Resource ID segment making up resource name. It identifies the resource within its parent collection as described in https://google.aip.dev/122.

Optional. Filter criteria.

Supported fields for filtering include:

• audit.create_time
• audit.creator
• audit.update_time
• audit.updater
• detail.data_leak.discovery_document_ids
• detail.data_leak.severity
• detail.detail_type
• detail.initial_access_broker.discovery_document_ids
• detail.initial_access_broker.severity
• detail.insider_threat.discovery_document_ids
• detail.insider_threat.severity
• finding_count
• priority_analysis.priority_level
• relevance_analysis.confidence
• relevance_analysis.relevance_level
• relevance_analysis.relevant
• severity_analysis.severity_level
• state

Examples:

• detail.detail_type = "initial_access_broker"
• detail.detail_type != "data_leak"
• detail.insider_threat.severity = "HIGH"
• audit.create_time >= "2026-04-03T00:00:00Z" AND audit.create_time < "2026-04-06T00:00:00Z"
• state = "NEW" OR state = "TRIAGED"
• severity_analysis.severity_level = "SEVERITY_LEVEL_CRITICAL"

Optional. Order by criteria in the csv format: "field1, field2 desc" or "field1, field2" or "field1 asc, field2". If a field is specified without asc or desc, ascending order is used by default. Supported fields for ordering are identical to those supported for filtering.

Examples:

• audit.create_time desc
• audit.update_time asc
• audit.create_time desc, severity_analysis.severity_level desc

Optional. Page token.