Creates a resident Event Threat Detection custom module at the scope of the given organization, folder, or project, and creates inherited custom modules for all descendants of the given parent. These modules are enabled by default.
HTTP request
POST https://securitycentermanagement.googleapis.com/v1/{parent=projects/*/locations/*}/eventThreatDetectionCustomModules
Required. Name of parent for the module, in one of the following formats:
organizations/{organization}/locations/{location}
folders/{folder}/locations/{location}
projects/{project}/locations/{location}
Query parameters
Parameters
validateOnly
boolean
Optional. When set to true, the request will be validated (including IAM checks), but no module will be created. An OK response indicates that the request is valid, while an error response indicates that the request is invalid.
If the request is valid, a subsequent request to create the module could still fail for one of the following reasons:
The state of your cloud resources changed; for example, you lost a required IAM permission
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-07-01 UTC."],[],[],null,["# Method: projects.locations.eventThreatDetectionCustomModules.create\n\n- [HTTP request](#body.HTTP_TEMPLATE)\n- [Path parameters](#body.PATH_PARAMETERS)\n- [Query parameters](#body.QUERY_PARAMETERS)\n- [Request body](#body.request_body)\n- [Response body](#body.response_body)\n- [Authorization scopes](#body.aspect)\n- [IAM Permissions](#body.aspect_1)\n- [Try it!](#try-it)\n\nCreates a resident Event Threat Detection custom module at the scope of the given organization, folder, or project, and creates inherited custom modules for all descendants of the given parent. These modules are enabled by default.\n\n### HTTP request\n\n`POST https://securitycentermanagement.googleapis.com/v1/{parent=projects/*/locations/*}/eventThreatDetectionCustomModules`\n\nThe URL uses [gRPC Transcoding](https://google.aip.dev/127) syntax.\n\n### Path parameters\n\n### Query parameters\n\n### Request body\n\nThe request body contains an instance of [EventThreatDetectionCustomModule](/security-command-center/docs/reference/security-center-management/rest/v1/folders.locations.eventThreatDetectionCustomModules#EventThreatDetectionCustomModule).\n\n### Response body\n\nIf successful, the response body contains a newly created instance of [EventThreatDetectionCustomModule](/security-command-center/docs/reference/security-center-management/rest/v1/folders.locations.eventThreatDetectionCustomModules#EventThreatDetectionCustomModule).\n\n### Authorization scopes\n\nRequires the following OAuth scope:\n\n- `https://www.googleapis.com/auth/cloud-platform`\n\nFor more information, see the [Authentication Overview](/docs/authentication#authorization-gcp).\n\n### IAM Permissions\n\nRequires the following [IAM](https://cloud.google.com/iam/docs) permission on the `parent` resource:\n\n- `securitycentermanagement.eventThreatDetectionCustomModules.create`\n\nFor more information, see the [IAM documentation](https://cloud.google.com/iam/docs)."]]