agentType": "A String", # Output only. The runtime the agent is hosted on (for example, `CLOUD_RUN_SERVICE`). `AGENT_TYPE_UNSPECIFIED` means the runtime is unknown to this service, which is distinct from `AGENT_TYPE_OTHER` (known, and not one of the enumerated Google Cloud runtimes).
"anomalousSessionsCount": 42, # The number of anomalous (SESSION_STATE_FLAGGED) sessions for this agent.
"latestSessionTime": "A String", # The latest session update_time observed for this agent.
"location": "A String", # Output only. The Google Cloud location (region) of the agent (for example, `us-central1`). Empty when the agent is not enrolled or its location is unknown.
"monitoredAgent": "A String", # The MonitoredAgent resource name. Format: `projects/{project}/locations/{location}/monitoredAgents/{monitored_agent}`
"severities": { # Map of severity level (string representation of Severity) to detector summaries aggregated across all sessions for this agent. The key is the string representation of Severity enum: "SEVERITY_UNSPECIFIED", "SEVERITY_CRITICAL", "SEVERITY_HIGH", "SEVERITY_MEDIUM", "SEVERITY_LOW".
"a_key": { # Breaks down anomalies by severity.
"detectorIds": [ # The list of detectors summaries for this severity level.
"A String",
],
"sessionsCount": 42, # Output only. The number of distinct sessions whose maximum severity equals `severity_level`. Each session is counted in exactly one bucket (its highest severity). Scope depends on where this appears: a global count on `AggregateAnalyzedSessionsResponse.summary`, per-agent on `agent_aggregates` entries, and page-scoped on `ListAnalyzedSessionsResponse`.
"severityLevel": "A String", # The severity level of the detector.
},
},
"totalSessionsCount": 42, # The number of analyzed sessions for this agent matched by the request.
},
],
"nextPageToken": "A String", # A token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
"summary": { # The view summary. # Overall summary across every MonitoredAgent included in the response.
"anomalousAgentsCount": 42, # Output only. The number of distinct agents in the request scope with at least one anomalous session in the time window. On `AggregateAnalyzedSessionsResponse.summary` this is a global count; it is not populated on `ListAnalyzedSessionsResponse.summary`.
"anomalousSessionsCount": 42, # Number of anomalous sessions.
"llmScannedSessionsCount": 42, # Output only. The number of distinct sessions in the time window that were scanned by the LLM judge.
"severities": { # The list of severity summaries for the analyzed sessions. The key is the string representation of Severity enum: "SEVERITY_UNSPECIFIED", "SEVERITY_CRITICAL", "SEVERITY_HIGH", "SEVERITY_MEDIUM", "SEVERITY_LOW".
"a_key": { # Breaks down anomalies by severity.
"detectorIds": [ # The list of detectors summaries for this severity level.
"A String",
],
"sessionsCount": 42, # Output only. The number of distinct sessions whose maximum severity equals `severity_level`. Each session is counted in exactly one bucket (its highest severity). Scope depends on where this appears: a global count on `AggregateAnalyzedSessionsResponse.summary`, per-agent on `agent_aggregates` entries, and page-scoped on `ListAnalyzedSessionsResponse`.
"severityLevel": "A String", # The severity level of the detector.
},
},
"totalSessionsCount": 42, # Total number of sessions.
},
}
aggregate_next()
Retrieves the next page of results.
Args:
previous_request: The request for the previous page. (required)
previous_response: The response from the request for the previous page. (required)
Returns:
A request object that you can call 'execute()' on to request the next
page. Returns None if there are no more items in the collection.
close()
Close httplib2 connections.
get(name, view=None, x__xgafv=None)
Gets the details of a specific AnalyzedSession.
Args:
name: string, Required. The name of the AnalyzedSession resource. Format: `projects/{project}/locations/{location}/monitoredAgents/{monitored_agent}/analyzedSessions/{analyzed_session}` (required)
view: string, Optional. Resource view to control which fields are returned.
Allowed values
ANALYZED_SESSION_VIEW_UNSPECIFIED - The default view: BASIC.
ANALYZED_SESSION_VIEW_BASIC - Basic view includes only the fields needed for the list table (name, session_id, created_time, severity counts).
ANALYZED_SESSION_VIEW_FULL - Full view includes all fields, including the detailed assessment.
x__xgafv: string, V1 error format.
Allowed values
1 - v1 error format
2 - v2 error format
Returns:
An object of the form:
{ # Represents an analyzed session for a monitored agent.
"agentDisplayName": "A String", # Output only. The human-readable display name of the MonitoredAgent that owns this session. May be empty when the session's agent is not enrolled as a MonitoredAgent; the `agent_resource_name` is always present and can be used as a fallback identifier.
"agentResourceName": "A String", # Output only. The resource name or identifier of the agent that ran this session. Matches `AgentResource.agent` on the corresponding `MonitoredAgent`, so the format depends on that agent's `AgentResource.agent_type`: * `REASONING_ENGINE`: `projects/{project}/locations/{location}/reasoningEngines/{reasoning_engine}` * `CLOUD_RUN_SERVICE`, `GKE_WORKLOAD`, `GCE_INSTANCE`: the resource name of the agent's runtime. * `AGENT_TYPE_OTHER`: a stable identifier for the agent.
"agentState": "A String", # Output only. The current enablement state of the MonitoredAgent that owns this session (for example, ACTIVE, DISABLED, or ENABLING). Defaults to ENABLEMENT_STATE_UNSPECIFIED when the agent is not enrolled or its state is unknown.
"agentType": "A String", # Output only. The runtime that the agent which ran this session is hosted on (for example, `CLOUD_RUN_SERVICE`). `AGENT_TYPE_UNSPECIFIED` means the runtime is unknown to this service -- the agent is not enrolled as a `MonitoredAgent`, or was enrolled before its runtime was recorded. That is distinct from `AGENT_TYPE_OTHER`, which means the runtime is known and is not one of the enumerated Google Cloud runtimes.
"assessment": { # Contains the detailed assessment for an analyzed session. # Output only. Overall security assessment. Populated only in FULL view.
"detectorFindings": [ # The list of detector findings.
{ # The details of a detector's assessment within an analyzed session.
"detectorId": "A String", # The detector ID.
"displayName": "A String", # The detector display name.
"explanation": "A String", # The explanation of the finding.
"probability": 3.14, # The probability that this finding is an anomaly, in the range [0.0, 1.0].
"recommendations": [ # The list of recommendations for this detector finding.
"A String",
],
"severity": "A String", # The severity of the finding.
},
],
},
"createTime": "A String", # Output only. The creation time of the session.
"latestAnalyzedTime": "A String", # Output only. The latest analyzed time of the session.
"location": "A String", # Output only. The Google Cloud location (region) of the agent that ran this session (for example, `us-central1`). Empty when the agent is not enrolled or its location is unknown.
"name": "A String", # Identifier. The resource name of the AnalyzedSession.
"sessionId": "A String", # Output only. The session ID.
"sessionState": "A String", # Output only. The state of the session.
"severities": { # Output only. Map of severity counts for listing analyzed sessions. The key is the string representation of Severity. Populated in BASIC view only.
"a_key": { # Breaks down anomalies by severity.
"detectorIds": [ # The list of detectors summaries for this severity level.
"A String",
],
"sessionsCount": 42, # Output only. The number of distinct sessions whose maximum severity equals `severity_level`. Each session is counted in exactly one bucket (its highest severity). Scope depends on where this appears: a global count on `AggregateAnalyzedSessionsResponse.summary`, per-agent on `agent_aggregates` entries, and page-scoped on `ListAnalyzedSessionsResponse`.
"severityLevel": "A String", # The severity level of the detector.
},
},
"userId": "A String", # Output only. The user ID.
}
list(parent, filter=None, orderBy=None, pageSize=None, pageToken=None, view=None, x__xgafv=None)
Lists AnalyzedSessions in a MonitoredAgent.
Args:
parent: string, Required. The parent MonitoredAgent resource. Format: `projects/{project}/locations/{location}/monitoredAgents/{monitored_agent}` (required)
filter: string, Optional. Filter expression restricting which AnalyzedSessions are returned. Supports a subset of AIP-160: a closed `detection_time` window (both bounds required), an equality on `severity`, and an equality on `agent_type`, joined by `AND`. Each clause is optional, may appear at most once, and may appear in any order. The `severity` value is the **canonical** `Severity` enum name -- `SEVERITY_CRITICAL`, `SEVERITY_HIGH`, `SEVERITY_MEDIUM` or `SEVERITY_LOW`. Short forms such as `"CRITICAL"` are rejected, as is `SEVERITY_UNSPECIFIED`. It matches sessions whose *maximum* severity equals that bucket: a session that fires at both LOW and CRITICAL matches `severity = "SEVERITY_CRITICAL"`, not `severity = "SEVERITY_LOW"`. The `agent_type` value is the canonical `AgentResource.AgentType` enum name -- `REASONING_ENGINE`, `CLOUD_RUN_SERVICE`, `GKE_WORKLOAD`, `GCE_INSTANCE`, `AGENT_TYPE_OTHER` or `AGENT_TYPE_UNSPECIFIED` -- and matches sessions run by an agent on that runtime. Unlike `severity`, `agent_type` accepts its `UNSPECIFIED` value. The two are not analogous: a session always has a computed severity bucket, so `SEVERITY_UNSPECIFIED` is never returned and filtering on it could only match nothing. `AGENT_TYPE_UNSPECIFIED` *is* returned -- it is what `AnalyzedSession.agent_type` reports for an agent whose runtime was never recorded -- so it must remain filterable. Example (time window, severity and runtime): ``` detection_time >= "2024-01-01T00:00:00Z" AND detection_time <= "2024-01-08T00:00:00Z" AND severity = "SEVERITY_CRITICAL" AND agent_type = "CLOUD_RUN_SERVICE" ``` If empty, results are restricted to the last 7 days with no severity or runtime restriction. Other fields, additional operators, set membership (`IN`), and boolean combinations (`OR`, `NOT`, parentheses) are not yet supported.
orderBy: string, Optional. Comma-separated list of fields to sort by, following AIP-132 syntax. The default sort direction is ascending; append " desc" to a field to sort descending. Supported fields (any other field yields INVALID_ARGUMENT): * `latest_detection_time` - the session's most-recent flagged detection time. `latest_detection_time desc` puts the newest sessions first. * `max_severity_rank` - the session's bucketed maximum severity, ranked LOW=1 < MEDIUM=2 < HIGH=3 < CRITICAL=4. `max_severity_rank desc` puts the most-severe sessions first. * `agent_display_name` - the MonitoredAgent's display name. Sorted as a STRING (case-sensitive, code-point order). If empty, defaults to `latest_detection_time desc`. Multi-field sort (for example, `max_severity_rank desc, latest_detection_time desc`) is supported. The `order_by` value MUST match the value used on the call that minted any supplied `page_token` (AIP-158). Mismatches yield INVALID_ARGUMENT.
pageSize: integer, Optional. The maximum number of analyzed sessions to return.
pageToken: string, Optional. A page token, received from a previous `ListAnalyzedSessions` call.
view: string, Optional. Resource view to control which fields are returned.
Allowed values
ANALYZED_SESSION_VIEW_UNSPECIFIED - The default view: BASIC.
ANALYZED_SESSION_VIEW_BASIC - Basic view includes only the fields needed for the list table (name, session_id, created_time, severity counts).
ANALYZED_SESSION_VIEW_FULL - Full view includes all fields, including the detailed assessment.
x__xgafv: string, V1 error format.
Allowed values
1 - v1 error format
2 - v2 error format
Returns:
An object of the form:
{ # Response to list analyzed sessions.
"analyzedSessions": [ # The list of analyzed sessions.
{ # Represents an analyzed session for a monitored agent.
"agentDisplayName": "A String", # Output only. The human-readable display name of the MonitoredAgent that owns this session. May be empty when the session's agent is not enrolled as a MonitoredAgent; the `agent_resource_name` is always present and can be used as a fallback identifier.
"agentResourceName": "A String", # Output only. The resource name or identifier of the agent that ran this session. Matches `AgentResource.agent` on the corresponding `MonitoredAgent`, so the format depends on that agent's `AgentResource.agent_type`: * `REASONING_ENGINE`: `projects/{project}/locations/{location}/reasoningEngines/{reasoning_engine}` * `CLOUD_RUN_SERVICE`, `GKE_WORKLOAD`, `GCE_INSTANCE`: the resource name of the agent's runtime. * `AGENT_TYPE_OTHER`: a stable identifier for the agent.
"agentState": "A String", # Output only. The current enablement state of the MonitoredAgent that owns this session (for example, ACTIVE, DISABLED, or ENABLING). Defaults to ENABLEMENT_STATE_UNSPECIFIED when the agent is not enrolled or its state is unknown.
"agentType": "A String", # Output only. The runtime that the agent which ran this session is hosted on (for example, `CLOUD_RUN_SERVICE`). `AGENT_TYPE_UNSPECIFIED` means the runtime is unknown to this service -- the agent is not enrolled as a `MonitoredAgent`, or was enrolled before its runtime was recorded. That is distinct from `AGENT_TYPE_OTHER`, which means the runtime is known and is not one of the enumerated Google Cloud runtimes.
"assessment": { # Contains the detailed assessment for an analyzed session. # Output only. Overall security assessment. Populated only in FULL view.
"detectorFindings": [ # The list of detector findings.
{ # The details of a detector's assessment within an analyzed session.
"detectorId": "A String", # The detector ID.
"displayName": "A String", # The detector display name.
"explanation": "A String", # The explanation of the finding.
"probability": 3.14, # The probability that this finding is an anomaly, in the range [0.0, 1.0].
"recommendations": [ # The list of recommendations for this detector finding.
"A String",
],
"severity": "A String", # The severity of the finding.
},
],
},
"createTime": "A String", # Output only. The creation time of the session.
"latestAnalyzedTime": "A String", # Output only. The latest analyzed time of the session.
"location": "A String", # Output only. The Google Cloud location (region) of the agent that ran this session (for example, `us-central1`). Empty when the agent is not enrolled or its location is unknown.
"name": "A String", # Identifier. The resource name of the AnalyzedSession.
"sessionId": "A String", # Output only. The session ID.
"sessionState": "A String", # Output only. The state of the session.
"severities": { # Output only. Map of severity counts for listing analyzed sessions. The key is the string representation of Severity. Populated in BASIC view only.
"a_key": { # Breaks down anomalies by severity.
"detectorIds": [ # The list of detectors summaries for this severity level.
"A String",
],
"sessionsCount": 42, # Output only. The number of distinct sessions whose maximum severity equals `severity_level`. Each session is counted in exactly one bucket (its highest severity). Scope depends on where this appears: a global count on `AggregateAnalyzedSessionsResponse.summary`, per-agent on `agent_aggregates` entries, and page-scoped on `ListAnalyzedSessionsResponse`.
"severityLevel": "A String", # The severity level of the detector.
},
},
"userId": "A String", # Output only. The user ID.
},
],
"nextPageToken": "A String", # A token to retrieve the next page of results.
"summary": { # The view summary. # Summary statistics computed across the sessions on the current page only. For statistics across the entire result set, use AggregateAnalyzedSessions.
"anomalousAgentsCount": 42, # Output only. The number of distinct agents in the request scope with at least one anomalous session in the time window. On `AggregateAnalyzedSessionsResponse.summary` this is a global count; it is not populated on `ListAnalyzedSessionsResponse.summary`.
"anomalousSessionsCount": 42, # Number of anomalous sessions.
"llmScannedSessionsCount": 42, # Output only. The number of distinct sessions in the time window that were scanned by the LLM judge.
"severities": { # The list of severity summaries for the analyzed sessions. The key is the string representation of Severity enum: "SEVERITY_UNSPECIFIED", "SEVERITY_CRITICAL", "SEVERITY_HIGH", "SEVERITY_MEDIUM", "SEVERITY_LOW".
"a_key": { # Breaks down anomalies by severity.
"detectorIds": [ # The list of detectors summaries for this severity level.
"A String",
],
"sessionsCount": 42, # Output only. The number of distinct sessions whose maximum severity equals `severity_level`. Each session is counted in exactly one bucket (its highest severity). Scope depends on where this appears: a global count on `AggregateAnalyzedSessionsResponse.summary`, per-agent on `agent_aggregates` entries, and page-scoped on `ListAnalyzedSessionsResponse`.
"severityLevel": "A String", # The severity level of the detector.
},
},
"totalSessionsCount": 42, # Total number of sessions.
},
}
list_next()
Retrieves the next page of results.
Args:
previous_request: The request for the previous page. (required)
previous_response: The response from the request for the previous page. (required)
Returns:
A request object that you can call 'execute()' on to request the next
page. Returns None if there are no more items in the collection.