Variables
Collection_CollectionType_name, Collection_CollectionType_value
var (
Collection_CollectionType_name = map[int32]string{
0: "COLLECTION_TYPE_UNSPECIFIED",
1: "TELEMETRY_ALERT",
2: "GCTI_FINDING",
3: "RULE_DETECTION",
4: "MACHINE_INTELLIGENCE_ALERT",
5: "SOAR_ALERT",
}
Collection_CollectionType_value = map[string]int32{
"COLLECTION_TYPE_UNSPECIFIED": 0,
"TELEMETRY_ALERT": 1,
"GCTI_FINDING": 2,
"UPPERCASE_ALERT": 2,
"RULE_DETECTION": 3,
"MACHINE_INTELLIGENCE_ALERT": 4,
"SOAR_ALERT": 5,
}
)Enum value maps for Collection_CollectionType.
Collection_DetectionTimingDetails_name, Collection_DetectionTimingDetails_value
var (
Collection_DetectionTimingDetails_name = map[int32]string{
0: "DETECTION_TIMING_DETAILS_UNSPECIFIED",
1: "DETECTION_TIMING_DETAILS_REPROCESSING",
2: "DETECTION_TIMING_DETAILS_RETROHUNT",
}
Collection_DetectionTimingDetails_value = map[string]int32{
"DETECTION_TIMING_DETAILS_UNSPECIFIED": 0,
"DETECTION_TIMING_DETAILS_REPROCESSING": 1,
"DETECTION_TIMING_DETAILS_RETROHUNT": 2,
}
)Enum value maps for Collection_DetectionTimingDetails.
Collection_RunFrequency_name, Collection_RunFrequency_value
var (
Collection_RunFrequency_name = map[int32]string{
0: "RUN_FREQUENCY_UNSPECIFIED",
1: "RUN_FREQUENCY_REALTIME",
2: "RUN_FREQUENCY_HOURLY",
3: "RUN_FREQUENCY_DAILY",
}
Collection_RunFrequency_value = map[string]int32{
"RUN_FREQUENCY_UNSPECIFIED": 0,
"RUN_FREQUENCY_REALTIME": 1,
"RUN_FREQUENCY_HOURLY": 2,
"RUN_FREQUENCY_DAILY": 3,
}
)Enum value maps for Collection_RunFrequency.
EntityGraphEnrichment_EnrichmentType_name, EntityGraphEnrichment_EnrichmentType_value
var (
EntityGraphEnrichment_EnrichmentType_name = map[int32]string{
0: "ENRICHMENT_TYPE_UNSPECIFIED",
1: "APPEND",
2: "OVERRIDE",
}
EntityGraphEnrichment_EnrichmentType_value = map[string]int32{
"ENRICHMENT_TYPE_UNSPECIFIED": 0,
"APPEND": 1,
"OVERRIDE": 2,
}
)Enum value maps for EntityGraphEnrichment_EnrichmentType.
ResponsePlatformInfo_ResponsePlatformType_name, ResponsePlatformInfo_ResponsePlatformType_value
var (
ResponsePlatformInfo_ResponsePlatformType_name = map[int32]string{
0: "RESPONSE_PLATFORM_TYPE_UNSPECIFIED",
1: "RESPONSE_PLATFORM_TYPE_SIEMPLIFY",
}
ResponsePlatformInfo_ResponsePlatformType_value = map[string]int32{
"RESPONSE_PLATFORM_TYPE_UNSPECIFIED": 0,
"RESPONSE_PLATFORM_TYPE_SIEMPLIFY": 1,
}
)Enum value maps for ResponsePlatformInfo_ResponsePlatformType.
EntityMetadata_EntityType_name, EntityMetadata_EntityType_value
var (
EntityMetadata_EntityType_name = map[int32]string{
0: "UNKNOWN_ENTITYTYPE",
1: "ASSET",
10000: "USER",
10001: "GROUP",
2: "RESOURCE",
3: "IP_ADDRESS",
9: "CIDR_BLOCK",
4: "FILE",
5: "DOMAIN_NAME",
6: "URL",
7: "MUTEX",
8: "METRIC",
}
EntityMetadata_EntityType_value = map[string]int32{
"UNKNOWN_ENTITYTYPE": 0,
"ASSET": 1,
"USER": 10000,
"GROUP": 10001,
"RESOURCE": 2,
"IP_ADDRESS": 3,
"CIDR_BLOCK": 9,
"FILE": 4,
"DOMAIN_NAME": 5,
"URL": 6,
"MUTEX": 7,
"METRIC": 8,
}
)Enum value maps for EntityMetadata_EntityType.
EntityMetadata_SourceType_name, EntityMetadata_SourceType_value
var (
EntityMetadata_SourceType_name = map[int32]string{
0: "SOURCE_TYPE_UNSPECIFIED",
1: "ENTITY_CONTEXT",
2: "DERIVED_CONTEXT",
3: "GLOBAL_CONTEXT",
}
EntityMetadata_SourceType_value = map[string]int32{
"SOURCE_TYPE_UNSPECIFIED": 0,
"ENTITY_CONTEXT": 1,
"DERIVED_CONTEXT": 2,
"GLOBAL_CONTEXT": 3,
}
)Enum value maps for EntityMetadata_SourceType.
Relation_Relationship_name, Relation_Relationship_value
var (
Relation_Relationship_name = map[int32]string{
0: "RELATIONSHIP_UNSPECIFIED",
1: "OWNS",
2: "ADMINISTERS",
3: "MEMBER",
4: "EXECUTES",
5: "DOWNLOADED_FROM",
6: "CONTACTS",
}
Relation_Relationship_value = map[string]int32{
"RELATIONSHIP_UNSPECIFIED": 0,
"OWNS": 1,
"ADMINISTERS": 2,
"MEMBER": 3,
"EXECUTES": 4,
"DOWNLOADED_FROM": 5,
"CONTACTS": 6,
}
)Enum value maps for Relation_Relationship.
Relation_Directionality_name, Relation_Directionality_value
var (
Relation_Directionality_name = map[int32]string{
0: "DIRECTIONALITY_UNSPECIFIED",
1: "BIDIRECTIONAL",
2: "UNIDIRECTIONAL",
}
Relation_Directionality_value = map[string]int32{
"DIRECTIONALITY_UNSPECIFIED": 0,
"BIDIRECTIONAL": 1,
"UNIDIRECTIONAL": 2,
}
)Enum value maps for Relation_Directionality.
Relation_EntityLabel_name, Relation_EntityLabel_value
var (
Relation_EntityLabel_name = map[int32]string{
0: "ENTITY_LABEL_UNSPECIFIED",
1: "PRINCIPAL",
2: "TARGET",
3: "OBSERVER",
4: "SRC",
5: "NETWORK",
6: "SECURITY_RESULT",
7: "INTERMEDIARY",
}
Relation_EntityLabel_value = map[string]int32{
"ENTITY_LABEL_UNSPECIFIED": 0,
"PRINCIPAL": 1,
"TARGET": 2,
"OBSERVER": 3,
"SRC": 4,
"NETWORK": 5,
"SECURITY_RESULT": 6,
"INTERMEDIARY": 7,
}
)Enum value maps for Relation_EntityLabel.
Metric_AggregateFunction_name, Metric_AggregateFunction_value
var (
Metric_AggregateFunction_name = map[int32]string{
0: "AGGREGATE_FUNCTION_UNSPECIFIED",
1: "MIN",
2: "MAX",
3: "COUNT",
4: "SUM",
5: "AVG",
6: "STDDEV",
}
Metric_AggregateFunction_value = map[string]int32{
"AGGREGATE_FUNCTION_UNSPECIFIED": 0,
"MIN": 1,
"MAX": 2,
"COUNT": 3,
"SUM": 4,
"AVG": 5,
"STDDEV": 6,
}
)Enum value maps for Metric_AggregateFunction.
Metric_MetricName_name, Metric_MetricName_value
var (
Metric_MetricName_name = map[int32]string{
0: "METRIC_NAME_UNSPECIFIED",
1: "NETWORK_BYTES_INBOUND",
2: "NETWORK_BYTES_OUTBOUND",
3: "NETWORK_BYTES_TOTAL",
4: "AUTH_ATTEMPTS_SUCCESS",
5: "AUTH_ATTEMPTS_FAIL",
6: "AUTH_ATTEMPTS_TOTAL",
7: "DNS_BYTES_OUTBOUND",
8: "NETWORK_FLOWS_INBOUND",
9: "NETWORK_FLOWS_OUTBOUND",
10: "NETWORK_FLOWS_TOTAL",
11: "DNS_QUERIES_SUCCESS",
12: "DNS_QUERIES_FAIL",
13: "DNS_QUERIES_TOTAL",
14: "FILE_EXECUTIONS_SUCCESS",
15: "FILE_EXECUTIONS_FAIL",
16: "FILE_EXECUTIONS_TOTAL",
17: "HTTP_QUERIES_SUCCESS",
18: "HTTP_QUERIES_FAIL",
19: "HTTP_QUERIES_TOTAL",
20: "WORKSPACE_EMAILS_SENT_TOTAL",
21: "WORKSPACE_TOTAL_DOWNLOAD_ACTIONS",
22: "WORKSPACE_TOTAL_CHANGE_ACTIONS",
23: "WORKSPACE_AUTH_ATTEMPTS_TOTAL",
24: "WORKSPACE_NETWORK_BYTES_OUTBOUND",
25: "WORKSPACE_NETWORK_BYTES_TOTAL",
26: "ALERT_EVENT_NAME_COUNT",
27: "RESOURCE_CREATION_TOTAL",
28: "RESOURCE_CREATION_SUCCESS",
29: "RESOURCE_READ_SUCCESS",
30: "RESOURCE_READ_FAIL",
31: "RESOURCE_DELETION_SUCCESS",
32: "RESOURCE_CREATION_FAIL",
33: "RESOURCE_DELETION_FAIL",
34: "RESOURCE_DELETION_TOTAL",
35: "RESOURCE_READ_TOTAL",
36: "RESOURCE_WRITTEN_FAIL",
37: "RESOURCE_WRITTEN_SUCCESS",
38: "RESOURCE_WRITTEN_TOTAL",
39: "UDM_DATA_PRESENCE_SUMMARY",
}
Metric_MetricName_value = map[string]int32{
"METRIC_NAME_UNSPECIFIED": 0,
"NETWORK_BYTES_INBOUND": 1,
"NETWORK_BYTES_OUTBOUND": 2,
"NETWORK_BYTES_TOTAL": 3,
"AUTH_ATTEMPTS_SUCCESS": 4,
"AUTH_ATTEMPTS_FAIL": 5,
"AUTH_ATTEMPTS_TOTAL": 6,
"DNS_BYTES_OUTBOUND": 7,
"NETWORK_FLOWS_INBOUND": 8,
"NETWORK_FLOWS_OUTBOUND": 9,
"NETWORK_FLOWS_TOTAL": 10,
"DNS_QUERIES_SUCCESS": 11,
"DNS_QUERIES_FAIL": 12,
"DNS_QUERIES_TOTAL": 13,
"FILE_EXECUTIONS_SUCCESS": 14,
"FILE_EXECUTIONS_FAIL": 15,
"FILE_EXECUTIONS_TOTAL": 16,
"HTTP_QUERIES_SUCCESS": 17,
"HTTP_QUERIES_FAIL": 18,
"HTTP_QUERIES_TOTAL": 19,
"WORKSPACE_EMAILS_SENT_TOTAL": 20,
"WORKSPACE_TOTAL_DOWNLOAD_ACTIONS": 21,
"WORKSPACE_TOTAL_CHANGE_ACTIONS": 22,
"WORKSPACE_AUTH_ATTEMPTS_TOTAL": 23,
"WORKSPACE_NETWORK_BYTES_OUTBOUND": 24,
"WORKSPACE_NETWORK_BYTES_TOTAL": 25,
"ALERT_EVENT_NAME_COUNT": 26,
"RESOURCE_CREATION_TOTAL": 27,
"RESOURCE_CREATION_SUCCESS": 28,
"RESOURCE_READ_SUCCESS": 29,
"RESOURCE_READ_FAIL": 30,
"RESOURCE_DELETION_SUCCESS": 31,
"RESOURCE_CREATION_FAIL": 32,
"RESOURCE_DELETION_FAIL": 33,
"RESOURCE_DELETION_TOTAL": 34,
"RESOURCE_READ_TOTAL": 35,
"RESOURCE_WRITTEN_FAIL": 36,
"RESOURCE_WRITTEN_SUCCESS": 37,
"RESOURCE_WRITTEN_TOTAL": 38,
"UDM_DATA_PRESENCE_SUMMARY": 39,
}
)Enum value maps for Metric_MetricName.
Metric_Dimension_name, Metric_Dimension_value
var (
Metric_Dimension_name = map[int32]string{
0: "DIMENSION_UNSPECIFIED",
1: "PRINCIPAL_DEVICE",
2: "TARGET_USER",
3: "TARGET_DEVICE",
4: "PRINCIPAL_USER",
5: "TARGET_IP",
6: "PRINCIPAL_FILE_HASH",
7: "PRINCIPAL_COUNTRY",
8: "SECURITY_CATEGORY",
9: "NETWORK_ASN",
10: "CLIENT_CERTIFICATE_HASH",
11: "DNS_QUERY_TYPE",
12: "DNS_DOMAIN",
13: "HTTP_USER_AGENT",
14: "EVENT_TYPE",
15: "PRODUCT_NAME",
16: "PRODUCT_EVENT_TYPE",
17: "PARENT_FOLDER_PATH",
18: "TARGET_RESOURCE_NAME",
19: "PRINCIPAL_APPLICATION",
20: "TARGET_APPLICATION",
21: "EMAIL_TO_ADDRESS",
22: "EMAIL_FROM_ADDRESS",
23: "MAIL_ID",
24: "PRINCIPAL_IP",
25: "SECURITY_ACTION",
28: "SECURITY_RULE_ID",
29: "TARGET_NETWORK_ORGANIZATION_NAME",
30: "PRINCIPAL_NETWORK_ORGANIZATION_NAME",
31: "PRINCIPAL_PROCESS_FILE_PATH",
32: "PRINCIPAL_PROCESS_FILE_HASH",
33: "SECURITY_RESULT_RULE_NAME",
34: "TARGET_RESOURCE_LABEL_KEY",
35: "VENDOR_NAME",
36: "TARGET_RESOURCE_TYPE",
37: "TARGET_LOCATION_NAME",
38: "LOG_TYPE",
39: "TARGET_HOSTNAME",
}
Metric_Dimension_value = map[string]int32{
"DIMENSION_UNSPECIFIED": 0,
"PRINCIPAL_DEVICE": 1,
"TARGET_USER": 2,
"TARGET_DEVICE": 3,
"PRINCIPAL_USER": 4,
"TARGET_IP": 5,
"PRINCIPAL_FILE_HASH": 6,
"PRINCIPAL_COUNTRY": 7,
"SECURITY_CATEGORY": 8,
"NETWORK_ASN": 9,
"CLIENT_CERTIFICATE_HASH": 10,
"DNS_QUERY_TYPE": 11,
"DNS_DOMAIN": 12,
"HTTP_USER_AGENT": 13,
"EVENT_TYPE": 14,
"PRODUCT_NAME": 15,
"PRODUCT_EVENT_TYPE": 16,
"PARENT_FOLDER_PATH": 17,
"TARGET_RESOURCE_NAME": 18,
"PRINCIPAL_APPLICATION": 19,
"TARGET_APPLICATION": 20,
"EMAIL_TO_ADDRESS": 21,
"EMAIL_FROM_ADDRESS": 22,
"MAIL_ID": 23,
"PRINCIPAL_IP": 24,
"SECURITY_ACTION": 25,
"SECURITY_RULE_ID": 28,
"TARGET_NETWORK_ORGANIZATION_NAME": 29,
"PRINCIPAL_NETWORK_ORGANIZATION_NAME": 30,
"PRINCIPAL_PROCESS_FILE_PATH": 31,
"PRINCIPAL_PROCESS_FILE_HASH": 32,
"SECURITY_RESULT_RULE_NAME": 33,
"TARGET_RESOURCE_LABEL_KEY": 34,
"VENDOR_NAME": 35,
"TARGET_RESOURCE_TYPE": 36,
"TARGET_LOCATION_NAME": 37,
"LOG_TYPE": 38,
"TARGET_HOSTNAME": 39,
}
)Enum value maps for Metric_Dimension.
Id_Namespace_name, Id_Namespace_value
var (
Id_Namespace_name = map[int32]string{
0: "NORMALIZED_TELEMETRY",
1: "RAW_TELEMETRY",
2: "RULE_DETECTIONS",
3: "UPPERCASE",
4: "MACHINE_INTELLIGENCE",
5: "SECURITY_COMMAND_CENTER",
6: "UNSPECIFIED",
7: "SOAR_ALERT",
8: "VIRUS_TOTAL",
}
Id_Namespace_value = map[string]int32{
"NORMALIZED_TELEMETRY": 0,
"RAW_TELEMETRY": 1,
"RULE_DETECTIONS": 2,
"UPPERCASE": 3,
"MACHINE_INTELLIGENCE": 4,
"SECURITY_COMMAND_CENTER": 5,
"UNSPECIFIED": 6,
"SOAR_ALERT": 7,
"VIRUS_TOTAL": 8,
}
)Enum value maps for Id_Namespace.
Verdict_name, Verdict_value
var (
Verdict_name = map[int32]string{
0: "VERDICT_UNSPECIFIED",
1: "TRUE_POSITIVE",
2: "FALSE_POSITIVE",
}
Verdict_value = map[string]int32{
"VERDICT_UNSPECIFIED": 0,
"TRUE_POSITIVE": 1,
"FALSE_POSITIVE": 2,
}
)Enum value maps for Verdict.
Reputation_name, Reputation_value
var (
Reputation_name = map[int32]string{
0: "REPUTATION_UNSPECIFIED",
1: "USEFUL",
2: "NOT_USEFUL",
}
Reputation_value = map[string]int32{
"REPUTATION_UNSPECIFIED": 0,
"USEFUL": 1,
"NOT_USEFUL": 2,
}
)Enum value maps for Reputation.
Status_name, Status_value
var (
Status_name = map[int32]string{
0: "STATUS_UNSPECIFIED",
1: "NEW",
2: "REVIEWED",
3: "CLOSED",
4: "OPEN",
}
Status_value = map[string]int32{
"STATUS_UNSPECIFIED": 0,
"NEW": 1,
"REVIEWED": 2,
"CLOSED": 3,
"OPEN": 4,
}
)Enum value maps for Status.
Priority_name, Priority_value
var (
Priority_name = map[int32]string{
0: "PRIORITY_UNSPECIFIED",
100: "PRIORITY_INFO",
200: "PRIORITY_LOW",
300: "PRIORITY_MEDIUM",
400: "PRIORITY_HIGH",
500: "PRIORITY_CRITICAL",
}
Priority_value = map[string]int32{
"PRIORITY_UNSPECIFIED": 0,
"PRIORITY_INFO": 100,
"PRIORITY_LOW": 200,
"PRIORITY_MEDIUM": 300,
"PRIORITY_HIGH": 400,
"PRIORITY_CRITICAL": 500,
}
)Enum value maps for Priority.
Reason_name, Reason_value
var (
Reason_name = map[int32]string{
0: "REASON_UNSPECIFIED",
1: "REASON_NOT_MALICIOUS",
2: "REASON_MALICIOUS",
3: "REASON_MAINTENANCE",
}
Reason_value = map[string]int32{
"REASON_UNSPECIFIED": 0,
"REASON_NOT_MALICIOUS": 1,
"REASON_MALICIOUS": 2,
"REASON_MAINTENANCE": 3,
}
)Enum value maps for Reason.
ThreatVerdict_name, ThreatVerdict_value
var (
ThreatVerdict_name = map[int32]string{
0: "THREAT_VERDICT_UNSPECIFIED",
1: "UNDETECTED",
2: "SUSPICIOUS",
3: "MALICIOUS",
}
ThreatVerdict_value = map[string]int32{
"THREAT_VERDICT_UNSPECIFIED": 0,
"UNDETECTED": 1,
"SUSPICIOUS": 2,
"MALICIOUS": 3,
}
)Enum value maps for ThreatVerdict.
Metadata_EventTimestampAttribute_name, Metadata_EventTimestampAttribute_value
var (
Metadata_EventTimestampAttribute_name = map[int32]string{
0: "EVENT_TIMESTAMP_ATTRIBUTE_UNSPECIFIED",
1: "FILE_LAST_ACCESS_TIME",
2: "FILE_LAST_MODIFIED_TIME",
3: "FILE_METADATA_LAST_CHANGE_TIME",
4: "FILE_CREATION_TIME",
5: "COLLECTED_TIME",
6: "COLLECTED",
7: "ACCESSED",
8: "CHANGED",
9: "CREATED",
10: "FILE_NAME_ACCESSED",
11: "FILE_NAME_CHANGED",
12: "FILE_NAME_CREATED",
13: "FILE_NAME_LAST_ACCESSED",
14: "FILE_NAME_LAST_MODIFIED",
15: "FILE_NAME_METADATA_LAST_CHANGED",
16: "FILE_NAME_MODIFIED",
17: "LAST_ACCESSED",
18: "LAST_MODIFIED",
19: "METADATA_LAST_CHANGED",
20: "MODIFIED",
21: "ADDED",
22: "BACKED_UP",
23: "LAST_CONNECTED",
24: "DELETED",
25: "ENDED",
26: "EXITED",
27: "EXPIRED",
28: "FIRST_ACCESSED",
29: "APPEARED",
30: "INSTALLED",
31: "LAST_ACTIVE",
32: "LAST_LOGGED_IN",
33: "LAST_LOGIN_ATTEMPT",
34: "LAST_PASSWORD_SET",
35: "LAST_PRINTED",
36: "LAST_RESUMED",
37: "LAST_EXECUTED",
38: "LAST_SEEN",
39: "LAST_SHUTDOWN",
40: "LAST_UPDATED",
41: "LAST_USED",
42: "LAST_VISITED",
43: "LINKED",
44: "METADATA_MODIFIED",
45: "CONTENT_MODIFIED",
46: "PURCHASED",
47: "RECORDED",
48: "REQUEST_RECEIVED",
49: "RESPONSE_SENT",
50: "SCHEDULED_TO_END",
51: "SCHEDULED_TO_START",
52: "SENT",
53: "STARTED",
54: "UPDATED",
55: "VALIDATED",
56: "MOST_RECENT_RUN",
57: "NEXT_RUN",
58: "VISITED",
59: "TARGET_CREATED",
60: "VOLUME_CREATED",
61: "POST_CHECKED",
62: "SYNCHRONIZED",
63: "ITEM_CREATED",
64: "ITEM_MODIFIED",
65: "DOCUMENT_LAST_SAVED",
66: "LAST_REGISTERED",
67: "LAUNCHED",
68: "FIRST_VISITED",
69: "FIRST_SEEN",
70: "DOWNLOADED",
}
Metadata_EventTimestampAttribute_value = map[string]int32{
"EVENT_TIMESTAMP_ATTRIBUTE_UNSPECIFIED": 0,
"FILE_LAST_ACCESS_TIME": 1,
"FILE_LAST_MODIFIED_TIME": 2,
"FILE_METADATA_LAST_CHANGE_TIME": 3,
"FILE_CREATION_TIME": 4,
"COLLECTED_TIME": 5,
"COLLECTED": 6,
"ACCESSED": 7,
"CHANGED": 8,
"CREATED": 9,
"FILE_NAME_ACCESSED": 10,
"FILE_NAME_CHANGED": 11,
"FILE_NAME_CREATED": 12,
"FILE_NAME_LAST_ACCESSED": 13,
"FILE_NAME_LAST_MODIFIED": 14,
"FILE_NAME_METADATA_LAST_CHANGED": 15,
"FILE_NAME_MODIFIED": 16,
"LAST_ACCESSED": 17,
"LAST_MODIFIED": 18,
"METADATA_LAST_CHANGED": 19,
"MODIFIED": 20,
"ADDED": 21,
"BACKED_UP": 22,
"LAST_CONNECTED": 23,
"DELETED": 24,
"ENDED": 25,
"EXITED": 26,
"EXPIRED": 27,
"FIRST_ACCESSED": 28,
"APPEARED": 29,
"INSTALLED": 30,
"LAST_ACTIVE": 31,
"LAST_LOGGED_IN": 32,
"LAST_LOGIN_ATTEMPT": 33,
"LAST_PASSWORD_SET": 34,
"LAST_PRINTED": 35,
"LAST_RESUMED": 36,
"LAST_EXECUTED": 37,
"LAST_SEEN": 38,
"LAST_SHUTDOWN": 39,
"LAST_UPDATED": 40,
"LAST_USED": 41,
"LAST_VISITED": 42,
"LINKED": 43,
"METADATA_MODIFIED": 44,
"CONTENT_MODIFIED": 45,
"PURCHASED": 46,
"RECORDED": 47,
"REQUEST_RECEIVED": 48,
"RESPONSE_SENT": 49,
"SCHEDULED_TO_END": 50,
"SCHEDULED_TO_START": 51,
"SENT": 52,
"STARTED": 53,
"UPDATED": 54,
"VALIDATED": 55,
"MOST_RECENT_RUN": 56,
"NEXT_RUN": 57,
"VISITED": 58,
"TARGET_CREATED": 59,
"VOLUME_CREATED": 60,
"POST_CHECKED": 61,
"SYNCHRONIZED": 62,
"ITEM_CREATED": 63,
"ITEM_MODIFIED": 64,
"DOCUMENT_LAST_SAVED": 65,
"LAST_REGISTERED": 66,
"LAUNCHED": 67,
"FIRST_VISITED": 68,
"FIRST_SEEN": 69,
"DOWNLOADED": 70,
}
)Enum value maps for Metadata_EventTimestampAttribute.
Metadata_EventType_name, Metadata_EventType_value
var (
Metadata_EventType_name = map[int32]string{ /* 105 elements not displayed */
}
Metadata_EventType_value = map[string]int32{ /* 105 elements not displayed */
}
)Enum value maps for Metadata_EventType.
Metadata_EnrichmentState_name, Metadata_EnrichmentState_value
var (
Metadata_EnrichmentState_name = map[int32]string{
0: "ENRICHMENT_STATE_UNSPECIFIED",
1: "ENRICHED",
2: "UNENRICHED",
}
Metadata_EnrichmentState_value = map[string]int32{
"ENRICHMENT_STATE_UNSPECIFIED": 0,
"ENRICHED": 1,
"UNENRICHED": 2,
}
)Enum value maps for Metadata_EnrichmentState.
Network_Direction_name, Network_Direction_value
var (
Network_Direction_name = map[int32]string{
0: "UNKNOWN_DIRECTION",
1: "INBOUND",
2: "OUTBOUND",
3: "BROADCAST",
}
Network_Direction_value = map[string]int32{
"UNKNOWN_DIRECTION": 0,
"INBOUND": 1,
"OUTBOUND": 2,
"BROADCAST": 3,
}
)Enum value maps for Network_Direction.
Network_IpProtocol_name, Network_IpProtocol_value
var (
Network_IpProtocol_name = map[int32]string{
0: "UNKNOWN_IP_PROTOCOL",
1: "ICMP",
2: "IGMP",
6: "TCP",
17: "UDP",
41: "IP6IN4",
47: "GRE",
50: "ESP",
58: "ICMP6",
88: "EIGRP",
97: "ETHERIP",
103: "PIM",
112: "VRRP",
132: "SCTP",
}
Network_IpProtocol_value = map[string]int32{
"UNKNOWN_IP_PROTOCOL": 0,
"ICMP": 1,
"IGMP": 2,
"TCP": 6,
"UDP": 17,
"IP6IN4": 41,
"GRE": 47,
"ESP": 50,
"ICMP6": 58,
"EIGRP": 88,
"ETHERIP": 97,
"PIM": 103,
"VRRP": 112,
"SCTP": 132,
}
)Enum value maps for Network_IpProtocol.
Network_ApplicationProtocol_name, Network_ApplicationProtocol_value
var (
Network_ApplicationProtocol_name = map[int32]string{
0: "UNKNOWN_APPLICATION_PROTOCOL",
1: "AFP",
2: "APPC",
3: "AMQP",
4: "ATOM",
5: "BEEP",
6: "BITCOIN",
7: "BIT_TORRENT",
8: "CFDP",
67: "CIP",
9: "COAP",
68: "COTP",
66: "DCERPC",
10: "DDS",
11: "DEVICE_NET",
4000: "DHCP",
69: "DICOM",
70: "DNP3",
3000: "DNS",
12: "E_DONKEY",
13: "ENRP",
14: "FAST_TRACK",
15: "FINGER",
16: "FREENET",
17: "FTAM",
71: "GOOSE",
18: "GOPHER",
77: "GRPC",
19: "HL7",
20: "H323",
2000: "HTTP",
2001: "HTTPS",
72: "IEC104",
21: "IRCP",
22: "KADEMLIA",
65: "KRB5",
23: "LDAP",
24: "LPD",
25: "MIME",
73: "MMS",
26: "MODBUS",
27: "MQTT",
28: "NETCONF",
29: "NFS",
30: "NIS",
31: "NNTP",
32: "NTCIP",
33: "NTP",
34: "OSCAR",
35: "PNRP",
74: "PTP",
1000: "QUIC",
36: "RDP",
37: "RELP",
38: "RIP",
39: "RLOGIN",
40: "RPC",
41: "RTMP",
42: "RTP",
43: "RTPS",
44: "RTSP",
45: "SAP",
46: "SDP",
47: "SIP",
48: "SLP",
49: "SMB",
50: "SMTP",
75: "SNMP",
51: "SNTP",
52: "SSH",
53: "SSMS",
54: "STYX",
76: "SV",
55: "TCAP",
56: "TDS",
57: "TOR",
58: "TSP",
59: "VTP",
60: "WHOIS",
61: "WEB_DAV",
62: "X400",
63: "X500",
64: "XMPP",
78: "FTP",
}
Network_ApplicationProtocol_value = map[string]int32{
"UNKNOWN_APPLICATION_PROTOCOL": 0,
"AFP": 1,
"APPC": 2,
"AMQP": 3,
"ATOM": 4,
"BEEP": 5,
"BITCOIN": 6,
"BIT_TORRENT": 7,
"CFDP": 8,
"CIP": 67,
"COAP": 9,
"COTP": 68,
"DCERPC": 66,
"DDS": 10,
"DEVICE_NET": 11,
"DHCP": 4000,
"DICOM": 69,
"DNP3": 70,
"DNS": 3000,
"E_DONKEY": 12,
"ENRP": 13,
"FAST_TRACK": 14,
"FINGER": 15,
"FREENET": 16,
"FTAM": 17,
"GOOSE": 71,
"GOPHER": 18,
"GRPC": 77,
"HL7": 19,
"H323": 20,
"HTTP": 2000,
"HTTPS": 2001,
"IEC104": 72,
"IRCP": 21,
"KADEMLIA": 22,
"KRB5": 65,
"LDAP": 23,
"LPD": 24,
"MIME": 25,
"MMS": 73,
"MODBUS": 26,
"MQTT": 27,
"NETCONF": 28,
"NFS": 29,
"NIS": 30,
"NNTP": 31,
"NTCIP": 32,
"NTP": 33,
"OSCAR": 34,
"PNRP": 35,
"PTP": 74,
"QUIC": 1000,
"RDP": 36,
"RELP": 37,
"RIP": 38,
"RLOGIN": 39,
"RPC": 40,
"RTMP": 41,
"RTP": 42,
"RTPS": 43,
"RTSP": 44,
"SAP": 45,
"SDP": 46,
"SIP": 47,
"SLP": 48,
"SMB": 49,
"SMTP": 50,
"SNMP": 75,
"SNTP": 51,
"SSH": 52,
"SSMS": 53,
"STYX": 54,
"SV": 76,
"TCAP": 55,
"TDS": 56,
"TOR": 57,
"TSP": 58,
"VTP": 59,
"WHOIS": 60,
"WEB_DAV": 61,
"X400": 62,
"X500": 63,
"XMPP": 64,
"FTP": 78,
}
)Enum value maps for Network_ApplicationProtocol.
Network_ConnectionState_name, Network_ConnectionState_value
var (
Network_ConnectionState_name = map[int32]string{
0: "CONNECTION_STATE_UNSPECIFIED",
1: "LISTENING",
2: "ESTABLISHED",
3: "TIME_WAIT",
4: "CLOSE_WAIT",
5: "CLOSED",
6: "SYN_SENT",
7: "SYN_RECEIVED",
8: "FIN_WAIT1",
9: "FIN_WAIT2",
10: "LAST_ACK",
}
Network_ConnectionState_value = map[string]int32{
"CONNECTION_STATE_UNSPECIFIED": 0,
"LISTENING": 1,
"ESTABLISHED": 2,
"TIME_WAIT": 3,
"CLOSE_WAIT": 4,
"CLOSED": 5,
"SYN_SENT": 6,
"SYN_RECEIVED": 7,
"FIN_WAIT1": 8,
"FIN_WAIT2": 9,
"LAST_ACK": 10,
}
)Enum value maps for Network_ConnectionState.
Authentication_AuthType_name, Authentication_AuthType_value
var (
Authentication_AuthType_name = map[int32]string{
0: "AUTHTYPE_UNSPECIFIED",
1: "MACHINE",
2: "SSO",
3: "VPN",
4: "PHYSICAL",
5: "TACACS",
}
Authentication_AuthType_value = map[string]int32{
"AUTHTYPE_UNSPECIFIED": 0,
"MACHINE": 1,
"SSO": 2,
"VPN": 3,
"PHYSICAL": 4,
"TACACS": 5,
}
)Enum value maps for Authentication_AuthType.
Authentication_Mechanism_name, Authentication_Mechanism_value
var (
Authentication_Mechanism_name = map[int32]string{
0: "MECHANISM_UNSPECIFIED",
1: "USERNAME_PASSWORD",
2: "OTP",
3: "HARDWARE_KEY",
4: "LOCAL",
5: "REMOTE",
6: "REMOTE_INTERACTIVE",
7: "MECHANISM_OTHER",
8: "BADGE_READER",
9: "NETWORK",
10: "BATCH",
11: "SERVICE",
12: "UNLOCK",
13: "NETWORK_CLEAR_TEXT",
14: "NEW_CREDENTIALS",
15: "INTERACTIVE",
16: "CACHED_INTERACTIVE",
17: "CACHED_REMOTE_INTERACTIVE",
18: "CACHED_UNLOCK",
19: "BIOMETRIC",
20: "WEARABLE",
}
Authentication_Mechanism_value = map[string]int32{
"MECHANISM_UNSPECIFIED": 0,
"USERNAME_PASSWORD": 1,
"OTP": 2,
"HARDWARE_KEY": 3,
"LOCAL": 4,
"REMOTE": 5,
"REMOTE_INTERACTIVE": 6,
"MECHANISM_OTHER": 7,
"BADGE_READER": 8,
"NETWORK": 9,
"BATCH": 10,
"SERVICE": 11,
"UNLOCK": 12,
"NETWORK_CLEAR_TEXT": 13,
"NEW_CREDENTIALS": 14,
"INTERACTIVE": 15,
"CACHED_INTERACTIVE": 16,
"CACHED_REMOTE_INTERACTIVE": 17,
"CACHED_UNLOCK": 18,
"BIOMETRIC": 19,
"WEARABLE": 20,
}
)Enum value maps for Authentication_Mechanism.
Authentication_AuthenticationStatus_name, Authentication_AuthenticationStatus_value
var (
Authentication_AuthenticationStatus_name = map[int32]string{
0: "UNKNOWN_AUTHENTICATION_STATUS",
1: "ACTIVE",
2: "SUSPENDED",
3: "NO_ACTIVE_CREDENTIALS",
4: "DELETED",
}
Authentication_AuthenticationStatus_value = map[string]int32{
"UNKNOWN_AUTHENTICATION_STATUS": 0,
"ACTIVE": 1,
"SUSPENDED": 2,
"NO_ACTIVE_CREDENTIALS": 3,
"DELETED": 4,
}
)Enum value maps for Authentication_AuthenticationStatus.
Authentication_Outcome_name, Authentication_Outcome_value
var (
Authentication_Outcome_name = map[int32]string{
0: "OUTCOME_UNSPECIFIED",
1: "SUCCESS",
2: "FAILURE",
}
Authentication_Outcome_value = map[string]int32{
"OUTCOME_UNSPECIFIED": 0,
"SUCCESS": 1,
"FAILURE": 2,
}
)Enum value maps for Authentication_Outcome.
LinuxUtmp_RecordType_name, LinuxUtmp_RecordType_value
var (
LinuxUtmp_RecordType_name = map[int32]string{
0: "RECORD_TYPE_UNSPECIFIED",
1: "RUN_LVL",
2: "BOOT_TIME",
3: "NEW_TIME",
4: "OLD_TIME",
5: "INIT_PROCESS",
6: "LOGIN_PROCESS",
7: "USER_PROCESS",
8: "DEAD_PROCESS",
9: "ACCOUNTING",
}
LinuxUtmp_RecordType_value = map[string]int32{
"RECORD_TYPE_UNSPECIFIED": 0,
"RUN_LVL": 1,
"BOOT_TIME": 2,
"NEW_TIME": 3,
"OLD_TIME": 4,
"INIT_PROCESS": 5,
"LOGIN_PROCESS": 6,
"USER_PROCESS": 7,
"DEAD_PROCESS": 8,
"ACCOUNTING": 9,
}
)Enum value maps for LinuxUtmp_RecordType.
WindowsEventLog_Channel_name, WindowsEventLog_Channel_value
var (
WindowsEventLog_Channel_name = map[int32]string{
0: "CHANNEL_UNSPECIFIED",
1: "SECURITY",
2: "SYSTEM",
3: "APPLICATION",
4: "SETUP",
5: "FORWARDED_EVENTS",
6: "OTHER",
}
WindowsEventLog_Channel_value = map[string]int32{
"CHANNEL_UNSPECIFIED": 0,
"SECURITY": 1,
"SYSTEM": 2,
"APPLICATION": 3,
"SETUP": 4,
"FORWARDED_EVENTS": 5,
"OTHER": 6,
}
)Enum value maps for WindowsEventLog_Channel.
Vulnerability_Severity_name, Vulnerability_Severity_value
var (
Vulnerability_Severity_name = map[int32]string{
0: "UNKNOWN_SEVERITY",
1: "LOW",
2: "MEDIUM",
3: "HIGH",
4: "CRITICAL",
}
Vulnerability_Severity_value = map[string]int32{
"UNKNOWN_SEVERITY": 0,
"LOW": 1,
"MEDIUM": 2,
"HIGH": 3,
"CRITICAL": 4,
}
)Enum value maps for Vulnerability_Severity.
Process_TokenElevationType_name, Process_TokenElevationType_value
var (
Process_TokenElevationType_name = map[int32]string{
0: "UNKNOWN",
1: "TYPE_1",
2: "TYPE_2",
3: "TYPE_3",
}
Process_TokenElevationType_value = map[string]int32{
"UNKNOWN": 0,
"TYPE_1": 1,
"TYPE_2": 2,
"TYPE_3": 3,
}
)Enum value maps for Process_TokenElevationType.
Process_State_name, Process_State_value
var (
Process_State_name = map[int32]string{
0: "STATE_UNSPECIFIED",
1: "RUNNING",
2: "SLEEPING",
3: "DISK_SLEEP",
4: "STOPPED",
5: "TRACING_STOP",
6: "ZOMBIE",
7: "DEAD",
8: "WAKE_KILL",
9: "WAKING",
10: "PARKED",
11: "IDLE",
12: "LOCKED",
13: "WAITING",
14: "SUSPENDED",
}
Process_State_value = map[string]int32{
"STATE_UNSPECIFIED": 0,
"RUNNING": 1,
"SLEEPING": 2,
"DISK_SLEEP": 3,
"STOPPED": 4,
"TRACING_STOP": 5,
"ZOMBIE": 6,
"DEAD": 7,
"WAKE_KILL": 8,
"WAKING": 9,
"PARKED": 10,
"IDLE": 11,
"LOCKED": 12,
"WAITING": 13,
"SUSPENDED": 14,
}
)Enum value maps for Process_State.
FindingVariable_Type_name, FindingVariable_Type_value
var (
FindingVariable_Type_name = map[int32]string{
0: "TYPE_UNSPECIFIED",
1: "MATCH",
2: "OUTCOME",
}
FindingVariable_Type_value = map[string]int32{
"TYPE_UNSPECIFIED": 0,
"MATCH": 1,
"OUTCOME": 2,
}
)Enum value maps for FindingVariable_Type.
SecurityResult_VerdictResponse_name, SecurityResult_VerdictResponse_value
var (
SecurityResult_VerdictResponse_name = map[int32]string{
0: "VERDICT_RESPONSE_UNSPECIFIED",
1: "MALICIOUS",
2: "BENIGN",
}
SecurityResult_VerdictResponse_value = map[string]int32{
"VERDICT_RESPONSE_UNSPECIFIED": 0,
"MALICIOUS": 1,
"BENIGN": 2,
}
)Enum value maps for SecurityResult_VerdictResponse.
SecurityResult_IoCStatsType_name, SecurityResult_IoCStatsType_value
var (
SecurityResult_IoCStatsType_name = map[int32]string{
0: "UNSPECIFIED_IOC_STATS_TYPE",
1: "MANDIANT_SOURCES",
2: "THIRD_PARTY_SOURCES",
3: "THREAT_INTELLIGENCE_IOC_STATS",
}
SecurityResult_IoCStatsType_value = map[string]int32{
"UNSPECIFIED_IOC_STATS_TYPE": 0,
"MANDIANT_SOURCES": 1,
"THIRD_PARTY_SOURCES": 2,
"THREAT_INTELLIGENCE_IOC_STATS": 3,
}
)Enum value maps for SecurityResult_IoCStatsType.
SecurityResult_VerdictType_name, SecurityResult_VerdictType_value
var (
SecurityResult_VerdictType_name = map[int32]string{
0: "VERDICT_TYPE_UNSPECIFIED",
1: "PROVIDER_ML_VERDICT",
2: "ANALYST_VERDICT",
}
SecurityResult_VerdictType_value = map[string]int32{
"VERDICT_TYPE_UNSPECIFIED": 0,
"PROVIDER_ML_VERDICT": 1,
"ANALYST_VERDICT": 2,
}
)Enum value maps for SecurityResult_VerdictType.
SecurityResult_SecurityCategory_name, SecurityResult_SecurityCategory_value
var (
SecurityResult_SecurityCategory_name = map[int32]string{
0: "UNKNOWN_CATEGORY",
10000: "SOFTWARE_MALICIOUS",
10100: "SOFTWARE_SUSPICIOUS",
10200: "SOFTWARE_PUA",
20000: "NETWORK_MALICIOUS",
20100: "NETWORK_SUSPICIOUS",
20200: "NETWORK_CATEGORIZED_CONTENT",
20300: "NETWORK_DENIAL_OF_SERVICE",
20400: "NETWORK_RECON",
20500: "NETWORK_COMMAND_AND_CONTROL",
30000: "ACL_VIOLATION",
40000: "AUTH_VIOLATION",
50000: "EXPLOIT",
60000: "DATA_EXFILTRATION",
60100: "DATA_AT_REST",
60200: "DATA_DESTRUCTION",
60300: "TOR_EXIT_NODE",
70000: "MAIL_SPAM",
70100: "MAIL_PHISHING",
70200: "MAIL_SPOOFING",
80000: "POLICY_VIOLATION",
90001: "SOCIAL_ENGINEERING",
90002: "PHISHING",
}
SecurityResult_SecurityCategory_value = map[string]int32{
"UNKNOWN_CATEGORY": 0,
"SOFTWARE_MALICIOUS": 10000,
"SOFTWARE_SUSPICIOUS": 10100,
"SOFTWARE_PUA": 10200,
"NETWORK_MALICIOUS": 20000,
"NETWORK_SUSPICIOUS": 20100,
"NETWORK_CATEGORIZED_CONTENT": 20200,
"NETWORK_DENIAL_OF_SERVICE": 20300,
"NETWORK_RECON": 20400,
"NETWORK_COMMAND_AND_CONTROL": 20500,
"ACL_VIOLATION": 30000,
"AUTH_VIOLATION": 40000,
"EXPLOIT": 50000,
"DATA_EXFILTRATION": 60000,
"DATA_AT_REST": 60100,
"DATA_DESTRUCTION": 60200,
"TOR_EXIT_NODE": 60300,
"MAIL_SPAM": 70000,
"MAIL_PHISHING": 70100,
"MAIL_SPOOFING": 70200,
"POLICY_VIOLATION": 80000,
"SOCIAL_ENGINEERING": 90001,
"PHISHING": 90002,
}
)Enum value maps for SecurityResult_SecurityCategory.
SecurityResult_AlertState_name, SecurityResult_AlertState_value
var (
SecurityResult_AlertState_name = map[int32]string{
0: "UNSPECIFIED",
1: "NOT_ALERTING",
2: "ALERTING",
}
SecurityResult_AlertState_value = map[string]int32{
"UNSPECIFIED": 0,
"NOT_ALERTING": 1,
"ALERTING": 2,
}
)Enum value maps for SecurityResult_AlertState.
SecurityResult_Action_name, SecurityResult_Action_value
var (
SecurityResult_Action_name = map[int32]string{
0: "UNKNOWN_ACTION",
1: "ALLOW",
2: "BLOCK",
3: "ALLOW_WITH_MODIFICATION",
4: "QUARANTINE",
5: "FAIL",
6: "CHALLENGE",
}
SecurityResult_Action_value = map[string]int32{
"UNKNOWN_ACTION": 0,
"ALLOW": 1,
"BLOCK": 2,
"ALLOW_WITH_MODIFICATION": 3,
"QUARANTINE": 4,
"FAIL": 5,
"CHALLENGE": 6,
}
)Enum value maps for SecurityResult_Action.
SecurityResult_ProductSeverity_name, SecurityResult_ProductSeverity_value
var (
SecurityResult_ProductSeverity_name = map[int32]string{
0: "UNKNOWN_SEVERITY",
100: "INFORMATIONAL",
150: "ERROR",
101: "NONE",
200: "LOW",
300: "MEDIUM",
400: "HIGH",
500: "CRITICAL",
}
SecurityResult_ProductSeverity_value = map[string]int32{
"UNKNOWN_SEVERITY": 0,
"INFORMATIONAL": 100,
"ERROR": 150,
"NONE": 101,
"LOW": 200,
"MEDIUM": 300,
"HIGH": 400,
"CRITICAL": 500,
}
)Enum value maps for SecurityResult_ProductSeverity.
SecurityResult_ProductConfidence_name, SecurityResult_ProductConfidence_value
var (
SecurityResult_ProductConfidence_name = map[int32]string{
0: "UNKNOWN_CONFIDENCE",
200: "LOW_CONFIDENCE",
300: "MEDIUM_CONFIDENCE",
400: "HIGH_CONFIDENCE",
}
SecurityResult_ProductConfidence_value = map[string]int32{
"UNKNOWN_CONFIDENCE": 0,
"LOW_CONFIDENCE": 200,
"MEDIUM_CONFIDENCE": 300,
"HIGH_CONFIDENCE": 400,
}
)Enum value maps for SecurityResult_ProductConfidence.
SecurityResult_ProductPriority_name, SecurityResult_ProductPriority_value
var (
SecurityResult_ProductPriority_name = map[int32]string{
0: "UNKNOWN_PRIORITY",
200: "LOW_PRIORITY",
300: "MEDIUM_PRIORITY",
400: "HIGH_PRIORITY",
}
SecurityResult_ProductPriority_value = map[string]int32{
"UNKNOWN_PRIORITY": 0,
"LOW_PRIORITY": 200,
"MEDIUM_PRIORITY": 300,
"HIGH_PRIORITY": 400,
}
)Enum value maps for SecurityResult_ProductPriority.
SecurityResult_ThreatStatus_name, SecurityResult_ThreatStatus_value
var (
SecurityResult_ThreatStatus_name = map[int32]string{
0: "THREAT_STATUS_UNSPECIFIED",
1: "ACTIVE",
2: "CLEARED",
3: "FALSE_POSITIVE",
}
SecurityResult_ThreatStatus_value = map[string]int32{
"THREAT_STATUS_UNSPECIFIED": 0,
"ACTIVE": 1,
"CLEARED": 2,
"FALSE_POSITIVE": 3,
}
)Enum value maps for SecurityResult_ThreatStatus.
SecurityResult_ThreatCollectionType_name, SecurityResult_ThreatCollectionType_value
var (
SecurityResult_ThreatCollectionType_name = map[int32]string{
0: "THREAT_COLLECTION_TYPE_UNSPECIFIED",
1: "CAMPAIGN",
2: "REPORT",
}
SecurityResult_ThreatCollectionType_value = map[string]int32{
"THREAT_COLLECTION_TYPE_UNSPECIFIED": 0,
"CAMPAIGN": 1,
"REPORT": 2,
}
)Enum value maps for SecurityResult_ThreatCollectionType.
SecurityResult_Association_AssociationType_name, SecurityResult_Association_AssociationType_value
var (
SecurityResult_Association_AssociationType_name = map[int32]string{
0: "ASSOCIATION_TYPE_UNSPECIFIED",
1: "THREAT_ACTOR",
2: "MALWARE",
3: "SOFTWARE_TOOLKIT",
}
SecurityResult_Association_AssociationType_value = map[string]int32{
"ASSOCIATION_TYPE_UNSPECIFIED": 0,
"THREAT_ACTOR": 1,
"MALWARE": 2,
"SOFTWARE_TOOLKIT": 3,
}
)Enum value maps for SecurityResult_Association_AssociationType.
File_FileType_name, File_FileType_value
var (
File_FileType_name = map[int32]string{ /* 182 elements not displayed */
}
File_FileType_value = map[string]int32{ /* 182 elements not displayed */
}
)Enum value maps for File_FileType.
UsnJournal_Attribute_name, UsnJournal_Attribute_value
var (
UsnJournal_Attribute_name = map[int32]string{
0: "ATTRIBUTE_UNSPECIFIED",
1: "READ_ONLY",
2: "HIDDEN",
3: "SYSTEM",
4: "ARCHIVE",
5: "COMPRESSED",
6: "ENCRYPTED",
7: "DIRECTORY",
8: "DEVICE",
9: "NORMAL",
10: "TEMPORARY",
11: "SPARSE_FILE",
12: "REPARSE_POINT",
13: "OFFLINE",
14: "NOT_CONTENT_INDEXED",
15: "INTEGRITY_STREAM",
16: "VIRTUAL",
17: "NO_SCRUB_DATA",
18: "EA",
19: "PINNED",
20: "UNPINNED",
21: "RECALL_ON_OPEN",
22: "RECALL_ON_DATA_ACCESS",
}
UsnJournal_Attribute_value = map[string]int32{
"ATTRIBUTE_UNSPECIFIED": 0,
"READ_ONLY": 1,
"HIDDEN": 2,
"SYSTEM": 3,
"ARCHIVE": 4,
"COMPRESSED": 5,
"ENCRYPTED": 6,
"DIRECTORY": 7,
"DEVICE": 8,
"NORMAL": 9,
"TEMPORARY": 10,
"SPARSE_FILE": 11,
"REPARSE_POINT": 12,
"OFFLINE": 13,
"NOT_CONTENT_INDEXED": 14,
"NON_CONTENT_INDEXED": 14,
"INTEGRITY_STREAM": 15,
"VIRTUAL": 16,
"NO_SCRUB_DATA": 17,
"EA": 18,
"PINNED": 19,
"UNPINNED": 20,
"RECALL_ON_OPEN": 21,
"RECALL_ON_DATA_ACCESS": 22,
}
)Enum value maps for UsnJournal_Attribute.
UsnJournal_Reason_name, UsnJournal_Reason_value
var (
UsnJournal_Reason_name = map[int32]string{
0: "REASON_UNSPECIFIED",
1: "DATA_OVERWRITE",
2: "DATA_EXTEND",
3: "DATA_TRUNCATION",
4: "NAMED_DATA_OVERWRITE",
5: "NAMED_DATA_EXTEND",
6: "NAMED_DATA_TRUNCATION",
7: "FILE_CREATE",
8: "FILE_DELETE",
9: "EA_CHANGE",
10: "SECURITY_CHANGE",
11: "RENAME_OLD_NAME",
12: "RENAME_NEW_NAME",
13: "INDEXABLE_CHANGE",
14: "BASIC_INFO_CHANGE",
15: "HARD_LINK_CHANGE",
16: "COMPRESSION_CHANGE",
17: "ENCRYPTION_CHANGE",
18: "OBJECT_ID_CHANGE",
19: "REPARSE_POINT_CHANGE",
20: "STREAM_CHANGE",
21: "TRANSACTED_CHANGE",
22: "CLOSE",
}
UsnJournal_Reason_value = map[string]int32{
"REASON_UNSPECIFIED": 0,
"DATA_OVERWRITE": 1,
"DATA_EXTEND": 2,
"DATA_TRUNCATION": 3,
"NAMED_DATA_OVERWRITE": 4,
"NAMED_DATA_EXTEND": 5,
"NAMED_DATA_TRUNCATION": 6,
"FILE_CREATE": 7,
"FILE_DELETE": 8,
"EA_CHANGE": 9,
"SECURITY_CHANGE": 10,
"RENAME_OLD_NAME": 11,
"RENAME_NEW_NAME": 12,
"INDEXABLE_CHANGE": 13,
"BASIC_INFO_CHANGE": 14,
"HARD_LINK_CHANGE": 15,
"COMPRESSION_CHANGE": 16,
"ENCRYPTION_CHANGE": 17,
"OBJECT_ID_CHANGE": 18,
"REPARSE_POINT_CHANGE": 19,
"STREAM_CHANGE": 20,
"TRANSACTED_CHANGE": 21,
"CLOSE": 22,
}
)Enum value maps for UsnJournal_Reason.
Dhcp_OpCode_name, Dhcp_OpCode_value
var (
Dhcp_OpCode_name = map[int32]string{
0: "UNKNOWN_OPCODE",
1: "BOOTREQUEST",
2: "BOOTREPLY",
}
Dhcp_OpCode_value = map[string]int32{
"UNKNOWN_OPCODE": 0,
"BOOTREQUEST": 1,
"BOOTREPLY": 2,
}
)Enum value maps for Dhcp_OpCode.
Dhcp_MessageType_name, Dhcp_MessageType_value
var (
Dhcp_MessageType_name = map[int32]string{
0: "UNKNOWN_MESSAGE_TYPE",
1: "DISCOVER",
2: "OFFER",
3: "REQUEST",
4: "DECLINE",
5: "ACK",
6: "NAK",
7: "RELEASE",
8: "INFORM",
100: "WIN_DELETED",
101: "WIN_EXPIRED",
}
Dhcp_MessageType_value = map[string]int32{
"UNKNOWN_MESSAGE_TYPE": 0,
"DISCOVER": 1,
"OFFER": 2,
"REQUEST": 3,
"DECLINE": 4,
"ACK": 5,
"NAK": 6,
"RELEASE": 7,
"INFORM": 8,
"WIN_DELETED": 100,
"WIN_EXPIRED": 101,
}
)Enum value maps for Dhcp_MessageType.
Browser_BrowserType_name, Browser_BrowserType_value
var (
Browser_BrowserType_name = map[int32]string{
0: "BROWSER_TYPE_UNSPECIFIED",
1: "CHROME",
2: "FIREFOX",
3: "SAFARI",
4: "INTERNET_EXPLORER",
5: "EDGE",
6: "OPERA",
}
Browser_BrowserType_value = map[string]int32{
"BROWSER_TYPE_UNSPECIFIED": 0,
"CHROME": 1,
"FIREFOX": 2,
"SAFARI": 3,
"INTERNET_EXPLORER": 4,
"EDGE": 5,
"OPERA": 6,
}
)Enum value maps for Browser_BrowserType.
Browser_UrlVisitType_name, Browser_UrlVisitType_value
var (
Browser_UrlVisitType_name = map[int32]string{
0: "URL_VISIT_TYPE_UNSPECIFIED",
1: "LINK",
2: "TYPED",
3: "AUTO_BOOKMARK",
4: "AUTO_SUBFRAME",
5: "MANUAL_SUBFRAME",
6: "GENERATED",
7: "AUTO_TOPLEVEL",
8: "FORM_SUBMIT",
9: "RELOAD",
10: "KEYWORD",
11: "KEYWORD_GENERATED",
12: "REDIRECT",
}
Browser_UrlVisitType_value = map[string]int32{
"URL_VISIT_TYPE_UNSPECIFIED": 0,
"LINK": 1,
"TYPED": 2,
"AUTO_BOOKMARK": 3,
"AUTO_SUBFRAME": 4,
"MANUAL_SUBFRAME": 5,
"GENERATED": 6,
"AUTO_TOPLEVEL": 7,
"FORM_SUBMIT": 8,
"RELOAD": 9,
"KEYWORD": 10,
"KEYWORD_GENERATED": 11,
"REDIRECT": 12,
}
)Enum value maps for Browser_UrlVisitType.
Browser_VisitSource_name, Browser_VisitSource_value
var (
Browser_VisitSource_name = map[int32]string{
0: "VISIT_SOURCE_UNSPECIFIED",
1: "SYNCED",
2: "BROWSER",
3: "EXTENSION",
4: "IMPORTED",
}
Browser_VisitSource_value = map[string]int32{
"VISIT_SOURCE_UNSPECIFIED": 0,
"SYNCED": 1,
"BROWSER": 2,
"EXTENSION": 3,
"IMPORTED": 4,
}
)Enum value maps for Browser_VisitSource.
Browser_Cookie_CookieSameSite_name, Browser_Cookie_CookieSameSite_value
var (
Browser_Cookie_CookieSameSite_name = map[int32]string{
0: "COOKIE_SAME_SITE_UNSPECIFIED",
1: "STRICT",
2: "LAX",
3: "NONE",
}
Browser_Cookie_CookieSameSite_value = map[string]int32{
"COOKIE_SAME_SITE_UNSPECIFIED": 0,
"STRICT": 1,
"LAX": 2,
"NONE": 3,
}
)Enum value maps for Browser_Cookie_CookieSameSite.
Asset_AssetType_name, Asset_AssetType_value
var (
Asset_AssetType_name = map[int32]string{
0: "ROLE_UNSPECIFIED",
1: "WORKSTATION",
2: "LAPTOP",
3: "IOT",
4: "NETWORK_ATTACHED_STORAGE",
5: "PRINTER",
6: "SCANNER",
7: "SERVER",
8: "TAPE_LIBRARY",
9: "MOBILE",
}
Asset_AssetType_value = map[string]int32{
"ROLE_UNSPECIFIED": 0,
"WORKSTATION": 1,
"LAPTOP": 2,
"IOT": 3,
"NETWORK_ATTACHED_STORAGE": 4,
"PRINTER": 5,
"SCANNER": 6,
"SERVER": 7,
"TAPE_LIBRARY": 8,
"MOBILE": 9,
}
)Enum value maps for Asset_AssetType.
Asset_DeploymentStatus_name, Asset_DeploymentStatus_value
var (
Asset_DeploymentStatus_name = map[int32]string{
0: "DEPLOYMENT_STATUS_UNSPECIFIED",
1: "ACTIVE",
2: "PENDING_DECOMISSION",
3: "DECOMISSIONED",
}
Asset_DeploymentStatus_value = map[string]int32{
"DEPLOYMENT_STATUS_UNSPECIFIED": 0,
"ACTIVE": 1,
"PENDING_DECOMISSION": 2,
"DECOMISSIONED": 3,
}
)Enum value maps for Asset_DeploymentStatus.
User_AccountType_name, User_AccountType_value
var (
User_AccountType_name = map[int32]string{
0: "ACCOUNT_TYPE_UNSPECIFIED",
1: "DOMAIN_ACCOUNT_TYPE",
2: "LOCAL_ACCOUNT_TYPE",
3: "CLOUD_ACCOUNT_TYPE",
4: "SERVICE_ACCOUNT_TYPE",
5: "DEFAULT_ACCOUNT_TYPE",
}
User_AccountType_value = map[string]int32{
"ACCOUNT_TYPE_UNSPECIFIED": 0,
"DOMAIN_ACCOUNT_TYPE": 1,
"LOCAL_ACCOUNT_TYPE": 2,
"CLOUD_ACCOUNT_TYPE": 3,
"SERVICE_ACCOUNT_TYPE": 4,
"DEFAULT_ACCOUNT_TYPE": 5,
}
)Enum value maps for User_AccountType.
User_Role_name, User_Role_value
var (
User_Role_name = map[int32]string{
0: "UNKNOWN_ROLE",
1: "ADMINISTRATOR",
2: "SERVICE_ACCOUNT",
}
User_Role_value = map[string]int32{
"UNKNOWN_ROLE": 0,
"ADMINISTRATOR": 1,
"SERVICE_ACCOUNT": 2,
}
)Enum value maps for User_Role.
Permission_PermissionType_name, Permission_PermissionType_value
var (
Permission_PermissionType_name = map[int32]string{
0: "UNKNOWN_PERMISSION_TYPE",
1: "ADMIN_WRITE",
2: "ADMIN_READ",
3: "DATA_WRITE",
4: "DATA_READ",
}
Permission_PermissionType_value = map[string]int32{
"UNKNOWN_PERMISSION_TYPE": 0,
"ADMIN_WRITE": 1,
"ADMIN_READ": 2,
"DATA_WRITE": 3,
"DATA_READ": 4,
}
)Enum value maps for Permission_PermissionType.
Role_Type_name, Role_Type_value
var (
Role_Type_name = map[int32]string{
0: "TYPE_UNSPECIFIED",
1: "ADMINISTRATOR",
2: "SERVICE_ACCOUNT",
}
Role_Type_value = map[string]int32{
"TYPE_UNSPECIFIED": 0,
"ADMINISTRATOR": 1,
"SERVICE_ACCOUNT": 2,
}
)Enum value maps for Role_Type.
Registry_Type_name, Registry_Type_value
var (
Registry_Type_name = map[int32]string{
0: "TYPE_UNSPECIFIED",
1: "NONE",
2: "SZ",
3: "EXPAND_SZ",
4: "BINARY",
5: "DWORD",
6: "DWORD_LITTLE_ENDIAN",
7: "DWORD_BIG_ENDIAN",
8: "LINK",
9: "MULTI_SZ",
10: "RESOURCE_LIST",
11: "QWORD",
12: "QWORD_LITTLE_ENDIAN",
}
Registry_Type_value = map[string]int32{
"TYPE_UNSPECIFIED": 0,
"NONE": 1,
"SZ": 2,
"EXPAND_SZ": 3,
"BINARY": 4,
"DWORD": 5,
"DWORD_LITTLE_ENDIAN": 6,
"DWORD_BIG_ENDIAN": 7,
"LINK": 8,
"MULTI_SZ": 9,
"RESOURCE_LIST": 10,
"QWORD": 11,
"QWORD_LITTLE_ENDIAN": 12,
}
)Enum value maps for Registry_Type.
WindowsScheduledTask_TaskState_name, WindowsScheduledTask_TaskState_value
var (
WindowsScheduledTask_TaskState_name = map[int32]string{
0: "TASK_STATE_UNSPECIFIED",
1: "DISABLED",
2: "QUEUED",
3: "ACTIVE",
4: "RUNNING",
}
WindowsScheduledTask_TaskState_value = map[string]int32{
"TASK_STATE_UNSPECIFIED": 0,
"DISABLED": 1,
"QUEUED": 2,
"ACTIVE": 3,
"RUNNING": 4,
}
)Enum value maps for WindowsScheduledTask_TaskState.
WindowsScheduledTask_TaskLogonType_name, WindowsScheduledTask_TaskLogonType_value
var (
WindowsScheduledTask_TaskLogonType_name = map[int32]string{
0: "TASK_LOGON_TYPE_UNSPECIFIED",
1: "PASSWORD",
2: "S4U",
3: "INTERACTIVE_TOKEN",
4: "GROUP",
5: "SERVICE_ACCOUNT",
6: "INTERACTIVE_TOKEN_OR_PASSWORD",
}
WindowsScheduledTask_TaskLogonType_value = map[string]int32{
"TASK_LOGON_TYPE_UNSPECIFIED": 0,
"PASSWORD": 1,
"S4U": 2,
"INTERACTIVE_TOKEN": 3,
"GROUP": 4,
"SERVICE_ACCOUNT": 5,
"INTERACTIVE_TOKEN_OR_PASSWORD": 6,
}
)Enum value maps for WindowsScheduledTask_TaskLogonType.
WindowsScheduledTask_TaskAction_ActionType_name, WindowsScheduledTask_TaskAction_ActionType_value
var (
WindowsScheduledTask_TaskAction_ActionType_name = map[int32]string{
0: "ACTION_TYPE_UNSPECIFIED",
1: "EXEC",
2: "COM_HANDLER",
3: "SEND_EMAIL",
4: "SHOW_MESSAGE",
}
WindowsScheduledTask_TaskAction_ActionType_value = map[string]int32{
"ACTION_TYPE_UNSPECIFIED": 0,
"EXEC": 1,
"COM_HANDLER": 2,
"SEND_EMAIL": 3,
"SHOW_MESSAGE": 4,
}
)Enum value maps for WindowsScheduledTask_TaskAction_ActionType.
WindowsScheduledTask_TaskTrigger_TriggerType_name, WindowsScheduledTask_TaskTrigger_TriggerType_value
var (
WindowsScheduledTask_TaskTrigger_TriggerType_name = map[int32]string{
0: "TRIGGER_TYPE_UNSPECIFIED",
1: "EVENT",
2: "TIME",
3: "DAILY",
4: "WEEKLY",
5: "MONTHLY",
6: "MONTHLYDOW",
7: "IDLE",
8: "REGISTRATION",
9: "BOOT",
10: "LOGON",
11: "SESSION_STATE_CHANGE",
12: "CUSTOM_TRIGGER01",
}
WindowsScheduledTask_TaskTrigger_TriggerType_value = map[string]int32{
"TRIGGER_TYPE_UNSPECIFIED": 0,
"EVENT": 1,
"TIME": 2,
"DAILY": 3,
"WEEKLY": 4,
"MONTHLY": 5,
"MONTHLYDOW": 6,
"IDLE": 7,
"REGISTRATION": 8,
"BOOT": 9,
"LOGON": 10,
"SESSION_STATE_CHANGE": 11,
"CUSTOM_TRIGGER01": 12,
}
)Enum value maps for WindowsScheduledTask_TaskTrigger_TriggerType.
Service_ServiceType_name, Service_ServiceType_value
var (
Service_ServiceType_name = map[int32]string{
0: "SERVICE_TYPE_UNSPECIFIED",
1: "KERNEL_DRIVER",
2: "FILE_SYSTEM_DRIVER",
3: "WIN32_OWN_PROCESS",
4: "WIN32_SHARE_PROCESS",
5: "ADAPTER",
6: "RECOGNIZER_DRIVER",
7: "INTERACTIVE_PROCESS",
}
Service_ServiceType_value = map[string]int32{
"SERVICE_TYPE_UNSPECIFIED": 0,
"KERNEL_DRIVER": 1,
"FILE_SYSTEM_DRIVER": 2,
"WIN32_OWN_PROCESS": 3,
"WIN32_SHARE_PROCESS": 4,
"ADAPTER": 5,
"RECOGNIZER_DRIVER": 6,
"INTERACTIVE_PROCESS": 7,
}
)Enum value maps for Service_ServiceType.
Service_StartupType_name, Service_StartupType_value
var (
Service_StartupType_name = map[int32]string{
0: "STARTUP_TYPE_UNSPECIFIED",
1: "AUTOMATIC",
2: "MANUAL",
3: "DISABLED",
}
Service_StartupType_value = map[string]int32{
"STARTUP_TYPE_UNSPECIFIED": 0,
"AUTOMATIC": 1,
"MANUAL": 2,
"DISABLED": 3,
}
)Enum value maps for Service_StartupType.
Service_State_name, Service_State_value
var (
Service_State_name = map[int32]string{
0: "STATE_UNSPECIFIED",
1: "RUNNING",
2: "STOPPED",
3: "PAUSED",
4: "COMPLETED",
5: "START_PENDING",
6: "STOP_PENDING",
7: "PAUSE_PENDING",
8: "CONTINUE_PENDING",
}
Service_State_value = map[string]int32{
"STATE_UNSPECIFIED": 0,
"RUNNING": 1,
"STOPPED": 2,
"PAUSED": 3,
"COMPLETED": 4,
"START_PENDING": 5,
"STOP_PENDING": 6,
"PAUSE_PENDING": 7,
"CONTINUE_PENDING": 8,
}
)Enum value maps for Service_State.
Resource_ResourceType_name, Resource_ResourceType_value
var (
Resource_ResourceType_name = map[int32]string{
0: "UNSPECIFIED",
1: "MUTEX",
2: "TASK",
3: "PIPE",
4: "DEVICE",
5: "FIREWALL_RULE",
6: "MAILBOX_FOLDER",
7: "VPC_NETWORK",
8: "VIRTUAL_MACHINE",
9: "STORAGE_BUCKET",
10: "STORAGE_OBJECT",
11: "DATABASE",
12: "TABLE",
13: "CLOUD_PROJECT",
14: "CLOUD_ORGANIZATION",
15: "SERVICE_ACCOUNT",
16: "ACCESS_POLICY",
17: "CLUSTER",
18: "SETTING",
19: "DATASET",
20: "BACKEND_SERVICE",
21: "POD",
22: "CONTAINER",
23: "FUNCTION",
24: "RUNTIME",
25: "IP_ADDRESS",
26: "DISK",
27: "VOLUME",
28: "IMAGE",
29: "SNAPSHOT",
30: "REPOSITORY",
31: "CREDENTIAL",
32: "LOAD_BALANCER",
33: "GATEWAY",
34: "SUBNET",
35: "USER",
36: "SERVICE",
}
Resource_ResourceType_value = map[string]int32{
"UNSPECIFIED": 0,
"MUTEX": 1,
"TASK": 2,
"PIPE": 3,
"DEVICE": 4,
"FIREWALL_RULE": 5,
"MAILBOX_FOLDER": 6,
"VPC_NETWORK": 7,
"VIRTUAL_MACHINE": 8,
"STORAGE_BUCKET": 9,
"STORAGE_OBJECT": 10,
"DATABASE": 11,
"TABLE": 12,
"CLOUD_PROJECT": 13,
"CLOUD_ORGANIZATION": 14,
"SERVICE_ACCOUNT": 15,
"ACCESS_POLICY": 16,
"CLUSTER": 17,
"SETTING": 18,
"DATASET": 19,
"BACKEND_SERVICE": 20,
"POD": 21,
"CONTAINER": 22,
"FUNCTION": 23,
"RUNTIME": 24,
"IP_ADDRESS": 25,
"DISK": 26,
"VOLUME": 27,
"IMAGE": 28,
"SNAPSHOT": 29,
"REPOSITORY": 30,
"CREDENTIAL": 31,
"LOAD_BALANCER": 32,
"GATEWAY": 33,
"SUBNET": 34,
"USER": 35,
"SERVICE": 36,
}
)Enum value maps for Resource_ResourceType.
Cloud_CloudEnvironment_name, Cloud_CloudEnvironment_value
var (
Cloud_CloudEnvironment_name = map[int32]string{
0: "UNSPECIFIED_CLOUD_ENVIRONMENT",
1: "GOOGLE_CLOUD_PLATFORM",
2: "AMAZON_WEB_SERVICES",
3: "MICROSOFT_AZURE",
}
Cloud_CloudEnvironment_value = map[string]int32{
"UNSPECIFIED_CLOUD_ENVIRONMENT": 0,
"GOOGLE_CLOUD_PLATFORM": 1,
"AMAZON_WEB_SERVICES": 2,
"MICROSOFT_AZURE": 3,
}
)Enum value maps for Cloud_CloudEnvironment.
Noun_Platform_name, Noun_Platform_value
var (
Noun_Platform_name = map[int32]string{
0: "UNKNOWN_PLATFORM",
1: "WINDOWS",
2: "MAC",
3: "LINUX",
4: "GCP",
5: "AWS",
6: "AZURE",
7: "IOS",
8: "ANDROID",
9: "CHROME_OS",
}
Noun_Platform_value = map[string]int32{
"UNKNOWN_PLATFORM": 0,
"WINDOWS": 1,
"MAC": 2,
"LINUX": 3,
"GCP": 4,
"AWS": 5,
"AZURE": 6,
"IOS": 7,
"ANDROID": 8,
"CHROME_OS": 9,
}
)Enum value maps for Noun_Platform.
File_backstory_collection_proto
var File_backstory_collection_proto protoreflect.FileDescriptorFile_backstory_data_access_proto
var File_backstory_data_access_proto protoreflect.FileDescriptorFile_backstory_entity_proto
var File_backstory_entity_proto protoreflect.FileDescriptorFile_backstory_entity_risk_proto
var File_backstory_entity_risk_proto protoreflect.FileDescriptorFile_backstory_id_proto
var File_backstory_id_proto protoreflect.FileDescriptorFile_backstory_udm_proto
var File_backstory_udm_proto protoreflect.FileDescriptorAnalyticsMetadata
type AnalyticsMetadata struct {
// Name of the analytic.
Analytic string `protobuf:"bytes,1,opt,name=analytic,proto3" json:"analytic,omitempty"`
// contains filtered or unexported fields
}Stores information about an analytics metric used in a rule.
func (*AnalyticsMetadata) Descriptor
func (*AnalyticsMetadata) Descriptor() ([]byte, []int)Deprecated: Use AnalyticsMetadata.ProtoReflect.Descriptor instead.
func (*AnalyticsMetadata) GetAnalytic
func (x *AnalyticsMetadata) GetAnalytic() stringfunc (*AnalyticsMetadata) ProtoMessage
func (*AnalyticsMetadata) ProtoMessage()func (*AnalyticsMetadata) ProtoReflect
func (x *AnalyticsMetadata) ProtoReflect() protoreflect.Messagefunc (*AnalyticsMetadata) Reset
func (x *AnalyticsMetadata) Reset()func (*AnalyticsMetadata) String
func (x *AnalyticsMetadata) String() stringAppCompatMetadata
type AppCompatMetadata struct {
// Indicates the chronological order in which the entry was added to the
// cache.
Sequence int32 `protobuf:"varint,1,opt,name=sequence,proto3" json:"sequence,omitempty"`
// Indicates whether the file associated with the entry was executed.
Executed bool `protobuf:"varint,2,opt,name=executed,proto3" json:"executed,omitempty"`
// Indicates which registry Control Set the AppCompatCache data belongs to
// (e.g., "ControlSet001").
ControlSet string `protobuf:"bytes,3,opt,name=control_set,json=controlSet,proto3" json:"control_set,omitempty"`
// contains filtered or unexported fields
}Windows AppCompatCache (Application Compatibility) metadata.
func (*AppCompatMetadata) Descriptor
func (*AppCompatMetadata) Descriptor() ([]byte, []int)Deprecated: Use AppCompatMetadata.ProtoReflect.Descriptor instead.
func (*AppCompatMetadata) GetControlSet
func (x *AppCompatMetadata) GetControlSet() stringfunc (*AppCompatMetadata) GetExecuted
func (x *AppCompatMetadata) GetExecuted() boolfunc (*AppCompatMetadata) GetSequence
func (x *AppCompatMetadata) GetSequence() int32func (*AppCompatMetadata) ProtoMessage
func (*AppCompatMetadata) ProtoMessage()func (*AppCompatMetadata) ProtoReflect
func (x *AppCompatMetadata) ProtoReflect() protoreflect.Messagefunc (*AppCompatMetadata) Reset
func (x *AppCompatMetadata) Reset()func (*AppCompatMetadata) String
func (x *AppCompatMetadata) String() stringArtifact
type Artifact struct {
// IP address of the artifact.
// This field can be used as an entity indicator for an external destination
// IP entity.
Ip string `protobuf:"bytes,1,opt,name=ip,proto3" json:"ip,omitempty"`
// The prevalence of the artifact within the customer's environment.
Prevalence *Prevalence `protobuf:"bytes,2,opt,name=prevalence,proto3" json:"prevalence,omitempty"`
// First seen timestamp of the IP in the customer's environment.
FirstSeenTime *timestamppb.Timestamp `protobuf:"bytes,3,opt,name=first_seen_time,json=firstSeenTime,proto3" json:"first_seen_time,omitempty"`
// Last seen timestamp of the IP address in the customer's environment.
LastSeenTime *timestamppb.Timestamp `protobuf:"bytes,4,opt,name=last_seen_time,json=lastSeenTime,proto3" json:"last_seen_time,omitempty"`
// Location of the Artifact's IP address.
Location *Location `protobuf:"bytes,5,opt,name=location,proto3" json:"location,omitempty"`
// Network information related to the Artifact's IP address.
Network *Network `protobuf:"bytes,6,opt,name=network,proto3" json:"network,omitempty"`
// Owner of the Autonomous System to which the IP address belongs.
AsOwner string `protobuf:"bytes,7,opt,name=as_owner,json=asOwner,proto3" json:"as_owner,omitempty"`
// Autonomous System Number to which the IP address belongs.
Asn int64 `protobuf:"varint,8,opt,name=asn,proto3" json:"asn,omitempty"`
// The JARM hash for the IP address.
// (https://engineering.salesforce.com/easily-identify-malicious-servers-on-the-internet-with-jarm-e095edac525a).
Jarm string `protobuf:"bytes,9,opt,name=jarm,proto3" json:"jarm,omitempty"`
// SSL certificate information about the IP address.
LastHttpsCertificate *SSLCertificate `protobuf:"bytes,10,opt,name=last_https_certificate,json=lastHttpsCertificate,proto3" json:"last_https_certificate,omitempty"`
// Most recent date for the certificate in VirusTotal.
LastHttpsCertificateDate *timestamppb.Timestamp `protobuf:"bytes,11,opt,name=last_https_certificate_date,json=lastHttpsCertificateDate,proto3" json:"last_https_certificate_date,omitempty"`
// RIR (one of the current RIRs: AFRINIC, ARIN, APNIC, LACNIC or RIPE NCC).
RegionalInternetRegistry string `protobuf:"bytes,12,opt,name=regional_internet_registry,json=regionalInternetRegistry,proto3" json:"regional_internet_registry,omitempty"`
// Identification attributes
Tags []string `protobuf:"bytes,13,rep,name=tags,proto3" json:"tags,omitempty"`
// WHOIS information as returned from the pertinent WHOIS server.
Whois string `protobuf:"bytes,14,opt,name=whois,proto3" json:"whois,omitempty"`
// Date of the last update of the WHOIS record in VirusTotal.
WhoisDate *timestamppb.Timestamp `protobuf:"bytes,15,opt,name=whois_date,json=whoisDate,proto3" json:"whois_date,omitempty"`
// VPN tunnels.
Tunnels []*Tunnels `protobuf:"bytes,16,rep,name=tunnels,proto3" json:"tunnels,omitempty"`
// Whether the VPN tunnels are configured for anonymous browsing or not.
Anonymous bool `protobuf:"varint,17,opt,name=anonymous,proto3" json:"anonymous,omitempty"`
// Entity or software accessing or utilizing network resources.
ArtifactClient *ArtifactClient `protobuf:"bytes,18,opt,name=artifact_client,json=artifactClient,proto3" json:"artifact_client,omitempty"`
// This field lists potential risks associated with the network activity.
Risks []string `protobuf:"bytes,19,rep,name=risks,proto3" json:"risks,omitempty"`
// contains filtered or unexported fields
}Information about an artifact. The artifact can only be an IP.
func (*Artifact) Descriptor
Deprecated: Use Artifact.ProtoReflect.Descriptor instead.
func (*Artifact) GetAnonymous
func (*Artifact) GetArtifactClient
func (x *Artifact) GetArtifactClient() *ArtifactClientfunc (*Artifact) GetAsOwner
func (*Artifact) GetAsn
func (*Artifact) GetFirstSeenTime
func (x *Artifact) GetFirstSeenTime() *timestamppb.Timestampfunc (*Artifact) GetIp
func (*Artifact) GetJarm
func (*Artifact) GetLastHttpsCertificate
func (x *Artifact) GetLastHttpsCertificate() *SSLCertificatefunc (*Artifact) GetLastHttpsCertificateDate
func (x *Artifact) GetLastHttpsCertificateDate() *timestamppb.Timestampfunc (*Artifact) GetLastSeenTime
func (x *Artifact) GetLastSeenTime() *timestamppb.Timestampfunc (*Artifact) GetLocation
func (*Artifact) GetNetwork
func (*Artifact) GetPrevalence
func (x *Artifact) GetPrevalence() *Prevalencefunc (*Artifact) GetRegionalInternetRegistry
func (*Artifact) GetRisks
func (*Artifact) GetTags
func (*Artifact) GetTunnels
func (*Artifact) GetWhois
func (*Artifact) GetWhoisDate
func (x *Artifact) GetWhoisDate() *timestamppb.Timestampfunc (*Artifact) ProtoMessage
func (*Artifact) ProtoMessage()func (*Artifact) ProtoReflect
func (x *Artifact) ProtoReflect() protoreflect.Messagefunc (*Artifact) Reset
func (x *Artifact) Reset()func (*Artifact) String
ArtifactClient
type ArtifactClient struct {
// The behaviors of the client accessing the network.
Behaviors []string `protobuf:"bytes,1,rep,name=behaviors,proto3" json:"behaviors,omitempty"`
// The type of proxies used by the client.
Proxies []string `protobuf:"bytes,2,rep,name=proxies,proto3" json:"proxies,omitempty"`
// contains filtered or unexported fields
}Entity or software accessing or utilizing network resources.
func (*ArtifactClient) Descriptor
func (*ArtifactClient) Descriptor() ([]byte, []int)Deprecated: Use ArtifactClient.ProtoReflect.Descriptor instead.
func (*ArtifactClient) GetBehaviors
func (x *ArtifactClient) GetBehaviors() []stringfunc (*ArtifactClient) GetProxies
func (x *ArtifactClient) GetProxies() []stringfunc (*ArtifactClient) ProtoMessage
func (*ArtifactClient) ProtoMessage()func (*ArtifactClient) ProtoReflect
func (x *ArtifactClient) ProtoReflect() protoreflect.Messagefunc (*ArtifactClient) Reset
func (x *ArtifactClient) Reset()func (*ArtifactClient) String
func (x *ArtifactClient) String() stringAsset
type Asset struct {
// A vendor-specific identifier to uniquely identify the entity (a GUID or
// similar).
// This field can be used as an entity indicator for asset entities.
ProductObjectId string `protobuf:"bytes,1,opt,name=product_object_id,json=productObjectId,proto3" json:"product_object_id,omitempty"`
// Asset hostname or domain name field.
// This field can be used as an entity indicator for asset entities.
Hostname string `protobuf:"bytes,2,opt,name=hostname,proto3" json:"hostname,omitempty"`
// The asset ID. Value must contain the ':' character. For example,
// cs:abcdd23434.
// This field can be used as an entity indicator for asset entities.
AssetId string `protobuf:"bytes,3,opt,name=asset_id,json=assetId,proto3" json:"asset_id,omitempty"`
// A list of IP addresses associated with an asset.
// This field can be used as an entity indicator for asset entities.
Ip []string `protobuf:"bytes,4,rep,name=ip,proto3" json:"ip,omitempty"`
// List of MAC addresses associated with an asset.
// This field can be used as an entity indicator for asset entities.
Mac []string `protobuf:"bytes,5,rep,name=mac,proto3" json:"mac,omitempty"`
// List of NAT IP addresses associated with an asset.
NatIp []string `protobuf:"bytes,22,rep,name=nat_ip,json=natIp,proto3" json:"nat_ip,omitempty"`
// The first observed time for an asset.
// The value is calculated on the basis of the
// first time the identifier was observed.
FirstSeenTime *timestamppb.Timestamp `protobuf:"bytes,23,opt,name=first_seen_time,json=firstSeenTime,proto3" json:"first_seen_time,omitempty"`
// The asset hardware specifications.
Hardware []*Hardware `protobuf:"bytes,6,rep,name=hardware,proto3" json:"hardware,omitempty"`
// The asset operating system platform software.
PlatformSoftware *PlatformSoftware `protobuf:"bytes,7,opt,name=platform_software,json=platformSoftware,proto3" json:"platform_software,omitempty"`
// The asset software details.
Software []*Software `protobuf:"bytes,17,rep,name=software,proto3" json:"software,omitempty"`
// Location of the asset.
Location *Location `protobuf:"bytes,8,opt,name=location,proto3" json:"location,omitempty"`
// The category of the asset (e.g. "End User Asset", "Workstation", "Server").
Category string `protobuf:"bytes,9,opt,name=category,proto3" json:"category,omitempty"`
// The type of the asset (e.g. workstation or laptop or server).
Type Asset_AssetType `protobuf:"varint,18,opt,name=type,proto3,enum=google.backstory.Asset_AssetType" json:"type,omitempty"`
// The network domain of the asset (e.g. "corp.acme.com")
NetworkDomain string `protobuf:"bytes,10,opt,name=network_domain,json=networkDomain,proto3" json:"network_domain,omitempty"`
// Time the asset was created or provisioned.
// Deprecate: creation_time should be populated in Attribute as generic
// metadata.
//
// Deprecated: Marked as deprecated in backstory/udm.proto.
CreationTime *timestamppb.Timestamp `protobuf:"bytes,11,opt,name=creation_time,json=creationTime,proto3" json:"creation_time,omitempty"`
// Time the asset was first discovered (by asset management/discoverability
// software).
FirstDiscoverTime *timestamppb.Timestamp `protobuf:"bytes,12,opt,name=first_discover_time,json=firstDiscoverTime,proto3" json:"first_discover_time,omitempty"`
// Time the asset was last discovered (by asset management/discoverability
// software).
LastDiscoverTime *timestamppb.Timestamp `protobuf:"bytes,13,opt,name=last_discover_time,json=lastDiscoverTime,proto3" json:"last_discover_time,omitempty"`
// Time the asset system or OS was last updated.
// For all other operations that are not system updates (such as resizing a
// VM), use Attribute.last_update_time.
SystemLastUpdateTime *timestamppb.Timestamp `protobuf:"bytes,14,opt,name=system_last_update_time,json=systemLastUpdateTime,proto3" json:"system_last_update_time,omitempty"`
// Time the asset was last boot started.
LastBootTime *timestamppb.Timestamp `protobuf:"bytes,15,opt,name=last_boot_time,json=lastBootTime,proto3" json:"last_boot_time,omitempty"`
// Metadata labels for the asset.
// Deprecated: labels should be populated in Attribute as generic metadata.
//
// Deprecated: Marked as deprecated in backstory/udm.proto.
Labels []*Label `protobuf:"bytes,16,rep,name=labels,proto3" json:"labels,omitempty"`
// The deployment status of the asset for device lifecycle purposes.
DeploymentStatus Asset_DeploymentStatus `protobuf:"varint,19,opt,name=deployment_status,json=deploymentStatus,proto3,enum=google.backstory.Asset_DeploymentStatus" json:"deployment_status,omitempty"`
// Vulnerabilities discovered on asset.
Vulnerabilities []*Vulnerability `protobuf:"bytes,21,rep,name=vulnerabilities,proto3" json:"vulnerabilities,omitempty"`
// Generic entity metadata attributes of the asset.
Attribute *Attribute `protobuf:"bytes,20,opt,name=attribute,proto3" json:"attribute,omitempty"`
// Information about a WMI persistence item.
WmiPersistenceItem *WmiPersistenceItem `protobuf:"bytes,24,opt,name=wmi_persistence_item,json=wmiPersistenceItem,proto3" json:"wmi_persistence_item,omitempty"`
// contains filtered or unexported fields
}Information about a compute asset such as a workstation, laptop, phone, virtual desktop, or VM.
func (*Asset) Descriptor
Deprecated: Use Asset.ProtoReflect.Descriptor instead.
func (*Asset) GetAssetId
func (*Asset) GetAttribute
func (*Asset) GetCategory
func (*Asset) GetCreationTime
func (x *Asset) GetCreationTime() *timestamppb.TimestampDeprecated: Marked as deprecated in backstory/udm.proto.
func (*Asset) GetDeploymentStatus
func (x *Asset) GetDeploymentStatus() Asset_DeploymentStatusfunc (*Asset) GetFirstDiscoverTime
func (x *Asset) GetFirstDiscoverTime() *timestamppb.Timestampfunc (*Asset) GetFirstSeenTime
func (x *Asset) GetFirstSeenTime() *timestamppb.Timestampfunc (*Asset) GetHardware
func (*Asset) GetHostname
func (*Asset) GetIp
func (*Asset) GetLabels
Deprecated: Marked as deprecated in backstory/udm.proto.
func (*Asset) GetLastBootTime
func (x *Asset) GetLastBootTime() *timestamppb.Timestampfunc (*Asset) GetLastDiscoverTime
func (x *Asset) GetLastDiscoverTime() *timestamppb.Timestampfunc (*Asset) GetLocation
func (*Asset) GetMac
func (*Asset) GetNatIp
func (*Asset) GetNetworkDomain
func (*Asset) GetPlatformSoftware
func (x *Asset) GetPlatformSoftware() *PlatformSoftwarefunc (*Asset) GetProductObjectId
func (*Asset) GetSoftware
func (*Asset) GetSystemLastUpdateTime
func (x *Asset) GetSystemLastUpdateTime() *timestamppb.Timestampfunc (*Asset) GetType
func (x *Asset) GetType() Asset_AssetTypefunc (*Asset) GetVulnerabilities
func (x *Asset) GetVulnerabilities() []*Vulnerabilityfunc (*Asset) GetWmiPersistenceItem
func (x *Asset) GetWmiPersistenceItem() *WmiPersistenceItemfunc (*Asset) ProtoMessage
func (*Asset) ProtoMessage()func (*Asset) ProtoReflect
func (x *Asset) ProtoReflect() protoreflect.Messagefunc (*Asset) Reset
func (x *Asset) Reset()func (*Asset) String
Asset_AssetType
type Asset_AssetType int32The role type of the asset.
Asset_ROLE_UNSPECIFIED, Asset_WORKSTATION, Asset_LAPTOP, Asset_IOT, Asset_NETWORK_ATTACHED_STORAGE, Asset_PRINTER, Asset_SCANNER, Asset_SERVER, Asset_TAPE_LIBRARY, Asset_MOBILE
const (
// Unspecified asset role.
Asset_ROLE_UNSPECIFIED Asset_AssetType = 0
// A workstation or desktop.
Asset_WORKSTATION Asset_AssetType = 1
// A laptop computer.
Asset_LAPTOP Asset_AssetType = 2
// An IOT asset.
Asset_IOT Asset_AssetType = 3
// A network attached storage device.
Asset_NETWORK_ATTACHED_STORAGE Asset_AssetType = 4
// A printer.
Asset_PRINTER Asset_AssetType = 5
// A scanner.
Asset_SCANNER Asset_AssetType = 6
// A server.
Asset_SERVER Asset_AssetType = 7
// A tape library device.
Asset_TAPE_LIBRARY Asset_AssetType = 8
// A mobile device such as a mobile phone or PDA.
Asset_MOBILE Asset_AssetType = 9
)func (Asset_AssetType) Descriptor
func (Asset_AssetType) Descriptor() protoreflect.EnumDescriptorfunc (Asset_AssetType) Enum
func (x Asset_AssetType) Enum() *Asset_AssetTypefunc (Asset_AssetType) EnumDescriptor
func (Asset_AssetType) EnumDescriptor() ([]byte, []int)Deprecated: Use Asset_AssetType.Descriptor instead.
func (Asset_AssetType) Number
func (x Asset_AssetType) Number() protoreflect.EnumNumberfunc (Asset_AssetType) String
func (x Asset_AssetType) String() stringfunc (Asset_AssetType) Type
func (Asset_AssetType) Type() protoreflect.EnumTypeAsset_DeploymentStatus
type Asset_DeploymentStatus int32Deployment status states.
Asset_DEPLOYMENT_STATUS_UNSPECIFIED, Asset_ACTIVE, Asset_PENDING_DECOMISSION, Asset_DECOMISSIONED
const (
// Unspecified deployment status.
Asset_DEPLOYMENT_STATUS_UNSPECIFIED Asset_DeploymentStatus = 0
// Asset is active, functional and deployed.
Asset_ACTIVE Asset_DeploymentStatus = 1
// Asset is pending decommission and no longer deployed.
Asset_PENDING_DECOMISSION Asset_DeploymentStatus = 2
// Asset is decommissioned.
Asset_DECOMISSIONED Asset_DeploymentStatus = 3
)func (Asset_DeploymentStatus) Descriptor
func (Asset_DeploymentStatus) Descriptor() protoreflect.EnumDescriptorfunc (Asset_DeploymentStatus) Enum
func (x Asset_DeploymentStatus) Enum() *Asset_DeploymentStatusfunc (Asset_DeploymentStatus) EnumDescriptor
func (Asset_DeploymentStatus) EnumDescriptor() ([]byte, []int)Deprecated: Use Asset_DeploymentStatus.Descriptor instead.
func (Asset_DeploymentStatus) Number
func (x Asset_DeploymentStatus) Number() protoreflect.EnumNumberfunc (Asset_DeploymentStatus) String
func (x Asset_DeploymentStatus) String() stringfunc (Asset_DeploymentStatus) Type
func (Asset_DeploymentStatus) Type() protoreflect.EnumTypeAtiPrioritization
type AtiPrioritization struct {
// The confidence score from "GTI verdict" source.
GtiVerdict int32 `protobuf:"varint,1,opt,name=gti_verdict,json=gtiVerdict,proto3" json:"gti_verdict,omitempty"`
// The confidence score from "GTI severity" source.
GtiSeverity int32 `protobuf:"varint,2,opt,name=gti_severity,json=gtiSeverity,proto3" json:"gti_severity,omitempty"`
// The confidence score from "GTI threat score" source.
GtiThreatScore int32 `protobuf:"varint,3,opt,name=gti_threat_score,json=gtiThreatScore,proto3" json:"gti_threat_score,omitempty"`
// The confidence score from "Mandiant Analyst Intel" source.
MandiantAnalystConfidence int32 `protobuf:"varint,4,opt,name=mandiant_analyst_confidence,json=mandiantAnalystConfidence,proto3" json:"mandiant_analyst_confidence,omitempty"`
// Timestamp of the latest update for GTI verdict, severity, or threat score.
GtiUpdateTime *timestamppb.Timestamp `protobuf:"bytes,5,opt,name=gti_update_time,json=gtiUpdateTime,proto3" json:"gti_update_time,omitempty"`
// Whether one or more Mandiant incident response customers had this indicator
// in their environment.
ActiveIr bool `protobuf:"varint,6,opt,name=active_ir,json=activeIr,proto3" json:"active_ir,omitempty"`
// The timestamp of the first time an active IR was applied to this entity.
ActiveIrFirstTaggedTime *timestamppb.Timestamp `protobuf:"bytes,7,opt,name=active_ir_first_tagged_time,json=activeIrFirstTaggedTime,proto3" json:"active_ir_first_tagged_time,omitempty"`
// Global customer count over the last 30 days
GlobalCustomerCount int64 `protobuf:"varint,8,opt,name=global_customer_count,json=globalCustomerCount,proto3" json:"global_customer_count,omitempty"`
// Global hit count over the last 30 days
GlobalHitCount int64 `protobuf:"varint,9,opt,name=global_hit_count,json=globalHitCount,proto3" json:"global_hit_count,omitempty"`
// Whether the indicator is being used by a maximum of one threat actor.
Exclusive bool `protobuf:"varint,10,opt,name=exclusive,proto3" json:"exclusive,omitempty"`
// Whether the indicator details are available in open source.
Osint bool `protobuf:"varint,11,opt,name=osint,proto3" json:"osint,omitempty"`
// Whether the indicator is a scanner.
Scanner bool `protobuf:"varint,12,opt,name=scanner,proto3" json:"scanner,omitempty"`
// Whether the indicator verdict has passed review.
Reviewed bool `protobuf:"varint,13,opt,name=reviewed,proto3" json:"reviewed,omitempty"`
// Malware families associated with this indicator.
AttributedMalware []*SecurityResult_Association `protobuf:"bytes,14,rep,name=attributed_malware,json=attributedMalware,proto3" json:"attributed_malware,omitempty"`
// Threat actors associated with this indicator.
AttributedThreatActors []*SecurityResult_Association `protobuf:"bytes,15,rep,name=attributed_threat_actors,json=attributedThreatActors,proto3" json:"attributed_threat_actors,omitempty"`
// contains filtered or unexported fields
}AtiPrioritization contains various fields used to calculate a priority score for an entity identified as a threat.
func (*AtiPrioritization) Descriptor
func (*AtiPrioritization) Descriptor() ([]byte, []int)Deprecated: Use AtiPrioritization.ProtoReflect.Descriptor instead.
func (*AtiPrioritization) GetActiveIr
func (x *AtiPrioritization) GetActiveIr() boolfunc (*AtiPrioritization) GetActiveIrFirstTaggedTime
func (x *AtiPrioritization) GetActiveIrFirstTaggedTime() *timestamppb.Timestampfunc (*AtiPrioritization) GetAttributedMalware
func (x *AtiPrioritization) GetAttributedMalware() []*SecurityResult_Associationfunc (*AtiPrioritization) GetAttributedThreatActors
func (x *AtiPrioritization) GetAttributedThreatActors() []*SecurityResult_Associationfunc (*AtiPrioritization) GetExclusive
func (x *AtiPrioritization) GetExclusive() boolfunc (*AtiPrioritization) GetGlobalCustomerCount
func (x *AtiPrioritization) GetGlobalCustomerCount() int64func (*AtiPrioritization) GetGlobalHitCount
func (x *AtiPrioritization) GetGlobalHitCount() int64func (*AtiPrioritization) GetGtiSeverity
func (x *AtiPrioritization) GetGtiSeverity() int32func (*AtiPrioritization) GetGtiThreatScore
func (x *AtiPrioritization) GetGtiThreatScore() int32func (*AtiPrioritization) GetGtiUpdateTime
func (x *AtiPrioritization) GetGtiUpdateTime() *timestamppb.Timestampfunc (*AtiPrioritization) GetGtiVerdict
func (x *AtiPrioritization) GetGtiVerdict() int32func (*AtiPrioritization) GetMandiantAnalystConfidence
func (x *AtiPrioritization) GetMandiantAnalystConfidence() int32func (*AtiPrioritization) GetOsint
func (x *AtiPrioritization) GetOsint() boolfunc (*AtiPrioritization) GetReviewed
func (x *AtiPrioritization) GetReviewed() boolfunc (*AtiPrioritization) GetScanner
func (x *AtiPrioritization) GetScanner() boolfunc (*AtiPrioritization) ProtoMessage
func (*AtiPrioritization) ProtoMessage()func (*AtiPrioritization) ProtoReflect
func (x *AtiPrioritization) ProtoReflect() protoreflect.Messagefunc (*AtiPrioritization) Reset
func (x *AtiPrioritization) Reset()func (*AtiPrioritization) String
func (x *AtiPrioritization) String() stringAttackDetails
type AttackDetails struct {
// ATT&CK version (e.g. 12.1).
Version string `protobuf:"bytes,1,opt,name=version,proto3" json:"version,omitempty"`
// Tactics employed.
Tactics []*AttackDetails_Tactic `protobuf:"bytes,2,rep,name=tactics,proto3" json:"tactics,omitempty"`
// Techniques employed.
Techniques []*AttackDetails_Technique `protobuf:"bytes,3,rep,name=techniques,proto3" json:"techniques,omitempty"`
// contains filtered or unexported fields
}MITRE ATT&CK details.
func (*AttackDetails) Descriptor
func (*AttackDetails) Descriptor() ([]byte, []int)Deprecated: Use AttackDetails.ProtoReflect.Descriptor instead.
func (*AttackDetails) GetTactics
func (x *AttackDetails) GetTactics() []*AttackDetails_Tacticfunc (*AttackDetails) GetTechniques
func (x *AttackDetails) GetTechniques() []*AttackDetails_Techniquefunc (*AttackDetails) GetVersion
func (x *AttackDetails) GetVersion() stringfunc (*AttackDetails) ProtoMessage
func (*AttackDetails) ProtoMessage()func (*AttackDetails) ProtoReflect
func (x *AttackDetails) ProtoReflect() protoreflect.Messagefunc (*AttackDetails) Reset
func (x *AttackDetails) Reset()func (*AttackDetails) String
func (x *AttackDetails) String() stringAttackDetails_Tactic
type AttackDetails_Tactic struct {
// Tactic ID (e.g. "TA0043").
Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
// Tactic Name (e.g. "Reconnaissance")
Name string `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`
// contains filtered or unexported fields
}Tactic information related to an attack or threat.
func (*AttackDetails_Tactic) Descriptor
func (*AttackDetails_Tactic) Descriptor() ([]byte, []int)Deprecated: Use AttackDetails_Tactic.ProtoReflect.Descriptor instead.
func (*AttackDetails_Tactic) GetId
func (x *AttackDetails_Tactic) GetId() stringfunc (*AttackDetails_Tactic) GetName
func (x *AttackDetails_Tactic) GetName() stringfunc (*AttackDetails_Tactic) ProtoMessage
func (*AttackDetails_Tactic) ProtoMessage()func (*AttackDetails_Tactic) ProtoReflect
func (x *AttackDetails_Tactic) ProtoReflect() protoreflect.Messagefunc (*AttackDetails_Tactic) Reset
func (x *AttackDetails_Tactic) Reset()func (*AttackDetails_Tactic) String
func (x *AttackDetails_Tactic) String() stringAttackDetails_Technique
type AttackDetails_Technique struct {
// Technique ID (e.g. "T1595").
Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
// Technique Name (e.g. "Active Scanning").
Name string `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`
// Subtechnique ID (e.g. "T1595.001").
SubtechniqueId string `protobuf:"bytes,3,opt,name=subtechnique_id,json=subtechniqueId,proto3" json:"subtechnique_id,omitempty"`
// Subtechnique Name (e.g. "Scanning IP Blocks").
SubtechniqueName string `protobuf:"bytes,4,opt,name=subtechnique_name,json=subtechniqueName,proto3" json:"subtechnique_name,omitempty"`
// contains filtered or unexported fields
}Technique information related to an attack or threat.
func (*AttackDetails_Technique) Descriptor
func (*AttackDetails_Technique) Descriptor() ([]byte, []int)Deprecated: Use AttackDetails_Technique.ProtoReflect.Descriptor instead.
func (*AttackDetails_Technique) GetId
func (x *AttackDetails_Technique) GetId() stringfunc (*AttackDetails_Technique) GetName
func (x *AttackDetails_Technique) GetName() stringfunc (*AttackDetails_Technique) GetSubtechniqueId
func (x *AttackDetails_Technique) GetSubtechniqueId() stringfunc (*AttackDetails_Technique) GetSubtechniqueName
func (x *AttackDetails_Technique) GetSubtechniqueName() stringfunc (*AttackDetails_Technique) ProtoMessage
func (*AttackDetails_Technique) ProtoMessage()func (*AttackDetails_Technique) ProtoReflect
func (x *AttackDetails_Technique) ProtoReflect() protoreflect.Messagefunc (*AttackDetails_Technique) Reset
func (x *AttackDetails_Technique) Reset()func (*AttackDetails_Technique) String
func (x *AttackDetails_Technique) String() stringAttribute
type Attribute struct {
// Cloud metadata attributes such as project ID, account ID, or organizational
// hierarchy.
Cloud *Cloud `protobuf:"bytes,1,opt,name=cloud,proto3" json:"cloud,omitempty"`
// Set of labels for the entity. Should only be used for product labels (for
// example, Google Cloud resource labels or Azure AD sensitivity labels.
// Should not be used for arbitrary key-value mappings.
Labels []*Label `protobuf:"bytes,2,rep,name=labels,proto3" json:"labels,omitempty"`
// System permissions for IAM entity
// (human principal, service account, group).
Permissions []*Permission `protobuf:"bytes,705,rep,name=permissions,proto3" json:"permissions,omitempty"`
// System IAM roles to be assumed by resources to use the role's permissions
// for access control.
Roles []*Role `protobuf:"bytes,3,rep,name=roles,proto3" json:"roles,omitempty"`
// Time the resource or entity was created or provisioned.
CreationTime *timestamppb.Timestamp `protobuf:"bytes,4,opt,name=creation_time,json=creationTime,proto3" json:"creation_time,omitempty"`
// Time the resource or entity was last updated.
LastUpdateTime *timestamppb.Timestamp `protobuf:"bytes,5,opt,name=last_update_time,json=lastUpdateTime,proto3" json:"last_update_time,omitempty"`
// contains filtered or unexported fields
}Attribute is a container for generic entity attributes including common attributes across core entities (such as, user or asset). For example, Cloud is a generic entity attribute since it can apply to an asset (for example, a VM) or a user (for example, an identity service account).
func (*Attribute) Descriptor
Deprecated: Use Attribute.ProtoReflect.Descriptor instead.
func (*Attribute) GetCloud
func (*Attribute) GetCreationTime
func (x *Attribute) GetCreationTime() *timestamppb.Timestampfunc (*Attribute) GetLabels
func (*Attribute) GetLastUpdateTime
func (x *Attribute) GetLastUpdateTime() *timestamppb.Timestampfunc (*Attribute) GetPermissions
func (x *Attribute) GetPermissions() []*Permissionfunc (*Attribute) GetRoles
func (*Attribute) ProtoMessage
func (*Attribute) ProtoMessage()func (*Attribute) ProtoReflect
func (x *Attribute) ProtoReflect() protoreflect.Messagefunc (*Attribute) Reset
func (x *Attribute) Reset()func (*Attribute) String
Authentication
type Authentication struct {
// The type of authentication.
Type Authentication_AuthType `protobuf:"varint,1,opt,name=type,proto3,enum=google.backstory.Authentication_AuthType" json:"type,omitempty"`
// The authentication mechanism.
Mechanism []Authentication_Mechanism `protobuf:"varint,2,rep,packed,name=mechanism,proto3,enum=google.backstory.Authentication_Mechanism" json:"mechanism,omitempty"`
// The vendor defined details of the authentication.
AuthDetails string `protobuf:"bytes,3,opt,name=auth_details,json=authDetails,proto3" json:"auth_details,omitempty"`
// The outcome of the authentication event.
Outcome Authentication_Outcome `protobuf:"varint,4,opt,name=outcome,proto3,enum=google.backstory.Authentication_Outcome" json:"outcome,omitempty"`
// contains filtered or unexported fields
}The Authentication extension captures details specific to authentication events. General guidelines for authentication events:
- Details about the source of the authentication event (for example, client IP or hostname), should be captured in principal. The principal may be empty if we have no details about the source of the login.
- Details about the target of the authentication event (for example, details about the machine that is being logged into or logged out of) should be captured in target.
- Some authentication events may involve a third-party. For example, a user logs into a cloud service (for example, Chronicle) via their company's SSO (the event is logged by their SSO solution). In this case, the principal captures information about the user's device, the target captures details about the cloud service they logged into, and the intermediary captures details about the SSO solution.
func (*Authentication) Descriptor
func (*Authentication) Descriptor() ([]byte, []int)Deprecated: Use Authentication.ProtoReflect.Descriptor instead.
func (*Authentication) GetAuthDetails
func (x *Authentication) GetAuthDetails() stringfunc (*Authentication) GetMechanism
func (x *Authentication) GetMechanism() []Authentication_Mechanismfunc (*Authentication) GetOutcome
func (x *Authentication) GetOutcome() Authentication_Outcomefunc (*Authentication) GetType
func (x *Authentication) GetType() Authentication_AuthTypefunc (*Authentication) ProtoMessage
func (*Authentication) ProtoMessage()func (*Authentication) ProtoReflect
func (x *Authentication) ProtoReflect() protoreflect.Messagefunc (*Authentication) Reset
func (x *Authentication) Reset()func (*Authentication) String
func (x *Authentication) String() stringAuthentication_AuthType
type Authentication_AuthType int32Type of system the authentication event is associated with.
Authentication_AUTHTYPE_UNSPECIFIED, Authentication_MACHINE, Authentication_SSO, Authentication_VPN, Authentication_PHYSICAL, Authentication_TACACS
const (
// The default type.
Authentication_AUTHTYPE_UNSPECIFIED Authentication_AuthType = 0
// A machine authentication.
Authentication_MACHINE Authentication_AuthType = 1
// An SSO authentication.
Authentication_SSO Authentication_AuthType = 2
// A VPN authentication.
Authentication_VPN Authentication_AuthType = 3
// A Physical authentication (e.g. "Badge reader").
Authentication_PHYSICAL Authentication_AuthType = 4
// A TACACS family protocol for networked systems authentication
// (e.g. TACACS, TACACS+).
Authentication_TACACS Authentication_AuthType = 5
)func (Authentication_AuthType) Descriptor
func (Authentication_AuthType) Descriptor() protoreflect.EnumDescriptorfunc (Authentication_AuthType) Enum
func (x Authentication_AuthType) Enum() *Authentication_AuthTypefunc (Authentication_AuthType) EnumDescriptor
func (Authentication_AuthType) EnumDescriptor() ([]byte, []int)Deprecated: Use Authentication_AuthType.Descriptor instead.
func (Authentication_AuthType) Number
func (x Authentication_AuthType) Number() protoreflect.EnumNumberfunc (Authentication_AuthType) String
func (x Authentication_AuthType) String() stringfunc (Authentication_AuthType) Type
func (Authentication_AuthType) Type() protoreflect.EnumTypeAuthentication_AuthenticationStatus
type Authentication_AuthenticationStatus int32Authentication status, can be used to describe the status of authentication for a user or particular credential.
Authentication_UNKNOWN_AUTHENTICATION_STATUS, Authentication_ACTIVE, Authentication_SUSPENDED, Authentication_NO_ACTIVE_CREDENTIALS, Authentication_DELETED
const (
// The default authentication status.
Authentication_UNKNOWN_AUTHENTICATION_STATUS Authentication_AuthenticationStatus = 0
// The authentication method is in active state.
Authentication_ACTIVE Authentication_AuthenticationStatus = 1
// The authentication method is in suspended/disabled state.
Authentication_SUSPENDED Authentication_AuthenticationStatus = 2
// The authentication method has no active credentials.
Authentication_NO_ACTIVE_CREDENTIALS Authentication_AuthenticationStatus = 3
// The authentication method has been deleted.
Authentication_DELETED Authentication_AuthenticationStatus = 4
)func (Authentication_AuthenticationStatus) Descriptor
func (Authentication_AuthenticationStatus) Descriptor() protoreflect.EnumDescriptorfunc (Authentication_AuthenticationStatus) Enum
func (x Authentication_AuthenticationStatus) Enum() *Authentication_AuthenticationStatusfunc (Authentication_AuthenticationStatus) EnumDescriptor
func (Authentication_AuthenticationStatus) EnumDescriptor() ([]byte, []int)Deprecated: Use Authentication_AuthenticationStatus.Descriptor instead.
func (Authentication_AuthenticationStatus) Number
func (x Authentication_AuthenticationStatus) Number() protoreflect.EnumNumberfunc (Authentication_AuthenticationStatus) String
func (x Authentication_AuthenticationStatus) String() stringfunc (Authentication_AuthenticationStatus) Type
func (Authentication_AuthenticationStatus) Type() protoreflect.EnumTypeAuthentication_Mechanism
type Authentication_Mechanism int32Mechanism(s) used to authenticate.
Authentication_MECHANISM_UNSPECIFIED, Authentication_USERNAME_PASSWORD, Authentication_OTP, Authentication_HARDWARE_KEY, Authentication_LOCAL, Authentication_REMOTE, Authentication_REMOTE_INTERACTIVE, Authentication_MECHANISM_OTHER, Authentication_BADGE_READER, Authentication_NETWORK, Authentication_BATCH, Authentication_SERVICE, Authentication_UNLOCK, Authentication_NETWORK_CLEAR_TEXT, Authentication_NEW_CREDENTIALS, Authentication_INTERACTIVE, Authentication_CACHED_INTERACTIVE, Authentication_CACHED_REMOTE_INTERACTIVE, Authentication_CACHED_UNLOCK, Authentication_BIOMETRIC, Authentication_WEARABLE
const (
// The default mechanism.
Authentication_MECHANISM_UNSPECIFIED Authentication_Mechanism = 0
// Username + password authentication.
Authentication_USERNAME_PASSWORD Authentication_Mechanism = 1
// OTP authentication.
Authentication_OTP Authentication_Mechanism = 2
// Hardware key authentication.
Authentication_HARDWARE_KEY Authentication_Mechanism = 3
// Local authentication.
Authentication_LOCAL Authentication_Mechanism = 4
// Remote authentication.
Authentication_REMOTE Authentication_Mechanism = 5
// RDP, Terminal Services, or VNC.
Authentication_REMOTE_INTERACTIVE Authentication_Mechanism = 6
// Some other mechanism that is not defined here.
Authentication_MECHANISM_OTHER Authentication_Mechanism = 7
// Badge reader authentication
Authentication_BADGE_READER Authentication_Mechanism = 8
// Network authentication.
Authentication_NETWORK Authentication_Mechanism = 9
// Batch authentication.
Authentication_BATCH Authentication_Mechanism = 10
// Service authentication
Authentication_SERVICE Authentication_Mechanism = 11
// Direct human-interactive unlock authentication.
Authentication_UNLOCK Authentication_Mechanism = 12
// Network clear text authentication.
Authentication_NETWORK_CLEAR_TEXT Authentication_Mechanism = 13
// Authentication with new credentials.
Authentication_NEW_CREDENTIALS Authentication_Mechanism = 14
// Interactive authentication.
Authentication_INTERACTIVE Authentication_Mechanism = 15
// Interactive authentication using cached credentials.
Authentication_CACHED_INTERACTIVE Authentication_Mechanism = 16
// Cached Remote Interactive authentication using cached credentials.
Authentication_CACHED_REMOTE_INTERACTIVE Authentication_Mechanism = 17
// Cached Remote Interactive authentication using cached credentials.
Authentication_CACHED_UNLOCK Authentication_Mechanism = 18
// Biometric device such as a fingerprint reader.
Authentication_BIOMETRIC Authentication_Mechanism = 19
// Wearable such as an Apple Watch.
Authentication_WEARABLE Authentication_Mechanism = 20
)func (Authentication_Mechanism) Descriptor
func (Authentication_Mechanism) Descriptor() protoreflect.EnumDescriptorfunc (Authentication_Mechanism) Enum
func (x Authentication_Mechanism) Enum() *Authentication_Mechanismfunc (Authentication_Mechanism) EnumDescriptor
func (Authentication_Mechanism) EnumDescriptor() ([]byte, []int)Deprecated: Use Authentication_Mechanism.Descriptor instead.
func (Authentication_Mechanism) Number
func (x Authentication_Mechanism) Number() protoreflect.EnumNumberfunc (Authentication_Mechanism) String
func (x Authentication_Mechanism) String() stringfunc (Authentication_Mechanism) Type
func (Authentication_Mechanism) Type() protoreflect.EnumTypeAuthentication_Outcome
type Authentication_Outcome int32The outcome of the authentication event.
Authentication_OUTCOME_UNSPECIFIED, Authentication_SUCCESS, Authentication_FAILURE
const (
// The default outcome.
Authentication_OUTCOME_UNSPECIFIED Authentication_Outcome = 0
// The authentication was successful.
Authentication_SUCCESS Authentication_Outcome = 1
// The authentication failed.
Authentication_FAILURE Authentication_Outcome = 2
)func (Authentication_Outcome) Descriptor
func (Authentication_Outcome) Descriptor() protoreflect.EnumDescriptorfunc (Authentication_Outcome) Enum
func (x Authentication_Outcome) Enum() *Authentication_Outcomefunc (Authentication_Outcome) EnumDescriptor
func (Authentication_Outcome) EnumDescriptor() ([]byte, []int)Deprecated: Use Authentication_Outcome.Descriptor instead.
func (Authentication_Outcome) Number
func (x Authentication_Outcome) Number() protoreflect.EnumNumberfunc (Authentication_Outcome) String
func (x Authentication_Outcome) String() stringfunc (Authentication_Outcome) Type
func (Authentication_Outcome) Type() protoreflect.EnumTypeBoolSequence
type BoolSequence struct {
// bool sequence.
BoolVals []bool `protobuf:"varint,1,rep,packed,name=bool_vals,json=boolVals,proto3" json:"bool_vals,omitempty"`
// contains filtered or unexported fields
}BoolSequence represents a sequence of bools.
func (*BoolSequence) Descriptor
func (*BoolSequence) Descriptor() ([]byte, []int)Deprecated: Use BoolSequence.ProtoReflect.Descriptor instead.
func (*BoolSequence) GetBoolVals
func (x *BoolSequence) GetBoolVals() []boolfunc (*BoolSequence) ProtoMessage
func (*BoolSequence) ProtoMessage()func (*BoolSequence) ProtoReflect
func (x *BoolSequence) ProtoReflect() protoreflect.Messagefunc (*BoolSequence) Reset
func (x *BoolSequence) Reset()func (*BoolSequence) String
func (x *BoolSequence) String() stringBrowser
type Browser struct {
// The browser that recorded the history entry (e.g. "Chrome", "Firefox",
// "Safari", etc.).
BrowserType Browser_BrowserType `protobuf:"varint,1,opt,name=browser_type,json=browserType,proto3,enum=google.backstory.Browser_BrowserType" json:"browser_type,omitempty"`
// The browser version.
BrowserVersion string `protobuf:"bytes,2,opt,name=browser_version,json=browserVersion,proto3" json:"browser_version,omitempty"`
// The timestamp indicating the initial visit to the URL.
FirstVisitTime *timestamppb.Timestamp `protobuf:"bytes,3,opt,name=first_visit_time,json=firstVisitTime,proto3" json:"first_visit_time,omitempty"`
// The timestamp indicating the most recent visit to the URL.
LastVisitTime *timestamppb.Timestamp `protobuf:"bytes,4,opt,name=last_visit_time,json=lastVisitTime,proto3" json:"last_visit_time,omitempty"`
// The browser profile associated with the history entry.
Profile string `protobuf:"bytes,5,opt,name=profile,proto3" json:"profile,omitempty"`
// A boolean value indicating if the URL was typed by the user.
Typed bool `protobuf:"varint,6,opt,name=typed,proto3" json:"typed,omitempty"`
// Describes the type of navigation or visit (e.g., direct, redirect, etc.).
VisitType Browser_UrlVisitType `protobuf:"varint,7,opt,name=visit_type,json=visitType,proto3,enum=google.backstory.Browser_UrlVisitType" json:"visit_type,omitempty"`
// A boolean value indicating if the history entry is hidden.
Hidden bool `protobuf:"varint,8,opt,name=hidden,proto3" json:"hidden,omitempty"`
// Indicates the URI from which the current visit originated.
RequestOriginUri string `protobuf:"bytes,9,opt,name=request_origin_uri,json=requestOriginUri,proto3" json:"request_origin_uri,omitempty"`
// The total number of times the Url has been visited.
VisitCount int64 `protobuf:"varint,10,opt,name=visit_count,json=visitCount,proto3" json:"visit_count,omitempty"`
// Describes the criteria used to calculate the visit_count.
VisitCountCriteria string `protobuf:"bytes,11,opt,name=visit_count_criteria,json=visitCountCriteria,proto3" json:"visit_count_criteria,omitempty"`
// Represents the textual content of a web page. This field should be kept
// short. Large strings may affect latency and payload sizes.
IndexedContent string `protobuf:"bytes,12,opt,name=indexed_content,json=indexedContent,proto3" json:"indexed_content,omitempty"`
// The timestamp indicating the first time the URL was bookmarked.
FirstBookmarkedTime *timestamppb.Timestamp `protobuf:"bytes,13,opt,name=first_bookmarked_time,json=firstBookmarkedTime,proto3" json:"first_bookmarked_time,omitempty"`
// Information about the cookies.
Cookies []*Browser_Cookie `protobuf:"bytes,14,rep,name=cookies,proto3" json:"cookies,omitempty"`
// The number of times the URL was visited with this specific visit type and
// visit source.
TypedCount int64 `protobuf:"varint,15,opt,name=typed_count,json=typedCount,proto3" json:"typed_count,omitempty"`
// The source of the visit.
VisitSource Browser_VisitSource `protobuf:"varint,16,opt,name=visit_source,json=visitSource,proto3,enum=google.backstory.Browser_VisitSource" json:"visit_source,omitempty"`
// contains filtered or unexported fields
}Information about an entry in the web browser's local history database.
func (*Browser) Descriptor
Deprecated: Use Browser.ProtoReflect.Descriptor instead.
func (*Browser) GetBrowserType
func (x *Browser) GetBrowserType() Browser_BrowserTypefunc (*Browser) GetBrowserVersion
func (*Browser) GetCookies
func (x *Browser) GetCookies() []*Browser_Cookiefunc (*Browser) GetFirstBookmarkedTime
func (x *Browser) GetFirstBookmarkedTime() *timestamppb.Timestampfunc (*Browser) GetFirstVisitTime
func (x *Browser) GetFirstVisitTime() *timestamppb.Timestampfunc (*Browser) GetHidden
func (*Browser) GetIndexedContent
func (*Browser) GetLastVisitTime
func (x *Browser) GetLastVisitTime() *timestamppb.Timestampfunc (*Browser) GetProfile
func (*Browser) GetRequestOriginUri
func (*Browser) GetTyped
func (*Browser) GetTypedCount
func (*Browser) GetVisitCount
func (*Browser) GetVisitCountCriteria
func (*Browser) GetVisitSource
func (x *Browser) GetVisitSource() Browser_VisitSourcefunc (*Browser) GetVisitType
func (x *Browser) GetVisitType() Browser_UrlVisitTypefunc (*Browser) ProtoMessage
func (*Browser) ProtoMessage()func (*Browser) ProtoReflect
func (x *Browser) ProtoReflect() protoreflect.Messagefunc (*Browser) Reset
func (x *Browser) Reset()func (*Browser) String
Browser_BrowserType
type Browser_BrowserType int32The name of the browser.
Browser_BROWSER_TYPE_UNSPECIFIED, Browser_CHROME, Browser_FIREFOX, Browser_SAFARI, Browser_INTERNET_EXPLORER, Browser_EDGE, Browser_OPERA
const (
// Default value.
Browser_BROWSER_TYPE_UNSPECIFIED Browser_BrowserType = 0
// Chrome.
Browser_CHROME Browser_BrowserType = 1
// Firefox.
Browser_FIREFOX Browser_BrowserType = 2
// Safari.
Browser_SAFARI Browser_BrowserType = 3
// Internet Explorer.
Browser_INTERNET_EXPLORER Browser_BrowserType = 4
// Edge.
Browser_EDGE Browser_BrowserType = 5
// Opera.
Browser_OPERA Browser_BrowserType = 6
)func (Browser_BrowserType) Descriptor
func (Browser_BrowserType) Descriptor() protoreflect.EnumDescriptorfunc (Browser_BrowserType) Enum
func (x Browser_BrowserType) Enum() *Browser_BrowserTypefunc (Browser_BrowserType) EnumDescriptor
func (Browser_BrowserType) EnumDescriptor() ([]byte, []int)Deprecated: Use Browser_BrowserType.Descriptor instead.
func (Browser_BrowserType) Number
func (x Browser_BrowserType) Number() protoreflect.EnumNumberfunc (Browser_BrowserType) String
func (x Browser_BrowserType) String() stringfunc (Browser_BrowserType) Type
func (Browser_BrowserType) Type() protoreflect.EnumTypeBrowser_Cookie
type Browser_Cookie struct {
// The unique name identifying the cookie.
Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
// The data stored within the cookie.
Value string `protobuf:"bytes,2,opt,name=value,proto3" json:"value,omitempty"`
// The domain for which the cookie is valid.
Domain string `protobuf:"bytes,3,opt,name=domain,proto3" json:"domain,omitempty"`
// The URL path for which the cookie is valid.
Path string `protobuf:"bytes,4,opt,name=path,proto3" json:"path,omitempty"`
// The date and time when the cookie will expire.
ExpirationTime *timestamppb.Timestamp `protobuf:"bytes,5,opt,name=expiration_time,json=expirationTime,proto3" json:"expiration_time,omitempty"`
// Indicates if the cookie is inaccessible via client-side scripts (e.g.,
// JavaScript).
HttpOnly bool `protobuf:"varint,6,opt,name=http_only,json=httpOnly,proto3" json:"http_only,omitempty"`
// Indicates if the cookie should only be sent over secure HTTPS
// connections.
Secure bool `protobuf:"varint,7,opt,name=secure,proto3" json:"secure,omitempty"`
// The maximum age of the cookie in seconds.
MaxAge int64 `protobuf:"varint,8,opt,name=max_age,json=maxAge,proto3" json:"max_age,omitempty"`
// Affects cross-site request behavior.
SameSite Browser_Cookie_CookieSameSite `protobuf:"varint,9,opt,name=same_site,json=sameSite,proto3,enum=google.backstory.Browser_Cookie_CookieSameSite" json:"same_site,omitempty"`
// Indicates if the cookie is persistent.
Session bool `protobuf:"varint,10,opt,name=session,proto3" json:"session,omitempty"`
// Shows if the cookies is stored using partitioned storage.
Partitioned bool `protobuf:"varint,11,opt,name=partitioned,proto3" json:"partitioned,omitempty"`
// contains filtered or unexported fields
}Browser cookie.
func (*Browser_Cookie) Descriptor
func (*Browser_Cookie) Descriptor() ([]byte, []int)Deprecated: Use Browser_Cookie.ProtoReflect.Descriptor instead.
func (*Browser_Cookie) GetDomain
func (x *Browser_Cookie) GetDomain() stringfunc (*Browser_Cookie) GetExpirationTime
func (x *Browser_Cookie) GetExpirationTime() *timestamppb.Timestampfunc (*Browser_Cookie) GetHttpOnly
func (x *Browser_Cookie) GetHttpOnly() boolfunc (*Browser_Cookie) GetMaxAge
func (x *Browser_Cookie) GetMaxAge() int64func (*Browser_Cookie) GetName
func (x *Browser_Cookie) GetName() stringfunc (*Browser_Cookie) GetPartitioned
func (x *Browser_Cookie) GetPartitioned() boolfunc (*Browser_Cookie) GetPath
func (x *Browser_Cookie) GetPath() stringfunc (*Browser_Cookie) GetSameSite
func (x *Browser_Cookie) GetSameSite() Browser_Cookie_CookieSameSitefunc (*Browser_Cookie) GetSecure
func (x *Browser_Cookie) GetSecure() boolfunc (*Browser_Cookie) GetSession
func (x *Browser_Cookie) GetSession() boolfunc (*Browser_Cookie) GetValue
func (x *Browser_Cookie) GetValue() stringfunc (*Browser_Cookie) ProtoMessage
func (*Browser_Cookie) ProtoMessage()func (*Browser_Cookie) ProtoReflect
func (x *Browser_Cookie) ProtoReflect() protoreflect.Messagefunc (*Browser_Cookie) Reset
func (x *Browser_Cookie) Reset()func (*Browser_Cookie) String
func (x *Browser_Cookie) String() stringBrowser_Cookie_CookieSameSite
type Browser_Cookie_CookieSameSite int32The SameSite attribute of a cookie.
Browser_Cookie_COOKIE_SAME_SITE_UNSPECIFIED, Browser_Cookie_STRICT, Browser_Cookie_LAX, Browser_Cookie_NONE
const (
// Default value.
Browser_Cookie_COOKIE_SAME_SITE_UNSPECIFIED Browser_Cookie_CookieSameSite = 0
// Corresponds to SameSite=Strict.
Browser_Cookie_STRICT Browser_Cookie_CookieSameSite = 1
// Corresponds to SameSite=Lax.
Browser_Cookie_LAX Browser_Cookie_CookieSameSite = 2
// Corresponds to SameSite=None.
Browser_Cookie_NONE Browser_Cookie_CookieSameSite = 3
)func (Browser_Cookie_CookieSameSite) Descriptor
func (Browser_Cookie_CookieSameSite) Descriptor() protoreflect.EnumDescriptorfunc (Browser_Cookie_CookieSameSite) Enum
func (x Browser_Cookie_CookieSameSite) Enum() *Browser_Cookie_CookieSameSitefunc (Browser_Cookie_CookieSameSite) EnumDescriptor
func (Browser_Cookie_CookieSameSite) EnumDescriptor() ([]byte, []int)Deprecated: Use Browser_Cookie_CookieSameSite.Descriptor instead.
func (Browser_Cookie_CookieSameSite) Number
func (x Browser_Cookie_CookieSameSite) Number() protoreflect.EnumNumberfunc (Browser_Cookie_CookieSameSite) String
func (x Browser_Cookie_CookieSameSite) String() stringfunc (Browser_Cookie_CookieSameSite) Type
func (Browser_Cookie_CookieSameSite) Type() protoreflect.EnumTypeBrowser_UrlVisitType
type Browser_UrlVisitType int32The type of visit to a URL.
Browser_URL_VISIT_TYPE_UNSPECIFIED, Browser_LINK, Browser_TYPED, Browser_AUTO_BOOKMARK, Browser_AUTO_SUBFRAME, Browser_MANUAL_SUBFRAME, Browser_GENERATED, Browser_AUTO_TOPLEVEL, Browser_FORM_SUBMIT, Browser_RELOAD, Browser_KEYWORD, Browser_KEYWORD_GENERATED, Browser_REDIRECT
const (
// Default value.
Browser_URL_VISIT_TYPE_UNSPECIFIED Browser_UrlVisitType = 0
// The user clicked a link.
Browser_LINK Browser_UrlVisitType = 1
// The user typed a URL.
Browser_TYPED Browser_UrlVisitType = 2
// The user bookmarked the URL.
Browser_AUTO_BOOKMARK Browser_UrlVisitType = 3
// Loaded in a nested subframe by the parent frame.
Browser_AUTO_SUBFRAME Browser_UrlVisitType = 4
// Loaded in a nested subframe by the user.
Browser_MANUAL_SUBFRAME Browser_UrlVisitType = 5
// The user clicked on auto generated link in browser address bar.
Browser_GENERATED Browser_UrlVisitType = 6
// The page was loaded through command line or is the starting page.
Browser_AUTO_TOPLEVEL Browser_UrlVisitType = 7
// The user submitted a form.
Browser_FORM_SUBMIT Browser_UrlVisitType = 8
// The user reloaded the page.
Browser_RELOAD Browser_UrlVisitType = 9
// The Url was generated by a keyword search configured by user.
Browser_KEYWORD Browser_UrlVisitType = 10
// Corresponds to a visit generated by a keyword search.
Browser_KEYWORD_GENERATED Browser_UrlVisitType = 11
// The user was redirected to the URL.
Browser_REDIRECT Browser_UrlVisitType = 12
)func (Browser_UrlVisitType) Descriptor
func (Browser_UrlVisitType) Descriptor() protoreflect.EnumDescriptorfunc (Browser_UrlVisitType) Enum
func (x Browser_UrlVisitType) Enum() *Browser_UrlVisitTypefunc (Browser_UrlVisitType) EnumDescriptor
func (Browser_UrlVisitType) EnumDescriptor() ([]byte, []int)Deprecated: Use Browser_UrlVisitType.Descriptor instead.
func (Browser_UrlVisitType) Number
func (x Browser_UrlVisitType) Number() protoreflect.EnumNumberfunc (Browser_UrlVisitType) String
func (x Browser_UrlVisitType) String() stringfunc (Browser_UrlVisitType) Type
func (Browser_UrlVisitType) Type() protoreflect.EnumTypeBrowser_VisitSource
type Browser_VisitSource int32The source of the visit.
Browser_VISIT_SOURCE_UNSPECIFIED, Browser_SYNCED, Browser_BROWSER, Browser_EXTENSION, Browser_IMPORTED
const (
// Default value.
Browser_VISIT_SOURCE_UNSPECIFIED Browser_VisitSource = 0
// The visit was synced from another device.
Browser_SYNCED Browser_VisitSource = 1
// The visit was from a browser.
Browser_BROWSER Browser_VisitSource = 2
// The visit was from an extension.
Browser_EXTENSION Browser_VisitSource = 3
// The visit was imported from another browser application.
Browser_IMPORTED Browser_VisitSource = 4
)func (Browser_VisitSource) Descriptor
func (Browser_VisitSource) Descriptor() protoreflect.EnumDescriptorfunc (Browser_VisitSource) Enum
func (x Browser_VisitSource) Enum() *Browser_VisitSourcefunc (Browser_VisitSource) EnumDescriptor
func (Browser_VisitSource) EnumDescriptor() ([]byte, []int)Deprecated: Use Browser_VisitSource.Descriptor instead.
func (Browser_VisitSource) Number
func (x Browser_VisitSource) Number() protoreflect.EnumNumberfunc (Browser_VisitSource) String
func (x Browser_VisitSource) String() stringfunc (Browser_VisitSource) Type
func (Browser_VisitSource) Type() protoreflect.EnumTypeBytesSequence
type BytesSequence struct {
// bytes sequence.
BytesVals [][]byte `protobuf:"bytes,1,rep,name=bytes_vals,json=bytesVals,proto3" json:"bytes_vals,omitempty"`
// contains filtered or unexported fields
}BytesSequence represents a sequence of bytes.
func (*BytesSequence) Descriptor
func (*BytesSequence) Descriptor() ([]byte, []int)Deprecated: Use BytesSequence.ProtoReflect.Descriptor instead.
func (*BytesSequence) GetBytesVals
func (x *BytesSequence) GetBytesVals() [][]bytefunc (*BytesSequence) ProtoMessage
func (*BytesSequence) ProtoMessage()func (*BytesSequence) ProtoReflect
func (x *BytesSequence) ProtoReflect() protoreflect.Messagefunc (*BytesSequence) Reset
func (x *BytesSequence) Reset()func (*BytesSequence) String
func (x *BytesSequence) String() stringCertificate
type Certificate struct {
// Certificate version.
Version string `protobuf:"bytes,1,opt,name=version,proto3" json:"version,omitempty"`
// Certificate serial number.
Serial string `protobuf:"bytes,2,opt,name=serial,proto3" json:"serial,omitempty"`
// Subject of the certificate.
Subject string `protobuf:"bytes,3,opt,name=subject,proto3" json:"subject,omitempty"`
// Issuer of the certificate.
Issuer string `protobuf:"bytes,4,opt,name=issuer,proto3" json:"issuer,omitempty"`
// The MD5 hash of the certificate, as a hex-encoded string.
Md5 string `protobuf:"bytes,5,opt,name=md5,proto3" json:"md5,omitempty"`
// The SHA1 hash of the certificate, as a hex-encoded string.
Sha1 string `protobuf:"bytes,6,opt,name=sha1,proto3" json:"sha1,omitempty"`
// The SHA256 hash of the certificate, as a hex-encoded string.
Sha256 string `protobuf:"bytes,7,opt,name=sha256,proto3" json:"sha256,omitempty"`
// Indicates when the certificate is first valid.
NotBefore *timestamppb.Timestamp `protobuf:"bytes,8,opt,name=not_before,json=notBefore,proto3" json:"not_before,omitempty"`
// Indicates when the certificate is no longer valid.
NotAfter *timestamppb.Timestamp `protobuf:"bytes,9,opt,name=not_after,json=notAfter,proto3" json:"not_after,omitempty"`
// contains filtered or unexported fields
}Certificate information
func (*Certificate) Descriptor
func (*Certificate) Descriptor() ([]byte, []int)Deprecated: Use Certificate.ProtoReflect.Descriptor instead.
func (*Certificate) GetIssuer
func (x *Certificate) GetIssuer() stringfunc (*Certificate) GetMd5
func (x *Certificate) GetMd5() stringfunc (*Certificate) GetNotAfter
func (x *Certificate) GetNotAfter() *timestamppb.Timestampfunc (*Certificate) GetNotBefore
func (x *Certificate) GetNotBefore() *timestamppb.Timestampfunc (*Certificate) GetSerial
func (x *Certificate) GetSerial() stringfunc (*Certificate) GetSha1
func (x *Certificate) GetSha1() stringfunc (*Certificate) GetSha256
func (x *Certificate) GetSha256() stringfunc (*Certificate) GetSubject
func (x *Certificate) GetSubject() stringfunc (*Certificate) GetVersion
func (x *Certificate) GetVersion() stringfunc (*Certificate) ProtoMessage
func (*Certificate) ProtoMessage()func (*Certificate) ProtoReflect
func (x *Certificate) ProtoReflect() protoreflect.Messagefunc (*Certificate) Reset
func (x *Certificate) Reset()func (*Certificate) String
func (x *Certificate) String() stringCloud
type Cloud struct {
// The Cloud environment.
Environment Cloud_CloudEnvironment `protobuf:"varint,1,opt,name=environment,proto3,enum=google.backstory.Cloud_CloudEnvironment" json:"environment,omitempty"`
// The cloud environment VPC.
// Deprecated.
//
// Deprecated: Marked as deprecated in backstory/udm.proto.
Vpc *Resource `protobuf:"bytes,2,opt,name=vpc,proto3" json:"vpc,omitempty"`
// The cloud environment project information.
// Deprecated: Use Resource.resource_ancestors
//
// Deprecated: Marked as deprecated in backstory/udm.proto.
Project *Resource `protobuf:"bytes,3,opt,name=project,proto3" json:"project,omitempty"`
// The cloud environment availability zone (different from region which is
// location.name).
AvailabilityZone string `protobuf:"bytes,4,opt,name=availability_zone,json=availabilityZone,proto3" json:"availability_zone,omitempty"`
// contains filtered or unexported fields
}Metadata related to the cloud environment.
func (*Cloud) Descriptor
Deprecated: Use Cloud.ProtoReflect.Descriptor instead.
func (*Cloud) GetAvailabilityZone
func (*Cloud) GetEnvironment
func (x *Cloud) GetEnvironment() Cloud_CloudEnvironmentfunc (*Cloud) GetProject
Deprecated: Marked as deprecated in backstory/udm.proto.
func (*Cloud) GetVpc
Deprecated: Marked as deprecated in backstory/udm.proto.
func (*Cloud) ProtoMessage
func (*Cloud) ProtoMessage()func (*Cloud) ProtoReflect
func (x *Cloud) ProtoReflect() protoreflect.Messagefunc (*Cloud) Reset
func (x *Cloud) Reset()func (*Cloud) String
Cloud_CloudEnvironment
type Cloud_CloudEnvironment int32The service provider environment.
Cloud_UNSPECIFIED_CLOUD_ENVIRONMENT, Cloud_GOOGLE_CLOUD_PLATFORM, Cloud_AMAZON_WEB_SERVICES, Cloud_MICROSOFT_AZURE
const (
// Default.
Cloud_UNSPECIFIED_CLOUD_ENVIRONMENT Cloud_CloudEnvironment = 0
// Google Cloud Platform.
Cloud_GOOGLE_CLOUD_PLATFORM Cloud_CloudEnvironment = 1
// Amazon Web Services.
Cloud_AMAZON_WEB_SERVICES Cloud_CloudEnvironment = 2
// Microsoft Azure.
Cloud_MICROSOFT_AZURE Cloud_CloudEnvironment = 3
)func (Cloud_CloudEnvironment) Descriptor
func (Cloud_CloudEnvironment) Descriptor() protoreflect.EnumDescriptorfunc (Cloud_CloudEnvironment) Enum
func (x Cloud_CloudEnvironment) Enum() *Cloud_CloudEnvironmentfunc (Cloud_CloudEnvironment) EnumDescriptor
func (Cloud_CloudEnvironment) EnumDescriptor() ([]byte, []int)Deprecated: Use Cloud_CloudEnvironment.Descriptor instead.
func (Cloud_CloudEnvironment) Number
func (x Cloud_CloudEnvironment) Number() protoreflect.EnumNumberfunc (Cloud_CloudEnvironment) String
func (x Cloud_CloudEnvironment) String() stringfunc (Cloud_CloudEnvironment) Type
func (Cloud_CloudEnvironment) Type() protoreflect.EnumTypeCollection
type Collection struct {
// Unique ID for the collection.
// The ID is specific to the type of collection. For example, with rule
// detections this is the detection ID.
Id string `protobuf:"bytes,7,opt,name=id,proto3" json:"id,omitempty"`
// What the collection represents.
Type Collection_CollectionType `protobuf:"varint,1,opt,name=type,proto3,enum=google.backstory.Collection_CollectionType" json:"type,omitempty"`
// The ID namespace used for the Collection.
IdNamespace Id_Namespace `protobuf:"varint,12,opt,name=id_namespace,json=idNamespace,proto3,enum=google.backstory.Id_Namespace" json:"id_namespace,omitempty"`
// Time the collection was created.
CreatedTime *timestamppb.Timestamp `protobuf:"bytes,5,opt,name=created_time,json=createdTime,proto3" json:"created_time,omitempty"`
// Time the collection was last updated.
LastUpdatedTime *timestamppb.Timestamp `protobuf:"bytes,6,opt,name=last_updated_time,json=lastUpdatedTime,proto3" json:"last_updated_time,omitempty"`
// Time interval that the collection represents.
TimeWindow *interval.Interval `protobuf:"bytes,8,opt,name=time_window,json=timeWindow,proto3" json:"time_window,omitempty"`
// Constituent elements of the collection. Each element shares an association
// that groups it together and is a component of the overall collection. For
// example, a detection collection may have several constituent elements that
// each share a correlation association that together represent a particular
// pattern or behavior.
CollectionElements []*Element `protobuf:"bytes,9,rep,name=collection_elements,json=collectionElements,proto3" json:"collection_elements,omitempty"`
// Detection metadata for findings that represent detections, can include
// rule details, machine learning model metadata, and indicators implicated
// in the detection (using the .about field).
Detection []*SecurityResult `protobuf:"bytes,3,rep,name=detection,proto3" json:"detection,omitempty"`
// Timestamp within the time_window related to the time of the
// collection_elements. For Rule Detections, this timestamp is the end of the
// the time_window for multi-event rules or the time of the event for single
// event rules. For late-arriving events that trigger new alerts, the
// detection_time will be the event time of the event.
DetectionTime *timestamppb.Timestamp `protobuf:"bytes,10,opt,name=detection_time,json=detectionTime,proto3" json:"detection_time,omitempty"`
// Consolidated investigation details (categorization, status, etc) typically
// for collections that begin as detection findings and then evolve with
// analyst action and feedback into investigations around the detection
// output.
Investigation *Investigation `protobuf:"bytes,4,opt,name=investigation,proto3" json:"investigation,omitempty"`
// Tags set by UC/DSML/RE for the Finding during creation.
Tags []string `protobuf:"bytes,11,rep,name=tags,proto3" json:"tags,omitempty"`
// Alert related info of this same alert in customer's SOAR platform.
ResponsePlatformInfo *ResponsePlatformInfo `protobuf:"bytes,13,opt,name=response_platform_info,json=responsePlatformInfo,proto3" json:"response_platform_info,omitempty"`
// The resource name of the Case that this collection belongs to.
// Example:
// projects/{project id}/locations/{region}/chronicle/cases/{internal_case_id}
CaseName string `protobuf:"bytes,14,opt,name=case_name,json=caseName,proto3" json:"case_name,omitempty"`
// A boolean field indicating that the alert is present in SOAR.
SoarAlert bool `protobuf:"varint,17,opt,name=soar_alert,json=soarAlert,proto3" json:"soar_alert,omitempty"`
// Metadata fields of alerts coming from other SIEM systems via SOAR.
SoarAlertMetadata *SoarAlertMetadata `protobuf:"bytes,18,opt,name=soar_alert_metadata,json=soarAlertMetadata,proto3" json:"soar_alert_metadata,omitempty"`
// The resource name of the DataAccessScope of this collection.
DataAccessScope string `protobuf:"bytes,19,opt,name=data_access_scope,json=dataAccessScope,proto3" json:"data_access_scope,omitempty"`
// Detection timing details for the collection. These details are used to
// determine prossible causes of latency for the detection.
// This field is only set for detections that are generated by rules.
DetectionTimingDetails []Collection_DetectionTimingDetails `protobuf:"varint,20,rep,packed,name=detection_timing_details,json=detectionTimingDetails,proto3,enum=google.backstory.Collection_DetectionTimingDetails" json:"detection_timing_details,omitempty"`
// The latency metrics for the specific detection. These metrics are
// calculated from ALL of the events that contribute to the detection, not
// just the sampled ones.
LatencyMetrics *LatencyMetrics `protobuf:"bytes,21,opt,name=latency_metrics,json=latencyMetrics,proto3" json:"latency_metrics,omitempty"`
// The run frequency of the rule when it generated the detection.
RuleRunFrequency Collection_RunFrequency `protobuf:"varint,22,opt,name=rule_run_frequency,json=ruleRunFrequency,proto3,enum=google.backstory.Collection_RunFrequency" json:"rule_run_frequency,omitempty"`
// The total number of simulated events that contributed to this detection.
// Simulated events are realistic threat sequences (Raw Logs or UDM)
// programmatically delivered into the production ingestion pipeline to verify
// the entire detection lifecycle—from identification to action.
SimulatedEventCount int64 `protobuf:"varint,23,opt,name=simulated_event_count,json=simulatedEventCount,proto3" json:"simulated_event_count,omitempty"`
// The set of all values from event ingestion_labels where SIMULATED is set as
// the key, for all simulated events that participated in this detection.
SimulatedEventNames []string `protobuf:"bytes,24,rep,name=simulated_event_names,json=simulatedEventNames,proto3" json:"simulated_event_names,omitempty"`
// contains filtered or unexported fields
}Collection represents a container of objects (such as events, entity context metadata, detection finding metadata) and state (such as investigation details).
An example use case for Collection is to model a detection and investigation from detection finding metadata to investigative state collected in the course of the investigation. For more complex investigation and response workflows a Collection could represent an incident consisting of multiple child findings or incidents. This can be expanded on to model remediation elements of a full detection and response workflow.
func (*Collection) Descriptor
func (*Collection) Descriptor() ([]byte, []int)Deprecated: Use Collection.ProtoReflect.Descriptor instead.
func (*Collection) GetCaseName
func (x *Collection) GetCaseName() stringfunc (*Collection) GetCollectionElements
func (x *Collection) GetCollectionElements() []*Elementfunc (*Collection) GetCreatedTime
func (x *Collection) GetCreatedTime() *timestamppb.Timestampfunc (*Collection) GetDataAccessScope
func (x *Collection) GetDataAccessScope() stringfunc (*Collection) GetDetection
func (x *Collection) GetDetection() []*SecurityResultfunc (*Collection) GetDetectionTime
func (x *Collection) GetDetectionTime() *timestamppb.Timestampfunc (*Collection) GetDetectionTimingDetails
func (x *Collection) GetDetectionTimingDetails() []Collection_DetectionTimingDetailsfunc (*Collection) GetId
func (x *Collection) GetId() stringfunc (*Collection) GetIdNamespace
func (x *Collection) GetIdNamespace() Id_Namespacefunc (*Collection) GetInvestigation
func (x *Collection) GetInvestigation() *Investigationfunc (*Collection) GetLastUpdatedTime
func (x *Collection) GetLastUpdatedTime() *timestamppb.Timestampfunc (*Collection) GetLatencyMetrics
func (x *Collection) GetLatencyMetrics() *LatencyMetricsfunc (*Collection) GetResponsePlatformInfo
func (x *Collection) GetResponsePlatformInfo() *ResponsePlatformInfofunc (*Collection) GetRuleRunFrequency
func (x *Collection) GetRuleRunFrequency() Collection_RunFrequencyfunc (*Collection) GetSimulatedEventCount
func (x *Collection) GetSimulatedEventCount() int64func (*Collection) GetSimulatedEventNames
func (x *Collection) GetSimulatedEventNames() []stringfunc (*Collection) GetSoarAlert
func (x *Collection) GetSoarAlert() boolfunc (*Collection) GetSoarAlertMetadata
func (x *Collection) GetSoarAlertMetadata() *SoarAlertMetadatafunc (*Collection) GetTags
func (x *Collection) GetTags() []stringfunc (*Collection) GetTimeWindow
func (x *Collection) GetTimeWindow() *interval.Intervalfunc (*Collection) GetType
func (x *Collection) GetType() Collection_CollectionTypefunc (*Collection) ProtoMessage
func (*Collection) ProtoMessage()func (*Collection) ProtoReflect
func (x *Collection) ProtoReflect() protoreflect.Messagefunc (*Collection) Reset
func (x *Collection) Reset()func (*Collection) String
func (x *Collection) String() stringCollection_CollectionType
type Collection_CollectionType int32The type of the collection which will indicate which other fields are relevant. For example, detection finding collections will populate the detection field. Findings that evolve into investigations will populate the investigation field.
Collection_COLLECTION_TYPE_UNSPECIFIED, Collection_TELEMETRY_ALERT, Collection_GCTI_FINDING, Collection_UPPERCASE_ALERT, Collection_RULE_DETECTION, Collection_MACHINE_INTELLIGENCE_ALERT, Collection_SOAR_ALERT
const (
// An unspecified collection type.
Collection_COLLECTION_TYPE_UNSPECIFIED Collection_CollectionType = 0
// An alert reported in customer telemetry.
Collection_TELEMETRY_ALERT Collection_CollectionType = 1
// A finding from the Uppercase team.
Collection_GCTI_FINDING Collection_CollectionType = 2
Collection_UPPERCASE_ALERT Collection_CollectionType = 2
// A detection found by applying a rule.
Collection_RULE_DETECTION Collection_CollectionType = 3
// An alert generated by Chronicle machine learning models.
Collection_MACHINE_INTELLIGENCE_ALERT Collection_CollectionType = 4
// An alert coming from other SIEMs via Chronicle SOAR.
Collection_SOAR_ALERT Collection_CollectionType = 5
)func (Collection_CollectionType) Descriptor
func (Collection_CollectionType) Descriptor() protoreflect.EnumDescriptorfunc (Collection_CollectionType) Enum
func (x Collection_CollectionType) Enum() *Collection_CollectionTypefunc (Collection_CollectionType) EnumDescriptor
func (Collection_CollectionType) EnumDescriptor() ([]byte, []int)Deprecated: Use Collection_CollectionType.Descriptor instead.
func (Collection_CollectionType) Number
func (x Collection_CollectionType) Number() protoreflect.EnumNumberfunc (Collection_CollectionType) String
func (x Collection_CollectionType) String() stringfunc (Collection_CollectionType) Type
func (Collection_CollectionType) Type() protoreflect.EnumTypeCollection_DetectionTimingDetails
type Collection_DetectionTimingDetails int32Detection timing details for the collection.
Collection_DETECTION_TIMING_DETAILS_UNSPECIFIED, Collection_DETECTION_TIMING_DETAILS_REPROCESSING, Collection_DETECTION_TIMING_DETAILS_RETROHUNT
const (
// Detection timing details are unspecified.
Collection_DETECTION_TIMING_DETAILS_UNSPECIFIED Collection_DetectionTimingDetails = 0
// Detection is generated by a reprocessing run.
Collection_DETECTION_TIMING_DETAILS_REPROCESSING Collection_DetectionTimingDetails = 1
// Detection is generated by a retrohunt run.
Collection_DETECTION_TIMING_DETAILS_RETROHUNT Collection_DetectionTimingDetails = 2
)func (Collection_DetectionTimingDetails) Descriptor
func (Collection_DetectionTimingDetails) Descriptor() protoreflect.EnumDescriptorfunc (Collection_DetectionTimingDetails) Enum
func (x Collection_DetectionTimingDetails) Enum() *Collection_DetectionTimingDetailsfunc (Collection_DetectionTimingDetails) EnumDescriptor
func (Collection_DetectionTimingDetails) EnumDescriptor() ([]byte, []int)Deprecated: Use Collection_DetectionTimingDetails.Descriptor instead.
func (Collection_DetectionTimingDetails) Number
func (x Collection_DetectionTimingDetails) Number() protoreflect.EnumNumberfunc (Collection_DetectionTimingDetails) String
func (x Collection_DetectionTimingDetails) String() stringfunc (Collection_DetectionTimingDetails) Type
func (Collection_DetectionTimingDetails) Type() protoreflect.EnumTypeCollection_RunFrequency
type Collection_RunFrequency int32Run frequencies used by rule executions.
Collection_RUN_FREQUENCY_UNSPECIFIED, Collection_RUN_FREQUENCY_REALTIME, Collection_RUN_FREQUENCY_HOURLY, Collection_RUN_FREQUENCY_DAILY
const (
// Unspecified run frequency.
Collection_RUN_FREQUENCY_UNSPECIFIED Collection_RunFrequency = 0
// Real-time run frequency.
Collection_RUN_FREQUENCY_REALTIME Collection_RunFrequency = 1
// Executes once an hour.
Collection_RUN_FREQUENCY_HOURLY Collection_RunFrequency = 2
// Executes once a day.
Collection_RUN_FREQUENCY_DAILY Collection_RunFrequency = 3
)func (Collection_RunFrequency) Descriptor
func (Collection_RunFrequency) Descriptor() protoreflect.EnumDescriptorfunc (Collection_RunFrequency) Enum
func (x Collection_RunFrequency) Enum() *Collection_RunFrequencyfunc (Collection_RunFrequency) EnumDescriptor
func (Collection_RunFrequency) EnumDescriptor() ([]byte, []int)Deprecated: Use Collection_RunFrequency.Descriptor instead.
func (Collection_RunFrequency) Number
func (x Collection_RunFrequency) Number() protoreflect.EnumNumberfunc (Collection_RunFrequency) String
func (x Collection_RunFrequency) String() stringfunc (Collection_RunFrequency) Type
func (Collection_RunFrequency) Type() protoreflect.EnumTypeDNSRecord
type DNSRecord struct {
// Type.
Type string `protobuf:"bytes,1,opt,name=type,proto3" json:"type,omitempty"`
// Value.
Value string `protobuf:"bytes,2,opt,name=value,proto3" json:"value,omitempty"`
// Time to live.
Ttl *durationpb.Duration `protobuf:"bytes,3,opt,name=ttl,proto3" json:"ttl,omitempty"`
// Priority.
Priority int64 `protobuf:"varint,4,opt,name=priority,proto3" json:"priority,omitempty"`
// Retry.
Retry int64 `protobuf:"varint,5,opt,name=retry,proto3" json:"retry,omitempty"`
// Refresh.
Refresh *durationpb.Duration `protobuf:"bytes,6,opt,name=refresh,proto3" json:"refresh,omitempty"`
// Minimum.
Minimum *durationpb.Duration `protobuf:"bytes,7,opt,name=minimum,proto3" json:"minimum,omitempty"`
// Expire.
Expire *durationpb.Duration `protobuf:"bytes,8,opt,name=expire,proto3" json:"expire,omitempty"`
// Serial.
Serial int64 `protobuf:"varint,9,opt,name=serial,proto3" json:"serial,omitempty"`
// Rname.
Rname string `protobuf:"bytes,10,opt,name=rname,proto3" json:"rname,omitempty"`
// contains filtered or unexported fields
}DNS record.
func (*DNSRecord) Descriptor
Deprecated: Use DNSRecord.ProtoReflect.Descriptor instead.
func (*DNSRecord) GetExpire
func (x *DNSRecord) GetExpire() *durationpb.Durationfunc (*DNSRecord) GetMinimum
func (x *DNSRecord) GetMinimum() *durationpb.Durationfunc (*DNSRecord) GetPriority
func (*DNSRecord) GetRefresh
func (x *DNSRecord) GetRefresh() *durationpb.Durationfunc (*DNSRecord) GetRetry
func (*DNSRecord) GetRname
func (*DNSRecord) GetSerial
func (*DNSRecord) GetTtl
func (x *DNSRecord) GetTtl() *durationpb.Durationfunc (*DNSRecord) GetType
func (*DNSRecord) GetValue
func (*DNSRecord) ProtoMessage
func (*DNSRecord) ProtoMessage()func (*DNSRecord) ProtoReflect
func (x *DNSRecord) ProtoReflect() protoreflect.Messagefunc (*DNSRecord) Reset
func (x *DNSRecord) Reset()func (*DNSRecord) String
DataAccessIngestionLabel
type DataAccessIngestionLabel struct {
// The key.
Key string `protobuf:"bytes,1,opt,name=key,proto3" json:"key,omitempty"`
// The value.
Value string `protobuf:"bytes,2,opt,name=value,proto3" json:"value,omitempty"`
// contains filtered or unexported fields
}Label used in data access for ingestion.
func (*DataAccessIngestionLabel) Descriptor
func (*DataAccessIngestionLabel) Descriptor() ([]byte, []int)Deprecated: Use DataAccessIngestionLabel.ProtoReflect.Descriptor instead.
func (*DataAccessIngestionLabel) GetKey
func (x *DataAccessIngestionLabel) GetKey() stringfunc (*DataAccessIngestionLabel) GetValue
func (x *DataAccessIngestionLabel) GetValue() stringfunc (*DataAccessIngestionLabel) ProtoMessage
func (*DataAccessIngestionLabel) ProtoMessage()func (*DataAccessIngestionLabel) ProtoReflect
func (x *DataAccessIngestionLabel) ProtoReflect() protoreflect.Messagefunc (*DataAccessIngestionLabel) Reset
func (x *DataAccessIngestionLabel) Reset()func (*DataAccessIngestionLabel) String
func (x *DataAccessIngestionLabel) String() stringDataAccessLabels
type DataAccessLabels struct {
// All the LogType labels.
LogTypes []string `protobuf:"bytes,1,rep,name=log_types,json=logTypes,proto3" json:"log_types,omitempty"`
// All the ingestion labels.
//
// Deprecated: Marked as deprecated in backstory/data_access.proto.
IngestionLabels []string `protobuf:"bytes,2,rep,name=ingestion_labels,json=ingestionLabels,proto3" json:"ingestion_labels,omitempty"`
// All the namespaces.
Namespaces []string `protobuf:"bytes,3,rep,name=namespaces,proto3" json:"namespaces,omitempty"`
// All the complex labels (UDM search syntax based).
CustomLabels []string `protobuf:"bytes,4,rep,name=custom_labels,json=customLabels,proto3" json:"custom_labels,omitempty"`
// All the ingestion labels (key/value pairs).
IngestionKvLabels []*DataAccessIngestionLabel `protobuf:"bytes,5,rep,name=ingestion_kv_labels,json=ingestionKvLabels,proto3" json:"ingestion_kv_labels,omitempty"`
// Are the labels ready for scoped access
AllowScopedAccess bool `protobuf:"varint,6,opt,name=allow_scoped_access,json=allowScopedAccess,proto3" json:"allow_scoped_access,omitempty"`
// contains filtered or unexported fields
}Label used in data access.
func (*DataAccessLabels) Descriptor
func (*DataAccessLabels) Descriptor() ([]byte, []int)Deprecated: Use DataAccessLabels.ProtoReflect.Descriptor instead.
func (*DataAccessLabels) GetAllowScopedAccess
func (x *DataAccessLabels) GetAllowScopedAccess() boolfunc (*DataAccessLabels) GetCustomLabels
func (x *DataAccessLabels) GetCustomLabels() []stringfunc (*DataAccessLabels) GetIngestionKvLabels
func (x *DataAccessLabels) GetIngestionKvLabels() []*DataAccessIngestionLabelfunc (*DataAccessLabels) GetIngestionLabels
func (x *DataAccessLabels) GetIngestionLabels() []stringDeprecated: Marked as deprecated in backstory/data_access.proto.
func (*DataAccessLabels) GetLogTypes
func (x *DataAccessLabels) GetLogTypes() []stringfunc (*DataAccessLabels) GetNamespaces
func (x *DataAccessLabels) GetNamespaces() []stringfunc (*DataAccessLabels) ProtoMessage
func (*DataAccessLabels) ProtoMessage()func (*DataAccessLabels) ProtoReflect
func (x *DataAccessLabels) ProtoReflect() protoreflect.Messagefunc (*DataAccessLabels) Reset
func (x *DataAccessLabels) Reset()func (*DataAccessLabels) String
func (x *DataAccessLabels) String() stringDataTableRowInfo
type DataTableRowInfo struct {
// The name of data table.
DataTable string `protobuf:"bytes,1,opt,name=data_table,json=dataTable,proto3" json:"data_table,omitempty"`
// Stores the key value pair for a data table row where the key is the name
// of the column for the given value.
Row *structpb.Struct `protobuf:"bytes,2,opt,name=row,proto3" json:"row,omitempty"`
// The row id of the data table row.
RowId string `protobuf:"bytes,3,opt,name=row_id,json=rowId,proto3" json:"row_id,omitempty"`
// contains filtered or unexported fields
}DataTableRowInfo captures information about a data table row including the name of the data table.
func (*DataTableRowInfo) Descriptor
func (*DataTableRowInfo) Descriptor() ([]byte, []int)Deprecated: Use DataTableRowInfo.ProtoReflect.Descriptor instead.
func (*DataTableRowInfo) GetDataTable
func (x *DataTableRowInfo) GetDataTable() stringfunc (*DataTableRowInfo) GetRow
func (x *DataTableRowInfo) GetRow() *structpb.Structfunc (*DataTableRowInfo) GetRowId
func (x *DataTableRowInfo) GetRowId() stringfunc (*DataTableRowInfo) ProtoMessage
func (*DataTableRowInfo) ProtoMessage()func (*DataTableRowInfo) ProtoReflect
func (x *DataTableRowInfo) ProtoReflect() protoreflect.Messagefunc (*DataTableRowInfo) Reset
func (x *DataTableRowInfo) Reset()func (*DataTableRowInfo) String
func (x *DataTableRowInfo) String() stringDhcp
type Dhcp struct {
// The BOOTP op code.
Opcode Dhcp_OpCode `protobuf:"varint,1,opt,name=opcode,proto3,enum=google.backstory.Dhcp_OpCode" json:"opcode,omitempty"`
// Hardware address type.
Htype uint32 `protobuf:"varint,2,opt,name=htype,proto3" json:"htype,omitempty"`
// Hardware address length.
Hlen uint32 `protobuf:"varint,3,opt,name=hlen,proto3" json:"hlen,omitempty"`
// Hardware ops.
Hops uint32 `protobuf:"varint,4,opt,name=hops,proto3" json:"hops,omitempty"`
// Transaction ID.
TransactionId uint32 `protobuf:"varint,5,opt,name=transaction_id,json=transactionId,proto3" json:"transaction_id,omitempty"`
// Seconds elapsed since client began address acquisition/renewal process.
Seconds uint32 `protobuf:"varint,6,opt,name=seconds,proto3" json:"seconds,omitempty"`
// Flags.
Flags uint32 `protobuf:"varint,7,opt,name=flags,proto3" json:"flags,omitempty"`
// Client IP address (ciaddr).
Ciaddr string `protobuf:"bytes,8,opt,name=ciaddr,proto3" json:"ciaddr,omitempty"`
// Your IP address (yiaddr).
Yiaddr string `protobuf:"bytes,9,opt,name=yiaddr,proto3" json:"yiaddr,omitempty"`
// IP address of the next bootstrap server.
Siaddr string `protobuf:"bytes,10,opt,name=siaddr,proto3" json:"siaddr,omitempty"`
// Relay agent IP address (giaddr).
Giaddr string `protobuf:"bytes,11,opt,name=giaddr,proto3" json:"giaddr,omitempty"`
// Client hardware address (chaddr).
Chaddr string `protobuf:"bytes,12,opt,name=chaddr,proto3" json:"chaddr,omitempty"`
// Server name that the client wishes to boot from.
Sname string `protobuf:"bytes,13,opt,name=sname,proto3" json:"sname,omitempty"`
// Boot image filename.
File string `protobuf:"bytes,14,opt,name=file,proto3" json:"file,omitempty"`
// List of DHCP options.
Options []*Dhcp_Option `protobuf:"bytes,15,rep,name=options,proto3" json:"options,omitempty"`
// DHCP message type.
Type Dhcp_MessageType `protobuf:"varint,16,opt,name=type,proto3,enum=google.backstory.Dhcp_MessageType" json:"type,omitempty"`
// Lease time in seconds. See RFC2132, section 9.2.
LeaseTimeSeconds uint32 `protobuf:"varint,17,opt,name=lease_time_seconds,json=leaseTimeSeconds,proto3" json:"lease_time_seconds,omitempty"`
// Client hostname. See RFC2132, section 3.14.
ClientHostname string `protobuf:"bytes,18,opt,name=client_hostname,json=clientHostname,proto3" json:"client_hostname,omitempty"`
// Client identifier. See RFC2132, section 9.14.
// Note: Make sure to update the client_identifier_string field as well if you
// update this field.
ClientIdentifier []byte `protobuf:"bytes,19,opt,name=client_identifier,json=clientIdentifier,proto3" json:"client_identifier,omitempty"`
// Requested IP address. See RFC2132, section 9.1.
RequestedAddress string `protobuf:"bytes,20,opt,name=requested_address,json=requestedAddress,proto3" json:"requested_address,omitempty"`
// Client identifier as string. See RFC2132, section 9.14.
// This field holds the string value of the client_identifier.
ClientIdentifierString string `protobuf:"bytes,21,opt,name=client_identifier_string,json=clientIdentifierString,proto3" json:"client_identifier_string,omitempty"`
// contains filtered or unexported fields
}DHCP information.
func (*Dhcp) Descriptor
Deprecated: Use Dhcp.ProtoReflect.Descriptor instead.
func (*Dhcp) GetChaddr
func (*Dhcp) GetCiaddr
func (*Dhcp) GetClientHostname
func (*Dhcp) GetClientIdentifier
func (*Dhcp) GetClientIdentifierString
func (*Dhcp) GetFile
func (*Dhcp) GetFlags
func (*Dhcp) GetGiaddr
func (*Dhcp) GetHlen
func (*Dhcp) GetHops
func (*Dhcp) GetHtype
func (*Dhcp) GetLeaseTimeSeconds
func (*Dhcp) GetOpcode
func (x *Dhcp) GetOpcode() Dhcp_OpCodefunc (*Dhcp) GetOptions
func (x *Dhcp) GetOptions() []*Dhcp_Optionfunc (*Dhcp) GetRequestedAddress
func (*Dhcp) GetSeconds
func (*Dhcp) GetSiaddr
func (*Dhcp) GetSname
func (*Dhcp) GetTransactionId
func (*Dhcp) GetType
func (x *Dhcp) GetType() Dhcp_MessageTypefunc (*Dhcp) GetYiaddr
func (*Dhcp) ProtoMessage
func (*Dhcp) ProtoMessage()func (*Dhcp) ProtoReflect
func (x *Dhcp) ProtoReflect() protoreflect.Messagefunc (*Dhcp) Reset
func (x *Dhcp) Reset()func (*Dhcp) String
Dhcp_MessageType
type Dhcp_MessageType int32DHCP message type. See RFC2131, section 3.1.
Dhcp_UNKNOWN_MESSAGE_TYPE, Dhcp_DISCOVER, Dhcp_OFFER, Dhcp_REQUEST, Dhcp_DECLINE, Dhcp_ACK, Dhcp_NAK, Dhcp_RELEASE, Dhcp_INFORM, Dhcp_WIN_DELETED, Dhcp_WIN_EXPIRED
const (
// Default message type.
Dhcp_UNKNOWN_MESSAGE_TYPE Dhcp_MessageType = 0
// DHCPDISCOVER.
Dhcp_DISCOVER Dhcp_MessageType = 1
// DHCPOFFER.
Dhcp_OFFER Dhcp_MessageType = 2
// DHCPREQUEST.
Dhcp_REQUEST Dhcp_MessageType = 3
// DHCPDECLINE.
Dhcp_DECLINE Dhcp_MessageType = 4
// DHCPACK.
Dhcp_ACK Dhcp_MessageType = 5
// DHCPNAK.
Dhcp_NAK Dhcp_MessageType = 6
// DHCPRELEASE.
Dhcp_RELEASE Dhcp_MessageType = 7
// DHCPINFORM.
Dhcp_INFORM Dhcp_MessageType = 8
// Microsoft Windows DHCP "lease deleted".
Dhcp_WIN_DELETED Dhcp_MessageType = 100
// Microsoft Windows DHCP "lease expired".
Dhcp_WIN_EXPIRED Dhcp_MessageType = 101
)func (Dhcp_MessageType) Descriptor
func (Dhcp_MessageType) Descriptor() protoreflect.EnumDescriptorfunc (Dhcp_MessageType) Enum
func (x Dhcp_MessageType) Enum() *Dhcp_MessageTypefunc (Dhcp_MessageType) EnumDescriptor
func (Dhcp_MessageType) EnumDescriptor() ([]byte, []int)Deprecated: Use Dhcp_MessageType.Descriptor instead.
func (Dhcp_MessageType) Number
func (x Dhcp_MessageType) Number() protoreflect.EnumNumberfunc (Dhcp_MessageType) String
func (x Dhcp_MessageType) String() stringfunc (Dhcp_MessageType) Type
func (Dhcp_MessageType) Type() protoreflect.EnumTypeDhcp_OpCode
type Dhcp_OpCode int32BOOTP op code. See RFC951, section 3.
Dhcp_UNKNOWN_OPCODE, Dhcp_BOOTREQUEST, Dhcp_BOOTREPLY
const (
// Default opcode.
Dhcp_UNKNOWN_OPCODE Dhcp_OpCode = 0
// Request.
Dhcp_BOOTREQUEST Dhcp_OpCode = 1
// Reply.
Dhcp_BOOTREPLY Dhcp_OpCode = 2
)func (Dhcp_OpCode) Descriptor
func (Dhcp_OpCode) Descriptor() protoreflect.EnumDescriptorfunc (Dhcp_OpCode) Enum
func (x Dhcp_OpCode) Enum() *Dhcp_OpCodefunc (Dhcp_OpCode) EnumDescriptor
func (Dhcp_OpCode) EnumDescriptor() ([]byte, []int)Deprecated: Use Dhcp_OpCode.Descriptor instead.
func (Dhcp_OpCode) Number
func (x Dhcp_OpCode) Number() protoreflect.EnumNumberfunc (Dhcp_OpCode) String
func (x Dhcp_OpCode) String() stringfunc (Dhcp_OpCode) Type
func (Dhcp_OpCode) Type() protoreflect.EnumTypeDhcp_Option
type Dhcp_Option struct {
// Code. See RFC1533.
Code uint32 `protobuf:"varint,1,opt,name=code,proto3" json:"code,omitempty"`
// Data.
Data []byte `protobuf:"bytes,2,opt,name=data,proto3" json:"data,omitempty"`
// contains filtered or unexported fields
}DHCP options.
func (*Dhcp_Option) Descriptor
func (*Dhcp_Option) Descriptor() ([]byte, []int)Deprecated: Use Dhcp_Option.ProtoReflect.Descriptor instead.
func (*Dhcp_Option) GetCode
func (x *Dhcp_Option) GetCode() uint32func (*Dhcp_Option) GetData
func (x *Dhcp_Option) GetData() []bytefunc (*Dhcp_Option) ProtoMessage
func (*Dhcp_Option) ProtoMessage()func (*Dhcp_Option) ProtoReflect
func (x *Dhcp_Option) ProtoReflect() protoreflect.Messagefunc (*Dhcp_Option) Reset
func (x *Dhcp_Option) Reset()func (*Dhcp_Option) String
func (x *Dhcp_Option) String() stringDns
type Dns struct {
// DNS query id.
Id uint32 `protobuf:"varint,6,opt,name=id,proto3" json:"id,omitempty"`
// Set to true if the event is a DNS response. See QR field from RFC1035.
Response bool `protobuf:"varint,7,opt,name=response,proto3" json:"response,omitempty"`
// The DNS OpCode used to specify the type of DNS query
// (for example, QUERY, IQUERY, or STATUS).
Opcode uint32 `protobuf:"varint,8,opt,name=opcode,proto3" json:"opcode,omitempty"`
// Other DNS header flags. See RFC1035, section 4.1.1.
Authoritative bool `protobuf:"varint,9,opt,name=authoritative,proto3" json:"authoritative,omitempty"`
// Whether the DNS response was truncated.
Truncated bool `protobuf:"varint,10,opt,name=truncated,proto3" json:"truncated,omitempty"`
// Whether a recursive DNS lookup is desired.
RecursionDesired bool `protobuf:"varint,11,opt,name=recursion_desired,json=recursionDesired,proto3" json:"recursion_desired,omitempty"`
// Whether a recursive DNS lookup is available.
RecursionAvailable bool `protobuf:"varint,12,opt,name=recursion_available,json=recursionAvailable,proto3" json:"recursion_available,omitempty"`
// Response code. See RCODE from RFC1035.
ResponseCode uint32 `protobuf:"varint,13,opt,name=response_code,json=responseCode,proto3" json:"response_code,omitempty"`
// A list of domain protocol message questions.
Questions []*Dns_Question `protobuf:"bytes,1,rep,name=questions,proto3" json:"questions,omitempty"`
// A list of answers to the domain name query.
Answers []*Dns_ResourceRecord `protobuf:"bytes,2,rep,name=answers,proto3" json:"answers,omitempty"`
// A list of domain name servers which verified the answers to the domain name
// queries.
Authority []*Dns_ResourceRecord `protobuf:"bytes,3,rep,name=authority,proto3" json:"authority,omitempty"`
// A list of additional domain name servers that can be used to verify the
// answer to the domain.
Additional []*Dns_ResourceRecord `protobuf:"bytes,4,rep,name=additional,proto3" json:"additional,omitempty"`
// contains filtered or unexported fields
}DNS information.
func (*Dns) Descriptor
Deprecated: Use Dns.ProtoReflect.Descriptor instead.
func (*Dns) GetAdditional
func (x *Dns) GetAdditional() []*Dns_ResourceRecordfunc (*Dns) GetAnswers
func (x *Dns) GetAnswers() []*Dns_ResourceRecordfunc (*Dns) GetAuthoritative
func (*Dns) GetAuthority
func (x *Dns) GetAuthority() []*Dns_ResourceRecordfunc (*Dns) GetId
func (*Dns) GetOpcode
func (*Dns) GetQuestions
func (x *Dns) GetQuestions() []*Dns_Questionfunc (*Dns) GetRecursionAvailable
func (*Dns) GetRecursionDesired
func (*Dns) GetResponse
func (*Dns) GetResponseCode
func (*Dns) GetTruncated
func (*Dns) ProtoMessage
func (*Dns) ProtoMessage()func (*Dns) ProtoReflect
func (x *Dns) ProtoReflect() protoreflect.Messagefunc (*Dns) Reset
func (x *Dns) Reset()func (*Dns) String
Dns_Question
type Dns_Question struct {
// The domain name.
Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
// The code specifying the type of the query.
Type uint32 `protobuf:"varint,2,opt,name=type,proto3" json:"type,omitempty"`
// The code specifying the class of the query.
Class uint32 `protobuf:"varint,3,opt,name=class,proto3" json:"class,omitempty"`
// The prevalence of the domain within the customer's environment.
Prevalence *Prevalence `protobuf:"bytes,4,opt,name=prevalence,proto3" json:"prevalence,omitempty"`
// contains filtered or unexported fields
}DNS Questions. See RFC1035, section 4.1.2.
func (*Dns_Question) Descriptor
func (*Dns_Question) Descriptor() ([]byte, []int)Deprecated: Use Dns_Question.ProtoReflect.Descriptor instead.
func (*Dns_Question) GetClass
func (x *Dns_Question) GetClass() uint32func (*Dns_Question) GetName
func (x *Dns_Question) GetName() stringfunc (*Dns_Question) GetPrevalence
func (x *Dns_Question) GetPrevalence() *Prevalencefunc (*Dns_Question) GetType
func (x *Dns_Question) GetType() uint32func (*Dns_Question) ProtoMessage
func (*Dns_Question) ProtoMessage()func (*Dns_Question) ProtoReflect
func (x *Dns_Question) ProtoReflect() protoreflect.Messagefunc (*Dns_Question) Reset
func (x *Dns_Question) Reset()func (*Dns_Question) String
func (x *Dns_Question) String() stringDns_ResourceRecord
type Dns_ResourceRecord struct {
// The name of the owner of the resource record.
Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
// The code specifying the type of the resource record.
Type uint32 `protobuf:"varint,2,opt,name=type,proto3" json:"type,omitempty"`
// The code specifying the class of the resource record.
Class uint32 `protobuf:"varint,3,opt,name=class,proto3" json:"class,omitempty"`
// The time interval for which the resource record can be cached before the
// source of the information should again be queried.
Ttl uint32 `protobuf:"varint,4,opt,name=ttl,proto3" json:"ttl,omitempty"`
// The payload or response to the DNS question for all responses encoded in
// UTF-8 format
Data string `protobuf:"bytes,5,opt,name=data,proto3" json:"data,omitempty"`
// The raw bytes of any non-UTF8 strings that might be included as part of a
// DNS response.
BinaryData []byte `protobuf:"bytes,6,opt,name=binary_data,json=binaryData,proto3" json:"binary_data,omitempty"`
// contains filtered or unexported fields
}DNS Resource Records. See RFC1035, section 4.1.3.
func (*Dns_ResourceRecord) Descriptor
func (*Dns_ResourceRecord) Descriptor() ([]byte, []int)Deprecated: Use Dns_ResourceRecord.ProtoReflect.Descriptor instead.
func (*Dns_ResourceRecord) GetBinaryData
func (x *Dns_ResourceRecord) GetBinaryData() []bytefunc (*Dns_ResourceRecord) GetClass
func (x *Dns_ResourceRecord) GetClass() uint32func (*Dns_ResourceRecord) GetData
func (x *Dns_ResourceRecord) GetData() stringfunc (*Dns_ResourceRecord) GetName
func (x *Dns_ResourceRecord) GetName() stringfunc (*Dns_ResourceRecord) GetTtl
func (x *Dns_ResourceRecord) GetTtl() uint32func (*Dns_ResourceRecord) GetType
func (x *Dns_ResourceRecord) GetType() uint32func (*Dns_ResourceRecord) ProtoMessage
func (*Dns_ResourceRecord) ProtoMessage()func (*Dns_ResourceRecord) ProtoReflect
func (x *Dns_ResourceRecord) ProtoReflect() protoreflect.Messagefunc (*Dns_ResourceRecord) Reset
func (x *Dns_ResourceRecord) Reset()func (*Dns_ResourceRecord) String
func (x *Dns_ResourceRecord) String() stringDomain
type Domain struct {
// The domain name.
// This field can be used as an entity indicator for Domain entities.
Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
// The prevalence of the domain within the customer's environment.
Prevalence *Prevalence `protobuf:"bytes,2,opt,name=prevalence,proto3" json:"prevalence,omitempty"`
// First seen timestamp of the domain in the customer's environment.
FirstSeenTime *timestamppb.Timestamp `protobuf:"bytes,3,opt,name=first_seen_time,json=firstSeenTime,proto3" json:"first_seen_time,omitempty"`
// Last seen timestamp of the domain in the customer's environment.
LastSeenTime *timestamppb.Timestamp `protobuf:"bytes,4,opt,name=last_seen_time,json=lastSeenTime,proto3" json:"last_seen_time,omitempty"`
// Registrar name . FOr example, "Wild West Domains, Inc. (R120-LROR)",
// "GoDaddy.com, LLC", or "PDR LTD. D/B/A PUBLICDOMAINREGISTRY.COM".
Registrar string `protobuf:"bytes,5,opt,name=registrar,proto3" json:"registrar,omitempty"`
// Contact email address.
ContactEmail string `protobuf:"bytes,6,opt,name=contact_email,json=contactEmail,proto3" json:"contact_email,omitempty"`
// Whois server name.
WhoisServer string `protobuf:"bytes,7,opt,name=whois_server,json=whoisServer,proto3" json:"whois_server,omitempty"`
// Repeated list of name servers.
NameServer []string `protobuf:"bytes,8,rep,name=name_server,json=nameServer,proto3" json:"name_server,omitempty"`
// Domain creation time.
CreationTime *timestamppb.Timestamp `protobuf:"bytes,9,opt,name=creation_time,json=creationTime,proto3" json:"creation_time,omitempty"`
// Last updated time.
UpdateTime *timestamppb.Timestamp `protobuf:"bytes,10,opt,name=update_time,json=updateTime,proto3" json:"update_time,omitempty"`
// Expiration time.
ExpirationTime *timestamppb.Timestamp `protobuf:"bytes,11,opt,name=expiration_time,json=expirationTime,proto3" json:"expiration_time,omitempty"`
// Audit updated time.
AuditUpdateTime *timestamppb.Timestamp `protobuf:"bytes,12,opt,name=audit_update_time,json=auditUpdateTime,proto3" json:"audit_update_time,omitempty"`
// Domain status. See
// [https://www.icann.org/resources/pages/epp-status-codes-2014-06-16-en](https://www.icann.org/resources/pages/epp-status-codes-2014-06-16-en)
// for meanings of possible values
Status string `protobuf:"bytes,13,opt,name=status,proto3" json:"status,omitempty"`
// Parsed contact information for the registrant of the domain.
Registrant *User `protobuf:"bytes,14,opt,name=registrant,proto3" json:"registrant,omitempty"`
// Parsed contact information for the administrative contact for the domain.
Admin *User `protobuf:"bytes,15,opt,name=admin,proto3" json:"admin,omitempty"`
// Parsed contact information for the technical contact for the domain
Tech *User `protobuf:"bytes,16,opt,name=tech,proto3" json:"tech,omitempty"`
// Parsed contact information for the billing contact of the domain.
Billing *User `protobuf:"bytes,17,opt,name=billing,proto3" json:"billing,omitempty"`
// Parsed contact information for the zone.
Zone *User `protobuf:"bytes,18,opt,name=zone,proto3" json:"zone,omitempty"`
// WHOIS raw text.
WhoisRecordRawText []byte `protobuf:"bytes,19,opt,name=whois_record_raw_text,json=whoisRecordRawText,proto3" json:"whois_record_raw_text,omitempty"`
// Registry Data raw text.
RegistryDataRawText []byte `protobuf:"bytes,20,opt,name=registry_data_raw_text,json=registryDataRawText,proto3" json:"registry_data_raw_text,omitempty"`
// IANA Registrar ID. See
// [https://www.iana.org/assignments/registrar-ids/registrar-ids.xhtml](https://www.iana.org/assignments/registrar-ids/registrar-ids.xhtml)
IanaRegistrarId int32 `protobuf:"varint,21,opt,name=iana_registrar_id,json=ianaRegistrarId,proto3" json:"iana_registrar_id,omitempty"`
// Indicates whether the domain appears to be using a private registration
// service to mask the owner's contact information.
PrivateRegistration bool `protobuf:"varint,22,opt,name=private_registration,json=privateRegistration,proto3" json:"private_registration,omitempty"`
// Categories assign to the domain as retrieved from VirusTotal.
Categories []string `protobuf:"bytes,23,rep,name=categories,proto3" json:"categories,omitempty"`
// Includes difference hash and MD5 hash of the domain's favicon.
Favicon *Favicon `protobuf:"bytes,24,opt,name=favicon,proto3" json:"favicon,omitempty"`
// Domain's JARM hash.
Jarm string `protobuf:"bytes,25,opt,name=jarm,proto3" json:"jarm,omitempty"`
// Domain's DNS records from the last scan.
LastDnsRecords []*DNSRecord `protobuf:"bytes,26,rep,name=last_dns_records,json=lastDnsRecords,proto3" json:"last_dns_records,omitempty"`
// Date when the DNS records list was retrieved by VirusTotal.
LastDnsRecordsTime *timestamppb.Timestamp `protobuf:"bytes,27,opt,name=last_dns_records_time,json=lastDnsRecordsTime,proto3" json:"last_dns_records_time,omitempty"`
// SSL certificate object retrieved last time the domain was analyzed.
LastHttpsCertificate *SSLCertificate `protobuf:"bytes,28,opt,name=last_https_certificate,json=lastHttpsCertificate,proto3" json:"last_https_certificate,omitempty"`
// When the certificate was retrieved by VirusTotal.
LastHttpsCertificateTime *timestamppb.Timestamp `protobuf:"bytes,29,opt,name=last_https_certificate_time,json=lastHttpsCertificateTime,proto3" json:"last_https_certificate_time,omitempty"`
// Domain's position in popularity ranks such as Alexa, Quantcast, Statvoo,
// etc
PopularityRanks []*PopularityRank `protobuf:"bytes,30,rep,name=popularity_ranks,json=popularityRanks,proto3" json:"popularity_ranks,omitempty"`
// List of representative attributes.
Tags []string `protobuf:"bytes,31,rep,name=tags,proto3" json:"tags,omitempty"`
// Date of the last update of the WHOIS record.
WhoisTime *timestamppb.Timestamp `protobuf:"bytes,32,opt,name=whois_time,json=whoisTime,proto3" json:"whois_time,omitempty"`
// contains filtered or unexported fields
}Information about a domain.
func (*Domain) Descriptor
Deprecated: Use Domain.ProtoReflect.Descriptor instead.
func (*Domain) GetAdmin
func (*Domain) GetAuditUpdateTime
func (x *Domain) GetAuditUpdateTime() *timestamppb.Timestampfunc (*Domain) GetBilling
func (*Domain) GetCategories
func (*Domain) GetContactEmail
func (*Domain) GetCreationTime
func (x *Domain) GetCreationTime() *timestamppb.Timestampfunc (*Domain) GetExpirationTime
func (x *Domain) GetExpirationTime() *timestamppb.Timestampfunc (*Domain) GetFavicon
func (*Domain) GetFirstSeenTime
func (x *Domain) GetFirstSeenTime() *timestamppb.Timestampfunc (*Domain) GetIanaRegistrarId
func (*Domain) GetJarm
func (*Domain) GetLastDnsRecords
func (*Domain) GetLastDnsRecordsTime
func (x *Domain) GetLastDnsRecordsTime() *timestamppb.Timestampfunc (*Domain) GetLastHttpsCertificate
func (x *Domain) GetLastHttpsCertificate() *SSLCertificatefunc (*Domain) GetLastHttpsCertificateTime
func (x *Domain) GetLastHttpsCertificateTime() *timestamppb.Timestampfunc (*Domain) GetLastSeenTime
func (x *Domain) GetLastSeenTime() *timestamppb.Timestampfunc (*Domain) GetName
func (*Domain) GetNameServer
func (*Domain) GetPopularityRanks
func (x *Domain) GetPopularityRanks() []*PopularityRankfunc (*Domain) GetPrevalence
func (x *Domain) GetPrevalence() *Prevalencefunc (*Domain) GetPrivateRegistration
func (*Domain) GetRegistrant
func (*Domain) GetRegistrar
func (*Domain) GetRegistryDataRawText
func (*Domain) GetStatus
func (*Domain) GetTags
func (*Domain) GetTech
func (*Domain) GetUpdateTime
func (x *Domain) GetUpdateTime() *timestamppb.Timestampfunc (*Domain) GetWhoisRecordRawText
func (*Domain) GetWhoisServer
func (*Domain) GetWhoisTime
func (x *Domain) GetWhoisTime() *timestamppb.Timestampfunc (*Domain) GetZone
func (*Domain) ProtoMessage
func (*Domain) ProtoMessage()func (*Domain) ProtoReflect
func (x *Domain) ProtoReflect() protoreflect.Messagefunc (*Domain) Reset
func (x *Domain) Reset()func (*Domain) String
DoubleSequence
type DoubleSequence struct {
// double sequence.
DoubleVals []float64 `protobuf:"fixed64,1,rep,packed,name=double_vals,json=doubleVals,proto3" json:"double_vals,omitempty"`
// contains filtered or unexported fields
}DoubleSequence represents a sequence of doubles.
func (*DoubleSequence) Descriptor
func (*DoubleSequence) Descriptor() ([]byte, []int)Deprecated: Use DoubleSequence.ProtoReflect.Descriptor instead.
func (*DoubleSequence) GetDoubleVals
func (x *DoubleSequence) GetDoubleVals() []float64func (*DoubleSequence) ProtoMessage
func (*DoubleSequence) ProtoMessage()func (*DoubleSequence) ProtoReflect
func (x *DoubleSequence) ProtoReflect() protoreflect.Messagefunc (*DoubleSequence) Reset
func (x *DoubleSequence) Reset()func (*DoubleSequence) String
func (x *DoubleSequence) String() stringElement
type Element struct {
// Metadata that provides the relevant association for the references in the
// element. For a detection, this can be the correlated aspect of the
// references that contributed to the overall detection. For example, may
// include sub-rule condition, machine learning model metadata, and/or
// indicators implicated in this component of the detection
// (using the .about field).
Association *SecurityResult `protobuf:"bytes,1,opt,name=association,proto3" json:"association,omitempty"`
// References to model primatives including events and entities that share a
// common association.
// Even though a reference can have both UDM and entity, a collection of
// references (of a single element) will only have one type of message in it
// (either UDM / Entity).
References []*Reference `protobuf:"bytes,2,rep,name=references,proto3" json:"references,omitempty"`
// A name that labels the entire references group.
Label string `protobuf:"bytes,3,opt,name=label,proto3" json:"label,omitempty"`
// Copied from the detection event_sample.too_many_event_samples field.
// If true, the number of references will be capped at the sample limit
// (set at rule service).
// This is applicable to both UDM references and Entity references.
ReferencesSampled bool `protobuf:"varint,4,opt,name=references_sampled,json=referencesSampled,proto3" json:"references_sampled,omitempty"`
// Latency metrics for the specific element. These are
// calculated from all the contributing events or entities for a single event
// variable, not just the sampled ones included in references. This is
// currently only populated for UDM events.
LatencyMetrics *LatencyMetrics `protobuf:"bytes,5,opt,name=latency_metrics,json=latencyMetrics,proto3" json:"latency_metrics,omitempty"`
// contains filtered or unexported fields
}func (*Element) Descriptor
Deprecated: Use Element.ProtoReflect.Descriptor instead.
func (*Element) GetAssociation
func (x *Element) GetAssociation() *SecurityResultfunc (*Element) GetLabel
func (*Element) GetLatencyMetrics
func (x *Element) GetLatencyMetrics() *LatencyMetricsfunc (*Element) GetReferences
func (*Element) GetReferencesSampled
func (*Element) ProtoMessage
func (*Element) ProtoMessage()func (*Element) ProtoReflect
func (x *Element) ProtoReflect() protoreflect.Messagefunc (*Element) Reset
func (x *Element) Reset()func (*Element) String
type Email struct {
// The 'from' address.
From string `protobuf:"bytes,1,opt,name=from,proto3" json:"from,omitempty"`
// The 'reply to' address.
ReplyTo string `protobuf:"bytes,2,opt,name=reply_to,json=replyTo,proto3" json:"reply_to,omitempty"`
// A list of 'to' addresses.
To []string `protobuf:"bytes,3,rep,name=to,proto3" json:"to,omitempty"`
// A list of 'cc' addresses.
Cc []string `protobuf:"bytes,4,rep,name=cc,proto3" json:"cc,omitempty"`
// A list of 'bcc' addresses.
Bcc []string `protobuf:"bytes,5,rep,name=bcc,proto3" json:"bcc,omitempty"`
// The mail (or message) ID.
MailId string `protobuf:"bytes,6,opt,name=mail_id,json=mailId,proto3" json:"mail_id,omitempty"`
// The subject line(s) of the email.
Subject []string `protobuf:"bytes,7,rep,name=subject,proto3" json:"subject,omitempty"`
// The envelope from address.
// [https://en.wikipedia.org/wiki/Bounce_address](https://en.wikipedia.org/wiki/Bounce_address)
BounceAddress string `protobuf:"bytes,8,opt,name=bounce_address,json=bounceAddress,proto3" json:"bounce_address,omitempty"`
// contains filtered or unexported fields
}Email info.
func (*Email) Descriptor
Deprecated: Use Email.ProtoReflect.Descriptor instead.
func (*Email) GetBcc
func (*Email) GetBounceAddress
func (*Email) GetCc
func (*Email) GetFrom
func (*Email) GetMailId
func (*Email) GetReplyTo
func (*Email) GetSubject
func (*Email) GetTo
func (*Email) ProtoMessage
func (*Email) ProtoMessage()func (*Email) ProtoReflect
func (x *Email) ProtoReflect() protoreflect.Messagefunc (*Email) Reset
func (x *Email) Reset()func (*Email) String
Entity
type Entity struct {
// Entity metadata such as timestamp, product, etc.
Metadata *EntityMetadata `protobuf:"bytes,1,opt,name=metadata,proto3" json:"metadata,omitempty"`
// Noun in the UDM event that this entity represents.
Entity *Noun `protobuf:"bytes,2,opt,name=entity,proto3" json:"entity,omitempty"`
// One or more relationships between the entity (a) and other entities,
// including the relationship type and related entity.
Relations []*Relation `protobuf:"bytes,4,rep,name=relations,proto3" json:"relations,omitempty"`
// Important entity data that cannot be adequately represented within
// the formal sections of the Entity.
Additional *structpb.Struct `protobuf:"bytes,3,opt,name=additional,proto3" json:"additional,omitempty"`
// Stores information related to the entity's risk score.
RiskScore *EntityRisk `protobuf:"bytes,5,opt,name=risk_score,json=riskScore,proto3,oneof" json:"risk_score,omitempty"`
// Stores statistical metrics about the entity. Used if metadata.entity_type
// is METRIC.
Metric *Metric `protobuf:"bytes,6,opt,name=metric,proto3" json:"metric,omitempty"`
// contains filtered or unexported fields
}An Entity provides additional context about an item in a UDM event. For example, a PROCESS_LAUNCH event describes that user 'abc@example.corp' launched process 'shady.exe'. The event does not include information that user 'abc@example.com' is a recently terminated employee who administers a server storing finance data. Information stored in one or more Entities can add this additional context.
func (*Entity) Descriptor
Deprecated: Use Entity.ProtoReflect.Descriptor instead.
func (*Entity) GetAdditional
func (*Entity) GetEntity
func (*Entity) GetMetadata
func (x *Entity) GetMetadata() *EntityMetadatafunc (*Entity) GetMetric
func (*Entity) GetRelations
func (*Entity) GetRiskScore
func (x *Entity) GetRiskScore() *EntityRiskfunc (*Entity) ProtoMessage
func (*Entity) ProtoMessage()func (*Entity) ProtoReflect
func (x *Entity) ProtoReflect() protoreflect.Messagefunc (*Entity) Reset
func (x *Entity) Reset()func (*Entity) String
EntityGraphEnrichment
type EntityGraphEnrichment struct {
// The name of the data table.
DataTable string `protobuf:"bytes,1,opt,name=data_table,json=dataTable,proto3" json:"data_table,omitempty"`
// The type of enrichment.
EnrichmentType EntityGraphEnrichment_EnrichmentType `protobuf:"varint,3,opt,name=enrichment_type,json=enrichmentType,proto3,enum=google.backstory.EntityGraphEnrichment_EnrichmentType" json:"enrichment_type,omitempty"`
// The entity which has only the overridden fields populated. Only populated
// if the enrichment type is OVERRIDE.
OverriddenEntity *Entity `protobuf:"bytes,2,opt,name=overridden_entity,json=overriddenEntity,proto3" json:"overridden_entity,omitempty"`
// contains filtered or unexported fields
}EntityGraphEnrichment contains the data table name and the enrichment applied to the entity.
func (*EntityGraphEnrichment) Descriptor
func (*EntityGraphEnrichment) Descriptor() ([]byte, []int)Deprecated: Use EntityGraphEnrichment.ProtoReflect.Descriptor instead.
func (*EntityGraphEnrichment) GetDataTable
func (x *EntityGraphEnrichment) GetDataTable() stringfunc (*EntityGraphEnrichment) GetEnrichmentType
func (x *EntityGraphEnrichment) GetEnrichmentType() EntityGraphEnrichment_EnrichmentTypefunc (*EntityGraphEnrichment) GetOverriddenEntity
func (x *EntityGraphEnrichment) GetOverriddenEntity() *Entityfunc (*EntityGraphEnrichment) ProtoMessage
func (*EntityGraphEnrichment) ProtoMessage()func (*EntityGraphEnrichment) ProtoReflect
func (x *EntityGraphEnrichment) ProtoReflect() protoreflect.Messagefunc (*EntityGraphEnrichment) Reset
func (x *EntityGraphEnrichment) Reset()func (*EntityGraphEnrichment) String
func (x *EntityGraphEnrichment) String() stringEntityGraphEnrichment_EnrichmentType
type EntityGraphEnrichment_EnrichmentType int32Type of enrichment.
EntityGraphEnrichment_ENRICHMENT_TYPE_UNSPECIFIED, EntityGraphEnrichment_APPEND, EntityGraphEnrichment_OVERRIDE
const (
// Enrichment type is unspecified.
EntityGraphEnrichment_ENRICHMENT_TYPE_UNSPECIFIED EntityGraphEnrichment_EnrichmentType = 0
// The data table was appended to the entity graph.
EntityGraphEnrichment_APPEND EntityGraphEnrichment_EnrichmentType = 1
// The entity graph was overridden by the data table.
EntityGraphEnrichment_OVERRIDE EntityGraphEnrichment_EnrichmentType = 2
)func (EntityGraphEnrichment_EnrichmentType) Descriptor
func (EntityGraphEnrichment_EnrichmentType) Descriptor() protoreflect.EnumDescriptorfunc (EntityGraphEnrichment_EnrichmentType) Enum
func (x EntityGraphEnrichment_EnrichmentType) Enum() *EntityGraphEnrichment_EnrichmentTypefunc (EntityGraphEnrichment_EnrichmentType) EnumDescriptor
func (EntityGraphEnrichment_EnrichmentType) EnumDescriptor() ([]byte, []int)Deprecated: Use EntityGraphEnrichment_EnrichmentType.Descriptor instead.
func (EntityGraphEnrichment_EnrichmentType) Number
func (x EntityGraphEnrichment_EnrichmentType) Number() protoreflect.EnumNumberfunc (EntityGraphEnrichment_EnrichmentType) String
func (x EntityGraphEnrichment_EnrichmentType) String() stringfunc (EntityGraphEnrichment_EnrichmentType) Type
func (EntityGraphEnrichment_EnrichmentType) Type() protoreflect.EnumTypeEntityMetadata
type EntityMetadata struct {
// A vendor-specific identifier that uniquely identifies the entity
// (e.g. a GUID, LDAP, OID, or similar).
ProductEntityId string `protobuf:"bytes,1,opt,name=product_entity_id,json=productEntityId,proto3" json:"product_entity_id,omitempty"`
// GMT timestamp when the entity information was collected by the vendor's
// local collection infrastructure.
CollectedTimestamp *timestamppb.Timestamp `protobuf:"bytes,2,opt,name=collected_timestamp,json=collectedTimestamp,proto3" json:"collected_timestamp,omitempty"`
// GMT timestamp when the entity described by the product_entity_id was
// created on the system where data was collected.
CreationTimestamp *timestamppb.Timestamp `protobuf:"bytes,8,opt,name=creation_timestamp,json=creationTimestamp,proto3" json:"creation_timestamp,omitempty"`
// Valid existence time range for the version of the entity represented by
// this entity data.
Interval *interval.Interval `protobuf:"bytes,9,opt,name=interval,proto3" json:"interval,omitempty"`
// Vendor name of the product that produced the entity information.
VendorName string `protobuf:"bytes,3,opt,name=vendor_name,json=vendorName,proto3" json:"vendor_name,omitempty"`
// Product name that produced the entity information.
ProductName string `protobuf:"bytes,4,opt,name=product_name,json=productName,proto3" json:"product_name,omitempty"`
// Vendor feed name for a threat indicator feed.
Feed string `protobuf:"bytes,14,opt,name=feed,proto3" json:"feed,omitempty"`
// Version of the product that produced the entity information.
ProductVersion string `protobuf:"bytes,5,opt,name=product_version,json=productVersion,proto3" json:"product_version,omitempty"`
// Entity type.
// If an entity has multiple possible types, this specifies the most specific
// type.
EntityType EntityMetadata_EntityType `protobuf:"varint,6,opt,name=entity_type,json=entityType,proto3,enum=google.backstory.EntityMetadata_EntityType" json:"entity_type,omitempty"`
// Human-readable description of the entity.
Description string `protobuf:"bytes,7,opt,name=description,proto3" json:"description,omitempty"`
// Metadata provided by a threat intelligence feed that identified the
// entity as malicious.
Threat []*SecurityResult `protobuf:"bytes,10,rep,name=threat,proto3" json:"threat,omitempty"`
// The source of the entity.
SourceType EntityMetadata_SourceType `protobuf:"varint,11,opt,name=source_type,json=sourceType,proto3,enum=google.backstory.EntityMetadata_SourceType" json:"source_type,omitempty"`
// Entity source metadata labels.
SourceLabels []*Label `protobuf:"bytes,12,rep,name=source_labels,json=sourceLabels,proto3" json:"source_labels,omitempty"`
// Metadata field from the event.
EventMetadata *Metadata `protobuf:"bytes,13,opt,name=event_metadata,json=eventMetadata,proto3" json:"event_metadata,omitempty"`
// Structured fields extracted from the log.
//
// Deprecated: Marked as deprecated in backstory/entity.proto.
StructuredFields *structpb.Struct `protobuf:"bytes,15,opt,name=structured_fields,json=structuredFields,proto3" json:"structured_fields,omitempty"`
// Flattened fields extracted from the log.
Extracted *structpb.Struct `protobuf:"bytes,16,opt,name=extracted,proto3" json:"extracted,omitempty"`
// Prioritization factors used by ATI curated rules.
AtiPrioritization *AtiPrioritization `protobuf:"bytes,17,opt,name=ati_prioritization,json=atiPrioritization,proto3" json:"ati_prioritization,omitempty"`
// contains filtered or unexported fields
}Information about the Entity and the product where the entity was created.
func (*EntityMetadata) Descriptor
func (*EntityMetadata) Descriptor() ([]byte, []int)Deprecated: Use EntityMetadata.ProtoReflect.Descriptor instead.
func (*EntityMetadata) GetAtiPrioritization
func (x *EntityMetadata) GetAtiPrioritization() *AtiPrioritizationfunc (*EntityMetadata) GetCollectedTimestamp
func (x *EntityMetadata) GetCollectedTimestamp() *timestamppb.Timestampfunc (*EntityMetadata) GetCreationTimestamp
func (x *EntityMetadata) GetCreationTimestamp() *timestamppb.Timestampfunc (*EntityMetadata) GetDescription
func (x *EntityMetadata) GetDescription() stringfunc (*EntityMetadata) GetEntityType
func (x *EntityMetadata) GetEntityType() EntityMetadata_EntityTypefunc (*EntityMetadata) GetEventMetadata
func (x *EntityMetadata) GetEventMetadata() *Metadatafunc (*EntityMetadata) GetExtracted
func (x *EntityMetadata) GetExtracted() *structpb.Structfunc (*EntityMetadata) GetFeed
func (x *EntityMetadata) GetFeed() stringfunc (*EntityMetadata) GetInterval
func (x *EntityMetadata) GetInterval() *interval.Intervalfunc (*EntityMetadata) GetProductEntityId
func (x *EntityMetadata) GetProductEntityId() stringfunc (*EntityMetadata) GetProductName
func (x *EntityMetadata) GetProductName() stringfunc (*EntityMetadata) GetProductVersion
func (x *EntityMetadata) GetProductVersion() stringfunc (*EntityMetadata) GetSourceLabels
func (x *EntityMetadata) GetSourceLabels() []*Labelfunc (*EntityMetadata) GetSourceType
func (x *EntityMetadata) GetSourceType() EntityMetadata_SourceTypefunc (*EntityMetadata) GetStructuredFields
func (x *EntityMetadata) GetStructuredFields() *structpb.StructDeprecated: Marked as deprecated in backstory/entity.proto.
func (*EntityMetadata) GetThreat
func (x *EntityMetadata) GetThreat() []*SecurityResultfunc (*EntityMetadata) GetVendorName
func (x *EntityMetadata) GetVendorName() stringfunc (*EntityMetadata) ProtoMessage
func (*EntityMetadata) ProtoMessage()func (*EntityMetadata) ProtoReflect
func (x *EntityMetadata) ProtoReflect() protoreflect.Messagefunc (*EntityMetadata) Reset
func (x *EntityMetadata) Reset()func (*EntityMetadata) String
func (x *EntityMetadata) String() stringEntityMetadata_EntityType
type EntityMetadata_EntityType int32Describes the type of entity. An unknown event type.
EntityMetadata_UNKNOWN_ENTITYTYPE, EntityMetadata_ASSET, EntityMetadata_USER, EntityMetadata_GROUP, EntityMetadata_RESOURCE, EntityMetadata_IP_ADDRESS, EntityMetadata_CIDR_BLOCK, EntityMetadata_FILE, EntityMetadata_DOMAIN_NAME, EntityMetadata_URL, EntityMetadata_MUTEX, EntityMetadata_METRIC
const (
// @hide_from_doc
EntityMetadata_UNKNOWN_ENTITYTYPE EntityMetadata_EntityType = 0
// An asset, such as workstation, laptop, phone, virtual machine, etc.
EntityMetadata_ASSET EntityMetadata_EntityType = 1
// User.
EntityMetadata_USER EntityMetadata_EntityType = 10000
// Group.
EntityMetadata_GROUP EntityMetadata_EntityType = 10001
// Resource.
EntityMetadata_RESOURCE EntityMetadata_EntityType = 2
// An external IP address.
EntityMetadata_IP_ADDRESS EntityMetadata_EntityType = 3
// A CIDR block.
EntityMetadata_CIDR_BLOCK EntityMetadata_EntityType = 9
// A file.
EntityMetadata_FILE EntityMetadata_EntityType = 4
// A domain.
EntityMetadata_DOMAIN_NAME EntityMetadata_EntityType = 5
// A url.
EntityMetadata_URL EntityMetadata_EntityType = 6
// A mutex.
EntityMetadata_MUTEX EntityMetadata_EntityType = 7
// A metric.
EntityMetadata_METRIC EntityMetadata_EntityType = 8
)func (EntityMetadata_EntityType) Descriptor
func (EntityMetadata_EntityType) Descriptor() protoreflect.EnumDescriptorfunc (EntityMetadata_EntityType) Enum
func (x EntityMetadata_EntityType) Enum() *EntityMetadata_EntityTypefunc (EntityMetadata_EntityType) EnumDescriptor
func (EntityMetadata_EntityType) EnumDescriptor() ([]byte, []int)Deprecated: Use EntityMetadata_EntityType.Descriptor instead.
func (EntityMetadata_EntityType) Number
func (x EntityMetadata_EntityType) Number() protoreflect.EnumNumberfunc (EntityMetadata_EntityType) String
func (x EntityMetadata_EntityType) String() stringfunc (EntityMetadata_EntityType) Type
func (EntityMetadata_EntityType) Type() protoreflect.EnumTypeEntityMetadata_SourceType
type EntityMetadata_SourceType int32Describes the source of an entity.
EntityMetadata_SOURCE_TYPE_UNSPECIFIED, EntityMetadata_ENTITY_CONTEXT, EntityMetadata_DERIVED_CONTEXT, EntityMetadata_GLOBAL_CONTEXT
const (
// Default source type
EntityMetadata_SOURCE_TYPE_UNSPECIFIED EntityMetadata_SourceType = 0
// Entities ingested from customers (e.g. AD_CONTEXT, DLP_CONTEXT)
EntityMetadata_ENTITY_CONTEXT EntityMetadata_SourceType = 1
// Entities derived from customer data such as prevalence, artifact
// first/last seen, or asset/user first seen stats.
EntityMetadata_DERIVED_CONTEXT EntityMetadata_SourceType = 2
// Global contextual entities such as WHOIS or Safe Browsing.
EntityMetadata_GLOBAL_CONTEXT EntityMetadata_SourceType = 3
)func (EntityMetadata_SourceType) Descriptor
func (EntityMetadata_SourceType) Descriptor() protoreflect.EnumDescriptorfunc (EntityMetadata_SourceType) Enum
func (x EntityMetadata_SourceType) Enum() *EntityMetadata_SourceTypefunc (EntityMetadata_SourceType) EnumDescriptor
func (EntityMetadata_SourceType) EnumDescriptor() ([]byte, []int)Deprecated: Use EntityMetadata_SourceType.Descriptor instead.
func (EntityMetadata_SourceType) Number
func (x EntityMetadata_SourceType) Number() protoreflect.EnumNumberfunc (EntityMetadata_SourceType) String
func (x EntityMetadata_SourceType) String() stringfunc (EntityMetadata_SourceType) Type
func (EntityMetadata_SourceType) Type() protoreflect.EnumTypeEntityRisk
type EntityRisk struct {
// Version of the risk score calculation algorithm.
RiskVersion string `protobuf:"bytes,1,opt,name=risk_version,json=riskVersion,proto3" json:"risk_version,omitempty"`
// Time window used when computing the risk score for an entity, for
// example 24 hours or 7 days.
RiskWindow *interval.Interval `protobuf:"bytes,2,opt,name=risk_window,json=riskWindow,proto3" json:"risk_window,omitempty"`
// Deprecated risk score.
//
// Deprecated: Marked as deprecated in backstory/entity_risk.proto.
DEPRECATEDRiskScore int32 `protobuf:"varint,3,opt,name=DEPRECATED_risk_score,json=DEPRECATEDRiskScore,proto3" json:"DEPRECATED_risk_score,omitempty"`
// Represents the change in risk score for an entity between the end of the
// previous time window and the end of the current time window.
RiskDelta *RiskDelta `protobuf:"bytes,4,opt,name=risk_delta,json=riskDelta,proto3,oneof" json:"risk_delta,omitempty"`
// Number of detections that make up the risk score within the time window.
DetectionsCount int32 `protobuf:"varint,5,opt,name=detections_count,json=detectionsCount,proto3" json:"detections_count,omitempty"`
// Timestamp of the first detection within the specified time window.
// This field is empty when there are no detections.
FirstDetectionTime *timestamppb.Timestamp `protobuf:"bytes,6,opt,name=first_detection_time,json=firstDetectionTime,proto3" json:"first_detection_time,omitempty"`
// Timestamp of the last detection within the specified time window.
// This field is empty when there are no detections.
LastDetectionTime *timestamppb.Timestamp `protobuf:"bytes,7,opt,name=last_detection_time,json=lastDetectionTime,proto3" json:"last_detection_time,omitempty"`
// Raw risk score for the entity.
RiskScore float32 `protobuf:"fixed32,8,opt,name=risk_score,json=riskScore,proto3" json:"risk_score,omitempty"`
// Normalized risk score for the entity. This value is between 0-1000.
NormalizedRiskScore int32 `protobuf:"varint,9,opt,name=normalized_risk_score,json=normalizedRiskScore,proto3" json:"normalized_risk_score,omitempty"`
// Risk window duration for the entity.
RiskWindowSize *durationpb.Duration `protobuf:"bytes,10,opt,name=risk_window_size,json=riskWindowSize,proto3" json:"risk_window_size,omitempty"`
// Represents the change in raw risk score for an entity between the end of
// the previous time window and the end of the current time window.
RawRiskDelta *RiskDelta `protobuf:"bytes,11,opt,name=raw_risk_delta,json=rawRiskDelta,proto3,oneof" json:"raw_risk_delta,omitempty"`
// Timestamp for UEBA risk score reset based deduplication. Used specifically
// for risk based meta rules.
LastResetTime *timestamppb.Timestamp `protobuf:"bytes,12,opt,name=last_reset_time,json=lastResetTime,proto3" json:"last_reset_time,omitempty"`
// Link to the Google Security Operations UI with information about the entity
// risk score.
// If the SecOps instance has multiple frontend paths configured, this will be
// a relative path that can be used to construct the full URL.
DetailUri string `protobuf:"bytes,13,opt,name=detail_uri,json=detailUri,proto3" json:"detail_uri,omitempty"`
// Whether there are new detections for the risk window.
RiskWindowHasNewDetections bool `protobuf:"varint,14,opt,name=risk_window_has_new_detections,json=riskWindowHasNewDetections,proto3" json:"risk_window_has_new_detections,omitempty"`
// contains filtered or unexported fields
}Stores information related to the risk score of an entity.
func (*EntityRisk) Descriptor
func (*EntityRisk) Descriptor() ([]byte, []int)Deprecated: Use EntityRisk.ProtoReflect.Descriptor instead.
func (*EntityRisk) GetDEPRECATEDRiskScore
func (x *EntityRisk) GetDEPRECATEDRiskScore() int32Deprecated: Marked as deprecated in backstory/entity_risk.proto.
func (*EntityRisk) GetDetailUri
func (x *EntityRisk) GetDetailUri() stringfunc (*EntityRisk) GetDetectionsCount
func (x *EntityRisk) GetDetectionsCount() int32func (*EntityRisk) GetFirstDetectionTime
func (x *EntityRisk) GetFirstDetectionTime() *timestamppb.Timestampfunc (*EntityRisk) GetLastDetectionTime
func (x *EntityRisk) GetLastDetectionTime() *timestamppb.Timestampfunc (*EntityRisk) GetLastResetTime
func (x *EntityRisk) GetLastResetTime() *timestamppb.Timestampfunc (*EntityRisk) GetNormalizedRiskScore
func (x *EntityRisk) GetNormalizedRiskScore() int32func (*EntityRisk) GetRawRiskDelta
func (x *EntityRisk) GetRawRiskDelta() *RiskDeltafunc (*EntityRisk) GetRiskDelta
func (x *EntityRisk) GetRiskDelta() *RiskDeltafunc (*EntityRisk) GetRiskScore
func (x *EntityRisk) GetRiskScore() float32func (*EntityRisk) GetRiskVersion
func (x *EntityRisk) GetRiskVersion() stringfunc (*EntityRisk) GetRiskWindow
func (x *EntityRisk) GetRiskWindow() *interval.Intervalfunc (*EntityRisk) GetRiskWindowHasNewDetections
func (x *EntityRisk) GetRiskWindowHasNewDetections() boolfunc (*EntityRisk) GetRiskWindowSize
func (x *EntityRisk) GetRiskWindowSize() *durationpb.Durationfunc (*EntityRisk) ProtoMessage
func (*EntityRisk) ProtoMessage()func (*EntityRisk) ProtoReflect
func (x *EntityRisk) ProtoReflect() protoreflect.Messagefunc (*EntityRisk) Reset
func (x *EntityRisk) Reset()func (*EntityRisk) String
func (x *EntityRisk) String() stringExifInfo
type ExifInfo struct {
// original file name.
OriginalFile string `protobuf:"bytes,1,opt,name=original_file,json=originalFile,proto3" json:"original_file,omitempty"`
// product name.
Product string `protobuf:"bytes,2,opt,name=product,proto3" json:"product,omitempty"`
// company name.
Company string `protobuf:"bytes,3,opt,name=company,proto3" json:"company,omitempty"`
// description of a file.
FileDescription string `protobuf:"bytes,4,opt,name=file_description,json=fileDescription,proto3" json:"file_description,omitempty"`
// entry point.
EntryPoint int64 `protobuf:"varint,5,opt,name=entry_point,json=entryPoint,proto3" json:"entry_point,omitempty"`
// Compilation time.
CompilationTime *timestamppb.Timestamp `protobuf:"bytes,6,opt,name=compilation_time,json=compilationTime,proto3" json:"compilation_time,omitempty"`
// contains filtered or unexported fields
}Exif information.
func (*ExifInfo) Descriptor
Deprecated: Use ExifInfo.ProtoReflect.Descriptor instead.
func (*ExifInfo) GetCompany
func (*ExifInfo) GetCompilationTime
func (x *ExifInfo) GetCompilationTime() *timestamppb.Timestampfunc (*ExifInfo) GetEntryPoint
func (*ExifInfo) GetFileDescription
func (*ExifInfo) GetOriginalFile
func (*ExifInfo) GetProduct
func (*ExifInfo) ProtoMessage
func (*ExifInfo) ProtoMessage()func (*ExifInfo) ProtoReflect
func (x *ExifInfo) ProtoReflect() protoreflect.Messagefunc (*ExifInfo) Reset
func (x *ExifInfo) Reset()func (*ExifInfo) String
Extensions
type Extensions struct {
// An authentication extension.
Auth *Authentication `protobuf:"bytes,1,opt,name=auth,proto3" json:"auth,omitempty"`
// A vulnerability extension.
Vulns *Vulnerabilities `protobuf:"bytes,2,opt,name=vulns,proto3" json:"vulns,omitempty"`
// An entity risk change extension.
EntityRisk *EntityRisk `protobuf:"bytes,3,opt,name=entity_risk,json=entityRisk,proto3" json:"entity_risk,omitempty"`
// A Linux Utmp extension. This captures details specific to Linux Utmp
// events, which record login and logout sessions on a Linux system.
LinuxUtmp *LinuxUtmp `protobuf:"bytes,4,opt,name=linux_utmp,json=linuxUtmp,proto3" json:"linux_utmp,omitempty"`
// A Windows Event Log extension. This captures details specific to Windows
// Event Log events, providing structured information from various Windows
// logs.
WindowsEventLog *WindowsEventLog `protobuf:"bytes,5,opt,name=windows_event_log,json=windowsEventLog,proto3" json:"windows_event_log,omitempty"`
// A resource usage extension. This captures details about what entity
// (e.g., process, user) is using a specific resource.
ResourceUsage *ResourceUsage `protobuf:"bytes,6,opt,name=resource_usage,json=resourceUsage,proto3" json:"resource_usage,omitempty"`
// A system event details extension. This captures additional details for
// system-level events, such as message type, sender image ID, and subsystem.
SystemEventDetails *SystemEventDetails `protobuf:"bytes,7,opt,name=system_event_details,json=systemEventDetails,proto3" json:"system_event_details,omitempty"`
// A Microsoft Outlook specific metadata extension. This includes metadata
// related to Outlook items, such as comments, templates, and security flags.
OutlookMetadata *OutlookMetadata `protobuf:"bytes,8,opt,name=outlook_metadata,json=outlookMetadata,proto3" json:"outlook_metadata,omitempty"`
// A SRUM extension. This captures details specific to Windows System Resource
// Usage Monitor (SRUM) events, providing insights into application resource
// consumption.
Srum *Srum `protobuf:"bytes,9,opt,name=srum,proto3" json:"srum,omitempty"`
// A UserAssist extension. This captures details specific to Windows User
// Assist events, which track application usage and execution.
UserAssist *UserAssist `protobuf:"bytes,10,opt,name=user_assist,json=userAssist,proto3" json:"user_assist,omitempty"`
// contains filtered or unexported fields
}Extensions to a UDM event.
func (*Extensions) Descriptor
func (*Extensions) Descriptor() ([]byte, []int)Deprecated: Use Extensions.ProtoReflect.Descriptor instead.
func (*Extensions) GetAuth
func (x *Extensions) GetAuth() *Authenticationfunc (*Extensions) GetEntityRisk
func (x *Extensions) GetEntityRisk() *EntityRiskfunc (*Extensions) GetLinuxUtmp
func (x *Extensions) GetLinuxUtmp() *LinuxUtmpfunc (*Extensions) GetOutlookMetadata
func (x *Extensions) GetOutlookMetadata() *OutlookMetadatafunc (*Extensions) GetResourceUsage
func (x *Extensions) GetResourceUsage() *ResourceUsagefunc (*Extensions) GetSrum
func (x *Extensions) GetSrum() *Srumfunc (*Extensions) GetSystemEventDetails
func (x *Extensions) GetSystemEventDetails() *SystemEventDetailsfunc (*Extensions) GetUserAssist
func (x *Extensions) GetUserAssist() *UserAssistfunc (*Extensions) GetVulns
func (x *Extensions) GetVulns() *Vulnerabilitiesfunc (*Extensions) GetWindowsEventLog
func (x *Extensions) GetWindowsEventLog() *WindowsEventLogfunc (*Extensions) ProtoMessage
func (*Extensions) ProtoMessage()func (*Extensions) ProtoReflect
func (x *Extensions) ProtoReflect() protoreflect.Messagefunc (*Extensions) Reset
func (x *Extensions) Reset()func (*Extensions) String
func (x *Extensions) String() stringFavicon
type Favicon struct {
// Favicon's MD5 hash.
RawMd5 string `protobuf:"bytes,1,opt,name=raw_md5,json=rawMd5,proto3" json:"raw_md5,omitempty"`
// Difference hash.
Dhash string `protobuf:"bytes,2,opt,name=dhash,proto3" json:"dhash,omitempty"`
// contains filtered or unexported fields
}Difference hash and MD5 hash of the domain's favicon.
func (*Favicon) Descriptor
Deprecated: Use Favicon.ProtoReflect.Descriptor instead.
func (*Favicon) GetDhash
func (*Favicon) GetRawMd5
func (*Favicon) ProtoMessage
func (*Favicon) ProtoMessage()func (*Favicon) ProtoReflect
func (x *Favicon) ProtoReflect() protoreflect.Messagefunc (*Favicon) Reset
func (x *Favicon) Reset()func (*Favicon) String
File
type File struct {
// The SHA256 hash of the file, as a hex-encoded string.
// This field can be used as an entity indicator for file entities.
Sha256 string `protobuf:"bytes,1,opt,name=sha256,proto3" json:"sha256,omitempty"`
// The MD5 hash of the file, as a hex-encoded string.
// This field can be used as an entity indicator for file entities.
Md5 string `protobuf:"bytes,2,opt,name=md5,proto3" json:"md5,omitempty"`
// The SHA1 hash of the file, as a hex-encoded string.
// This field can be used as an entity indicator for file entities.
Sha1 string `protobuf:"bytes,3,opt,name=sha1,proto3" json:"sha1,omitempty"`
// The size of the file in bytes.
Size uint64 `protobuf:"varint,4,opt,name=size,proto3" json:"size,omitempty"`
// The full path identifying the location of the file on the system.
// This field can be used as an entity indicator for file entities.
FullPath string `protobuf:"bytes,5,opt,name=full_path,json=fullPath,proto3" json:"full_path,omitempty"`
// The MIME (Multipurpose Internet Mail Extensions) type of the file,
// for example "PE", "PDF", or "powershell script".
MimeType string `protobuf:"bytes,6,opt,name=mime_type,json=mimeType,proto3" json:"mime_type,omitempty"`
// Metadata associated with the file.
// Deprecate FileMetadata in favor of using fields in File.
//
// Deprecated: Marked as deprecated in backstory/udm.proto.
FileMetadata *FileMetadata `protobuf:"bytes,7,opt,name=file_metadata,json=fileMetadata,proto3" json:"file_metadata,omitempty"`
// Google Cloud Threat Intelligence (GCTI) security result for the file
// including threat context and detection metadata.
SecurityResult *SecurityResult `protobuf:"bytes,36,opt,name=security_result,json=securityResult,proto3" json:"security_result,omitempty"`
// Metadata about the Portable Executable (PE) file.
PeFile *FileMetadataPE `protobuf:"bytes,8,opt,name=pe_file,json=peFile,proto3" json:"pe_file,omitempty"`
// Ssdeep of the file
Ssdeep string `protobuf:"bytes,9,opt,name=ssdeep,proto3" json:"ssdeep,omitempty"`
// Vhash of the file.
Vhash string `protobuf:"bytes,10,opt,name=vhash,proto3" json:"vhash,omitempty"`
// Deprecated. Use authentihash instead.
//
// Deprecated: Marked as deprecated in backstory/udm.proto.
Ahash string `protobuf:"bytes,11,opt,name=ahash,proto3" json:"ahash,omitempty"`
// Authentihash of the file.
Authentihash string `protobuf:"bytes,20,opt,name=authentihash,proto3" json:"authentihash,omitempty"`
// SymHash of the file. Used for Mach-O (e.g. MacOS) binaries, to identify
// similar files based on their symbol table.
Symhash string `protobuf:"bytes,41,opt,name=symhash,proto3" json:"symhash,omitempty"`
// Metadata about the prefetch file.
PrefetchFileMetadata *PrefetchFileMetadata `protobuf:"bytes,43,opt,name=prefetch_file_metadata,json=prefetchFileMetadata,proto3" json:"prefetch_file_metadata,omitempty"`
// FileType field.
FileType File_FileType `protobuf:"varint,12,opt,name=file_type,json=fileType,proto3,enum=google.backstory.File_FileType" json:"file_type,omitempty"`
// Capabilities tags.
CapabilitiesTags []string `protobuf:"bytes,13,rep,name=capabilities_tags,json=capabilitiesTags,proto3" json:"capabilities_tags,omitempty"`
// Names fields.
Names []string `protobuf:"bytes,14,rep,name=names,proto3" json:"names,omitempty"`
// Tags for the file.
Tags []string `protobuf:"bytes,27,rep,name=tags,proto3" json:"tags,omitempty"`
// Timestamp when the file was last updated.
LastModificationTime *timestamppb.Timestamp `protobuf:"bytes,15,opt,name=last_modification_time,json=lastModificationTime,proto3" json:"last_modification_time,omitempty"`
// Timestamp when the file was created.
CreateTime *timestamppb.Timestamp `protobuf:"bytes,39,opt,name=create_time,json=createTime,proto3" json:"create_time,omitempty"`
// Timestamp when the file was accessed.
LastAccessTime *timestamppb.Timestamp `protobuf:"bytes,40,opt,name=last_access_time,json=lastAccessTime,proto3" json:"last_access_time,omitempty"`
// Prevalence of the file hash in the customer's environment.
Prevalence *Prevalence `protobuf:"bytes,16,opt,name=prevalence,proto3" json:"prevalence,omitempty"`
// Timestamp the file was first seen in the customer's environment.
FirstSeenTime *timestamppb.Timestamp `protobuf:"bytes,17,opt,name=first_seen_time,json=firstSeenTime,proto3" json:"first_seen_time,omitempty"`
// Timestamp the file was last seen in the customer's environment.
LastSeenTime *timestamppb.Timestamp `protobuf:"bytes,18,opt,name=last_seen_time,json=lastSeenTime,proto3" json:"last_seen_time,omitempty"`
// The mode of the file. A bit string indicating the permissions and
// privileges of the file.
StatMode uint64 `protobuf:"varint,21,opt,name=stat_mode,json=statMode,proto3" json:"stat_mode,omitempty"`
// The file identifier. Unique identifier of object within a file system.
StatInode uint64 `protobuf:"varint,22,opt,name=stat_inode,json=statInode,proto3" json:"stat_inode,omitempty"`
// The file system identifier to which the object belongs.
StatDev uint64 `protobuf:"varint,23,opt,name=stat_dev,json=statDev,proto3" json:"stat_dev,omitempty"`
// Number of links to file.
StatNlink uint64 `protobuf:"varint,24,opt,name=stat_nlink,json=statNlink,proto3" json:"stat_nlink,omitempty"`
// User defined flags for file.
StatFlags uint32 `protobuf:"varint,25,opt,name=stat_flags,json=statFlags,proto3" json:"stat_flags,omitempty"`
// Timestamp the file was last analysed.
LastAnalysisTime *timestamppb.Timestamp `protobuf:"bytes,26,opt,name=last_analysis_time,json=lastAnalysisTime,proto3" json:"last_analysis_time,omitempty"`
// Embedded urls found in the file.
EmbeddedUrls []string `protobuf:"bytes,28,rep,name=embedded_urls,json=embeddedUrls,proto3" json:"embedded_urls,omitempty"`
// Embedded domains found in the file.
EmbeddedDomains []string `protobuf:"bytes,29,rep,name=embedded_domains,json=embeddedDomains,proto3" json:"embedded_domains,omitempty"`
// Embedded IP addresses found in the file.
EmbeddedIps []string `protobuf:"bytes,30,rep,name=embedded_ips,json=embeddedIps,proto3" json:"embedded_ips,omitempty"`
// Exif metadata from different file formats extracted by exiftool.
ExifInfo *ExifInfo `protobuf:"bytes,31,opt,name=exif_info,json=exifInfo,proto3" json:"exif_info,omitempty"`
// File signature information extracted from different tools.
SignatureInfo *SignatureInfo `protobuf:"bytes,32,opt,name=signature_info,json=signatureInfo,proto3" json:"signature_info,omitempty"`
// Information about the PDF file structure.
PdfInfo *PDFInfo `protobuf:"bytes,33,opt,name=pdf_info,json=pdfInfo,proto3" json:"pdf_info,omitempty"`
// First submission time of the file.
FirstSubmissionTime *timestamppb.Timestamp `protobuf:"bytes,34,opt,name=first_submission_time,json=firstSubmissionTime,proto3" json:"first_submission_time,omitempty"`
// Last submission time of the file.
LastSubmissionTime *timestamppb.Timestamp `protobuf:"bytes,35,opt,name=last_submission_time,json=lastSubmissionTime,proto3" json:"last_submission_time,omitempty"`
// Icon's relevant hashes.
MainIcon *Favicon `protobuf:"bytes,37,opt,name=main_icon,json=mainIcon,proto3" json:"main_icon,omitempty"`
// NTFS metadata.
Ntfs *NtfsFileMetadata `protobuf:"bytes,38,opt,name=ntfs,proto3" json:"ntfs,omitempty"`
// Windows AppCompatCache (Application Compatibility) metadata.
AppCompatCache *AppCompatMetadata `protobuf:"bytes,42,opt,name=app_compat_cache,json=appCompatCache,proto3" json:"app_compat_cache,omitempty"`
// contains filtered or unexported fields
}Information about a file.
func (*File) Descriptor
Deprecated: Use File.ProtoReflect.Descriptor instead.
func (*File) GetAhash
Deprecated: Marked as deprecated in backstory/udm.proto.
func (*File) GetAppCompatCache
func (x *File) GetAppCompatCache() *AppCompatMetadatafunc (*File) GetAuthentihash
func (*File) GetCapabilitiesTags
func (*File) GetCreateTime
func (x *File) GetCreateTime() *timestamppb.Timestampfunc (*File) GetEmbeddedDomains
func (*File) GetEmbeddedIps
func (*File) GetEmbeddedUrls
func (*File) GetExifInfo
func (*File) GetFileMetadata
func (x *File) GetFileMetadata() *FileMetadataDeprecated: Marked as deprecated in backstory/udm.proto.
func (*File) GetFileType
func (x *File) GetFileType() File_FileTypefunc (*File) GetFirstSeenTime
func (x *File) GetFirstSeenTime() *timestamppb.Timestampfunc (*File) GetFirstSubmissionTime
func (x *File) GetFirstSubmissionTime() *timestamppb.Timestampfunc (*File) GetFullPath
func (*File) GetLastAccessTime
func (x *File) GetLastAccessTime() *timestamppb.Timestampfunc (*File) GetLastAnalysisTime
func (x *File) GetLastAnalysisTime() *timestamppb.Timestampfunc (*File) GetLastModificationTime
func (x *File) GetLastModificationTime() *timestamppb.Timestampfunc (*File) GetLastSeenTime
func (x *File) GetLastSeenTime() *timestamppb.Timestampfunc (*File) GetLastSubmissionTime
func (x *File) GetLastSubmissionTime() *timestamppb.Timestampfunc (*File) GetMainIcon
func (*File) GetMd5
func (*File) GetMimeType
func (*File) GetNames
func (*File) GetNtfs
func (x *File) GetNtfs() *NtfsFileMetadatafunc (*File) GetPdfInfo
func (*File) GetPeFile
func (x *File) GetPeFile() *FileMetadataPEfunc (*File) GetPrefetchFileMetadata
func (x *File) GetPrefetchFileMetadata() *PrefetchFileMetadatafunc (*File) GetPrevalence
func (x *File) GetPrevalence() *Prevalencefunc (*File) GetSecurityResult
func (x *File) GetSecurityResult() *SecurityResultfunc (*File) GetSha1
func (*File) GetSha256
func (*File) GetSignatureInfo
func (x *File) GetSignatureInfo() *SignatureInfofunc (*File) GetSize
func (*File) GetSsdeep
func (*File) GetStatDev
func (*File) GetStatFlags
func (*File) GetStatInode
func (*File) GetStatMode
func (*File) GetStatNlink
func (*File) GetSymhash
func (*File) GetTags
func (*File) GetVhash
func (*File) ProtoMessage
func (*File) ProtoMessage()func (*File) ProtoReflect
func (x *File) ProtoReflect() protoreflect.Messagefunc (*File) Reset
func (x *File) Reset()func (*File) String
FileMetadata
type FileMetadata struct {
// Metadata for Microsoft Windows PE files.
// Deprecate PeFileMetadata in favor of single File proto.
//
// Deprecated: Marked as deprecated in backstory/udm.proto.
Pe *PeFileMetadata `protobuf:"bytes,1,opt,name=pe,proto3" json:"pe,omitempty"`
// contains filtered or unexported fields
}Metadata about a file. Place metadata about different file types here, for example data from the Microsoft Windows VersionInfo block or digital signer details. Use a different sub-message per file type.
func (*FileMetadata) Descriptor
func (*FileMetadata) Descriptor() ([]byte, []int)Deprecated: Use FileMetadata.ProtoReflect.Descriptor instead.
func (*FileMetadata) GetPe
func (x *FileMetadata) GetPe() *PeFileMetadataDeprecated: Marked as deprecated in backstory/udm.proto.
func (*FileMetadata) ProtoMessage
func (*FileMetadata) ProtoMessage()func (*FileMetadata) ProtoReflect
func (x *FileMetadata) ProtoReflect() protoreflect.Messagefunc (*FileMetadata) Reset
func (x *FileMetadata) Reset()func (*FileMetadata) String
func (x *FileMetadata) String() stringFileMetadataCodesign
type FileMetadataCodesign struct {
// Code sign identifier.
Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
// Code sign format.
Format string `protobuf:"bytes,2,opt,name=format,proto3" json:"format,omitempty"`
// Code sign timestamp
CompilationTime *timestamppb.Timestamp `protobuf:"bytes,3,opt,name=compilation_time,json=compilationTime,proto3" json:"compilation_time,omitempty"`
// The assigned team identifier of the developer who signed the application.
TeamId string `protobuf:"bytes,4,opt,name=team_id,json=teamId,proto3" json:"team_id,omitempty"`
// contains filtered or unexported fields
}File metadata from the codesign utility.
func (*FileMetadataCodesign) Descriptor
func (*FileMetadataCodesign) Descriptor() ([]byte, []int)Deprecated: Use FileMetadataCodesign.ProtoReflect.Descriptor instead.
func (*FileMetadataCodesign) GetCompilationTime
func (x *FileMetadataCodesign) GetCompilationTime() *timestamppb.Timestampfunc (*FileMetadataCodesign) GetFormat
func (x *FileMetadataCodesign) GetFormat() stringfunc (*FileMetadataCodesign) GetId
func (x *FileMetadataCodesign) GetId() stringfunc (*FileMetadataCodesign) GetTeamId
func (x *FileMetadataCodesign) GetTeamId() stringfunc (*FileMetadataCodesign) ProtoMessage
func (*FileMetadataCodesign) ProtoMessage()func (*FileMetadataCodesign) ProtoReflect
func (x *FileMetadataCodesign) ProtoReflect() protoreflect.Messagefunc (*FileMetadataCodesign) Reset
func (x *FileMetadataCodesign) Reset()func (*FileMetadataCodesign) String
func (x *FileMetadataCodesign) String() stringFileMetadataImports
type FileMetadataImports struct {
// Library field.
Library string `protobuf:"bytes,1,opt,name=library,proto3" json:"library,omitempty"`
// Function field.
Functions []string `protobuf:"bytes,2,rep,name=functions,proto3" json:"functions,omitempty"`
// contains filtered or unexported fields
}File metadata imports.
func (*FileMetadataImports) Descriptor
func (*FileMetadataImports) Descriptor() ([]byte, []int)Deprecated: Use FileMetadataImports.ProtoReflect.Descriptor instead.
func (*FileMetadataImports) GetFunctions
func (x *FileMetadataImports) GetFunctions() []stringfunc (*FileMetadataImports) GetLibrary
func (x *FileMetadataImports) GetLibrary() stringfunc (*FileMetadataImports) ProtoMessage
func (*FileMetadataImports) ProtoMessage()func (*FileMetadataImports) ProtoReflect
func (x *FileMetadataImports) ProtoReflect() protoreflect.Messagefunc (*FileMetadataImports) Reset
func (x *FileMetadataImports) Reset()func (*FileMetadataImports) String
func (x *FileMetadataImports) String() stringFileMetadataPE
type FileMetadataPE struct {
// Imphash of the file.
Imphash string `protobuf:"bytes,1,opt,name=imphash,proto3" json:"imphash,omitempty"`
// info.pe-entry-point.
EntryPoint int64 `protobuf:"varint,2,opt,name=entry_point,json=entryPoint,proto3" json:"entry_point,omitempty"`
// info.exiftool.EntryPoint.
EntryPointExiftool int64 `protobuf:"varint,9,opt,name=entry_point_exiftool,json=entryPointExiftool,proto3" json:"entry_point_exiftool,omitempty"`
// info.pe-timestamp.
CompilationTime *timestamppb.Timestamp `protobuf:"bytes,10,opt,name=compilation_time,json=compilationTime,proto3" json:"compilation_time,omitempty"`
// info.exiftool.TimeStamp.
CompilationExiftoolTime *timestamppb.Timestamp `protobuf:"bytes,11,opt,name=compilation_exiftool_time,json=compilationExiftoolTime,proto3" json:"compilation_exiftool_time,omitempty"`
// FilemetadataSection fields.
Section []*FileMetadataSection `protobuf:"bytes,3,rep,name=section,proto3" json:"section,omitempty"`
// FilemetadataImports fields.
Imports []*FileMetadataImports `protobuf:"bytes,4,rep,name=imports,proto3" json:"imports,omitempty"`
// FilemetadataPeResourceInfo fields.
Resource []*FileMetadataPeResourceInfo `protobuf:"bytes,5,rep,name=resource,proto3" json:"resource,omitempty"`
// Deprecated: use resources_type_count_str.
//
// Deprecated: Marked as deprecated in backstory/udm.proto.
ResourcesTypeCount []*StringToInt64MapEntry `protobuf:"bytes,6,rep,name=resources_type_count,json=resourcesTypeCount,proto3" json:"resources_type_count,omitempty"`
// Deprecated: use resources_language_count_str.
//
// Deprecated: Marked as deprecated in backstory/udm.proto.
ResourcesLanguageCount []*StringToInt64MapEntry `protobuf:"bytes,7,rep,name=resources_language_count,json=resourcesLanguageCount,proto3" json:"resources_language_count,omitempty"`
// Number of resources by resource type.
// Example: RT_ICON: 10, RT_DIALOG: 5
ResourcesTypeCountStr []*Label `protobuf:"bytes,12,rep,name=resources_type_count_str,json=resourcesTypeCountStr,proto3" json:"resources_type_count_str,omitempty"`
// Number of resources by language.
// Example: NEUTRAL: 20, ENGLISH US: 10
ResourcesLanguageCountStr []*Label `protobuf:"bytes,13,rep,name=resources_language_count_str,json=resourcesLanguageCountStr,proto3" json:"resources_language_count_str,omitempty"`
// FilemetadataSignatureInfo field.
// deprecated, user File.signature_info instead.
//
// Deprecated: Marked as deprecated in backstory/udm.proto.
SignatureInfo *FileMetadataSignatureInfo `protobuf:"bytes,8,opt,name=signature_info,json=signatureInfo,proto3" json:"signature_info,omitempty"`
// contains filtered or unexported fields
}Metadata about the Portable Executable (PE) file.
func (*FileMetadataPE) Descriptor
func (*FileMetadataPE) Descriptor() ([]byte, []int)Deprecated: Use FileMetadataPE.ProtoReflect.Descriptor instead.
func (*FileMetadataPE) GetCompilationExiftoolTime
func (x *FileMetadataPE) GetCompilationExiftoolTime() *timestamppb.Timestampfunc (*FileMetadataPE) GetCompilationTime
func (x *FileMetadataPE) GetCompilationTime() *timestamppb.Timestampfunc (*FileMetadataPE) GetEntryPoint
func (x *FileMetadataPE) GetEntryPoint() int64func (*FileMetadataPE) GetEntryPointExiftool
func (x *FileMetadataPE) GetEntryPointExiftool() int64func (*FileMetadataPE) GetImphash
func (x *FileMetadataPE) GetImphash() stringfunc (*FileMetadataPE) GetImports
func (x *FileMetadataPE) GetImports() []*FileMetadataImportsfunc (*FileMetadataPE) GetResource
func (x *FileMetadataPE) GetResource() []*FileMetadataPeResourceInfofunc (*FileMetadataPE) GetResourcesLanguageCount
func (x *FileMetadataPE) GetResourcesLanguageCount() []*StringToInt64MapEntryDeprecated: Marked as deprecated in backstory/udm.proto.
func (*FileMetadataPE) GetResourcesLanguageCountStr
func (x *FileMetadataPE) GetResourcesLanguageCountStr() []*Labelfunc (*FileMetadataPE) GetResourcesTypeCount
func (x *FileMetadataPE) GetResourcesTypeCount() []*StringToInt64MapEntryDeprecated: Marked as deprecated in backstory/udm.proto.
func (*FileMetadataPE) GetResourcesTypeCountStr
func (x *FileMetadataPE) GetResourcesTypeCountStr() []*Labelfunc (*FileMetadataPE) GetSection
func (x *FileMetadataPE) GetSection() []*FileMetadataSectionfunc (*FileMetadataPE) GetSignatureInfo
func (x *FileMetadataPE) GetSignatureInfo() *FileMetadataSignatureInfoDeprecated: Marked as deprecated in backstory/udm.proto.
func (*FileMetadataPE) ProtoMessage
func (*FileMetadataPE) ProtoMessage()func (*FileMetadataPE) ProtoReflect
func (x *FileMetadataPE) ProtoReflect() protoreflect.Messagefunc (*FileMetadataPE) Reset
func (x *FileMetadataPE) Reset()func (*FileMetadataPE) String
func (x *FileMetadataPE) String() stringFileMetadataPeResourceInfo
type FileMetadataPeResourceInfo struct {
// SHA256_hex field..
Sha256Hex string `protobuf:"bytes,1,opt,name=sha256_hex,json=sha256Hex,proto3" json:"sha256_hex,omitempty"`
// Type of resource content, as identified by the magic Python module.
FiletypeMagic string `protobuf:"bytes,2,opt,name=filetype_magic,json=filetypeMagic,proto3" json:"filetype_magic,omitempty"`
// Human-readable version of the language and sublanguage identifiers, as
// defined in the Microsoft Windows PE specification.
LanguageCode string `protobuf:"bytes,4,opt,name=language_code,json=languageCode,proto3" json:"language_code,omitempty"`
// Entropy of the resource.
Entropy float64 `protobuf:"fixed64,5,opt,name=entropy,proto3" json:"entropy,omitempty"`
// File type.
// Note that this value may not match any of the well-known type identifiers
// defined in the ResourceType enum.
FileType string `protobuf:"bytes,6,opt,name=file_type,json=fileType,proto3" json:"file_type,omitempty"`
// contains filtered or unexported fields
}File metadata for PE resource.
func (*FileMetadataPeResourceInfo) Descriptor
func (*FileMetadataPeResourceInfo) Descriptor() ([]byte, []int)Deprecated: Use FileMetadataPeResourceInfo.ProtoReflect.Descriptor instead.
func (*FileMetadataPeResourceInfo) GetEntropy
func (x *FileMetadataPeResourceInfo) GetEntropy() float64func (*FileMetadataPeResourceInfo) GetFileType
func (x *FileMetadataPeResourceInfo) GetFileType() stringfunc (*FileMetadataPeResourceInfo) GetFiletypeMagic
func (x *FileMetadataPeResourceInfo) GetFiletypeMagic() stringfunc (*FileMetadataPeResourceInfo) GetLanguageCode
func (x *FileMetadataPeResourceInfo) GetLanguageCode() stringfunc (*FileMetadataPeResourceInfo) GetSha256Hex
func (x *FileMetadataPeResourceInfo) GetSha256Hex() stringfunc (*FileMetadataPeResourceInfo) ProtoMessage
func (*FileMetadataPeResourceInfo) ProtoMessage()func (*FileMetadataPeResourceInfo) ProtoReflect
func (x *FileMetadataPeResourceInfo) ProtoReflect() protoreflect.Messagefunc (*FileMetadataPeResourceInfo) Reset
func (x *FileMetadataPeResourceInfo) Reset()func (*FileMetadataPeResourceInfo) String
func (x *FileMetadataPeResourceInfo) String() stringFileMetadataSection
type FileMetadataSection struct {
// Name of the section.
Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
// Entropy of the section.
Entropy float64 `protobuf:"fixed64,2,opt,name=entropy,proto3" json:"entropy,omitempty"`
// Raw file size in bytes.
RawSizeBytes int64 `protobuf:"varint,3,opt,name=raw_size_bytes,json=rawSizeBytes,proto3" json:"raw_size_bytes,omitempty"`
// Virtual file size in bytes.
VirtualSizeBytes int64 `protobuf:"varint,4,opt,name=virtual_size_bytes,json=virtualSizeBytes,proto3" json:"virtual_size_bytes,omitempty"`
// MD5 hex of the file.
Md5Hex string `protobuf:"bytes,5,opt,name=md5_hex,json=md5Hex,proto3" json:"md5_hex,omitempty"`
// contains filtered or unexported fields
}File metadata section.
func (*FileMetadataSection) Descriptor
func (*FileMetadataSection) Descriptor() ([]byte, []int)Deprecated: Use FileMetadataSection.ProtoReflect.Descriptor instead.
func (*FileMetadataSection) GetEntropy
func (x *FileMetadataSection) GetEntropy() float64func (*FileMetadataSection) GetMd5Hex
func (x *FileMetadataSection) GetMd5Hex() stringfunc (*FileMetadataSection) GetName
func (x *FileMetadataSection) GetName() stringfunc (*FileMetadataSection) GetRawSizeBytes
func (x *FileMetadataSection) GetRawSizeBytes() int64func (*FileMetadataSection) GetVirtualSizeBytes
func (x *FileMetadataSection) GetVirtualSizeBytes() int64func (*FileMetadataSection) ProtoMessage
func (*FileMetadataSection) ProtoMessage()func (*FileMetadataSection) ProtoReflect
func (x *FileMetadataSection) ProtoReflect() protoreflect.Messagefunc (*FileMetadataSection) Reset
func (x *FileMetadataSection) Reset()func (*FileMetadataSection) String
func (x *FileMetadataSection) String() stringFileMetadataSignatureInfo
type FileMetadataSignatureInfo struct {
// Status of the certificate.
// Valid values are "Signed", "Unsigned" or a description of the certificate
// anomaly, if found.
VerificationMessage string `protobuf:"bytes,1,opt,name=verification_message,json=verificationMessage,proto3" json:"verification_message,omitempty"`
// True if verification_message == "Signed"
Verified bool `protobuf:"varint,2,opt,name=verified,proto3" json:"verified,omitempty"`
// Deprecated: use signers field.
//
// Deprecated: Marked as deprecated in backstory/udm.proto.
Signer []string `protobuf:"bytes,3,rep,name=signer,proto3" json:"signer,omitempty"`
// File metadata signer information.
// The order of the signers matters. Each element is a higher level
// authority, being the last the root authority.
Signers []*SignerInfo `protobuf:"bytes,4,rep,name=signers,proto3" json:"signers,omitempty"`
// List of certificates.
X509 []*X509 `protobuf:"bytes,5,rep,name=x509,proto3" json:"x509,omitempty"`
// contains filtered or unexported fields
}Signature information.
func (*FileMetadataSignatureInfo) Descriptor
func (*FileMetadataSignatureInfo) Descriptor() ([]byte, []int)Deprecated: Use FileMetadataSignatureInfo.ProtoReflect.Descriptor instead.
func (*FileMetadataSignatureInfo) GetSigner
func (x *FileMetadataSignatureInfo) GetSigner() []stringDeprecated: Marked as deprecated in backstory/udm.proto.
func (*FileMetadataSignatureInfo) GetSigners
func (x *FileMetadataSignatureInfo) GetSigners() []*SignerInfofunc (*FileMetadataSignatureInfo) GetVerificationMessage
func (x *FileMetadataSignatureInfo) GetVerificationMessage() stringfunc (*FileMetadataSignatureInfo) GetVerified
func (x *FileMetadataSignatureInfo) GetVerified() boolfunc (*FileMetadataSignatureInfo) GetX509
func (x *FileMetadataSignatureInfo) GetX509() []*X509func (*FileMetadataSignatureInfo) ProtoMessage
func (*FileMetadataSignatureInfo) ProtoMessage()func (*FileMetadataSignatureInfo) ProtoReflect
func (x *FileMetadataSignatureInfo) ProtoReflect() protoreflect.Messagefunc (*FileMetadataSignatureInfo) Reset
func (x *FileMetadataSignatureInfo) Reset()func (*FileMetadataSignatureInfo) String
func (x *FileMetadataSignatureInfo) String() stringFile_FileType
type File_FileType int32The file type, for example Microsoft Windows executable.
File_FILE_TYPE_UNSPECIFIED, File_FILE_TYPE_PE_EXE, File_FILE_TYPE_PE_DLL, File_FILE_TYPE_MSI, File_FILE_TYPE_NE_EXE, File_FILE_TYPE_NE_DLL, File_FILE_TYPE_DOS_EXE, File_FILE_TYPE_DOS_COM, File_FILE_TYPE_COFF, File_FILE_TYPE_ELF, File_FILE_TYPE_LINUX_KERNEL, File_FILE_TYPE_RPM, File_FILE_TYPE_LINUX, File_FILE_TYPE_MACH_O, File_FILE_TYPE_JAVA_BYTECODE, File_FILE_TYPE_DMG, File_FILE_TYPE_DEB, File_FILE_TYPE_PKG, File_FILE_TYPE_PYC, File_FILE_TYPE_LNK, File_FILE_TYPE_DESKTOP_ENTRY, File_FILE_TYPE_JPEG, File_FILE_TYPE_TIFF, File_FILE_TYPE_GIF, File_FILE_TYPE_PNG, File_FILE_TYPE_BMP, File_FILE_TYPE_GIMP, File_FILE_TYPE_IN_DESIGN, File_FILE_TYPE_PSD, File_FILE_TYPE_TARGA, File_FILE_TYPE_XWD, File_FILE_TYPE_DIB, File_FILE_TYPE_JNG, File_FILE_TYPE_ICO, File_FILE_TYPE_FPX, File_FILE_TYPE_EPS, File_FILE_TYPE_SVG, File_FILE_TYPE_EMF, File_FILE_TYPE_WEBP, File_FILE_TYPE_DWG, File_FILE_TYPE_DXF, File_FILE_TYPE_THREEDS, File_FILE_TYPE_OGG, File_FILE_TYPE_FLC, File_FILE_TYPE_FLI, File_FILE_TYPE_MP3, File_FILE_TYPE_FLAC, File_FILE_TYPE_WAV, File_FILE_TYPE_MIDI, File_FILE_TYPE_AVI, File_FILE_TYPE_MPEG, File_FILE_TYPE_QUICKTIME, File_FILE_TYPE_ASF, File_FILE_TYPE_DIVX, File_FILE_TYPE_FLV, File_FILE_TYPE_WMA, File_FILE_TYPE_WMV, File_FILE_TYPE_RM, File_FILE_TYPE_MOV, File_FILE_TYPE_MP4, File_FILE_TYPE_T3GP, File_FILE_TYPE_WEBM, File_FILE_TYPE_MKV, File_FILE_TYPE_PDF, File_FILE_TYPE_PS, File_FILE_TYPE_DOC, File_FILE_TYPE_DOCX, File_FILE_TYPE_PPT, File_FILE_TYPE_PPTX, File_FILE_TYPE_XLS, File_FILE_TYPE_XLSX, File_FILE_TYPE_RTF, File_FILE_TYPE_PPSX, File_FILE_TYPE_ODP, File_FILE_TYPE_ODS, File_FILE_TYPE_ODT, File_FILE_TYPE_HWP, File_FILE_TYPE_GUL, File_FILE_TYPE_ODF, File_FILE_TYPE_ODG, File_FILE_TYPE_ONE_NOTE, File_FILE_TYPE_OOXML, File_FILE_TYPE_SLK, File_FILE_TYPE_EBOOK, File_FILE_TYPE_LATEX, File_FILE_TYPE_TTF, File_FILE_TYPE_EOT, File_FILE_TYPE_WOFF, File_FILE_TYPE_CHM, File_FILE_TYPE_ZIP, File_FILE_TYPE_GZIP, File_FILE_TYPE_BZIP, File_FILE_TYPE_RZIP, File_FILE_TYPE_DZIP, File_FILE_TYPE_SEVENZIP, File_FILE_TYPE_CAB, File_FILE_TYPE_JAR, File_FILE_TYPE_RAR, File_FILE_TYPE_MSCOMPRESS, File_FILE_TYPE_ACE, File_FILE_TYPE_ARC, File_FILE_TYPE_ARJ, File_FILE_TYPE_ASD, File_FILE_TYPE_BLACKHOLE, File_FILE_TYPE_KGB, File_FILE_TYPE_ZLIB, File_FILE_TYPE_TAR, File_FILE_TYPE_ZST, File_FILE_TYPE_LZFSE, File_FILE_TYPE_PYTHON_WHL, File_FILE_TYPE_PYTHON_PKG, File_FILE_TYPE_MSIX, File_FILE_TYPE_TEXT, File_FILE_TYPE_SCRIPT, File_FILE_TYPE_PHP, File_FILE_TYPE_PYTHON, File_FILE_TYPE_PERL, File_FILE_TYPE_RUBY, File_FILE_TYPE_C, File_FILE_TYPE_CPP, File_FILE_TYPE_JAVA, File_FILE_TYPE_SHELLSCRIPT, File_FILE_TYPE_PASCAL, File_FILE_TYPE_AWK, File_FILE_TYPE_DYALOG, File_FILE_TYPE_FORTRAN, File_FILE_TYPE_JAVASCRIPT, File_FILE_TYPE_POWERSHELL, File_FILE_TYPE_VBA, File_FILE_TYPE_M4, File_FILE_TYPE_OBJETIVEC, File_FILE_TYPE_JMOD, File_FILE_TYPE_MAKEFILE, File_FILE_TYPE_INI, File_FILE_TYPE_CLJ, File_FILE_TYPE_PDB, File_FILE_TYPE_SQL, File_FILE_TYPE_NEKO, File_FILE_TYPE_WER, File_FILE_TYPE_GOLANG, File_FILE_TYPE_M3U, File_FILE_TYPE_BAT, File_FILE_TYPE_MSC, File_FILE_TYPE_RDP, File_FILE_TYPE_SYMBIAN, File_FILE_TYPE_PALMOS, File_FILE_TYPE_WINCE, File_FILE_TYPE_ANDROID, File_FILE_TYPE_IPHONE, File_FILE_TYPE_HTML, File_FILE_TYPE_XML, File_FILE_TYPE_SWF, File_FILE_TYPE_FLA, File_FILE_TYPE_COOKIE, File_FILE_TYPE_TORRENT, File_FILE_TYPE_EMAIL_TYPE, File_FILE_TYPE_OUTLOOK, File_FILE_TYPE_SGML, File_FILE_TYPE_JSON, File_FILE_TYPE_CSV, File_FILE_TYPE_HTA, File_FILE_TYPE_INTERNET_SHORTCUT, File_FILE_TYPE_CAP, File_FILE_TYPE_ISOIMAGE, File_FILE_TYPE_SQUASHFS, File_FILE_TYPE_VHD, File_FILE_TYPE_APPLE, File_FILE_TYPE_MACINTOSH, File_FILE_TYPE_APPLESINGLE, File_FILE_TYPE_APPLEDOUBLE, File_FILE_TYPE_MACINTOSH_HFS, File_FILE_TYPE_APPLE_PLIST, File_FILE_TYPE_MACINTOSH_LIB, File_FILE_TYPE_APPLESCRIPT, File_FILE_TYPE_APPLESCRIPT_COMPILED, File_FILE_TYPE_CRX, File_FILE_TYPE_XPI, File_FILE_TYPE_ROM, File_FILE_TYPE_IPS, File_FILE_TYPE_PEM, File_FILE_TYPE_PGP, File_FILE_TYPE_CRT
const (
// File type is UNSPECIFIED.
File_FILE_TYPE_UNSPECIFIED File_FileType = 0
// File type is PE_EXE.
File_FILE_TYPE_PE_EXE File_FileType = 1
// Although DLLs are actually portable executables, this value
// enables the file type to be identified separately.
// File type is PE_DLL.
File_FILE_TYPE_PE_DLL File_FileType = 2
// File type is MSI.
File_FILE_TYPE_MSI File_FileType = 3
// File type is NE_EXE.
File_FILE_TYPE_NE_EXE File_FileType = 10
// File type is NE_DLL.
File_FILE_TYPE_NE_DLL File_FileType = 11
// File type is DOS_EXE.
File_FILE_TYPE_DOS_EXE File_FileType = 20
// File type is DOS_COM.
File_FILE_TYPE_DOS_COM File_FileType = 21
// File type is COFF.
File_FILE_TYPE_COFF File_FileType = 30
// File type is ELF.
File_FILE_TYPE_ELF File_FileType = 31
// File type is LINUX_KERNEL.
File_FILE_TYPE_LINUX_KERNEL File_FileType = 32
// File type is RPM.
File_FILE_TYPE_RPM File_FileType = 33
// File type is LINUX.
File_FILE_TYPE_LINUX File_FileType = 34
// File type is MACH_O.
File_FILE_TYPE_MACH_O File_FileType = 35
// File type is JAVA_BYTECODE.
File_FILE_TYPE_JAVA_BYTECODE File_FileType = 36
// File type is DMG.
File_FILE_TYPE_DMG File_FileType = 37
// File type is DEB.
File_FILE_TYPE_DEB File_FileType = 38
// File type is PKG.
File_FILE_TYPE_PKG File_FileType = 39
// File type is PYC.
File_FILE_TYPE_PYC File_FileType = 40
// File type is LNK.
File_FILE_TYPE_LNK File_FileType = 50
// File type is DESKTOP_ENTRY.
File_FILE_TYPE_DESKTOP_ENTRY File_FileType = 51
// File type is JPEG.
File_FILE_TYPE_JPEG File_FileType = 100
// File type is TIFF.
File_FILE_TYPE_TIFF File_FileType = 101
// File type is GIF.
File_FILE_TYPE_GIF File_FileType = 102
// File type is PNG.
File_FILE_TYPE_PNG File_FileType = 103
// File type is BMP.
File_FILE_TYPE_BMP File_FileType = 104
// File type is GIMP.
File_FILE_TYPE_GIMP File_FileType = 105
// File type is Adobe InDesign.
File_FILE_TYPE_IN_DESIGN File_FileType = 106
// File type is PSD.
// Adobe Photoshop.
File_FILE_TYPE_PSD File_FileType = 107
// File type is TARGA.
File_FILE_TYPE_TARGA File_FileType = 108
// File type is XWD.
File_FILE_TYPE_XWD File_FileType = 109
// File type is DIB.
File_FILE_TYPE_DIB File_FileType = 110
// File type is JNG.
File_FILE_TYPE_JNG File_FileType = 111
// File type is ICO.
File_FILE_TYPE_ICO File_FileType = 112
// File type is FPX.
File_FILE_TYPE_FPX File_FileType = 113
// File type is EPS.
File_FILE_TYPE_EPS File_FileType = 114
// File type is SVG.
File_FILE_TYPE_SVG File_FileType = 115
// File type is EMF.
File_FILE_TYPE_EMF File_FileType = 116
// File type is WEBP.
File_FILE_TYPE_WEBP File_FileType = 117
// File type is DWG.
File_FILE_TYPE_DWG File_FileType = 118
// File type is DXF.
File_FILE_TYPE_DXF File_FileType = 119
// File type is 3DS.
File_FILE_TYPE_THREEDS File_FileType = 120
// File type is OGG.
File_FILE_TYPE_OGG File_FileType = 150
// File type is FLC.
File_FILE_TYPE_FLC File_FileType = 151
// File type is FLI.
File_FILE_TYPE_FLI File_FileType = 152
// File type is MP3.
File_FILE_TYPE_MP3 File_FileType = 153
// File type is FLAC.
File_FILE_TYPE_FLAC File_FileType = 154
// File type is WAV.
File_FILE_TYPE_WAV File_FileType = 155
// File type is MIDI.
File_FILE_TYPE_MIDI File_FileType = 156
// File type is AVI.
File_FILE_TYPE_AVI File_FileType = 157
// File type is MPEG.
File_FILE_TYPE_MPEG File_FileType = 158
// File type is QUICKTIME.
File_FILE_TYPE_QUICKTIME File_FileType = 159
// File type is ASF.
File_FILE_TYPE_ASF File_FileType = 160
// File type is DIVX.
File_FILE_TYPE_DIVX File_FileType = 161
// File type is FLV.
File_FILE_TYPE_FLV File_FileType = 162
// File type is WMA.
File_FILE_TYPE_WMA File_FileType = 163
// File type is WMV.
File_FILE_TYPE_WMV File_FileType = 164
// File type is RM.
// RealMedia type.
File_FILE_TYPE_RM File_FileType = 165
// File type is MOV.
File_FILE_TYPE_MOV File_FileType = 166
// File type is MP4.
File_FILE_TYPE_MP4 File_FileType = 167
// File type is T3GP.
File_FILE_TYPE_T3GP File_FileType = 168
// File type is WEBM.
File_FILE_TYPE_WEBM File_FileType = 169
// File type is MKV.
File_FILE_TYPE_MKV File_FileType = 170
// File type is PDF.
File_FILE_TYPE_PDF File_FileType = 200
// File type is PS.
File_FILE_TYPE_PS File_FileType = 201
// File type is DOC.
File_FILE_TYPE_DOC File_FileType = 202
// File type is DOCX.
File_FILE_TYPE_DOCX File_FileType = 203
// File type is PPT.
File_FILE_TYPE_PPT File_FileType = 204
// File type is PPTX.
File_FILE_TYPE_PPTX File_FileType = 205
// File type is XLS.
File_FILE_TYPE_XLS File_FileType = 206
// File type is XLSX.
File_FILE_TYPE_XLSX File_FileType = 207
// File type is RTF.
File_FILE_TYPE_RTF File_FileType = 208
// File type is PPSX.
File_FILE_TYPE_PPSX File_FileType = 209
// File type is ODP.
File_FILE_TYPE_ODP File_FileType = 250
// File type is ODS.
File_FILE_TYPE_ODS File_FileType = 251
// File type is ODT.
File_FILE_TYPE_ODT File_FileType = 252
// File type is HWP.
File_FILE_TYPE_HWP File_FileType = 253
// File type is GUL.
File_FILE_TYPE_GUL File_FileType = 254
// File type is ODF.
File_FILE_TYPE_ODF File_FileType = 255
// File type is ODG.
File_FILE_TYPE_ODG File_FileType = 256
// File type is ONE_NOTE.
File_FILE_TYPE_ONE_NOTE File_FileType = 257
// File type is OOXML.
File_FILE_TYPE_OOXML File_FileType = 258
// File type is SLK.
File_FILE_TYPE_SLK File_FileType = 259
// File type is EBOOK.
File_FILE_TYPE_EBOOK File_FileType = 260
// File type is LATEX.
File_FILE_TYPE_LATEX File_FileType = 261
// File type is TTF.
File_FILE_TYPE_TTF File_FileType = 262
// File type is EOT.
File_FILE_TYPE_EOT File_FileType = 263
// File type is WOFF.
File_FILE_TYPE_WOFF File_FileType = 264
// File type is CHM.
File_FILE_TYPE_CHM File_FileType = 265
// File type is ZIP.
File_FILE_TYPE_ZIP File_FileType = 300
// File type is GZIP.
File_FILE_TYPE_GZIP File_FileType = 301
// File type is BZIP.
File_FILE_TYPE_BZIP File_FileType = 302
// File type is RZIP.
File_FILE_TYPE_RZIP File_FileType = 303
// File type is DZIP.
File_FILE_TYPE_DZIP File_FileType = 304
// File type is SEVENZIP.
File_FILE_TYPE_SEVENZIP File_FileType = 305
// File type is CAB.
File_FILE_TYPE_CAB File_FileType = 306
// File type is JAR.
File_FILE_TYPE_JAR File_FileType = 307
// File type is RAR.
File_FILE_TYPE_RAR File_FileType = 308
// File type is MSCOMPRESS.
File_FILE_TYPE_MSCOMPRESS File_FileType = 309
// File type is ACE.
File_FILE_TYPE_ACE File_FileType = 310
// File type is ARC.
File_FILE_TYPE_ARC File_FileType = 311
// File type is ARJ.
File_FILE_TYPE_ARJ File_FileType = 312
// File type is ASD.
File_FILE_TYPE_ASD File_FileType = 313
// File type is BLACKHOLE.
File_FILE_TYPE_BLACKHOLE File_FileType = 314
// File type is KGB.
File_FILE_TYPE_KGB File_FileType = 315
// File type is ZLIB.
File_FILE_TYPE_ZLIB File_FileType = 316
// File type is TAR.
File_FILE_TYPE_TAR File_FileType = 317
// File type is ZST.
File_FILE_TYPE_ZST File_FileType = 318
// File type is LZFSE.
File_FILE_TYPE_LZFSE File_FileType = 319
// File type is PYTHON_WHL.
File_FILE_TYPE_PYTHON_WHL File_FileType = 320
// File type is PYTHON_PKG.
File_FILE_TYPE_PYTHON_PKG File_FileType = 321
// File type is MSIX, new Windows app package format.
File_FILE_TYPE_MSIX File_FileType = 322
// File type is TEXT.
File_FILE_TYPE_TEXT File_FileType = 400
// File type is SCRIPT.
File_FILE_TYPE_SCRIPT File_FileType = 401
// File type is PHP.
File_FILE_TYPE_PHP File_FileType = 402
// File type is PYTHON.
File_FILE_TYPE_PYTHON File_FileType = 403
// File type is PERL.
File_FILE_TYPE_PERL File_FileType = 404
// File type is RUBY.
File_FILE_TYPE_RUBY File_FileType = 405
// File type is C.
File_FILE_TYPE_C File_FileType = 406
// File type is CPP.
File_FILE_TYPE_CPP File_FileType = 407
// File type is JAVA.
File_FILE_TYPE_JAVA File_FileType = 408
// File type is SHELLSCRIPT.
File_FILE_TYPE_SHELLSCRIPT File_FileType = 409
// File type is PASCAL.
File_FILE_TYPE_PASCAL File_FileType = 410
// File type is AWK.
File_FILE_TYPE_AWK File_FileType = 411
// File type is DYALOG.
File_FILE_TYPE_DYALOG File_FileType = 412
// File type is FORTRAN.
File_FILE_TYPE_FORTRAN File_FileType = 413
// File type is JAVASCRIPT.
File_FILE_TYPE_JAVASCRIPT File_FileType = 414
// File type is POWERSHELL.
File_FILE_TYPE_POWERSHELL File_FileType = 415
// File type is VBA.
File_FILE_TYPE_VBA File_FileType = 416
// File type is M4.
File_FILE_TYPE_M4 File_FileType = 417
// File type is OBJETIVEC.
File_FILE_TYPE_OBJETIVEC File_FileType = 418
// File type is JMOD.
File_FILE_TYPE_JMOD File_FileType = 419
// File type is MAKEFILE.
File_FILE_TYPE_MAKEFILE File_FileType = 420
// File type is INI.
File_FILE_TYPE_INI File_FileType = 421
// File type is CLJ.
File_FILE_TYPE_CLJ File_FileType = 422
// File type is PDB.
File_FILE_TYPE_PDB File_FileType = 425
// File type is SQL.
File_FILE_TYPE_SQL File_FileType = 426
// File type is NEKO.
File_FILE_TYPE_NEKO File_FileType = 427
// File type is WER.
File_FILE_TYPE_WER File_FileType = 428
// File type is GOLANG.
File_FILE_TYPE_GOLANG File_FileType = 429
// File type is M3U.
File_FILE_TYPE_M3U File_FileType = 430
// File type is BAT, Windows .bat/.cmd (old files are tagged as
// SHELLSCRIPT).
File_FILE_TYPE_BAT File_FileType = 431
// File type is MSC, Microsoft Management Console (MMC).
File_FILE_TYPE_MSC File_FileType = 432
// File type is RDP, Microsoft Remote Desktop Protocol (RDP) file.
File_FILE_TYPE_RDP File_FileType = 433
// File type is SYMBIAN.
File_FILE_TYPE_SYMBIAN File_FileType = 500
// File type is PALMOS.
File_FILE_TYPE_PALMOS File_FileType = 501
// File type is WINCE.
File_FILE_TYPE_WINCE File_FileType = 502
// File type is ANDROID.
File_FILE_TYPE_ANDROID File_FileType = 503
// File type is IPHONE.
File_FILE_TYPE_IPHONE File_FileType = 504
// File type is HTML.
File_FILE_TYPE_HTML File_FileType = 600
// File type is XML.
File_FILE_TYPE_XML File_FileType = 601
// File type is SWF.
File_FILE_TYPE_SWF File_FileType = 602
// File type is FLA.
File_FILE_TYPE_FLA File_FileType = 603
// File type is COOKIE.
File_FILE_TYPE_COOKIE File_FileType = 604
// File type is TORRENT.
File_FILE_TYPE_TORRENT File_FileType = 605
// File type is EMAIL_TYPE.
File_FILE_TYPE_EMAIL_TYPE File_FileType = 606
// File type is OUTLOOK.
File_FILE_TYPE_OUTLOOK File_FileType = 607
// File type is SGML.
File_FILE_TYPE_SGML File_FileType = 608
// File type is JSON.
File_FILE_TYPE_JSON File_FileType = 609
// File type is CSV.
File_FILE_TYPE_CSV File_FileType = 610
// File type is HTA (HTML Application).
File_FILE_TYPE_HTA File_FileType = 611
// File type is MSHTML .url.
File_FILE_TYPE_INTERNET_SHORTCUT File_FileType = 612
// File type is CAP.
File_FILE_TYPE_CAP File_FileType = 700
// File type is ISOIMAGE.
File_FILE_TYPE_ISOIMAGE File_FileType = 800
// File type is SQUASHFS.
File_FILE_TYPE_SQUASHFS File_FileType = 801
// File type is VHD.
File_FILE_TYPE_VHD File_FileType = 802
// File type is APPLE.
File_FILE_TYPE_APPLE File_FileType = 1000
// File type is MACINTOSH.
File_FILE_TYPE_MACINTOSH File_FileType = 1001
// File type is APPLESINGLE.
File_FILE_TYPE_APPLESINGLE File_FileType = 1002
// File type is APPLEDOUBLE.
File_FILE_TYPE_APPLEDOUBLE File_FileType = 1003
// File type is MACINTOSH_HFS.
File_FILE_TYPE_MACINTOSH_HFS File_FileType = 1004
// File type is APPLE_PLIST.
File_FILE_TYPE_APPLE_PLIST File_FileType = 1005
// File type is MACINTOSH_LIB.
File_FILE_TYPE_MACINTOSH_LIB File_FileType = 1006
// File type is APPLESCRIPT.
File_FILE_TYPE_APPLESCRIPT File_FileType = 1007
// File type is APPLESCRIPT_COMPILED .
File_FILE_TYPE_APPLESCRIPT_COMPILED File_FileType = 1008
// File type is CRX.
File_FILE_TYPE_CRX File_FileType = 1100
// File type is XPI.
File_FILE_TYPE_XPI File_FileType = 1101
// File type is ROM.
File_FILE_TYPE_ROM File_FileType = 1200
// File type is IPS.
File_FILE_TYPE_IPS File_FileType = 1201
// File type is PEM.
File_FILE_TYPE_PEM File_FileType = 1300
// File type is PGP.
File_FILE_TYPE_PGP File_FileType = 1301
// File type is CRT.
File_FILE_TYPE_CRT File_FileType = 1302
)func (File_FileType) Descriptor
func (File_FileType) Descriptor() protoreflect.EnumDescriptorfunc (File_FileType) Enum
func (x File_FileType) Enum() *File_FileTypefunc (File_FileType) EnumDescriptor
func (File_FileType) EnumDescriptor() ([]byte, []int)Deprecated: Use File_FileType.Descriptor instead.
func (File_FileType) Number
func (x File_FileType) Number() protoreflect.EnumNumberfunc (File_FileType) String
func (x File_FileType) String() stringfunc (File_FileType) Type
func (File_FileType) Type() protoreflect.EnumTypeFindingVariable
type FindingVariable struct {
// The type of the variable.
Type FindingVariable_Type `protobuf:"varint,1,opt,name=type,proto3,enum=google.backstory.FindingVariable_Type" json:"type,omitempty"`
// The value in string form.
Value string `protobuf:"bytes,2,opt,name=value,proto3" json:"value,omitempty"`
// The UDM field path for the field which this value was derived from.
// Example: `principal.user.username`
SourcePath string `protobuf:"bytes,3,opt,name=source_path,json=sourcePath,proto3" json:"source_path,omitempty"`
// The typed value of the variable.
//
// Types that are valid to be assigned to TypedValue:
//
// *FindingVariable_BoolVal
// *FindingVariable_BytesVal
// *FindingVariable_DoubleVal
// *FindingVariable_Int64Val
// *FindingVariable_Uint64Val
// *FindingVariable_StringVal
// *FindingVariable_TimestampTime
// *FindingVariable_NullVal
// *FindingVariable_BoolSeq
// *FindingVariable_BytesSeq
// *FindingVariable_DoubleSeq
// *FindingVariable_Int64Seq
// *FindingVariable_Uint64Seq
// *FindingVariable_StringSeq
TypedValue isFindingVariable_TypedValue `protobuf_oneof:"typed_value"`
// contains filtered or unexported fields
}A structure that holds the value and associated metadata for values extracted while producing a Finding.
func (*FindingVariable) Descriptor
func (*FindingVariable) Descriptor() ([]byte, []int)Deprecated: Use FindingVariable.ProtoReflect.Descriptor instead.
func (*FindingVariable) GetBoolSeq
func (x *FindingVariable) GetBoolSeq() *BoolSequencefunc (*FindingVariable) GetBoolVal
func (x *FindingVariable) GetBoolVal() boolfunc (*FindingVariable) GetBytesSeq
func (x *FindingVariable) GetBytesSeq() *BytesSequencefunc (*FindingVariable) GetBytesVal
func (x *FindingVariable) GetBytesVal() []bytefunc (*FindingVariable) GetDoubleSeq
func (x *FindingVariable) GetDoubleSeq() *DoubleSequencefunc (*FindingVariable) GetDoubleVal
func (x *FindingVariable) GetDoubleVal() float64func (*FindingVariable) GetInt64Seq
func (x *FindingVariable) GetInt64Seq() *Int64Sequencefunc (*FindingVariable) GetInt64Val
func (x *FindingVariable) GetInt64Val() int64func (*FindingVariable) GetNullVal
func (x *FindingVariable) GetNullVal() boolfunc (*FindingVariable) GetSourcePath
func (x *FindingVariable) GetSourcePath() stringfunc (*FindingVariable) GetStringSeq
func (x *FindingVariable) GetStringSeq() *StringSequencefunc (*FindingVariable) GetStringVal
func (x *FindingVariable) GetStringVal() stringfunc (*FindingVariable) GetTimestampTime
func (x *FindingVariable) GetTimestampTime() *timestamppb.Timestampfunc (*FindingVariable) GetType
func (x *FindingVariable) GetType() FindingVariable_Typefunc (*FindingVariable) GetTypedValue
func (x *FindingVariable) GetTypedValue() isFindingVariable_TypedValuefunc (*FindingVariable) GetUint64Seq
func (x *FindingVariable) GetUint64Seq() *Uint64Sequencefunc (*FindingVariable) GetUint64Val
func (x *FindingVariable) GetUint64Val() uint64func (*FindingVariable) GetValue
func (x *FindingVariable) GetValue() stringfunc (*FindingVariable) ProtoMessage
func (*FindingVariable) ProtoMessage()func (*FindingVariable) ProtoReflect
func (x *FindingVariable) ProtoReflect() protoreflect.Messagefunc (*FindingVariable) Reset
func (x *FindingVariable) Reset()func (*FindingVariable) String
func (x *FindingVariable) String() stringFindingVariable_BoolSeq
type FindingVariable_BoolSeq struct {
// The value in boolsequence format.
BoolSeq *BoolSequence `protobuf:"bytes,11,opt,name=bool_seq,json=boolSeq,proto3,oneof"`
}FindingVariable_BoolVal
type FindingVariable_BoolVal struct {
// The value in boolean format.
BoolVal bool `protobuf:"varint,4,opt,name=bool_val,json=boolVal,proto3,oneof"`
}FindingVariable_BytesSeq
type FindingVariable_BytesSeq struct {
// The value in bytessequence format.
BytesSeq *BytesSequence `protobuf:"bytes,12,opt,name=bytes_seq,json=bytesSeq,proto3,oneof"`
}FindingVariable_BytesVal
type FindingVariable_BytesVal struct {
// The value in bytes format.
BytesVal []byte `protobuf:"bytes,5,opt,name=bytes_val,json=bytesVal,proto3,oneof"`
}FindingVariable_DoubleSeq
type FindingVariable_DoubleSeq struct {
// The value in doublesequence format.
DoubleSeq *DoubleSequence `protobuf:"bytes,13,opt,name=double_seq,json=doubleSeq,proto3,oneof"`
}FindingVariable_DoubleVal
type FindingVariable_DoubleVal struct {
// The value in double format.
DoubleVal float64 `protobuf:"fixed64,6,opt,name=double_val,json=doubleVal,proto3,oneof"`
}FindingVariable_Int64Seq
type FindingVariable_Int64Seq struct {
// The value in int64sequence format.
Int64Seq *Int64Sequence `protobuf:"bytes,14,opt,name=int64_seq,json=int64Seq,proto3,oneof"`
}FindingVariable_Int64Val
type FindingVariable_Int64Val struct {
// The value in int64 format.
Int64Val int64 `protobuf:"varint,7,opt,name=int64_val,json=int64Val,proto3,oneof"`
}FindingVariable_NullVal
type FindingVariable_NullVal struct {
// Whether the value is null.
NullVal bool `protobuf:"varint,10,opt,name=null_val,json=nullVal,proto3,oneof"`
}FindingVariable_StringSeq
type FindingVariable_StringSeq struct {
// The value in stringsequence format.
StringSeq *StringSequence `protobuf:"bytes,16,opt,name=string_seq,json=stringSeq,proto3,oneof"`
}FindingVariable_StringVal
type FindingVariable_StringVal struct {
// The value in string format.
// Enum values are returned as strings.
StringVal string `protobuf:"bytes,9,opt,name=string_val,json=stringVal,proto3,oneof"`
}FindingVariable_TimestampTime
type FindingVariable_TimestampTime struct {
// The value in timestamp format.
TimestampTime *timestamppb.Timestamp `protobuf:"bytes,17,opt,name=timestamp_time,json=timestampTime,proto3,oneof"`
}FindingVariable_Type
type FindingVariable_Type int32Type options for Finding variables.
FindingVariable_TYPE_UNSPECIFIED, FindingVariable_MATCH, FindingVariable_OUTCOME
const (
// An unspecified variable type.
FindingVariable_TYPE_UNSPECIFIED FindingVariable_Type = 0
// A variable coming from the match conditions.
FindingVariable_MATCH FindingVariable_Type = 1
// A variable representing significant data that was found in the detection
// logic.
FindingVariable_OUTCOME FindingVariable_Type = 2
)func (FindingVariable_Type) Descriptor
func (FindingVariable_Type) Descriptor() protoreflect.EnumDescriptorfunc (FindingVariable_Type) Enum
func (x FindingVariable_Type) Enum() *FindingVariable_Typefunc (FindingVariable_Type) EnumDescriptor
func (FindingVariable_Type) EnumDescriptor() ([]byte, []int)Deprecated: Use FindingVariable_Type.Descriptor instead.
func (FindingVariable_Type) Number
func (x FindingVariable_Type) Number() protoreflect.EnumNumberfunc (FindingVariable_Type) String
func (x FindingVariable_Type) String() stringfunc (FindingVariable_Type) Type
func (FindingVariable_Type) Type() protoreflect.EnumTypeFindingVariable_Uint64Seq
type FindingVariable_Uint64Seq struct {
// The value in uint64sequence format.
Uint64Seq *Uint64Sequence `protobuf:"bytes,15,opt,name=uint64_seq,json=uint64Seq,proto3,oneof"`
}FindingVariable_Uint64Val
type FindingVariable_Uint64Val struct {
// The value in uint64 format.
Uint64Val uint64 `protobuf:"varint,8,opt,name=uint64_val,json=uint64Val,proto3,oneof"`
}Ftp
type Ftp struct {
// The FTP command.
Command string `protobuf:"bytes,1,opt,name=command,proto3" json:"command,omitempty"`
// contains filtered or unexported fields
}FTP info.
func (*Ftp) Descriptor
Deprecated: Use Ftp.ProtoReflect.Descriptor instead.
func (*Ftp) GetCommand
func (*Ftp) ProtoMessage
func (*Ftp) ProtoMessage()func (*Ftp) ProtoReflect
func (x *Ftp) ProtoReflect() protoreflect.Messagefunc (*Ftp) Reset
func (x *Ftp) Reset()func (*Ftp) String
Group
type Group struct {
// Product globally unique user object identifier, such as an LDAP Object
// Identifier.
ProductObjectId string `protobuf:"bytes,1,opt,name=product_object_id,json=productObjectId,proto3" json:"product_object_id,omitempty"`
// Group creation time.
// Deprecated: creation_time should be populated in Attribute as generic
// metadata.
//
// Deprecated: Marked as deprecated in backstory/udm.proto.
CreationTime *timestamppb.Timestamp `protobuf:"bytes,100,opt,name=creation_time,json=creationTime,proto3" json:"creation_time,omitempty"`
// Group display name. e.g. "Finance".
GroupDisplayName string `protobuf:"bytes,101,opt,name=group_display_name,json=groupDisplayName,proto3" json:"group_display_name,omitempty"`
// Generic entity metadata attributes of the group.
Attribute *Attribute `protobuf:"bytes,4,opt,name=attribute,proto3" json:"attribute,omitempty"`
// Email addresses of the group.
EmailAddresses []string `protobuf:"bytes,2,rep,name=email_addresses,json=emailAddresses,proto3" json:"email_addresses,omitempty"`
// Microsoft Windows SID of the group.
WindowsSid string `protobuf:"bytes,3,opt,name=windows_sid,json=windowsSid,proto3" json:"windows_sid,omitempty"`
// contains filtered or unexported fields
}Information about an organizational group.
func (*Group) Descriptor
Deprecated: Use Group.ProtoReflect.Descriptor instead.
func (*Group) GetAttribute
func (*Group) GetCreationTime
func (x *Group) GetCreationTime() *timestamppb.TimestampDeprecated: Marked as deprecated in backstory/udm.proto.
func (*Group) GetEmailAddresses
func (*Group) GetGroupDisplayName
func (*Group) GetProductObjectId
func (*Group) GetWindowsSid
func (*Group) ProtoMessage
func (*Group) ProtoMessage()func (*Group) ProtoReflect
func (x *Group) ProtoReflect() protoreflect.Messagefunc (*Group) Reset
func (x *Group) Reset()func (*Group) String
GroupedFields
type GroupedFields struct {
// IP addresses.
Ip []string `protobuf:"bytes,1,rep,name=ip,proto3" json:"ip,omitempty"`
// Domains.
Domain []string `protobuf:"bytes,2,rep,name=domain,proto3" json:"domain,omitempty"`
// Hostnames.
Hostname []string `protobuf:"bytes,3,rep,name=hostname,proto3" json:"hostname,omitempty"`
// Users.
User []string `protobuf:"bytes,4,rep,name=user,proto3" json:"user,omitempty"`
// Emails.
Email []string `protobuf:"bytes,5,rep,name=email,proto3" json:"email,omitempty"`
// File paths.
FilePath []string `protobuf:"bytes,6,rep,name=file_path,json=filePath,proto3" json:"file_path,omitempty"`
// File Hashes.
Hash []string `protobuf:"bytes,7,rep,name=hash,proto3" json:"hash,omitempty"`
// Process Identifiers.
ProcessId []string `protobuf:"bytes,8,rep,name=process_id,json=processId,proto3" json:"process_id,omitempty"`
// contains filtered or unexported fields
}Grouped fields are aliases for groups of related UDM fields. All fields grouped together are of type string.
func (*GroupedFields) Descriptor
func (*GroupedFields) Descriptor() ([]byte, []int)Deprecated: Use GroupedFields.ProtoReflect.Descriptor instead.
func (*GroupedFields) GetDomain
func (x *GroupedFields) GetDomain() []stringfunc (*GroupedFields) GetEmail
func (x *GroupedFields) GetEmail() []stringfunc (*GroupedFields) GetFilePath
func (x *GroupedFields) GetFilePath() []stringfunc (*GroupedFields) GetHash
func (x *GroupedFields) GetHash() []stringfunc (*GroupedFields) GetHostname
func (x *GroupedFields) GetHostname() []stringfunc (*GroupedFields) GetIp
func (x *GroupedFields) GetIp() []stringfunc (*GroupedFields) GetProcessId
func (x *GroupedFields) GetProcessId() []stringfunc (*GroupedFields) GetUser
func (x *GroupedFields) GetUser() []stringfunc (*GroupedFields) ProtoMessage
func (*GroupedFields) ProtoMessage()func (*GroupedFields) ProtoReflect
func (x *GroupedFields) ProtoReflect() protoreflect.Messagefunc (*GroupedFields) Reset
func (x *GroupedFields) Reset()func (*GroupedFields) String
func (x *GroupedFields) String() stringHardware
type Hardware struct {
// Hardware serial number.
SerialNumber string `protobuf:"bytes,1,opt,name=serial_number,json=serialNumber,proto3" json:"serial_number,omitempty"`
// Hardware manufacturer.
Manufacturer string `protobuf:"bytes,2,opt,name=manufacturer,proto3" json:"manufacturer,omitempty"`
// Hardware model.
Model string `protobuf:"bytes,3,opt,name=model,proto3" json:"model,omitempty"`
// Platform of the hardware CPU (e.g. "Intel Broadwell").
CpuPlatform string `protobuf:"bytes,4,opt,name=cpu_platform,json=cpuPlatform,proto3" json:"cpu_platform,omitempty"`
// Model description of the hardware CPU
// (e.g. "2.8 GHz Quad-Core Intel Core i5").
CpuModel string `protobuf:"bytes,5,opt,name=cpu_model,json=cpuModel,proto3" json:"cpu_model,omitempty"`
// Clock speed of the hardware CPU in MHz.
CpuClockSpeed uint64 `protobuf:"varint,6,opt,name=cpu_clock_speed,json=cpuClockSpeed,proto3" json:"cpu_clock_speed,omitempty"`
// Maximum possible clock speed of the hardware CPU in MHz.
CpuMaxClockSpeed uint64 `protobuf:"varint,7,opt,name=cpu_max_clock_speed,json=cpuMaxClockSpeed,proto3" json:"cpu_max_clock_speed,omitempty"`
// Number of CPU cores.
CpuNumberCores uint64 `protobuf:"varint,8,opt,name=cpu_number_cores,json=cpuNumberCores,proto3" json:"cpu_number_cores,omitempty"`
// Amount of the hardware ramdom access memory (RAM) in Mb.
Ram uint64 `protobuf:"varint,9,opt,name=ram,proto3" json:"ram,omitempty"`
// contains filtered or unexported fields
}Hardware specification details for a resource, including both physical and virtual hardware.
func (*Hardware) Descriptor
Deprecated: Use Hardware.ProtoReflect.Descriptor instead.
func (*Hardware) GetCpuClockSpeed
func (*Hardware) GetCpuMaxClockSpeed
func (*Hardware) GetCpuModel
func (*Hardware) GetCpuNumberCores
func (*Hardware) GetCpuPlatform
func (*Hardware) GetManufacturer
func (*Hardware) GetModel
func (*Hardware) GetRam
func (*Hardware) GetSerialNumber
func (*Hardware) ProtoMessage
func (*Hardware) ProtoMessage()func (*Hardware) ProtoReflect
func (x *Hardware) ProtoReflect() protoreflect.Messagefunc (*Hardware) Reset
func (x *Hardware) Reset()func (*Hardware) String
Http
type Http struct {
// The HTTP request method
// (e.g. "GET", "POST", "PATCH", "DELETE").
Method string `protobuf:"bytes,1,opt,name=method,proto3" json:"method,omitempty"`
// The URL for the HTTP referer.
ReferralUrl string `protobuf:"bytes,2,opt,name=referral_url,json=referralUrl,proto3" json:"referral_url,omitempty"`
// The User-Agent request header which includes the application type,
// operating system, software vendor or software version of the requesting
// software user agent.
UserAgent string `protobuf:"bytes,3,opt,name=user_agent,json=userAgent,proto3" json:"user_agent,omitempty"`
// The response status code, for example
// 200, 302, 404, or 500.
ResponseCode int32 `protobuf:"varint,4,opt,name=response_code,json=responseCode,proto3" json:"response_code,omitempty"`
// contains filtered or unexported fields
}Specify the full URL of the HTTP request within "target". Also specify any uploaded or downloaded file information within "source" or "target".
func (*Http) Descriptor
Deprecated: Use Http.ProtoReflect.Descriptor instead.
func (*Http) GetMethod
func (*Http) GetReferralUrl
func (*Http) GetResponseCode
func (*Http) GetUserAgent
func (*Http) ProtoMessage
func (*Http) ProtoMessage()func (*Http) ProtoReflect
func (x *Http) ProtoReflect() protoreflect.Messagefunc (*Http) Reset
func (x *Http) Reset()func (*Http) String
Id
type Id struct {
// Namespace the id belongs to.
Namespace Id_Namespace `protobuf:"varint,1,opt,name=namespace,proto3,enum=google.backstory.Id_Namespace" json:"namespace,omitempty"`
// Full raw ID.
Id []byte `protobuf:"bytes,2,opt,name=id,proto3" json:"id,omitempty"`
// Some ids are stored as strings that are not able to be translated to bytes,
// so store these separately.
// Ex. detection id of the form de_aaaaaaaa-aaaa...
StringId string `protobuf:"bytes,3,opt,name=string_id,json=stringId,proto3" json:"string_id,omitempty"`
// contains filtered or unexported fields
}Identifier to identify a UDM object like a UDM event, Entity, Collection. The full identifier for persistence is created by setting the 32 most significant bits as the Id.Namespace enum This is a convenience wrapper to define the id space enum values and provide an easy interface for RPCs, most persistence use cases should use a denormalized form.
func (*Id) Descriptor
Deprecated: Use Id.ProtoReflect.Descriptor instead.
func (*Id) GetId
func (*Id) GetNamespace
func (x *Id) GetNamespace() Id_Namespacefunc (*Id) GetStringId
func (*Id) ProtoMessage
func (*Id) ProtoMessage()func (*Id) ProtoReflect
func (x *Id) ProtoReflect() protoreflect.Messagefunc (*Id) Reset
func (x *Id) Reset()func (*Id) String
Id_Namespace
type Id_Namespace int32Extracted Namespace Component
Id_NORMALIZED_TELEMETRY, Id_RAW_TELEMETRY, Id_RULE_DETECTIONS, Id_UPPERCASE, Id_MACHINE_INTELLIGENCE, Id_SECURITY_COMMAND_CENTER, Id_UNSPECIFIED, Id_SOAR_ALERT, Id_VIRUS_TOTAL
const (
// Ingested and Normalized telemetry events
Id_NORMALIZED_TELEMETRY Id_Namespace = 0
// Ingested Raw telemetry
Id_RAW_TELEMETRY Id_Namespace = 1
// Chronicle Rules engine
Id_RULE_DETECTIONS Id_Namespace = 2
// Uppercase
Id_UPPERCASE Id_Namespace = 3
// DSML - Machine Intelligence
Id_MACHINE_INTELLIGENCE Id_Namespace = 4
// A normalized telemetry event from Google Security Command Center.
Id_SECURITY_COMMAND_CENTER Id_Namespace = 5
// Unspecified Namespace
Id_UNSPECIFIED Id_Namespace = 6
// An alert coming from other SIEMs via Chronicle SOAR.
Id_SOAR_ALERT Id_Namespace = 7
// VirusTotal.
Id_VIRUS_TOTAL Id_Namespace = 8
)func (Id_Namespace) Descriptor
func (Id_Namespace) Descriptor() protoreflect.EnumDescriptorfunc (Id_Namespace) Enum
func (x Id_Namespace) Enum() *Id_Namespacefunc (Id_Namespace) EnumDescriptor
func (Id_Namespace) EnumDescriptor() ([]byte, []int)Deprecated: Use Id_Namespace.Descriptor instead.
func (Id_Namespace) Number
func (x Id_Namespace) Number() protoreflect.EnumNumberfunc (Id_Namespace) String
func (x Id_Namespace) String() stringfunc (Id_Namespace) Type
func (Id_Namespace) Type() protoreflect.EnumTypeInt64Sequence
type Int64Sequence struct {
// int64 sequence.
Int64Vals []int64 `protobuf:"varint,1,rep,packed,name=int64_vals,json=int64Vals,proto3" json:"int64_vals,omitempty"`
// contains filtered or unexported fields
}Int64Sequence represents a sequence of int64s.
func (*Int64Sequence) Descriptor
func (*Int64Sequence) Descriptor() ([]byte, []int)Deprecated: Use Int64Sequence.ProtoReflect.Descriptor instead.
func (*Int64Sequence) GetInt64Vals
func (x *Int64Sequence) GetInt64Vals() []int64func (*Int64Sequence) ProtoMessage
func (*Int64Sequence) ProtoMessage()func (*Int64Sequence) ProtoReflect
func (x *Int64Sequence) ProtoReflect() protoreflect.Messagefunc (*Int64Sequence) Reset
func (x *Int64Sequence) Reset()func (*Int64Sequence) String
func (x *Int64Sequence) String() stringInvestigation
type Investigation struct {
// Describes reason a finding investigation was resolved.
Verdict *Verdict `protobuf:"varint,2,opt,name=verdict,proto3,enum=google.backstory.Verdict,oneof" json:"verdict,omitempty"`
// Describes whether a finding was useful or not-useful.
Reputation *Reputation `protobuf:"varint,3,opt,name=reputation,proto3,enum=google.backstory.Reputation,oneof" json:"reputation,omitempty"`
// Severity score for a finding set by an analyst.
SeverityScore *uint32 `protobuf:"varint,4,opt,name=severity_score,json=severityScore,proto3,oneof" json:"severity_score,omitempty"`
// Describes the workflow status of a finding.
Status *Status `protobuf:"varint,5,opt,name=status,proto3,enum=google.backstory.Status,oneof" json:"status,omitempty"`
// Comment added by the Analyst.
Comments []string `protobuf:"bytes,6,rep,name=comments,proto3" json:"comments,omitempty"`
// Priority of the Alert or Finding set by analyst.
Priority *Priority `protobuf:"varint,7,opt,name=priority,proto3,enum=google.backstory.Priority,oneof" json:"priority,omitempty"`
// Root cause of the Alert or Finding set by analyst.
RootCause *string `protobuf:"bytes,8,opt,name=root_cause,json=rootCause,proto3,oneof" json:"root_cause,omitempty"`
// Reason for closing the Case or Alert.
Reason *Reason `protobuf:"varint,9,opt,name=reason,proto3,enum=google.backstory.Reason,oneof" json:"reason,omitempty"`
// Risk score for a finding set by an analyst.
RiskScore *uint32 `protobuf:"varint,10,opt,name=risk_score,json=riskScore,proto3,oneof" json:"risk_score,omitempty"`
// Identifier for the investigation
Id *string `protobuf:"bytes,11,opt,name=id,proto3,oneof" json:"id,omitempty"`
// contains filtered or unexported fields
}Represents the aggregated state of an investigation such as categorization, severity, and status. Can be expanded to include analyst assignment details and more.
func (*Investigation) Descriptor
func (*Investigation) Descriptor() ([]byte, []int)Deprecated: Use Investigation.ProtoReflect.Descriptor instead.
func (*Investigation) GetComments
func (x *Investigation) GetComments() []stringfunc (*Investigation) GetId
func (x *Investigation) GetId() stringfunc (*Investigation) GetPriority
func (x *Investigation) GetPriority() Priorityfunc (*Investigation) GetReason
func (x *Investigation) GetReason() Reasonfunc (*Investigation) GetReputation
func (x *Investigation) GetReputation() Reputationfunc (*Investigation) GetRiskScore
func (x *Investigation) GetRiskScore() uint32func (*Investigation) GetRootCause
func (x *Investigation) GetRootCause() stringfunc (*Investigation) GetSeverityScore
func (x *Investigation) GetSeverityScore() uint32func (*Investigation) GetStatus
func (x *Investigation) GetStatus() Statusfunc (*Investigation) GetVerdict
func (x *Investigation) GetVerdict() Verdictfunc (*Investigation) ProtoMessage
func (*Investigation) ProtoMessage()func (*Investigation) ProtoReflect
func (x *Investigation) ProtoReflect() protoreflect.Messagefunc (*Investigation) Reset
func (x *Investigation) Reset()func (*Investigation) String
func (x *Investigation) String() stringLabel
type Label struct {
// The key.
Key string `protobuf:"bytes,1,opt,name=key,proto3" json:"key,omitempty"`
// The value.
Value string `protobuf:"bytes,2,opt,name=value,proto3" json:"value,omitempty"`
// Where the label is derived from.
Source string `protobuf:"bytes,3,opt,name=source,proto3" json:"source,omitempty"`
// Indicates whether this label can be used for Data RBAC
RbacEnabled bool `protobuf:"varint,4,opt,name=rbac_enabled,json=rbacEnabled,proto3" json:"rbac_enabled,omitempty"`
// contains filtered or unexported fields
}Key value labels.
func (*Label) Descriptor
Deprecated: Use Label.ProtoReflect.Descriptor instead.
func (*Label) GetKey
func (*Label) GetRbacEnabled
func (*Label) GetSource
func (*Label) GetValue
func (*Label) ProtoMessage
func (*Label) ProtoMessage()func (*Label) ProtoReflect
func (x *Label) ProtoReflect() protoreflect.Messagefunc (*Label) Reset
func (x *Label) Reset()func (*Label) String
LatencyMetrics
type LatencyMetrics struct {
// The oldest ingestion timestamp from the events used to create the
// detection.
OldestIngestionTime *timestamppb.Timestamp `protobuf:"bytes,1,opt,name=oldest_ingestion_time,json=oldestIngestionTime,proto3" json:"oldest_ingestion_time,omitempty"`
// The newest (most recent) ingestion timestamp from the events used to
// create the detection.
NewestIngestionTime *timestamppb.Timestamp `protobuf:"bytes,2,opt,name=newest_ingestion_time,json=newestIngestionTime,proto3" json:"newest_ingestion_time,omitempty"`
// The oldest event timestamp from the events used to create the detection.
OldestEventTime *timestamppb.Timestamp `protobuf:"bytes,3,opt,name=oldest_event_time,json=oldestEventTime,proto3" json:"oldest_event_time,omitempty"`
// The newest (most recent) event timestamp from the events used to create
// the detection.
NewestEventTime *timestamppb.Timestamp `protobuf:"bytes,4,opt,name=newest_event_time,json=newestEventTime,proto3" json:"newest_event_time,omitempty"`
// The difference between newest ingestion timestamp and newest event
// timestamp.
IngestionLatency *durationpb.Duration `protobuf:"bytes,5,opt,name=ingestion_latency,json=ingestionLatency,proto3" json:"ingestion_latency,omitempty"`
// contains filtered or unexported fields
}LatencyMetrics contains relevant timestamps for measuring latency per event variable. These metrics are calculated from ALL of the events that contribute to the detection, not just the sampled ones.
func (*LatencyMetrics) Descriptor
func (*LatencyMetrics) Descriptor() ([]byte, []int)Deprecated: Use LatencyMetrics.ProtoReflect.Descriptor instead.
func (*LatencyMetrics) GetIngestionLatency
func (x *LatencyMetrics) GetIngestionLatency() *durationpb.Durationfunc (*LatencyMetrics) GetNewestEventTime
func (x *LatencyMetrics) GetNewestEventTime() *timestamppb.Timestampfunc (*LatencyMetrics) GetNewestIngestionTime
func (x *LatencyMetrics) GetNewestIngestionTime() *timestamppb.Timestampfunc (*LatencyMetrics) GetOldestEventTime
func (x *LatencyMetrics) GetOldestEventTime() *timestamppb.Timestampfunc (*LatencyMetrics) GetOldestIngestionTime
func (x *LatencyMetrics) GetOldestIngestionTime() *timestamppb.Timestampfunc (*LatencyMetrics) ProtoMessage
func (*LatencyMetrics) ProtoMessage()func (*LatencyMetrics) ProtoReflect
func (x *LatencyMetrics) ProtoReflect() protoreflect.Messagefunc (*LatencyMetrics) Reset
func (x *LatencyMetrics) Reset()func (*LatencyMetrics) String
func (x *LatencyMetrics) String() stringLinuxUtmp
type LinuxUtmp struct {
// The activity record type.
RecordType LinuxUtmp_RecordType `protobuf:"varint,1,opt,name=record_type,json=recordType,proto3,enum=google.backstory.LinuxUtmp_RecordType" json:"record_type,omitempty"`
// contains filtered or unexported fields
}The LinuxUtmp extension captures details specific to Linux Utmp events.
func (*LinuxUtmp) Descriptor
Deprecated: Use LinuxUtmp.ProtoReflect.Descriptor instead.
func (*LinuxUtmp) GetRecordType
func (x *LinuxUtmp) GetRecordType() LinuxUtmp_RecordTypefunc (*LinuxUtmp) ProtoMessage
func (*LinuxUtmp) ProtoMessage()func (*LinuxUtmp) ProtoReflect
func (x *LinuxUtmp) ProtoReflect() protoreflect.Messagefunc (*LinuxUtmp) Reset
func (x *LinuxUtmp) Reset()func (*LinuxUtmp) String
LinuxUtmp_RecordType
type LinuxUtmp_RecordType int32The type of activity record from the Utmp file.
LinuxUtmp_RECORD_TYPE_UNSPECIFIED, LinuxUtmp_RUN_LVL, LinuxUtmp_BOOT_TIME, LinuxUtmp_NEW_TIME, LinuxUtmp_OLD_TIME, LinuxUtmp_INIT_PROCESS, LinuxUtmp_LOGIN_PROCESS, LinuxUtmp_USER_PROCESS, LinuxUtmp_DEAD_PROCESS, LinuxUtmp_ACCOUNTING
const (
// The default record type.
LinuxUtmp_RECORD_TYPE_UNSPECIFIED LinuxUtmp_RecordType = 0
// Run-level change.
LinuxUtmp_RUN_LVL LinuxUtmp_RecordType = 1
// System boot time.
LinuxUtmp_BOOT_TIME LinuxUtmp_RecordType = 2
// New time after system clock change.
LinuxUtmp_NEW_TIME LinuxUtmp_RecordType = 3
// Old time before system clock change.
LinuxUtmp_OLD_TIME LinuxUtmp_RecordType = 4
// Process spawned by init.
LinuxUtmp_INIT_PROCESS LinuxUtmp_RecordType = 5
// Login process.
LinuxUtmp_LOGIN_PROCESS LinuxUtmp_RecordType = 6
// Normal user process (logged-in session).
LinuxUtmp_USER_PROCESS LinuxUtmp_RecordType = 7
// Terminated process (session ended).
LinuxUtmp_DEAD_PROCESS LinuxUtmp_RecordType = 8
// Accounting message.
LinuxUtmp_ACCOUNTING LinuxUtmp_RecordType = 9
)func (LinuxUtmp_RecordType) Descriptor
func (LinuxUtmp_RecordType) Descriptor() protoreflect.EnumDescriptorfunc (LinuxUtmp_RecordType) Enum
func (x LinuxUtmp_RecordType) Enum() *LinuxUtmp_RecordTypefunc (LinuxUtmp_RecordType) EnumDescriptor
func (LinuxUtmp_RecordType) EnumDescriptor() ([]byte, []int)Deprecated: Use LinuxUtmp_RecordType.Descriptor instead.
func (LinuxUtmp_RecordType) Number
func (x LinuxUtmp_RecordType) Number() protoreflect.EnumNumberfunc (LinuxUtmp_RecordType) String
func (x LinuxUtmp_RecordType) String() stringfunc (LinuxUtmp_RecordType) Type
func (LinuxUtmp_RecordType) Type() protoreflect.EnumTypeLocation
type Location struct {
// The city.
City string `protobuf:"bytes,1,opt,name=city,proto3" json:"city,omitempty"`
// The state.
State string `protobuf:"bytes,2,opt,name=state,proto3" json:"state,omitempty"`
// The country or region.
CountryOrRegion string `protobuf:"bytes,3,opt,name=country_or_region,json=countryOrRegion,proto3" json:"country_or_region,omitempty"`
// Custom location name (e.g. building or site name like "London Office").
// For cloud environments, this is the region (e.g. "us-west2").
Name string `protobuf:"bytes,4,opt,name=name,proto3" json:"name,omitempty"`
// Desk name or individual location, typically for an employee in an
// office.
// (e.g. "IN-BLR-BCPC-11-1121D").
DeskName string `protobuf:"bytes,5,opt,name=desk_name,json=deskName,proto3" json:"desk_name,omitempty"`
// Floor name, number or a combination of the two for a building.
// (e.g. "1-A").
FloorName string `protobuf:"bytes,6,opt,name=floor_name,json=floorName,proto3" json:"floor_name,omitempty"`
// Deprecated: use region_coordinates.
//
// Deprecated: Marked as deprecated in backstory/udm.proto.
RegionLatitude float32 `protobuf:"fixed32,7,opt,name=region_latitude,json=regionLatitude,proto3" json:"region_latitude,omitempty"`
// Deprecated: use region_coordinates.
//
// Deprecated: Marked as deprecated in backstory/udm.proto.
RegionLongitude float32 `protobuf:"fixed32,8,opt,name=region_longitude,json=regionLongitude,proto3" json:"region_longitude,omitempty"`
// Coordinates for the associated region.
// See
// [https://cloud.google.com/vision/docs/reference/rest/v1/LatLng](https://cloud.google.com/vision/docs/reference/rest/v1/LatLng)
// for a description of the fields.
RegionCoordinates *latlng.LatLng `protobuf:"bytes,9,opt,name=region_coordinates,json=regionCoordinates,proto3" json:"region_coordinates,omitempty"`
// contains filtered or unexported fields
}Information about a location.
func (*Location) Descriptor
Deprecated: Use Location.ProtoReflect.Descriptor instead.
func (*Location) GetCity
func (*Location) GetCountryOrRegion
func (*Location) GetDeskName
func (*Location) GetFloorName
func (*Location) GetName
func (*Location) GetRegionCoordinates
func (*Location) GetRegionLatitude
Deprecated: Marked as deprecated in backstory/udm.proto.
func (*Location) GetRegionLongitude
Deprecated: Marked as deprecated in backstory/udm.proto.
func (*Location) GetState
func (*Location) ProtoMessage
func (*Location) ProtoMessage()func (*Location) ProtoReflect
func (x *Location) ProtoReflect() protoreflect.Messagefunc (*Location) Reset
func (x *Location) Reset()func (*Location) String
Metadata
type Metadata struct {
// ID of the UDM event. Can be used for raw and normalized event retrieval.
Id []byte `protobuf:"bytes,15,opt,name=id,proto3" json:"id,omitempty"`
// A vendor-specific event identifier to uniquely identify the event (e.g. a
// GUID).
ProductLogId string `protobuf:"bytes,1,opt,name=product_log_id,json=productLogId,proto3" json:"product_log_id,omitempty"`
// The GMT timestamp when the event was generated.
EventTimestamp *timestamppb.Timestamp `protobuf:"bytes,2,opt,name=event_timestamp,json=eventTimestamp,proto3" json:"event_timestamp,omitempty"`
// Attributes associated with event_timestamp. This field
// is used to distinguish between different types of timestamps that can be
// used to represent the event_timestamp.
EventTimestampAttributes []Metadata_EventTimestampAttribute `protobuf:"varint,21,rep,packed,name=event_timestamp_attributes,json=eventTimestampAttributes,proto3,enum=google.backstory.Metadata_EventTimestampAttribute" json:"event_timestamp_attributes,omitempty"`
// The GMT timestamp when the event was collected by the vendor's local
// collection infrastructure.
CollectedTimestamp *timestamppb.Timestamp `protobuf:"bytes,3,opt,name=collected_timestamp,json=collectedTimestamp,proto3" json:"collected_timestamp,omitempty"`
// The GMT timestamp when the event was ingested (received) by Chronicle.
IngestedTimestamp *timestamppb.Timestamp `protobuf:"bytes,11,opt,name=ingested_timestamp,json=ingestedTimestamp,proto3" json:"ingested_timestamp,omitempty"`
// The event type.
// If an event has multiple possible types, this specifies the most specific
// type.
EventType Metadata_EventType `protobuf:"varint,4,opt,name=event_type,json=eventType,proto3,enum=google.backstory.Metadata_EventType" json:"event_type,omitempty"`
// The name of the product vendor.
VendorName string `protobuf:"bytes,5,opt,name=vendor_name,json=vendorName,proto3" json:"vendor_name,omitempty"`
// The name of the product.
ProductName string `protobuf:"bytes,6,opt,name=product_name,json=productName,proto3" json:"product_name,omitempty"`
// The version of the product.
ProductVersion string `protobuf:"bytes,7,opt,name=product_version,json=productVersion,proto3" json:"product_version,omitempty"`
// A short, descriptive, human-readable, product-specific event name or type
// (e.g. "Scanned X", "User account created", "process_start").
ProductEventType string `protobuf:"bytes,8,opt,name=product_event_type,json=productEventType,proto3" json:"product_event_type,omitempty"`
// The deployment identifier assigned by the vendor for a product deployment.
ProductDeploymentId string `protobuf:"bytes,14,opt,name=product_deployment_id,json=productDeploymentId,proto3" json:"product_deployment_id,omitempty"`
// A human-readable unparsable description of the event.
Description string `protobuf:"bytes,9,opt,name=description,proto3" json:"description,omitempty"`
// A URL that takes the user to the source product console for this event.
UrlBackToProduct string `protobuf:"bytes,10,opt,name=url_back_to_product,json=urlBackToProduct,proto3" json:"url_back_to_product,omitempty"`
// User-configured ingestion metadata labels.
IngestionLabels []*Label `protobuf:"bytes,12,rep,name=ingestion_labels,json=ingestionLabels,proto3" json:"ingestion_labels,omitempty"`
// Tags added by Chronicle after an event is parsed. It is an error to
// populate this field from within a parser.
Tags *Tags `protobuf:"bytes,13,opt,name=tags,proto3" json:"tags,omitempty"`
// The enrichment state.
EnrichmentState Metadata_EnrichmentState `protobuf:"varint,16,opt,name=enrichment_state,json=enrichmentState,proto3,enum=google.backstory.Metadata_EnrichmentState" json:"enrichment_state,omitempty"`
// The string value of log type.
LogType string `protobuf:"bytes,17,opt,name=log_type,json=logType,proto3" json:"log_type,omitempty"`
// Data access labels on the base event.
BaseLabels *DataAccessLabels `protobuf:"bytes,18,opt,name=base_labels,json=baseLabels,proto3" json:"base_labels,omitempty"`
// Data access labels from all the contextual events used to enrich the base
// event.
EnrichmentLabels *DataAccessLabels `protobuf:"bytes,19,opt,name=enrichment_labels,json=enrichmentLabels,proto3" json:"enrichment_labels,omitempty"`
// Flattened fields extracted from the log.
//
// Deprecated: Marked as deprecated in backstory/udm.proto.
StructuredFields *structpb.Struct `protobuf:"bytes,20,opt,name=structured_fields,json=structuredFields,proto3" json:"structured_fields,omitempty"`
// The version of the parser that generated this UDM event.
ParserVersion string `protobuf:"bytes,22,opt,name=parser_version,json=parserVersion,proto3" json:"parser_version,omitempty"`
// contains filtered or unexported fields
}General information associated with a UDM event.
func (*Metadata) Descriptor
Deprecated: Use Metadata.ProtoReflect.Descriptor instead.
func (*Metadata) GetBaseLabels
func (x *Metadata) GetBaseLabels() *DataAccessLabelsfunc (*Metadata) GetCollectedTimestamp
func (x *Metadata) GetCollectedTimestamp() *timestamppb.Timestampfunc (*Metadata) GetDescription
func (*Metadata) GetEnrichmentLabels
func (x *Metadata) GetEnrichmentLabels() *DataAccessLabelsfunc (*Metadata) GetEnrichmentState
func (x *Metadata) GetEnrichmentState() Metadata_EnrichmentStatefunc (*Metadata) GetEventTimestamp
func (x *Metadata) GetEventTimestamp() *timestamppb.Timestampfunc (*Metadata) GetEventTimestampAttributes
func (x *Metadata) GetEventTimestampAttributes() []Metadata_EventTimestampAttributefunc (*Metadata) GetEventType
func (x *Metadata) GetEventType() Metadata_EventTypefunc (*Metadata) GetId
func (*Metadata) GetIngestedTimestamp
func (x *Metadata) GetIngestedTimestamp() *timestamppb.Timestampfunc (*Metadata) GetIngestionLabels
func (*Metadata) GetLogType
func (*Metadata) GetParserVersion
func (*Metadata) GetProductDeploymentId
func (*Metadata) GetProductEventType
func (*Metadata) GetProductLogId
func (*Metadata) GetProductName
func (*Metadata) GetProductVersion
func (*Metadata) GetStructuredFields
Deprecated: Marked as deprecated in backstory/udm.proto.
func (*Metadata) GetTags
func (*Metadata) GetUrlBackToProduct
func (*Metadata) GetVendorName
func (*Metadata) ProtoMessage
func (*Metadata) ProtoMessage()func (*Metadata) ProtoReflect
func (x *Metadata) ProtoReflect() protoreflect.Messagefunc (*Metadata) Reset
func (x *Metadata) Reset()func (*Metadata) String
Metadata_EnrichmentState
type Metadata_EnrichmentState int32An enrichment state.
Metadata_ENRICHMENT_STATE_UNSPECIFIED, Metadata_ENRICHED, Metadata_UNENRICHED
const (
// Unspecified.
Metadata_ENRICHMENT_STATE_UNSPECIFIED Metadata_EnrichmentState = 0
// The event has been enriched by Chronicle.
Metadata_ENRICHED Metadata_EnrichmentState = 1
// The event has not been enriched by Chronicle.
Metadata_UNENRICHED Metadata_EnrichmentState = 2
)func (Metadata_EnrichmentState) Descriptor
func (Metadata_EnrichmentState) Descriptor() protoreflect.EnumDescriptorfunc (Metadata_EnrichmentState) Enum
func (x Metadata_EnrichmentState) Enum() *Metadata_EnrichmentStatefunc (Metadata_EnrichmentState) EnumDescriptor
func (Metadata_EnrichmentState) EnumDescriptor() ([]byte, []int)Deprecated: Use Metadata_EnrichmentState.Descriptor instead.
func (Metadata_EnrichmentState) Number
func (x Metadata_EnrichmentState) Number() protoreflect.EnumNumberfunc (Metadata_EnrichmentState) String
func (x Metadata_EnrichmentState) String() stringfunc (Metadata_EnrichmentState) Type
func (Metadata_EnrichmentState) Type() protoreflect.EnumTypeMetadata_EventTimestampAttribute
type Metadata_EventTimestampAttribute int32Enum representing the type of timestamp that the event_timestamp field represents.
Metadata_EVENT_TIMESTAMP_ATTRIBUTE_UNSPECIFIED, Metadata_FILE_LAST_ACCESS_TIME, Metadata_FILE_LAST_MODIFIED_TIME, Metadata_FILE_METADATA_LAST_CHANGE_TIME, Metadata_FILE_CREATION_TIME, Metadata_COLLECTED_TIME, Metadata_COLLECTED, Metadata_ACCESSED, Metadata_CHANGED, Metadata_CREATED, Metadata_FILE_NAME_ACCESSED, Metadata_FILE_NAME_CHANGED, Metadata_FILE_NAME_CREATED, Metadata_FILE_NAME_LAST_ACCESSED, Metadata_FILE_NAME_LAST_MODIFIED, Metadata_FILE_NAME_METADATA_LAST_CHANGED, Metadata_FILE_NAME_MODIFIED, Metadata_LAST_ACCESSED, Metadata_LAST_MODIFIED, Metadata_METADATA_LAST_CHANGED, Metadata_MODIFIED, Metadata_ADDED, Metadata_BACKED_UP, Metadata_LAST_CONNECTED, Metadata_DELETED, Metadata_ENDED, Metadata_EXITED, Metadata_EXPIRED, Metadata_FIRST_ACCESSED, Metadata_APPEARED, Metadata_INSTALLED, Metadata_LAST_ACTIVE, Metadata_LAST_LOGGED_IN, Metadata_LAST_LOGIN_ATTEMPT, Metadata_LAST_PASSWORD_SET, Metadata_LAST_PRINTED, Metadata_LAST_RESUMED, Metadata_LAST_EXECUTED, Metadata_LAST_SEEN, Metadata_LAST_SHUTDOWN, Metadata_LAST_UPDATED, Metadata_LAST_USED, Metadata_LAST_VISITED, Metadata_LINKED, Metadata_METADATA_MODIFIED, Metadata_CONTENT_MODIFIED, Metadata_PURCHASED, Metadata_RECORDED, Metadata_REQUEST_RECEIVED, Metadata_RESPONSE_SENT, Metadata_SCHEDULED_TO_END, Metadata_SCHEDULED_TO_START, Metadata_SENT, Metadata_STARTED, Metadata_UPDATED, Metadata_VALIDATED, Metadata_MOST_RECENT_RUN, Metadata_NEXT_RUN, Metadata_VISITED, Metadata_TARGET_CREATED, Metadata_VOLUME_CREATED, Metadata_POST_CHECKED, Metadata_SYNCHRONIZED, Metadata_ITEM_CREATED, Metadata_ITEM_MODIFIED, Metadata_DOCUMENT_LAST_SAVED, Metadata_LAST_REGISTERED, Metadata_LAUNCHED, Metadata_FIRST_VISITED, Metadata_FIRST_SEEN, Metadata_DOWNLOADED
const (
// Default event timestamp attribute.
Metadata_EVENT_TIMESTAMP_ATTRIBUTE_UNSPECIFIED Metadata_EventTimestampAttribute = 0
// Deprecated. Use LAST_ACCESSED instead.
//
// Deprecated: Marked as deprecated in backstory/udm.proto.
Metadata_FILE_LAST_ACCESS_TIME Metadata_EventTimestampAttribute = 1
// Deprecated. Use LAST_MODIFIED instead.
//
// Deprecated: Marked as deprecated in backstory/udm.proto.
Metadata_FILE_LAST_MODIFIED_TIME Metadata_EventTimestampAttribute = 2
// Deprecated. Use METADATA_LAST_CHANGED instead.
//
// Deprecated: Marked as deprecated in backstory/udm.proto.
Metadata_FILE_METADATA_LAST_CHANGE_TIME Metadata_EventTimestampAttribute = 3
// Deprecated. Use CREATED instead.
//
// Deprecated: Marked as deprecated in backstory/udm.proto.
Metadata_FILE_CREATION_TIME Metadata_EventTimestampAttribute = 4
// Deprecated. Use COLLECTED instead.
//
// Deprecated: Marked as deprecated in backstory/udm.proto.
Metadata_COLLECTED_TIME Metadata_EventTimestampAttribute = 5
// The time when the event was collected by the vendor's local
// collection infrastructure.
Metadata_COLLECTED Metadata_EventTimestampAttribute = 6
// The time when the file was accessed.
Metadata_ACCESSED Metadata_EventTimestampAttribute = 7
// The time when the file was changed.
Metadata_CHANGED Metadata_EventTimestampAttribute = 8
// The time when the file was first created.
Metadata_CREATED Metadata_EventTimestampAttribute = 9
// The time when the file name was accessed.
Metadata_FILE_NAME_ACCESSED Metadata_EventTimestampAttribute = 10
// The time when the file name was changed.
Metadata_FILE_NAME_CHANGED Metadata_EventTimestampAttribute = 11
// The time when the file name was created.
Metadata_FILE_NAME_CREATED Metadata_EventTimestampAttribute = 12
// The time when the file name was last accessed.
Metadata_FILE_NAME_LAST_ACCESSED Metadata_EventTimestampAttribute = 13
// The time when the file name was last modified.
Metadata_FILE_NAME_LAST_MODIFIED Metadata_EventTimestampAttribute = 14
// The time when the file name metadata was last changed.
Metadata_FILE_NAME_METADATA_LAST_CHANGED Metadata_EventTimestampAttribute = 15
// The time when the file name was modified.
Metadata_FILE_NAME_MODIFIED Metadata_EventTimestampAttribute = 16
// The time when the file was last accessed.
Metadata_LAST_ACCESSED Metadata_EventTimestampAttribute = 17
// The time when the file was last modified.
Metadata_LAST_MODIFIED Metadata_EventTimestampAttribute = 18
// The time when the file metadata was last changed.
Metadata_METADATA_LAST_CHANGED Metadata_EventTimestampAttribute = 19
// The time when the file was modified.
Metadata_MODIFIED Metadata_EventTimestampAttribute = 20
// Added Timestamp.
Metadata_ADDED Metadata_EventTimestampAttribute = 21
// Backed Up Timestamp.
Metadata_BACKED_UP Metadata_EventTimestampAttribute = 22
// Last Connected timestamp.
Metadata_LAST_CONNECTED Metadata_EventTimestampAttribute = 23
// Deleted Timestamp.
Metadata_DELETED Metadata_EventTimestampAttribute = 24
// Ended Timestamp.
Metadata_ENDED Metadata_EventTimestampAttribute = 25
// Exited Timestamp.
Metadata_EXITED Metadata_EventTimestampAttribute = 26
// Expired Timestamp.
Metadata_EXPIRED Metadata_EventTimestampAttribute = 27
// First Accessed Timestamp.
Metadata_FIRST_ACCESSED Metadata_EventTimestampAttribute = 28
// Appeared Timestamp.
Metadata_APPEARED Metadata_EventTimestampAttribute = 29
// Installed Timestamp.
Metadata_INSTALLED Metadata_EventTimestampAttribute = 30
// Last Active Timestamp.
Metadata_LAST_ACTIVE Metadata_EventTimestampAttribute = 31
// Last Login Timestamp.
Metadata_LAST_LOGGED_IN Metadata_EventTimestampAttribute = 32
// Last Login Attempt Timestamp.
Metadata_LAST_LOGIN_ATTEMPT Metadata_EventTimestampAttribute = 33
// Last Password Set Timestamp.
Metadata_LAST_PASSWORD_SET Metadata_EventTimestampAttribute = 34
// Last Printed Timestamp.
Metadata_LAST_PRINTED Metadata_EventTimestampAttribute = 35
// Last Resumed Timestamp.
Metadata_LAST_RESUMED Metadata_EventTimestampAttribute = 36
// Last Executed Timestamp.
Metadata_LAST_EXECUTED Metadata_EventTimestampAttribute = 37
// Last Seen Timestamp.
Metadata_LAST_SEEN Metadata_EventTimestampAttribute = 38
// Last Shutdown Timestamp.
Metadata_LAST_SHUTDOWN Metadata_EventTimestampAttribute = 39
// Last Updated Timestamp.
Metadata_LAST_UPDATED Metadata_EventTimestampAttribute = 40
// Last Used Timestamp.
Metadata_LAST_USED Metadata_EventTimestampAttribute = 41
// Last Visited Timestamp.
Metadata_LAST_VISITED Metadata_EventTimestampAttribute = 42
// Linked Timestamp.
Metadata_LINKED Metadata_EventTimestampAttribute = 43
// Metadata Modified Timestamp.
Metadata_METADATA_MODIFIED Metadata_EventTimestampAttribute = 44
// Modified Timestamp.
Metadata_CONTENT_MODIFIED Metadata_EventTimestampAttribute = 45
// Purchased Timestamp.
Metadata_PURCHASED Metadata_EventTimestampAttribute = 46
// Recorded Timestamp.
Metadata_RECORDED Metadata_EventTimestampAttribute = 47
// Request Received Timestamp.
Metadata_REQUEST_RECEIVED Metadata_EventTimestampAttribute = 48
// Response Sent Timestamp.
Metadata_RESPONSE_SENT Metadata_EventTimestampAttribute = 49
// Scheduled to End Timestamp.
Metadata_SCHEDULED_TO_END Metadata_EventTimestampAttribute = 50
// Scheduled to Start Timestamp.
Metadata_SCHEDULED_TO_START Metadata_EventTimestampAttribute = 51
// Sent Timestamp.
Metadata_SENT Metadata_EventTimestampAttribute = 52
// Started Timestamp.
Metadata_STARTED Metadata_EventTimestampAttribute = 53
// Updated Timestamp.
Metadata_UPDATED Metadata_EventTimestampAttribute = 54
// Validated Timestamp.
Metadata_VALIDATED Metadata_EventTimestampAttribute = 55
// Most Recent Run Timestamp.
Metadata_MOST_RECENT_RUN Metadata_EventTimestampAttribute = 56
// Next Run Timestamp.
Metadata_NEXT_RUN Metadata_EventTimestampAttribute = 57
// Visited Timestamp.
Metadata_VISITED Metadata_EventTimestampAttribute = 58
// Target Created Timestamp.
Metadata_TARGET_CREATED Metadata_EventTimestampAttribute = 59
// Volume Created Timestamp.
Metadata_VOLUME_CREATED Metadata_EventTimestampAttribute = 60
// Post Checked Timestamp.
Metadata_POST_CHECKED Metadata_EventTimestampAttribute = 61
// Synchronized Timestamp.
Metadata_SYNCHRONIZED Metadata_EventTimestampAttribute = 62
// Item Created Timestamp.
Metadata_ITEM_CREATED Metadata_EventTimestampAttribute = 63
// Item Modified Timestamp.
Metadata_ITEM_MODIFIED Metadata_EventTimestampAttribute = 64
// Document Last Saved Timestamp.
Metadata_DOCUMENT_LAST_SAVED Metadata_EventTimestampAttribute = 65
// Last Registered Timestamp.
Metadata_LAST_REGISTERED Metadata_EventTimestampAttribute = 66
// Launched Timestamp.
Metadata_LAUNCHED Metadata_EventTimestampAttribute = 67
// First Visited Timestamp.
Metadata_FIRST_VISITED Metadata_EventTimestampAttribute = 68
// First Seen Timestamp.
Metadata_FIRST_SEEN Metadata_EventTimestampAttribute = 69
// Downloaded Timestamp.
Metadata_DOWNLOADED Metadata_EventTimestampAttribute = 70
)func (Metadata_EventTimestampAttribute) Descriptor
func (Metadata_EventTimestampAttribute) Descriptor() protoreflect.EnumDescriptorfunc (Metadata_EventTimestampAttribute) Enum
func (x Metadata_EventTimestampAttribute) Enum() *Metadata_EventTimestampAttributefunc (Metadata_EventTimestampAttribute) EnumDescriptor
func (Metadata_EventTimestampAttribute) EnumDescriptor() ([]byte, []int)Deprecated: Use Metadata_EventTimestampAttribute.Descriptor instead.
func (Metadata_EventTimestampAttribute) Number
func (x Metadata_EventTimestampAttribute) Number() protoreflect.EnumNumberfunc (Metadata_EventTimestampAttribute) String
func (x Metadata_EventTimestampAttribute) String() stringfunc (Metadata_EventTimestampAttribute) Type
func (Metadata_EventTimestampAttribute) Type() protoreflect.EnumTypeMetadata_EventType
type Metadata_EventType int32An event type. Choose event type not based on the product that generated the event but the one that logged the event itself. So, for example, an antivirus (AV) scanning email on a client would generate an SMTP_PROXY event, not an AV event. A DLP device scanning a web upload would generate an HTTP_PROXY event and not a DLP or process activity event. Note: In the case of a HTTP_PROXY event, you might also include process details if this occurred on an endpoint. That would be optional, but there are a certain set of required fields and banned fields due to its status as an HTTP_PROXY event.
Metadata_EVENTTYPE_UNSPECIFIED, Metadata_PROCESS_UNCATEGORIZED, Metadata_PROCESS_LAUNCH, Metadata_PROCESS_INJECTION, Metadata_PROCESS_PRIVILEGE_ESCALATION, Metadata_PROCESS_TERMINATION, Metadata_PROCESS_OPEN, Metadata_PROCESS_MODULE_LOAD, Metadata_REGISTRY_UNCATEGORIZED, Metadata_REGISTRY_CREATION, Metadata_REGISTRY_MODIFICATION, Metadata_REGISTRY_DELETION, Metadata_SETTING_UNCATEGORIZED, Metadata_SETTING_CREATION, Metadata_SETTING_MODIFICATION, Metadata_SETTING_DELETION, Metadata_MUTEX_UNCATEGORIZED, Metadata_MUTEX_CREATION, Metadata_FILE_UNCATEGORIZED, Metadata_FILE_CREATION, Metadata_FILE_DELETION, Metadata_FILE_MODIFICATION, Metadata_FILE_READ, Metadata_FILE_COPY, Metadata_FILE_OPEN, Metadata_FILE_MOVE, Metadata_FILE_SYNC, Metadata_USER_UNCATEGORIZED, Metadata_USER_LOGIN, Metadata_USER_LOGOUT, Metadata_USER_CREATION, Metadata_USER_CHANGE_PASSWORD, Metadata_USER_CHANGE_PERMISSIONS, Metadata_USER_STATS, Metadata_USER_BADGE_IN, Metadata_USER_DELETION, Metadata_USER_RESOURCE_CREATION, Metadata_USER_RESOURCE_UPDATE_CONTENT, Metadata_USER_RESOURCE_UPDATE_PERMISSIONS, Metadata_USER_COMMUNICATION, Metadata_USER_RESOURCE_ACCESS, Metadata_USER_RESOURCE_DELETION, Metadata_GROUP_UNCATEGORIZED, Metadata_GROUP_CREATION, Metadata_GROUP_DELETION, Metadata_GROUP_MODIFICATION, Metadata_EMAIL_UNCATEGORIZED, Metadata_EMAIL_TRANSACTION, Metadata_EMAIL_URL_CLICK, Metadata_NETWORK_UNCATEGORIZED, Metadata_NETWORK_FLOW, Metadata_NETWORK_CONNECTION, Metadata_NETWORK_FTP, Metadata_NETWORK_DHCP, Metadata_NETWORK_DNS, Metadata_NETWORK_HTTP, Metadata_NETWORK_SMTP, Metadata_STATUS_UNCATEGORIZED, Metadata_STATUS_HEARTBEAT, Metadata_STATUS_STARTUP, Metadata_STATUS_SHUTDOWN, Metadata_STATUS_UPDATE, Metadata_SCAN_UNCATEGORIZED, Metadata_SCAN_FILE, Metadata_SCAN_PROCESS_BEHAVIORS, Metadata_SCAN_PROCESS, Metadata_SCAN_HOST, Metadata_SCAN_VULN_HOST, Metadata_SCAN_VULN_NETWORK, Metadata_SCAN_NETWORK, Metadata_SCHEDULED_TASK_UNCATEGORIZED, Metadata_SCHEDULED_TASK_CREATION, Metadata_SCHEDULED_TASK_DELETION, Metadata_SCHEDULED_TASK_ENABLE, Metadata_SCHEDULED_TASK_DISABLE, Metadata_SCHEDULED_TASK_MODIFICATION, Metadata_SYSTEM_AUDIT_LOG_UNCATEGORIZED, Metadata_SYSTEM_AUDIT_LOG_WIPE, Metadata_SERVICE_UNSPECIFIED, Metadata_SERVICE_CREATION, Metadata_SERVICE_DELETION, Metadata_SERVICE_START, Metadata_SERVICE_STOP, Metadata_SERVICE_MODIFICATION, Metadata_GENERIC_EVENT, Metadata_RESOURCE_CREATION, Metadata_RESOURCE_DELETION, Metadata_RESOURCE_PERMISSIONS_CHANGE, Metadata_RESOURCE_READ, Metadata_RESOURCE_WRITTEN, Metadata_DEVICE_FIRMWARE_UPDATE, Metadata_DEVICE_CONFIG_UPDATE, Metadata_DEVICE_PROGRAM_UPLOAD, Metadata_DEVICE_PROGRAM_DOWNLOAD, Metadata_ANALYST_UPDATE_VERDICT, Metadata_ANALYST_UPDATE_REPUTATION, Metadata_ANALYST_UPDATE_SEVERITY_SCORE, Metadata_ANALYST_UPDATE_STATUS, Metadata_ANALYST_ADD_COMMENT, Metadata_ANALYST_UPDATE_PRIORITY, Metadata_ANALYST_UPDATE_ROOT_CAUSE, Metadata_ANALYST_UPDATE_REASON, Metadata_ANALYST_UPDATE_RISK_SCORE, Metadata_ENTITY_RISK_CHANGE, Metadata_TRIAGE_AGENT_UPDATE_INVESTIGATION
const (
// Default event type
Metadata_EVENTTYPE_UNSPECIFIED Metadata_EventType = 0
// Activity related to a process which does not match any other event types.
Metadata_PROCESS_UNCATEGORIZED Metadata_EventType = 10000
// Process launch.
Metadata_PROCESS_LAUNCH Metadata_EventType = 10001
// Process injecting into another process.
Metadata_PROCESS_INJECTION Metadata_EventType = 10002
// Process privilege escalation.
Metadata_PROCESS_PRIVILEGE_ESCALATION Metadata_EventType = 10003
// Process termination.
Metadata_PROCESS_TERMINATION Metadata_EventType = 10004
// Process being opened.
Metadata_PROCESS_OPEN Metadata_EventType = 10005
// Process loading a module.
Metadata_PROCESS_MODULE_LOAD Metadata_EventType = 10006
// Registry event which does not match any of the other event types.
Metadata_REGISTRY_UNCATEGORIZED Metadata_EventType = 11000
// Registry creation.
Metadata_REGISTRY_CREATION Metadata_EventType = 11001
// Registry modification.
Metadata_REGISTRY_MODIFICATION Metadata_EventType = 11002
// Registry deletion.
Metadata_REGISTRY_DELETION Metadata_EventType = 11003
// Settings-related event which does not match any of the other
// event types.
Metadata_SETTING_UNCATEGORIZED Metadata_EventType = 12000
// Setting creation.
Metadata_SETTING_CREATION Metadata_EventType = 12001
// Setting modification.
Metadata_SETTING_MODIFICATION Metadata_EventType = 12002
// Setting deletion.
Metadata_SETTING_DELETION Metadata_EventType = 12003
// Any mutex event other than creation.
Metadata_MUTEX_UNCATEGORIZED Metadata_EventType = 13000
// Mutex creation.
Metadata_MUTEX_CREATION Metadata_EventType = 13001
// File event which does not match any of the other event types.
Metadata_FILE_UNCATEGORIZED Metadata_EventType = 14000
// File created.
Metadata_FILE_CREATION Metadata_EventType = 14001
// File deleted.
Metadata_FILE_DELETION Metadata_EventType = 14002
// File modified.
Metadata_FILE_MODIFICATION Metadata_EventType = 14003
// File read.
Metadata_FILE_READ Metadata_EventType = 14004
// File copied.
// Used for file copies, for example, to a thumb drive.
Metadata_FILE_COPY Metadata_EventType = 14005
// File opened.
Metadata_FILE_OPEN Metadata_EventType = 14006
// File moved or renamed.
Metadata_FILE_MOVE Metadata_EventType = 14007
// File synced (for example, Google Drive, Dropbox, backup).
Metadata_FILE_SYNC Metadata_EventType = 14008
// User activity which does not match any of the other event types.
Metadata_USER_UNCATEGORIZED Metadata_EventType = 15000
// User login.
Metadata_USER_LOGIN Metadata_EventType = 15001
// User logout.
Metadata_USER_LOGOUT Metadata_EventType = 15002
// User creation.
Metadata_USER_CREATION Metadata_EventType = 15003
// User password change event.
Metadata_USER_CHANGE_PASSWORD Metadata_EventType = 15004
// Change in user permissions.
Metadata_USER_CHANGE_PERMISSIONS Metadata_EventType = 15005
// Deprecated. Used to update user info for an LDAP dump.
//
// Deprecated: Marked as deprecated in backstory/udm.proto.
Metadata_USER_STATS Metadata_EventType = 15006
// User physically badging into a location.
Metadata_USER_BADGE_IN Metadata_EventType = 15007
// User deletion.
Metadata_USER_DELETION Metadata_EventType = 15008
// User creating a virtual resource.
// This is equivalent to RESOURCE_CREATION.
Metadata_USER_RESOURCE_CREATION Metadata_EventType = 15009
// User updating content of a virtual resource.
// This is equivalent to RESOURCE_WRITTEN.
Metadata_USER_RESOURCE_UPDATE_CONTENT Metadata_EventType = 15010
// User updating permissions of a virtual resource.
// This is equivalent to RESOURCE_PERMISSIONS_CHANGE.
Metadata_USER_RESOURCE_UPDATE_PERMISSIONS Metadata_EventType = 15011
// User initiating communication through a medium (for example, video).
Metadata_USER_COMMUNICATION Metadata_EventType = 15012
// User accessing a virtual resource.
// This is equivalent to RESOURCE_READ.
Metadata_USER_RESOURCE_ACCESS Metadata_EventType = 15013
// User deleting a virtual resource.
// This is equivalent to RESOURCE_DELETION.
Metadata_USER_RESOURCE_DELETION Metadata_EventType = 15014
// A group activity that does not fall into one of the other event types.
Metadata_GROUP_UNCATEGORIZED Metadata_EventType = 23000
// A group creation.
Metadata_GROUP_CREATION Metadata_EventType = 23001
// A group deletion.
Metadata_GROUP_DELETION Metadata_EventType = 23002
// A group modification.
Metadata_GROUP_MODIFICATION Metadata_EventType = 23003
// Email messages
Metadata_EMAIL_UNCATEGORIZED Metadata_EventType = 19000
// An email transaction.
Metadata_EMAIL_TRANSACTION Metadata_EventType = 19001
// Deprecated: use NETWORK_HTTP instead. An email URL click event.
//
// Deprecated: Marked as deprecated in backstory/udm.proto.
Metadata_EMAIL_URL_CLICK Metadata_EventType = 19002
// A network event that does not fit into one of the other event types.
Metadata_NETWORK_UNCATEGORIZED Metadata_EventType = 16000
// Aggregated flow stats like netflow.
Metadata_NETWORK_FLOW Metadata_EventType = 16001
// Network connection details like from a FW.
Metadata_NETWORK_CONNECTION Metadata_EventType = 16002
// FTP telemetry.
Metadata_NETWORK_FTP Metadata_EventType = 16003
// DHCP payload.
Metadata_NETWORK_DHCP Metadata_EventType = 16004
// DNS payload.
Metadata_NETWORK_DNS Metadata_EventType = 16005
// HTTP telemetry.
Metadata_NETWORK_HTTP Metadata_EventType = 16006
// SMTP telemetry.
Metadata_NETWORK_SMTP Metadata_EventType = 16007
// A status message that does not fit into one of the other event types.
Metadata_STATUS_UNCATEGORIZED Metadata_EventType = 17000
// Heartbeat indicating product is alive.
Metadata_STATUS_HEARTBEAT Metadata_EventType = 17001
// An agent startup.
Metadata_STATUS_STARTUP Metadata_EventType = 17002
// An agent shutdown.
Metadata_STATUS_SHUTDOWN Metadata_EventType = 17003
// A software or fingerprint update.
Metadata_STATUS_UPDATE Metadata_EventType = 17004
// Scan item that does not fit into one of the other event types.
Metadata_SCAN_UNCATEGORIZED Metadata_EventType = 18000
// A file scan.
Metadata_SCAN_FILE Metadata_EventType = 18001
// Scan process behaviors.
// Please use SCAN_PROCESS instead.
//
// Deprecated: Marked as deprecated in backstory/udm.proto.
Metadata_SCAN_PROCESS_BEHAVIORS Metadata_EventType = 18002
// Scan process.
Metadata_SCAN_PROCESS Metadata_EventType = 18003
// Scan results from scanning an entire host device for threats/sensitive
// documents.
Metadata_SCAN_HOST Metadata_EventType = 18004
// Vulnerability scan logs about host vulnerabilities (e.g., out of date
// software) and network vulnerabilities (e.g., unprotected service detected
// via a network scan).
Metadata_SCAN_VULN_HOST Metadata_EventType = 18005
// Vulnerability scan logs about network vulnerabilities.
Metadata_SCAN_VULN_NETWORK Metadata_EventType = 18006
// Scan network for suspicious activity
Metadata_SCAN_NETWORK Metadata_EventType = 18007
// Scheduled task event that does not fall into one of the other
// event types.
Metadata_SCHEDULED_TASK_UNCATEGORIZED Metadata_EventType = 20000
// Scheduled task creation.
Metadata_SCHEDULED_TASK_CREATION Metadata_EventType = 20001
// Scheduled task deletion.
Metadata_SCHEDULED_TASK_DELETION Metadata_EventType = 20002
// Scheduled task being enabled.
Metadata_SCHEDULED_TASK_ENABLE Metadata_EventType = 20003
// Scheduled task being disabled.
Metadata_SCHEDULED_TASK_DISABLE Metadata_EventType = 20004
// Scheduled task being modified.
Metadata_SCHEDULED_TASK_MODIFICATION Metadata_EventType = 20005
// A system audit log event that is not a wipe.
Metadata_SYSTEM_AUDIT_LOG_UNCATEGORIZED Metadata_EventType = 21000
// A system audit log wipe.
Metadata_SYSTEM_AUDIT_LOG_WIPE Metadata_EventType = 21001
// Service event that does not fit into one of the other event types.
Metadata_SERVICE_UNSPECIFIED Metadata_EventType = 22000
// A service creation.
Metadata_SERVICE_CREATION Metadata_EventType = 22001
// A service deletion.
Metadata_SERVICE_DELETION Metadata_EventType = 22002
// A service start.
Metadata_SERVICE_START Metadata_EventType = 22003
// A service stop.
Metadata_SERVICE_STOP Metadata_EventType = 22004
// A service modification.
Metadata_SERVICE_MODIFICATION Metadata_EventType = 22005
// Operating system events that are not described by any of the other
// event types. Might include uncategorized Microsoft Windows event logs.
Metadata_GENERIC_EVENT Metadata_EventType = 100000
// The resource was created/provisioned.
// This is equivalent to USER_RESOURCE_CREATION.
Metadata_RESOURCE_CREATION Metadata_EventType = 1
// The resource was deleted/deprovisioned.
// This is equivalent to USER_RESOURCE_DELETION.
Metadata_RESOURCE_DELETION Metadata_EventType = 2
// The resource had it's permissions or ACLs updated.
// This is equivalent to USER_RESOURCE_UPDATE_PERMISSIONS.
Metadata_RESOURCE_PERMISSIONS_CHANGE Metadata_EventType = 3
// The resource was read.
// This is equivalent to USER_RESOURCE_ACCESS.
Metadata_RESOURCE_READ Metadata_EventType = 4
// The resource was written to.
// This is equivalent to USER_RESOURCE_UPDATE_CONTENT.
Metadata_RESOURCE_WRITTEN Metadata_EventType = 5
// Firmware update.
Metadata_DEVICE_FIRMWARE_UPDATE Metadata_EventType = 25000
// Configuration update.
Metadata_DEVICE_CONFIG_UPDATE Metadata_EventType = 25001
// A program or application uploaded to a device.
Metadata_DEVICE_PROGRAM_UPLOAD Metadata_EventType = 25002
// A program or application downloaded to a device.
Metadata_DEVICE_PROGRAM_DOWNLOAD Metadata_EventType = 25003
// Analyst update about the Verdict (such as true positive, false positive,
// or disregard) of a finding.
Metadata_ANALYST_UPDATE_VERDICT Metadata_EventType = 24000
// Analyst update about the Reputation (such as useful or not useful) of a
// finding.
Metadata_ANALYST_UPDATE_REPUTATION Metadata_EventType = 24001
// Analyst update about the Severity score (0-100) of a finding.
Metadata_ANALYST_UPDATE_SEVERITY_SCORE Metadata_EventType = 24002
// Analyst update about the finding status.
Metadata_ANALYST_UPDATE_STATUS Metadata_EventType = 24007
// Analyst addition of a comment for a finding.
Metadata_ANALYST_ADD_COMMENT Metadata_EventType = 24008
// Analyst update about the priority (such as low, medium, or high) for a
// finding.
Metadata_ANALYST_UPDATE_PRIORITY Metadata_EventType = 24009
// Analyst update about the root cause for a finding.
Metadata_ANALYST_UPDATE_ROOT_CAUSE Metadata_EventType = 24010
// Analyst update about the reason (such as malicious or not malicious) for
// a finding.
Metadata_ANALYST_UPDATE_REASON Metadata_EventType = 24011
// Analyst update about the risk score (0-100) of a finding.
Metadata_ANALYST_UPDATE_RISK_SCORE Metadata_EventType = 24012
// An update to an entity risk score. This event type is restricted to
// events published by Google Securit Operations Risk Analytics.
Metadata_ENTITY_RISK_CHANGE Metadata_EventType = 26000
// Triage Agent has investigated the finding.
Metadata_TRIAGE_AGENT_UPDATE_INVESTIGATION Metadata_EventType = 27000
)func (Metadata_EventType) Descriptor
func (Metadata_EventType) Descriptor() protoreflect.EnumDescriptorfunc (Metadata_EventType) Enum
func (x Metadata_EventType) Enum() *Metadata_EventTypefunc (Metadata_EventType) EnumDescriptor
func (Metadata_EventType) EnumDescriptor() ([]byte, []int)Deprecated: Use Metadata_EventType.Descriptor instead.
func (Metadata_EventType) Number
func (x Metadata_EventType) Number() protoreflect.EnumNumberfunc (Metadata_EventType) String
func (x Metadata_EventType) String() stringfunc (Metadata_EventType) Type
func (Metadata_EventType) Type() protoreflect.EnumTypeMetric
type Metric struct {
// Timestamp of the first time the entity was seen in the environment.
FirstSeen *timestamppb.Timestamp `protobuf:"bytes,1,opt,name=first_seen,json=firstSeen,proto3" json:"first_seen,omitempty"`
// Time stamp of the last time last time the entity was seen in the
// environment.
LastSeen *timestamppb.Timestamp `protobuf:"bytes,2,opt,name=last_seen,json=lastSeen,proto3" json:"last_seen,omitempty"`
// Sum of all precomputed measures for the given metric.
SumMeasure *Metric_Measure `protobuf:"bytes,3,opt,name=sum_measure,json=sumMeasure,proto3" json:"sum_measure,omitempty"`
// Total number of events used to calculate the given precomputed metric.
TotalEvents int64 `protobuf:"varint,4,opt,name=total_events,json=totalEvents,proto3" json:"total_events,omitempty"`
// Name of the analytic.
MetricName Metric_MetricName `protobuf:"varint,5,opt,name=metric_name,json=metricName,proto3,enum=google.backstory.Metric_MetricName" json:"metric_name,omitempty"`
// All group by clauses used to calculate the metric.
Dimensions []Metric_Dimension `protobuf:"varint,6,rep,packed,name=dimensions,proto3,enum=google.backstory.Metric_Dimension" json:"dimensions,omitempty"`
// Export window for which the metric was exported.
ExportWindow int64 `protobuf:"varint,7,opt,name=export_window,json=exportWindow,proto3" json:"export_window,omitempty"`
// Display name of the custom metric. Google-authored metrics do not have a
// display name.
DisplayName string `protobuf:"bytes,8,opt,name=display_name,json=displayName,proto3" json:"display_name,omitempty"`
// List of outcome variables used in the custom metric.
OutcomeVariables []*FindingVariable `protobuf:"bytes,9,rep,name=outcome_variables,json=outcomeVariables,proto3" json:"outcome_variables,omitempty"`
// List of match variables used in the custom metric.
MatchVariables []*FindingVariable `protobuf:"bytes,10,rep,name=match_variables,json=matchVariables,proto3" json:"match_variables,omitempty"`
// Time range for which the custom metric was calculated.
TimeRange *interval.Interval `protobuf:"bytes,11,opt,name=time_range,json=timeRange,proto3" json:"time_range,omitempty"`
// contains filtered or unexported fields
}Stores precomputed aggregated analytic data for an entity.
func (*Metric) Descriptor
Deprecated: Use Metric.ProtoReflect.Descriptor instead.
func (*Metric) GetDimensions
func (x *Metric) GetDimensions() []Metric_Dimensionfunc (*Metric) GetDisplayName
func (*Metric) GetExportWindow
func (*Metric) GetFirstSeen
func (x *Metric) GetFirstSeen() *timestamppb.Timestampfunc (*Metric) GetLastSeen
func (x *Metric) GetLastSeen() *timestamppb.Timestampfunc (*Metric) GetMatchVariables
func (x *Metric) GetMatchVariables() []*FindingVariablefunc (*Metric) GetMetricName
func (x *Metric) GetMetricName() Metric_MetricNamefunc (*Metric) GetOutcomeVariables
func (x *Metric) GetOutcomeVariables() []*FindingVariablefunc (*Metric) GetSumMeasure
func (x *Metric) GetSumMeasure() *Metric_Measurefunc (*Metric) GetTimeRange
func (*Metric) GetTotalEvents
func (*Metric) ProtoMessage
func (*Metric) ProtoMessage()func (*Metric) ProtoReflect
func (x *Metric) ProtoReflect() protoreflect.Messagefunc (*Metric) Reset
func (x *Metric) Reset()func (*Metric) String
Metric_AggregateFunction
type Metric_AggregateFunction int32Mathematic function used to calculate the value.
Metric_AGGREGATE_FUNCTION_UNSPECIFIED, Metric_MIN, Metric_MAX, Metric_COUNT, Metric_SUM, Metric_AVG, Metric_STDDEV
const (
// Default value.
Metric_AGGREGATE_FUNCTION_UNSPECIFIED Metric_AggregateFunction = 0
// Minimum.
Metric_MIN Metric_AggregateFunction = 1
// Maximum.
Metric_MAX Metric_AggregateFunction = 2
// Count.
Metric_COUNT Metric_AggregateFunction = 3
// Sum.
Metric_SUM Metric_AggregateFunction = 4
// Average.
Metric_AVG Metric_AggregateFunction = 5
// Standard Deviation.
Metric_STDDEV Metric_AggregateFunction = 6
)func (Metric_AggregateFunction) Descriptor
func (Metric_AggregateFunction) Descriptor() protoreflect.EnumDescriptorfunc (Metric_AggregateFunction) Enum
func (x Metric_AggregateFunction) Enum() *Metric_AggregateFunctionfunc (Metric_AggregateFunction) EnumDescriptor
func (Metric_AggregateFunction) EnumDescriptor() ([]byte, []int)Deprecated: Use Metric_AggregateFunction.Descriptor instead.
func (Metric_AggregateFunction) Number
func (x Metric_AggregateFunction) Number() protoreflect.EnumNumberfunc (Metric_AggregateFunction) String
func (x Metric_AggregateFunction) String() stringfunc (Metric_AggregateFunction) Type
func (Metric_AggregateFunction) Type() protoreflect.EnumTypeMetric_Dimension
type Metric_Dimension int32Describes field used as the dimension when grouping data to calculate the aggregate metric.
Metric_DIMENSION_UNSPECIFIED, Metric_PRINCIPAL_DEVICE, Metric_TARGET_USER, Metric_TARGET_DEVICE, Metric_PRINCIPAL_USER, Metric_TARGET_IP, Metric_PRINCIPAL_FILE_HASH, Metric_PRINCIPAL_COUNTRY, Metric_SECURITY_CATEGORY, Metric_NETWORK_ASN, Metric_CLIENT_CERTIFICATE_HASH, Metric_DNS_QUERY_TYPE, Metric_DNS_DOMAIN, Metric_HTTP_USER_AGENT, Metric_EVENT_TYPE, Metric_PRODUCT_NAME, Metric_PRODUCT_EVENT_TYPE, Metric_PARENT_FOLDER_PATH, Metric_TARGET_RESOURCE_NAME, Metric_PRINCIPAL_APPLICATION, Metric_TARGET_APPLICATION, Metric_EMAIL_TO_ADDRESS, Metric_EMAIL_FROM_ADDRESS, Metric_MAIL_ID, Metric_PRINCIPAL_IP, Metric_SECURITY_ACTION, Metric_SECURITY_RULE_ID, Metric_TARGET_NETWORK_ORGANIZATION_NAME, Metric_PRINCIPAL_NETWORK_ORGANIZATION_NAME, Metric_PRINCIPAL_PROCESS_FILE_PATH, Metric_PRINCIPAL_PROCESS_FILE_HASH, Metric_SECURITY_RESULT_RULE_NAME, Metric_TARGET_RESOURCE_LABEL_KEY, Metric_VENDOR_NAME, Metric_TARGET_RESOURCE_TYPE, Metric_TARGET_LOCATION_NAME, Metric_LOG_TYPE, Metric_TARGET_HOSTNAME
const (
// Default
Metric_DIMENSION_UNSPECIFIED Metric_Dimension = 0
// Principal Device
Metric_PRINCIPAL_DEVICE Metric_Dimension = 1
// Target User
Metric_TARGET_USER Metric_Dimension = 2
// Target Device
Metric_TARGET_DEVICE Metric_Dimension = 3
// Principal User
Metric_PRINCIPAL_USER Metric_Dimension = 4
// Target IP
Metric_TARGET_IP Metric_Dimension = 5
// Principal File Hash
Metric_PRINCIPAL_FILE_HASH Metric_Dimension = 6
// Principal Country
Metric_PRINCIPAL_COUNTRY Metric_Dimension = 7
// Security Category
Metric_SECURITY_CATEGORY Metric_Dimension = 8
// Network ASN
Metric_NETWORK_ASN Metric_Dimension = 9
// Client Certificate Hash
Metric_CLIENT_CERTIFICATE_HASH Metric_Dimension = 10
// DNS Query Type
Metric_DNS_QUERY_TYPE Metric_Dimension = 11
// DNS Domain
Metric_DNS_DOMAIN Metric_Dimension = 12
// HTTP User Agent
Metric_HTTP_USER_AGENT Metric_Dimension = 13
// Event Type
Metric_EVENT_TYPE Metric_Dimension = 14
// Product Name
Metric_PRODUCT_NAME Metric_Dimension = 15
// Product Event Type
Metric_PRODUCT_EVENT_TYPE Metric_Dimension = 16
// Parent Folder Path
Metric_PARENT_FOLDER_PATH Metric_Dimension = 17
// Target resource Name
Metric_TARGET_RESOURCE_NAME Metric_Dimension = 18
// Principal Application.
Metric_PRINCIPAL_APPLICATION Metric_Dimension = 19
// Target Application.
Metric_TARGET_APPLICATION Metric_Dimension = 20
// Email To Address.
Metric_EMAIL_TO_ADDRESS Metric_Dimension = 21
// Email From Address.
Metric_EMAIL_FROM_ADDRESS Metric_Dimension = 22
// Mail Id.
Metric_MAIL_ID Metric_Dimension = 23
// Principal IP.
Metric_PRINCIPAL_IP Metric_Dimension = 24
// Security Action.
Metric_SECURITY_ACTION Metric_Dimension = 25
// Security Rule Id.
Metric_SECURITY_RULE_ID Metric_Dimension = 28
// Target Network Organization name.
Metric_TARGET_NETWORK_ORGANIZATION_NAME Metric_Dimension = 29
// Principal Network Organization name.
Metric_PRINCIPAL_NETWORK_ORGANIZATION_NAME Metric_Dimension = 30
// Principal Process File Path.
Metric_PRINCIPAL_PROCESS_FILE_PATH Metric_Dimension = 31
// Principal Process File SHA256 Hash.
Metric_PRINCIPAL_PROCESS_FILE_HASH Metric_Dimension = 32
// Security Result rule name.
Metric_SECURITY_RESULT_RULE_NAME Metric_Dimension = 33
// Target Resource label key.
Metric_TARGET_RESOURCE_LABEL_KEY Metric_Dimension = 34
// Vendor name.
Metric_VENDOR_NAME Metric_Dimension = 35
// Target Resource type.
Metric_TARGET_RESOURCE_TYPE Metric_Dimension = 36
// Target Location name.
Metric_TARGET_LOCATION_NAME Metric_Dimension = 37
// Log type.
Metric_LOG_TYPE Metric_Dimension = 38
// Target Hostname.
Metric_TARGET_HOSTNAME Metric_Dimension = 39
)func (Metric_Dimension) Descriptor
func (Metric_Dimension) Descriptor() protoreflect.EnumDescriptorfunc (Metric_Dimension) Enum
func (x Metric_Dimension) Enum() *Metric_Dimensionfunc (Metric_Dimension) EnumDescriptor
func (Metric_Dimension) EnumDescriptor() ([]byte, []int)Deprecated: Use Metric_Dimension.Descriptor instead.
func (Metric_Dimension) Number
func (x Metric_Dimension) Number() protoreflect.EnumNumberfunc (Metric_Dimension) String
func (x Metric_Dimension) String() stringfunc (Metric_Dimension) Type
func (Metric_Dimension) Type() protoreflect.EnumTypeMetric_Measure
type Metric_Measure struct {
// Value of the aggregated measure.
Value float64 `protobuf:"fixed64,1,opt,name=value,proto3" json:"value,omitempty"`
// Function used to calculate the aggregated measure.
AggregateFunction Metric_AggregateFunction `protobuf:"varint,2,opt,name=aggregate_function,json=aggregateFunction,proto3,enum=google.backstory.Metric_AggregateFunction" json:"aggregate_function,omitempty"`
// contains filtered or unexported fields
}Describes the precomputed measure.
func (*Metric_Measure) Descriptor
func (*Metric_Measure) Descriptor() ([]byte, []int)Deprecated: Use Metric_Measure.ProtoReflect.Descriptor instead.
func (*Metric_Measure) GetAggregateFunction
func (x *Metric_Measure) GetAggregateFunction() Metric_AggregateFunctionfunc (*Metric_Measure) GetValue
func (x *Metric_Measure) GetValue() float64func (*Metric_Measure) ProtoMessage
func (*Metric_Measure) ProtoMessage()func (*Metric_Measure) ProtoReflect
func (x *Metric_Measure) ProtoReflect() protoreflect.Messagefunc (*Metric_Measure) Reset
func (x *Metric_Measure) Reset()func (*Metric_Measure) String
func (x *Metric_Measure) String() stringMetric_MetricName
type Metric_MetricName int32The name of the precomputed analytic.
Metric_METRIC_NAME_UNSPECIFIED, Metric_NETWORK_BYTES_INBOUND, Metric_NETWORK_BYTES_OUTBOUND, Metric_NETWORK_BYTES_TOTAL, Metric_AUTH_ATTEMPTS_SUCCESS, Metric_AUTH_ATTEMPTS_FAIL, Metric_AUTH_ATTEMPTS_TOTAL, Metric_DNS_BYTES_OUTBOUND, Metric_NETWORK_FLOWS_INBOUND, Metric_NETWORK_FLOWS_OUTBOUND, Metric_NETWORK_FLOWS_TOTAL, Metric_DNS_QUERIES_SUCCESS, Metric_DNS_QUERIES_FAIL, Metric_DNS_QUERIES_TOTAL, Metric_FILE_EXECUTIONS_SUCCESS, Metric_FILE_EXECUTIONS_FAIL, Metric_FILE_EXECUTIONS_TOTAL, Metric_HTTP_QUERIES_SUCCESS, Metric_HTTP_QUERIES_FAIL, Metric_HTTP_QUERIES_TOTAL, Metric_WORKSPACE_EMAILS_SENT_TOTAL, Metric_WORKSPACE_TOTAL_DOWNLOAD_ACTIONS, Metric_WORKSPACE_TOTAL_CHANGE_ACTIONS, Metric_WORKSPACE_AUTH_ATTEMPTS_TOTAL, Metric_WORKSPACE_NETWORK_BYTES_OUTBOUND, Metric_WORKSPACE_NETWORK_BYTES_TOTAL, Metric_ALERT_EVENT_NAME_COUNT, Metric_RESOURCE_CREATION_TOTAL, Metric_RESOURCE_CREATION_SUCCESS, Metric_RESOURCE_READ_SUCCESS, Metric_RESOURCE_READ_FAIL, Metric_RESOURCE_DELETION_SUCCESS, Metric_RESOURCE_CREATION_FAIL, Metric_RESOURCE_DELETION_FAIL, Metric_RESOURCE_DELETION_TOTAL, Metric_RESOURCE_READ_TOTAL, Metric_RESOURCE_WRITTEN_FAIL, Metric_RESOURCE_WRITTEN_SUCCESS, Metric_RESOURCE_WRITTEN_TOTAL, Metric_UDM_DATA_PRESENCE_SUMMARY
const (
// Default
Metric_METRIC_NAME_UNSPECIFIED Metric_MetricName = 0
// Total received network bytes.
Metric_NETWORK_BYTES_INBOUND Metric_MetricName = 1
// Total network sent bytes.
Metric_NETWORK_BYTES_OUTBOUND Metric_MetricName = 2
// Total network sent bytes and received bytes.
Metric_NETWORK_BYTES_TOTAL Metric_MetricName = 3
// Successful authentication attempts.
Metric_AUTH_ATTEMPTS_SUCCESS Metric_MetricName = 4
// Failed authentication attempts.
Metric_AUTH_ATTEMPTS_FAIL Metric_MetricName = 5
// Total authentication attempts.
Metric_AUTH_ATTEMPTS_TOTAL Metric_MetricName = 6
// Total number of sent bytes for DNS events.
Metric_DNS_BYTES_OUTBOUND Metric_MetricName = 7
// Total number of events having non-null received bytes.
Metric_NETWORK_FLOWS_INBOUND Metric_MetricName = 8
// Total number of events having non-null sent bytes.
Metric_NETWORK_FLOWS_OUTBOUND Metric_MetricName = 9
// Total events having non-null sent or received bytes.
Metric_NETWORK_FLOWS_TOTAL Metric_MetricName = 10
// DNS query success count - Number of events with response_code = 0.
Metric_DNS_QUERIES_SUCCESS Metric_MetricName = 11
// Number of events with response_code != 0.
Metric_DNS_QUERIES_FAIL Metric_MetricName = 12
// Total number of DNS queries made.
Metric_DNS_QUERIES_TOTAL Metric_MetricName = 13
// Number of successfule file executions.
Metric_FILE_EXECUTIONS_SUCCESS Metric_MetricName = 14
// Number of failed file executions.
Metric_FILE_EXECUTIONS_FAIL Metric_MetricName = 15
// Total number file executions.
Metric_FILE_EXECUTIONS_TOTAL Metric_MetricName = 16
// Number of successful HTTP queries.
Metric_HTTP_QUERIES_SUCCESS Metric_MetricName = 17
// Number of failed HTTP queries.
Metric_HTTP_QUERIES_FAIL Metric_MetricName = 18
// Total number of HTTP queries.
Metric_HTTP_QUERIES_TOTAL Metric_MetricName = 19
// Total number of emails sent in Google Workspace.
Metric_WORKSPACE_EMAILS_SENT_TOTAL Metric_MetricName = 20
// Total number of download actions in Google Workspace.
Metric_WORKSPACE_TOTAL_DOWNLOAD_ACTIONS Metric_MetricName = 21
// Total number of change actions in Google Workspace.
Metric_WORKSPACE_TOTAL_CHANGE_ACTIONS Metric_MetricName = 22
// Total number of authentication attempts in Google Workspace.
Metric_WORKSPACE_AUTH_ATTEMPTS_TOTAL Metric_MetricName = 23
// Number of outbound network bytes (total sent) in Google Workspace.
Metric_WORKSPACE_NETWORK_BYTES_OUTBOUND Metric_MetricName = 24
// Total number of network bytes (both sent and received) in Google
// Workspace.
Metric_WORKSPACE_NETWORK_BYTES_TOTAL Metric_MetricName = 25
// Track number of alerts fired by EDR/SENTINEL/MICROSOFT_GRAPH.
Metric_ALERT_EVENT_NAME_COUNT Metric_MetricName = 26
// Analytic tracking successful resource creations.
Metric_RESOURCE_CREATION_TOTAL Metric_MetricName = 27
// Analytic tracking successful resource creations.
Metric_RESOURCE_CREATION_SUCCESS Metric_MetricName = 28
// Analytic tracking successful resource reads.
Metric_RESOURCE_READ_SUCCESS Metric_MetricName = 29
// Analytic tracking failed resource reads.
Metric_RESOURCE_READ_FAIL Metric_MetricName = 30
// Analytic tracking successful resource deletions.
Metric_RESOURCE_DELETION_SUCCESS Metric_MetricName = 31
// Analytic tracking failed resource creations.
Metric_RESOURCE_CREATION_FAIL Metric_MetricName = 32
// Analytic tracking failed resource deletions.
Metric_RESOURCE_DELETION_FAIL Metric_MetricName = 33
// Analytic tracking total resource deletions.
Metric_RESOURCE_DELETION_TOTAL Metric_MetricName = 34
// Analytic tracking total resource reads.
Metric_RESOURCE_READ_TOTAL Metric_MetricName = 35
// Analytic tracking failed resource writes.
Metric_RESOURCE_WRITTEN_FAIL Metric_MetricName = 36
// Analytic tracking successful resource writes.
Metric_RESOURCE_WRITTEN_SUCCESS Metric_MetricName = 37
// Analytic tracking total resource writes.
Metric_RESOURCE_WRITTEN_TOTAL Metric_MetricName = 38
// UDM data summary tracking unique values of dimensions.
Metric_UDM_DATA_PRESENCE_SUMMARY Metric_MetricName = 39
)func (Metric_MetricName) Descriptor
func (Metric_MetricName) Descriptor() protoreflect.EnumDescriptorfunc (Metric_MetricName) Enum
func (x Metric_MetricName) Enum() *Metric_MetricNamefunc (Metric_MetricName) EnumDescriptor
func (Metric_MetricName) EnumDescriptor() ([]byte, []int)Deprecated: Use Metric_MetricName.Descriptor instead.
func (Metric_MetricName) Number
func (x Metric_MetricName) Number() protoreflect.EnumNumberfunc (Metric_MetricName) String
func (x Metric_MetricName) String() stringfunc (Metric_MetricName) Type
func (Metric_MetricName) Type() protoreflect.EnumTypeNetwork
type Network struct {
// The number of bytes sent.
SentBytes uint64 `protobuf:"varint,1,opt,name=sent_bytes,json=sentBytes,proto3" json:"sent_bytes,omitempty"`
// The number of bytes received.
ReceivedBytes uint64 `protobuf:"varint,2,opt,name=received_bytes,json=receivedBytes,proto3" json:"received_bytes,omitempty"`
// The number of total bytes.
TotalBytes int64 `protobuf:"varint,27,opt,name=total_bytes,json=totalBytes,proto3" json:"total_bytes,omitempty"`
// The number of packets sent.
SentPackets int64 `protobuf:"varint,22,opt,name=sent_packets,json=sentPackets,proto3" json:"sent_packets,omitempty"`
// The number of packets received.
ReceivedPackets int64 `protobuf:"varint,23,opt,name=received_packets,json=receivedPackets,proto3" json:"received_packets,omitempty"`
// The duration of the session as the number of seconds and nanoseconds.
// For seconds, network.session_duration.seconds, the type is a 64-bit
// integer. For nanoseconds, network.session_duration.nanos, the type is a
// 32-bit integer.
SessionDuration *durationpb.Duration `protobuf:"bytes,13,opt,name=session_duration,json=sessionDuration,proto3" json:"session_duration,omitempty"`
// The ID of the network session.
SessionId string `protobuf:"bytes,14,opt,name=session_id,json=sessionId,proto3" json:"session_id,omitempty"`
// The ID of the parent network session.
ParentSessionId string `protobuf:"bytes,20,opt,name=parent_session_id,json=parentSessionId,proto3" json:"parent_session_id,omitempty"`
// The version of the application protocol. e.g. "1.1, 2.0"
ApplicationProtocolVersion string `protobuf:"bytes,21,opt,name=application_protocol_version,json=applicationProtocolVersion,proto3" json:"application_protocol_version,omitempty"`
// Community ID network flow value.
CommunityId string `protobuf:"bytes,15,opt,name=community_id,json=communityId,proto3" json:"community_id,omitempty"`
// The direction of network traffic.
Direction Network_Direction `protobuf:"varint,12,opt,name=direction,proto3,enum=google.backstory.Network_Direction" json:"direction,omitempty"`
// The IP protocol.
IpProtocol Network_IpProtocol `protobuf:"varint,3,opt,name=ip_protocol,json=ipProtocol,proto3,enum=google.backstory.Network_IpProtocol" json:"ip_protocol,omitempty"`
// True if IPv6 is used.
Ipv6 bool `protobuf:"varint,29,opt,name=ipv6,proto3" json:"ipv6,omitempty"`
// The application protocol.
ApplicationProtocol Network_ApplicationProtocol `protobuf:"varint,4,opt,name=application_protocol,json=applicationProtocol,proto3,enum=google.backstory.Network_ApplicationProtocol" json:"application_protocol,omitempty"`
// FTP info.
Ftp *Ftp `protobuf:"bytes,5,opt,name=ftp,proto3" json:"ftp,omitempty"`
// Email info for the sender/recipient.
Email *Email `protobuf:"bytes,6,opt,name=email,proto3" json:"email,omitempty"`
// DNS info.
Dns *Dns `protobuf:"bytes,7,opt,name=dns,proto3" json:"dns,omitempty"`
// DHCP info.
Dhcp *Dhcp `protobuf:"bytes,8,opt,name=dhcp,proto3" json:"dhcp,omitempty"`
// HTTP info.
Http *Http `protobuf:"bytes,9,opt,name=http,proto3" json:"http,omitempty"`
// TLS info.
Tls *Tls `protobuf:"bytes,10,opt,name=tls,proto3" json:"tls,omitempty"`
// SMTP info.
// Store fields specific to SMTP not covered by Email.
Smtp *Smtp `protobuf:"bytes,11,opt,name=smtp,proto3" json:"smtp,omitempty"`
// Autonomous system number.
Asn string `protobuf:"bytes,16,opt,name=asn,proto3" json:"asn,omitempty"`
// DNS domain name.
DnsDomain string `protobuf:"bytes,17,opt,name=dns_domain,json=dnsDomain,proto3" json:"dns_domain,omitempty"`
// Carrier identification.
CarrierName string `protobuf:"bytes,18,opt,name=carrier_name,json=carrierName,proto3" json:"carrier_name,omitempty"`
// Organization name (e.g Google).
OrganizationName string `protobuf:"bytes,19,opt,name=organization_name,json=organizationName,proto3" json:"organization_name,omitempty"`
// Associated human-readable IP subnet range (e.g. 10.1.2.0/24).
IpSubnetRange string `protobuf:"bytes,24,opt,name=ip_subnet_range,json=ipSubnetRange,proto3" json:"ip_subnet_range,omitempty"`
// Whether the IP address is a known proxy.
IsProxy bool `protobuf:"varint,25,opt,name=is_proxy,json=isProxy,proto3" json:"is_proxy,omitempty"`
// Proxy information. Only set if is_proxy is true.
ProxyInfo *ProxyInfo `protobuf:"bytes,26,opt,name=proxy_info,json=proxyInfo,proto3" json:"proxy_info,omitempty"`
// The state of the network connection.
ConnectionState Network_ConnectionState `protobuf:"varint,28,opt,name=connection_state,json=connectionState,proto3,enum=google.backstory.Network_ConnectionState" json:"connection_state,omitempty"`
// contains filtered or unexported fields
}A network event.
func (*Network) Descriptor
Deprecated: Use Network.ProtoReflect.Descriptor instead.
func (*Network) GetApplicationProtocol
func (x *Network) GetApplicationProtocol() Network_ApplicationProtocolfunc (*Network) GetApplicationProtocolVersion
func (*Network) GetAsn
func (*Network) GetCarrierName
func (*Network) GetCommunityId
func (*Network) GetConnectionState
func (x *Network) GetConnectionState() Network_ConnectionStatefunc (*Network) GetDhcp
func (*Network) GetDirection
func (x *Network) GetDirection() Network_Directionfunc (*Network) GetDns
func (*Network) GetDnsDomain
func (*Network) GetEmail
func (*Network) GetFtp
func (*Network) GetHttp
func (*Network) GetIpProtocol
func (x *Network) GetIpProtocol() Network_IpProtocolfunc (*Network) GetIpSubnetRange
func (*Network) GetIpv6
func (*Network) GetIsProxy
func (*Network) GetOrganizationName
func (*Network) GetParentSessionId
func (*Network) GetProxyInfo
func (*Network) GetReceivedBytes
func (*Network) GetReceivedPackets
func (*Network) GetSentBytes
func (*Network) GetSentPackets
func (*Network) GetSessionDuration
func (x *Network) GetSessionDuration() *durationpb.Durationfunc (*Network) GetSessionId
func (*Network) GetSmtp
func (*Network) GetTls
func (*Network) GetTotalBytes
func (*Network) ProtoMessage
func (*Network) ProtoMessage()func (*Network) ProtoReflect
func (x *Network) ProtoReflect() protoreflect.Messagefunc (*Network) Reset
func (x *Network) Reset()func (*Network) String
Network_ApplicationProtocol
type Network_ApplicationProtocol int32A network application protocol.
Network_UNKNOWN_APPLICATION_PROTOCOL, Network_AFP, Network_APPC, Network_AMQP, Network_ATOM, Network_BEEP, Network_BITCOIN, Network_BIT_TORRENT, Network_CFDP, Network_CIP, Network_COAP, Network_COTP, Network_DCERPC, Network_DDS, Network_DEVICE_NET, Network_DHCP, Network_DICOM, Network_DNP3, Network_DNS, Network_E_DONKEY, Network_ENRP, Network_FAST_TRACK, Network_FINGER, Network_FREENET, Network_FTAM, Network_GOOSE, Network_GOPHER, Network_GRPC, Network_HL7, Network_H323, Network_HTTP, Network_HTTPS, Network_IEC104, Network_IRCP, Network_KADEMLIA, Network_KRB5, Network_LDAP, Network_LPD, Network_MIME, Network_MMS, Network_MODBUS, Network_MQTT, Network_NETCONF, Network_NFS, Network_NIS, Network_NNTP, Network_NTCIP, Network_NTP, Network_OSCAR, Network_PNRP, Network_PTP, Network_QUIC, Network_RDP, Network_RELP, Network_RIP, Network_RLOGIN, Network_RPC, Network_RTMP, Network_RTP, Network_RTPS, Network_RTSP, Network_SAP, Network_SDP, Network_SIP, Network_SLP, Network_SMB, Network_SMTP, Network_SNMP, Network_SNTP, Network_SSH, Network_SSMS, Network_STYX, Network_SV, Network_TCAP, Network_TDS, Network_TOR, Network_TSP, Network_VTP, Network_WHOIS, Network_WEB_DAV, Network_X400, Network_X500, Network_XMPP, Network_FTP
const (
// The default application protocol.
Network_UNKNOWN_APPLICATION_PROTOCOL Network_ApplicationProtocol = 0
// Apple Filing Protocol.
Network_AFP Network_ApplicationProtocol = 1
// Advanced Program-to-Program Communication.
Network_APPC Network_ApplicationProtocol = 2
// Advanced Message Queuing Protocol.
Network_AMQP Network_ApplicationProtocol = 3
// Publishing Protocol.
Network_ATOM Network_ApplicationProtocol = 4
// Block Extensible Exchange Protocol.
Network_BEEP Network_ApplicationProtocol = 5
// Crypto currency protocol.
Network_BITCOIN Network_ApplicationProtocol = 6
// Peer-to-peer file sharing.
Network_BIT_TORRENT Network_ApplicationProtocol = 7
// Coherent File Distribution Protocol.
Network_CFDP Network_ApplicationProtocol = 8
// Common Industrial Protocol.
Network_CIP Network_ApplicationProtocol = 67
// Constrained Application Protocol.
Network_COAP Network_ApplicationProtocol = 9
// Connection Oriented Transport Protocol.
Network_COTP Network_ApplicationProtocol = 68
// DCE/RPC.
Network_DCERPC Network_ApplicationProtocol = 66
// Data Distribution Service.
Network_DDS Network_ApplicationProtocol = 10
// Automation industry protocol.
Network_DEVICE_NET Network_ApplicationProtocol = 11
// DHCP.
Network_DHCP Network_ApplicationProtocol = 4000
// Digital Imaging and Communications in Medicine Protocol.
Network_DICOM Network_ApplicationProtocol = 69
// Distributed Network Protocol 3 (DNP3)
Network_DNP3 Network_ApplicationProtocol = 70
// DNS.
Network_DNS Network_ApplicationProtocol = 3000
// Classic file sharing protocol.
Network_E_DONKEY Network_ApplicationProtocol = 12
// Endpoint Handlespace Redundancy Protocol.
Network_ENRP Network_ApplicationProtocol = 13
// Filesharing peer-to-peer protocol.
Network_FAST_TRACK Network_ApplicationProtocol = 14
// User Information Protocol.
Network_FINGER Network_ApplicationProtocol = 15
// Censorship resistant peer-to-peer network.
Network_FREENET Network_ApplicationProtocol = 16
// File Transfer Access and Management.
Network_FTAM Network_ApplicationProtocol = 17
// GOOSE Protocol.
Network_GOOSE Network_ApplicationProtocol = 71
// Gopher protocol.
Network_GOPHER Network_ApplicationProtocol = 18
// gRPC Remote Procedure Call.
Network_GRPC Network_ApplicationProtocol = 77
// Health Level Seven.
Network_HL7 Network_ApplicationProtocol = 19
// Packet-based multimedia communications system.
Network_H323 Network_ApplicationProtocol = 20
// HTTP.
Network_HTTP Network_ApplicationProtocol = 2000
// HTTPS.
Network_HTTPS Network_ApplicationProtocol = 2001
// IEC 60870-5-104 (IEC 104) Protocol.
Network_IEC104 Network_ApplicationProtocol = 72
// Internet Relay Chat Protocol.
Network_IRCP Network_ApplicationProtocol = 21
// Peer-to-peer hashtables.
Network_KADEMLIA Network_ApplicationProtocol = 22
// Kerberos 5.
Network_KRB5 Network_ApplicationProtocol = 65
// Lightweight Directory Access Protocol.
Network_LDAP Network_ApplicationProtocol = 23
// Line Printer Daemon Protocol.
Network_LPD Network_ApplicationProtocol = 24
// Multipurpose Internet Mail Extensions and Secure MIME.
Network_MIME Network_ApplicationProtocol = 25
// Multimedia Messaging Service.
Network_MMS Network_ApplicationProtocol = 73
// Serial communications protocol.
Network_MODBUS Network_ApplicationProtocol = 26
// Message Queuing Telemetry Transport.
Network_MQTT Network_ApplicationProtocol = 27
// Network Configuration.
Network_NETCONF Network_ApplicationProtocol = 28
// Network File System.
Network_NFS Network_ApplicationProtocol = 29
// Network Information Service.
Network_NIS Network_ApplicationProtocol = 30
// Network News Transfer Protocol.
Network_NNTP Network_ApplicationProtocol = 31
// National Transportation Communications for Intelligent Transportation
// System.
Network_NTCIP Network_ApplicationProtocol = 32
// Network Time Protocol.
Network_NTP Network_ApplicationProtocol = 33
// AOL Instant Messenger Protocol.
Network_OSCAR Network_ApplicationProtocol = 34
// Peer Name Resolution Protocol.
Network_PNRP Network_ApplicationProtocol = 35
// Precision Time Protocol.
Network_PTP Network_ApplicationProtocol = 74
// QUIC.
Network_QUIC Network_ApplicationProtocol = 1000
// Remote Desktop Protocol.
Network_RDP Network_ApplicationProtocol = 36
// Reliable Event Logging Protocol.
Network_RELP Network_ApplicationProtocol = 37
// Routing Information Protocol.
Network_RIP Network_ApplicationProtocol = 38
// Remote Login in UNIX Systems.
Network_RLOGIN Network_ApplicationProtocol = 39
// Remote Procedure Call.
Network_RPC Network_ApplicationProtocol = 40
// Real Time Messaging Protocol.
Network_RTMP Network_ApplicationProtocol = 41
// Real-time Transport Protocol.
Network_RTP Network_ApplicationProtocol = 42
// Real Time Publish Subscribe.
Network_RTPS Network_ApplicationProtocol = 43
// Real Time Streaming Protocol.
Network_RTSP Network_ApplicationProtocol = 44
// Session Announcement Protocol.
Network_SAP Network_ApplicationProtocol = 45
// Session Description Protocol.
Network_SDP Network_ApplicationProtocol = 46
// Session Initiation Protocol.
Network_SIP Network_ApplicationProtocol = 47
// Service Location Protocol.
Network_SLP Network_ApplicationProtocol = 48
// Server Message Block.
Network_SMB Network_ApplicationProtocol = 49
// Simple Mail Transfer Protocol.
Network_SMTP Network_ApplicationProtocol = 50
// Simple Network Management Protocol.
Network_SNMP Network_ApplicationProtocol = 75
// Simple Network Time Protocol.
Network_SNTP Network_ApplicationProtocol = 51
// Secure Shell.
Network_SSH Network_ApplicationProtocol = 52
// Secure SMS Messaging Protocol.
Network_SSMS Network_ApplicationProtocol = 53
// Styx/9P - Plan 9 from Bell Labs distributed file system protocol.
Network_STYX Network_ApplicationProtocol = 54
// Sampled Values Protocol.
Network_SV Network_ApplicationProtocol = 76
// Transaction Capabilities Application Part.
Network_TCAP Network_ApplicationProtocol = 55
// Tabular Data Stream.
Network_TDS Network_ApplicationProtocol = 56
// Anonymity network.
Network_TOR Network_ApplicationProtocol = 57
// Time Stamp Protocol.
Network_TSP Network_ApplicationProtocol = 58
// Virtual Terminal Protocol.
Network_VTP Network_ApplicationProtocol = 59
// Remote Directory Access Protocol.
Network_WHOIS Network_ApplicationProtocol = 60
// Web Distributed Authoring and Versioning.
Network_WEB_DAV Network_ApplicationProtocol = 61
// Message Handling Service Protocol.
Network_X400 Network_ApplicationProtocol = 62
// Directory Access Protocol (DAP).
Network_X500 Network_ApplicationProtocol = 63
// Extensible Messaging and Presence Protocol.
Network_XMPP Network_ApplicationProtocol = 64
// File Transfer Protocol.
Network_FTP Network_ApplicationProtocol = 78
)func (Network_ApplicationProtocol) Descriptor
func (Network_ApplicationProtocol) Descriptor() protoreflect.EnumDescriptorfunc (Network_ApplicationProtocol) Enum
func (x Network_ApplicationProtocol) Enum() *Network_ApplicationProtocolfunc (Network_ApplicationProtocol) EnumDescriptor
func (Network_ApplicationProtocol) EnumDescriptor() ([]byte, []int)Deprecated: Use Network_ApplicationProtocol.Descriptor instead.
func (Network_ApplicationProtocol) Number
func (x Network_ApplicationProtocol) Number() protoreflect.EnumNumberfunc (Network_ApplicationProtocol) String
func (x Network_ApplicationProtocol) String() stringfunc (Network_ApplicationProtocol) Type
func (Network_ApplicationProtocol) Type() protoreflect.EnumTypeNetwork_ConnectionState
type Network_ConnectionState int32The state of a network connection.
Network_CONNECTION_STATE_UNSPECIFIED, Network_LISTENING, Network_ESTABLISHED, Network_TIME_WAIT, Network_CLOSE_WAIT, Network_CLOSED, Network_SYN_SENT, Network_SYN_RECEIVED, Network_FIN_WAIT1, Network_FIN_WAIT2, Network_LAST_ACK
const (
// The default connection state.
Network_CONNECTION_STATE_UNSPECIFIED Network_ConnectionState = 0
// The port is listening for incoming connections.
Network_LISTENING Network_ConnectionState = 1
// A connection has been established.
Network_ESTABLISHED Network_ConnectionState = 2
// The connection is waiting for a timeout.
Network_TIME_WAIT Network_ConnectionState = 3
// The connection is waiting for a connection termination request from the
// local application.
Network_CLOSE_WAIT Network_ConnectionState = 4
// The connection is closed.
Network_CLOSED Network_ConnectionState = 5
// A connection request has been sent.
Network_SYN_SENT Network_ConnectionState = 6
// A connection request has been received.
Network_SYN_RECEIVED Network_ConnectionState = 7
// The connection is waiting for a connection termination request from the
// remote host.
Network_FIN_WAIT1 Network_ConnectionState = 8
// The connection is waiting for a connection termination request from the
// local application.
Network_FIN_WAIT2 Network_ConnectionState = 9
// The connection is waiting for an acknowledgment of the final connection
// termination request.
Network_LAST_ACK Network_ConnectionState = 10
)func (Network_ConnectionState) Descriptor
func (Network_ConnectionState) Descriptor() protoreflect.EnumDescriptorfunc (Network_ConnectionState) Enum
func (x Network_ConnectionState) Enum() *Network_ConnectionStatefunc (Network_ConnectionState) EnumDescriptor
func (Network_ConnectionState) EnumDescriptor() ([]byte, []int)Deprecated: Use Network_ConnectionState.Descriptor instead.
func (Network_ConnectionState) Number
func (x Network_ConnectionState) Number() protoreflect.EnumNumberfunc (Network_ConnectionState) String
func (x Network_ConnectionState) String() stringfunc (Network_ConnectionState) Type
func (Network_ConnectionState) Type() protoreflect.EnumTypeNetwork_Direction
type Network_Direction int32A network traffic direction.
Network_UNKNOWN_DIRECTION, Network_INBOUND, Network_OUTBOUND, Network_BROADCAST
const (
// The default direction.
Network_UNKNOWN_DIRECTION Network_Direction = 0
// An inbound request.
Network_INBOUND Network_Direction = 1
// An outbound request.
Network_OUTBOUND Network_Direction = 2
// A broadcast.
Network_BROADCAST Network_Direction = 3
)func (Network_Direction) Descriptor
func (Network_Direction) Descriptor() protoreflect.EnumDescriptorfunc (Network_Direction) Enum
func (x Network_Direction) Enum() *Network_Directionfunc (Network_Direction) EnumDescriptor
func (Network_Direction) EnumDescriptor() ([]byte, []int)Deprecated: Use Network_Direction.Descriptor instead.
func (Network_Direction) Number
func (x Network_Direction) Number() protoreflect.EnumNumberfunc (Network_Direction) String
func (x Network_Direction) String() stringfunc (Network_Direction) Type
func (Network_Direction) Type() protoreflect.EnumTypeNetwork_IpProtocol
type Network_IpProtocol int32An IP protocol.
Network_UNKNOWN_IP_PROTOCOL, Network_ICMP, Network_IGMP, Network_TCP, Network_UDP, Network_IP6IN4, Network_GRE, Network_ESP, Network_ICMP6, Network_EIGRP, Network_ETHERIP, Network_PIM, Network_VRRP, Network_SCTP
const (
// The default protocol.
Network_UNKNOWN_IP_PROTOCOL Network_IpProtocol = 0
// ICMP.
Network_ICMP Network_IpProtocol = 1
// IGMP
Network_IGMP Network_IpProtocol = 2
// TCP.
Network_TCP Network_IpProtocol = 6
// UDP.
Network_UDP Network_IpProtocol = 17
// IPv6 Encapsulation
Network_IP6IN4 Network_IpProtocol = 41
// Generic Routing Encapsulation
Network_GRE Network_IpProtocol = 47
// Encapsulating Security Payload
Network_ESP Network_IpProtocol = 50
// ICMPv6
Network_ICMP6 Network_IpProtocol = 58
// Enhanced Interior Gateway Routing
Network_EIGRP Network_IpProtocol = 88
// Ethernet-within-IP Encapsulation
Network_ETHERIP Network_IpProtocol = 97
// Protocol Independent Multicast
Network_PIM Network_IpProtocol = 103
// Virtual Router Redundancy Protocol
Network_VRRP Network_IpProtocol = 112
// Stream Control Transmission Protocol
Network_SCTP Network_IpProtocol = 132
)func (Network_IpProtocol) Descriptor
func (Network_IpProtocol) Descriptor() protoreflect.EnumDescriptorfunc (Network_IpProtocol) Enum
func (x Network_IpProtocol) Enum() *Network_IpProtocolfunc (Network_IpProtocol) EnumDescriptor
func (Network_IpProtocol) EnumDescriptor() ([]byte, []int)Deprecated: Use Network_IpProtocol.Descriptor instead.
func (Network_IpProtocol) Number
func (x Network_IpProtocol) Number() protoreflect.EnumNumberfunc (Network_IpProtocol) String
func (x Network_IpProtocol) String() stringfunc (Network_IpProtocol) Type
func (Network_IpProtocol) Type() protoreflect.EnumTypeNoun
type Noun struct {
// Client hostname or domain name field.
// Hostname also doubles as the domain for remote entities.
// This field can be used as an entity indicator for asset entities.
Hostname string `protobuf:"bytes,1,opt,name=hostname,proto3" json:"hostname,omitempty"`
// Information about the domain.
Domain *Domain `protobuf:"bytes,30,opt,name=domain,proto3" json:"domain,omitempty"`
// Information about an artifact.
Artifact *Artifact `protobuf:"bytes,32,opt,name=artifact,proto3" json:"artifact,omitempty"`
// Information about the URL.
UrlMetadata *Url `protobuf:"bytes,37,opt,name=url_metadata,json=urlMetadata,proto3" json:"url_metadata,omitempty"`
// Information about an entry in the web browser's local history database.
Browser *Browser `protobuf:"bytes,38,opt,name=browser,proto3" json:"browser,omitempty"`
// The asset ID.
// This field can be used as an entity indicator for asset entities.
AssetId string `protobuf:"bytes,2,opt,name=asset_id,json=assetId,proto3" json:"asset_id,omitempty"`
// Information about the user.
User *User `protobuf:"bytes,3,opt,name=user,proto3" json:"user,omitempty"`
// Information about the user's management chain (reporting hierarchy).
// Note: user_management_chain is only populated when data is exported to
// BigQuery since recursive fields (e.g. user.managers) are not supported by
// BigQuery.
UserManagementChain []*User `protobuf:"bytes,29,rep,name=user_management_chain,json=userManagementChain,proto3" json:"user_management_chain,omitempty"`
// Information about the group.
Group *Group `protobuf:"bytes,20,opt,name=group,proto3" json:"group,omitempty"`
// Information about the process.
Process *Process `protobuf:"bytes,4,opt,name=process,proto3" json:"process,omitempty"`
// Information about the process's ancestors ordered from immediate ancestor
// (parent process) to root.
// Note: process_ancestors is only populated when data is exported to BigQuery
// since recursive fields (e.g. process.parent_process) are not supported by
// BigQuery.
ProcessAncestors []*Process `protobuf:"bytes,28,rep,name=process_ancestors,json=processAncestors,proto3" json:"process_ancestors,omitempty"`
// Information about the asset.
Asset *Asset `protobuf:"bytes,27,opt,name=asset,proto3" json:"asset,omitempty"`
// A list of IP addresses associated with a network connection.
// This field can be used as an entity indicator for asset entities.
Ip []string `protobuf:"bytes,6,rep,name=ip,proto3" json:"ip,omitempty"`
// A list of NAT translated IP addresses associated with a network connection.
NatIp []string `protobuf:"bytes,21,rep,name=nat_ip,json=natIp,proto3" json:"nat_ip,omitempty"`
// Source or destination network port number when a specific network
// connection is described within an event.
Port int32 `protobuf:"varint,7,opt,name=port,proto3" json:"port,omitempty"`
// NAT external network port number when a specific network connection is
// described within an event.
NatPort int32 `protobuf:"varint,22,opt,name=nat_port,json=natPort,proto3" json:"nat_port,omitempty"`
// List of MAC addresses associated with a device.
// This field can be used as an entity indicator for asset entities.
Mac []string `protobuf:"bytes,8,rep,name=mac,proto3" json:"mac,omitempty"`
// Domain which the device belongs to (for example, the Microsoft Windows
// domain).
AdministrativeDomain string `protobuf:"bytes,9,opt,name=administrative_domain,json=administrativeDomain,proto3" json:"administrative_domain,omitempty"`
// Namespace which the device belongs to, such as "AD forest".
// Uses for this field include Microsoft Windows AD forest, the name of
// subsidiary, or the name of acquisition.
// This field can be used along with an asset indicator to identify an asset.
Namespace string `protobuf:"bytes,19,opt,name=namespace,proto3" json:"namespace,omitempty"`
// The URL.
Url string `protobuf:"bytes,10,opt,name=url,proto3" json:"url,omitempty"`
// Information about the file.
File *File `protobuf:"bytes,11,opt,name=file,proto3" json:"file,omitempty"`
// Email address.
// Only filled in for security_result.about
Email string `protobuf:"bytes,12,opt,name=email,proto3" json:"email,omitempty"`
// Registry information.
Registry *Registry `protobuf:"bytes,13,opt,name=registry,proto3" json:"registry,omitempty"`
// The name of an application or service.
// Some SSO solutions only capture the name of a target application
// such as "Atlassian" or "Chronicle".
Application string `protobuf:"bytes,14,opt,name=application,proto3" json:"application,omitempty"`
// Platform.
Platform Noun_Platform `protobuf:"varint,5,opt,name=platform,proto3,enum=google.backstory.Noun_Platform" json:"platform,omitempty"`
// Platform version. For example,
// "Microsoft Windows 1803".
PlatformVersion string `protobuf:"bytes,15,opt,name=platform_version,json=platformVersion,proto3" json:"platform_version,omitempty"`
// Platform patch level.
// For example, "Build 17134.48"
PlatformPatchLevel string `protobuf:"bytes,16,opt,name=platform_patch_level,json=platformPatchLevel,proto3" json:"platform_patch_level,omitempty"`
// Cloud metadata.
// Deprecated: cloud should be populated in entity Attribute as generic
// metadata (e.g. asset.attribute.cloud).
//
// Deprecated: Marked as deprecated in backstory/udm.proto.
Cloud *Cloud `protobuf:"bytes,24,opt,name=cloud,proto3" json:"cloud,omitempty"`
// Physical location. For cloud environments, set the region in
// location.name.
Location *Location `protobuf:"bytes,17,opt,name=location,proto3" json:"location,omitempty"`
// Deprecated: use ip_geo_artifact.location instead.
//
// Deprecated: Marked as deprecated in backstory/udm.proto.
IpLocation []*Location `protobuf:"bytes,34,rep,name=ip_location,json=ipLocation,proto3" json:"ip_location,omitempty"`
// Enriched geographic information corresponding to an IP address.
// Specifically, location and network data.
IpGeoArtifact []*Artifact `protobuf:"bytes,35,rep,name=ip_geo_artifact,json=ipGeoArtifact,proto3" json:"ip_geo_artifact,omitempty"`
// Information about the resource (e.g. scheduled task, calendar entry).
// This field should not be used for files, registry, or processes because
// these objects are already part of Noun.
Resource *Resource `protobuf:"bytes,18,opt,name=resource,proto3" json:"resource,omitempty"`
// Information about the resource's ancestors ordered from immediate ancestor
// (starting with parent resource).
ResourceAncestors []*Resource `protobuf:"bytes,31,rep,name=resource_ancestors,json=resourceAncestors,proto3" json:"resource_ancestors,omitempty"`
// Labels are key-value pairs.
// For example: key = "env", value = "prod".
// Deprecated: labels should be populated in entity Attribute as generic
// metadata (e.g. user.attribute.labels).
//
// Deprecated: Marked as deprecated in backstory/udm.proto.
Labels []*Label `protobuf:"bytes,23,rep,name=labels,proto3" json:"labels,omitempty"`
// Finding to which the Analyst updated the feedback.
ObjectReference *Id `protobuf:"bytes,25,opt,name=object_reference,json=objectReference,proto3" json:"object_reference,omitempty"`
// Analyst feedback/investigation for alerts.
Investigation *Investigation `protobuf:"bytes,26,opt,name=investigation,proto3" json:"investigation,omitempty"`
// Network details, including sub-messages with details on each protocol
// (for example, DHCP, DNS, or HTTP).
Network *Network `protobuf:"bytes,33,opt,name=network,proto3" json:"network,omitempty"`
// A list of security results.
SecurityResult []*SecurityResult `protobuf:"bytes,36,rep,name=security_result,json=securityResult,proto3" json:"security_result,omitempty"`
// contains filtered or unexported fields
}The Noun type is used to represent the different entities in an event: principal, src, target, observer, intermediary, and about. It stores attributes known about the entity. For example, if the entity is a device with multiple IP or MAC addresses, it stores the IP and MAC addresses that are relevant to the event.
func (*Noun) Descriptor
Deprecated: Use Noun.ProtoReflect.Descriptor instead.
func (*Noun) GetAdministrativeDomain
func (*Noun) GetApplication
func (*Noun) GetArtifact
func (*Noun) GetAsset
func (*Noun) GetAssetId
func (*Noun) GetBrowser
func (*Noun) GetCloud
Deprecated: Marked as deprecated in backstory/udm.proto.
func (*Noun) GetDomain
func (*Noun) GetEmail
func (*Noun) GetFile
func (*Noun) GetGroup
func (*Noun) GetHostname
func (*Noun) GetInvestigation
func (x *Noun) GetInvestigation() *Investigationfunc (*Noun) GetIp
func (*Noun) GetIpGeoArtifact
func (*Noun) GetIpLocation
Deprecated: Marked as deprecated in backstory/udm.proto.
func (*Noun) GetLabels
Deprecated: Marked as deprecated in backstory/udm.proto.
func (*Noun) GetLocation
func (*Noun) GetMac
func (*Noun) GetNamespace
func (*Noun) GetNatIp
func (*Noun) GetNatPort
func (*Noun) GetNetwork
func (*Noun) GetObjectReference
func (*Noun) GetPlatform
func (x *Noun) GetPlatform() Noun_Platformfunc (*Noun) GetPlatformPatchLevel
func (*Noun) GetPlatformVersion
func (*Noun) GetPort
func (*Noun) GetProcess
func (*Noun) GetProcessAncestors
func (*Noun) GetRegistry
func (*Noun) GetResource
func (*Noun) GetResourceAncestors
func (*Noun) GetSecurityResult
func (x *Noun) GetSecurityResult() []*SecurityResultfunc (*Noun) GetUrl
func (*Noun) GetUrlMetadata
func (*Noun) GetUser
func (*Noun) GetUserManagementChain
func (*Noun) ProtoMessage
func (*Noun) ProtoMessage()func (*Noun) ProtoReflect
func (x *Noun) ProtoReflect() protoreflect.Messagefunc (*Noun) Reset
func (x *Noun) Reset()func (*Noun) String
Noun_Platform
type Noun_Platform int32Operating system platform.
Noun_UNKNOWN_PLATFORM, Noun_WINDOWS, Noun_MAC, Noun_LINUX, Noun_GCP, Noun_AWS, Noun_AZURE, Noun_IOS, Noun_ANDROID, Noun_CHROME_OS
const (
// Default value.
Noun_UNKNOWN_PLATFORM Noun_Platform = 0
// Microsoft Windows.
Noun_WINDOWS Noun_Platform = 1
// macOS.
Noun_MAC Noun_Platform = 2
// Linux.
Noun_LINUX Noun_Platform = 3
// Deprecated: see cloud.environment.
//
// Deprecated: Marked as deprecated in backstory/udm.proto.
Noun_GCP Noun_Platform = 4
// Deprecated: see cloud.environment.
//
// Deprecated: Marked as deprecated in backstory/udm.proto.
Noun_AWS Noun_Platform = 5
// Deprecated: see cloud.environment.
//
// Deprecated: Marked as deprecated in backstory/udm.proto.
Noun_AZURE Noun_Platform = 6
// IOS
Noun_IOS Noun_Platform = 7
// Android
Noun_ANDROID Noun_Platform = 8
// Chrome OS
Noun_CHROME_OS Noun_Platform = 9
)func (Noun_Platform) Descriptor
func (Noun_Platform) Descriptor() protoreflect.EnumDescriptorfunc (Noun_Platform) Enum
func (x Noun_Platform) Enum() *Noun_Platformfunc (Noun_Platform) EnumDescriptor
func (Noun_Platform) EnumDescriptor() ([]byte, []int)Deprecated: Use Noun_Platform.Descriptor instead.
func (Noun_Platform) Number
func (x Noun_Platform) Number() protoreflect.EnumNumberfunc (Noun_Platform) String
func (x Noun_Platform) String() stringfunc (Noun_Platform) Type
func (Noun_Platform) Type() protoreflect.EnumTypeNtfsFileMetadata
type NtfsFileMetadata struct {
// NTFS MFT entry changed timestamp.
ChangeTime *timestamppb.Timestamp `protobuf:"bytes,1,opt,name=change_time,json=changeTime,proto3" json:"change_time,omitempty"`
// NTFS $FILE_NAME attribute created timestamp.
FilenameCreateTime *timestamppb.Timestamp `protobuf:"bytes,2,opt,name=filename_create_time,json=filenameCreateTime,proto3" json:"filename_create_time,omitempty"`
// NTFS $FILE_NAME attribute modified timestamp.
FilenameModifyTime *timestamppb.Timestamp `protobuf:"bytes,3,opt,name=filename_modify_time,json=filenameModifyTime,proto3" json:"filename_modify_time,omitempty"`
// NTFS $FILE_NAME attribute accessed timestamp.
FilenameAccessTime *timestamppb.Timestamp `protobuf:"bytes,4,opt,name=filename_access_time,json=filenameAccessTime,proto3" json:"filename_access_time,omitempty"`
// NTFS $FILE_NAME attribute changed timestamp.
FilenameChangeTime *timestamppb.Timestamp `protobuf:"bytes,5,opt,name=filename_change_time,json=filenameChangeTime,proto3" json:"filename_change_time,omitempty"`
// NTFS USN journal.
UsnJournal []*UsnJournal `protobuf:"bytes,6,rep,name=usn_journal,json=usnJournal,proto3" json:"usn_journal,omitempty"`
// contains filtered or unexported fields
}NTFS-specific file metadata.
func (*NtfsFileMetadata) Descriptor
func (*NtfsFileMetadata) Descriptor() ([]byte, []int)Deprecated: Use NtfsFileMetadata.ProtoReflect.Descriptor instead.
func (*NtfsFileMetadata) GetChangeTime
func (x *NtfsFileMetadata) GetChangeTime() *timestamppb.Timestampfunc (*NtfsFileMetadata) GetFilenameAccessTime
func (x *NtfsFileMetadata) GetFilenameAccessTime() *timestamppb.Timestampfunc (*NtfsFileMetadata) GetFilenameChangeTime
func (x *NtfsFileMetadata) GetFilenameChangeTime() *timestamppb.Timestampfunc (*NtfsFileMetadata) GetFilenameCreateTime
func (x *NtfsFileMetadata) GetFilenameCreateTime() *timestamppb.Timestampfunc (*NtfsFileMetadata) GetFilenameModifyTime
func (x *NtfsFileMetadata) GetFilenameModifyTime() *timestamppb.Timestampfunc (*NtfsFileMetadata) GetUsnJournal
func (x *NtfsFileMetadata) GetUsnJournal() []*UsnJournalfunc (*NtfsFileMetadata) ProtoMessage
func (*NtfsFileMetadata) ProtoMessage()func (*NtfsFileMetadata) ProtoReflect
func (x *NtfsFileMetadata) ProtoReflect() protoreflect.Messagefunc (*NtfsFileMetadata) Reset
func (x *NtfsFileMetadata) Reset()func (*NtfsFileMetadata) String
func (x *NtfsFileMetadata) String() stringOutlookMetadata
type OutlookMetadata struct {
// A user-defined comment or note associated with the Outlook item.
Comment string `protobuf:"bytes,1,opt,name=comment,proto3" json:"comment,omitempty"`
// The name of the template file used to create the Outlook item.
Template string `protobuf:"bytes,2,opt,name=template,proto3" json:"template,omitempty"`
// The title of the Outlook item.
Title string `protobuf:"bytes,3,opt,name=title,proto3" json:"title,omitempty"`
// Count of Security-related flags for the message, such as encryption or
// signing status.
SecurityFlagsCount int32 `protobuf:"varint,4,opt,name=security_flags_count,json=securityFlagsCount,proto3" json:"security_flags_count,omitempty"`
// contains filtered or unexported fields
}Microsoft Outlook specific metadata.
func (*OutlookMetadata) Descriptor
func (*OutlookMetadata) Descriptor() ([]byte, []int)Deprecated: Use OutlookMetadata.ProtoReflect.Descriptor instead.
func (*OutlookMetadata) GetComment
func (x *OutlookMetadata) GetComment() stringfunc (*OutlookMetadata) GetSecurityFlagsCount
func (x *OutlookMetadata) GetSecurityFlagsCount() int32func (*OutlookMetadata) GetTemplate
func (x *OutlookMetadata) GetTemplate() stringfunc (*OutlookMetadata) GetTitle
func (x *OutlookMetadata) GetTitle() stringfunc (*OutlookMetadata) ProtoMessage
func (*OutlookMetadata) ProtoMessage()func (*OutlookMetadata) ProtoReflect
func (x *OutlookMetadata) ProtoReflect() protoreflect.Messagefunc (*OutlookMetadata) Reset
func (x *OutlookMetadata) Reset()func (*OutlookMetadata) String
func (x *OutlookMetadata) String() stringPDFInfo
type PDFInfo struct {
// Number of /JS tags found in the PDF file. Should be the same as
// javascript field in normal scenarios.
Js int64 `protobuf:"varint,1,opt,name=js,proto3" json:"js,omitempty"`
// Number of /JavaScript tags found in the PDF file. Should be the same as
// the js field in normal scenarios.
Javascript int64 `protobuf:"varint,2,opt,name=javascript,proto3" json:"javascript,omitempty"`
// Number of /Launch tags found in the PDF file.
LaunchActionCount int64 `protobuf:"varint,3,opt,name=launch_action_count,json=launchActionCount,proto3" json:"launch_action_count,omitempty"`
// Number of object streams.
ObjectStreamCount int64 `protobuf:"varint,4,opt,name=object_stream_count,json=objectStreamCount,proto3" json:"object_stream_count,omitempty"`
// Number of object definitions (endobj keyword).
EndobjCount int64 `protobuf:"varint,5,opt,name=endobj_count,json=endobjCount,proto3" json:"endobj_count,omitempty"`
// PDF version.
Header string `protobuf:"bytes,6,opt,name=header,proto3" json:"header,omitempty"`
// Number of /AcroForm tags found in the PDF.
Acroform int64 `protobuf:"varint,7,opt,name=acroform,proto3" json:"acroform,omitempty"`
// Number of /AA tags found in the PDF.
Autoaction int64 `protobuf:"varint,8,opt,name=autoaction,proto3" json:"autoaction,omitempty"`
// Number of /EmbeddedFile tags found in the PDF.
EmbeddedFile int64 `protobuf:"varint,9,opt,name=embedded_file,json=embeddedFile,proto3" json:"embedded_file,omitempty"`
// Whether the document is encrypted or not. This is defined by the /Encrypt
// tag.
Encrypted int64 `protobuf:"varint,10,opt,name=encrypted,proto3" json:"encrypted,omitempty"`
// Number of /RichMedia tags found in the PDF.
Flash int64 `protobuf:"varint,11,opt,name=flash,proto3" json:"flash,omitempty"`
// Number of /JBIG2Decode tags found in the PDF.
Jbig2Compression int64 `protobuf:"varint,12,opt,name=jbig2_compression,json=jbig2Compression,proto3" json:"jbig2_compression,omitempty"`
// Number of objects definitions (obj keyword).
ObjCount int64 `protobuf:"varint,13,opt,name=obj_count,json=objCount,proto3" json:"obj_count,omitempty"`
// Number of defined stream objects (stream keyword).
EndstreamCount int64 `protobuf:"varint,14,opt,name=endstream_count,json=endstreamCount,proto3" json:"endstream_count,omitempty"`
// Number of pages in the PDF.
PageCount int64 `protobuf:"varint,15,opt,name=page_count,json=pageCount,proto3" json:"page_count,omitempty"`
// Number of defined stream objects (stream keyword).
StreamCount int64 `protobuf:"varint,16,opt,name=stream_count,json=streamCount,proto3" json:"stream_count,omitempty"`
// Number of /OpenAction tags found in the PDF.
Openaction int64 `protobuf:"varint,17,opt,name=openaction,proto3" json:"openaction,omitempty"`
// Number of startxref keywords in the PDF.
Startxref int64 `protobuf:"varint,18,opt,name=startxref,proto3" json:"startxref,omitempty"`
// Number of colors expressed with more than 3 bytes (CVE-2009-3459).
SuspiciousColors int64 `protobuf:"varint,19,opt,name=suspicious_colors,json=suspiciousColors,proto3" json:"suspicious_colors,omitempty"`
// Number of trailer keywords in the PDF.
Trailer int64 `protobuf:"varint,20,opt,name=trailer,proto3" json:"trailer,omitempty"`
// Number of \XFA tags found in the PDF.
Xfa int64 `protobuf:"varint,21,opt,name=xfa,proto3" json:"xfa,omitempty"`
// Number of xref keywords in the PDF.
Xref int64 `protobuf:"varint,22,opt,name=xref,proto3" json:"xref,omitempty"`
// contains filtered or unexported fields
}Information about the PDF file structure. See https://developers.virustotal.com/reference/pdf_info
func (*PDFInfo) Descriptor
Deprecated: Use PDFInfo.ProtoReflect.Descriptor instead.
func (*PDFInfo) GetAcroform
func (*PDFInfo) GetAutoaction
func (*PDFInfo) GetEmbeddedFile
func (*PDFInfo) GetEncrypted
func (*PDFInfo) GetEndobjCount
func (*PDFInfo) GetEndstreamCount
func (*PDFInfo) GetFlash
func (*PDFInfo) GetHeader
func (*PDFInfo) GetJavascript
func (*PDFInfo) GetJbig2Compression
func (*PDFInfo) GetJs
func (*PDFInfo) GetLaunchActionCount
func (*PDFInfo) GetObjCount
func (*PDFInfo) GetObjectStreamCount
func (*PDFInfo) GetOpenaction
func (*PDFInfo) GetPageCount
func (*PDFInfo) GetStartxref
func (*PDFInfo) GetStreamCount
func (*PDFInfo) GetSuspiciousColors
func (*PDFInfo) GetTrailer
func (*PDFInfo) GetXfa
func (*PDFInfo) GetXref
func (*PDFInfo) ProtoMessage
func (*PDFInfo) ProtoMessage()func (*PDFInfo) ProtoReflect
func (x *PDFInfo) ProtoReflect() protoreflect.Messagefunc (*PDFInfo) Reset
func (x *PDFInfo) Reset()func (*PDFInfo) String
PeFileMetadata
type PeFileMetadata struct {
// Hash of PE imports.
ImportHash string `protobuf:"bytes,1,opt,name=import_hash,json=importHash,proto3" json:"import_hash,omitempty"`
// contains filtered or unexported fields
}Metadata about a Microsoft Windows Portable Executable.
func (*PeFileMetadata) Descriptor
func (*PeFileMetadata) Descriptor() ([]byte, []int)Deprecated: Use PeFileMetadata.ProtoReflect.Descriptor instead.
func (*PeFileMetadata) GetImportHash
func (x *PeFileMetadata) GetImportHash() stringfunc (*PeFileMetadata) ProtoMessage
func (*PeFileMetadata) ProtoMessage()func (*PeFileMetadata) ProtoReflect
func (x *PeFileMetadata) ProtoReflect() protoreflect.Messagefunc (*PeFileMetadata) Reset
func (x *PeFileMetadata) Reset()func (*PeFileMetadata) String
func (x *PeFileMetadata) String() stringPermission
type Permission struct {
// Name of the permission (e.g. chronicle.analyst.updateRule).
Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
// Description of the permission (e.g. 'Ability to update detect rules').
Description string `protobuf:"bytes,2,opt,name=description,proto3" json:"description,omitempty"`
// Type of the permission.
Type Permission_PermissionType `protobuf:"varint,3,opt,name=type,proto3,enum=google.backstory.Permission_PermissionType" json:"type,omitempty"`
// contains filtered or unexported fields
}System permission for resource access and modification.
func (*Permission) Descriptor
func (*Permission) Descriptor() ([]byte, []int)Deprecated: Use Permission.ProtoReflect.Descriptor instead.
func (*Permission) GetDescription
func (x *Permission) GetDescription() stringfunc (*Permission) GetName
func (x *Permission) GetName() stringfunc (*Permission) GetType
func (x *Permission) GetType() Permission_PermissionTypefunc (*Permission) ProtoMessage
func (*Permission) ProtoMessage()func (*Permission) ProtoReflect
func (x *Permission) ProtoReflect() protoreflect.Messagefunc (*Permission) Reset
func (x *Permission) Reset()func (*Permission) String
func (x *Permission) String() stringPermission_PermissionType
type Permission_PermissionType int32High level categorizations of permission type.
Permission_UNKNOWN_PERMISSION_TYPE, Permission_ADMIN_WRITE, Permission_ADMIN_READ, Permission_DATA_WRITE, Permission_DATA_READ
const (
// Default permission type.
Permission_UNKNOWN_PERMISSION_TYPE Permission_PermissionType = 0
// Administrator write permission.
Permission_ADMIN_WRITE Permission_PermissionType = 1
// Administrator read permission.
Permission_ADMIN_READ Permission_PermissionType = 2
// Data resource access write permission.
Permission_DATA_WRITE Permission_PermissionType = 3
// Data resource access read permission.
Permission_DATA_READ Permission_PermissionType = 4
)func (Permission_PermissionType) Descriptor
func (Permission_PermissionType) Descriptor() protoreflect.EnumDescriptorfunc (Permission_PermissionType) Enum
func (x Permission_PermissionType) Enum() *Permission_PermissionTypefunc (Permission_PermissionType) EnumDescriptor
func (Permission_PermissionType) EnumDescriptor() ([]byte, []int)Deprecated: Use Permission_PermissionType.Descriptor instead.
func (Permission_PermissionType) Number
func (x Permission_PermissionType) Number() protoreflect.EnumNumberfunc (Permission_PermissionType) String
func (x Permission_PermissionType) String() stringfunc (Permission_PermissionType) Type
func (Permission_PermissionType) Type() protoreflect.EnumTypePlatformSoftware
type PlatformSoftware struct {
// The platform operating system.
Platform Noun_Platform `protobuf:"varint,1,opt,name=platform,proto3,enum=google.backstory.Noun_Platform" json:"platform,omitempty"`
// The platform software version (
// e.g. "Microsoft Windows 1803").
PlatformVersion string `protobuf:"bytes,2,opt,name=platform_version,json=platformVersion,proto3" json:"platform_version,omitempty"`
// The platform software patch level (
// e.g. "Build 17134.48", "SP1").
PlatformPatchLevel string `protobuf:"bytes,3,opt,name=platform_patch_level,json=platformPatchLevel,proto3" json:"platform_patch_level,omitempty"`
// contains filtered or unexported fields
}Platform software information about an operating system.
func (*PlatformSoftware) Descriptor
func (*PlatformSoftware) Descriptor() ([]byte, []int)Deprecated: Use PlatformSoftware.ProtoReflect.Descriptor instead.
func (*PlatformSoftware) GetPlatform
func (x *PlatformSoftware) GetPlatform() Noun_Platformfunc (*PlatformSoftware) GetPlatformPatchLevel
func (x *PlatformSoftware) GetPlatformPatchLevel() stringfunc (*PlatformSoftware) GetPlatformVersion
func (x *PlatformSoftware) GetPlatformVersion() stringfunc (*PlatformSoftware) ProtoMessage
func (*PlatformSoftware) ProtoMessage()func (*PlatformSoftware) ProtoReflect
func (x *PlatformSoftware) ProtoReflect() protoreflect.Messagefunc (*PlatformSoftware) Reset
func (x *PlatformSoftware) Reset()func (*PlatformSoftware) String
func (x *PlatformSoftware) String() stringPopularityRank
type PopularityRank struct {
// Name of the rank serial number hexdump.
Giver string `protobuf:"bytes,1,opt,name=giver,proto3" json:"giver,omitempty"`
// Rank position.
Rank int64 `protobuf:"varint,2,opt,name=rank,proto3" json:"rank,omitempty"`
// Timestamp when the rank was ingested.
IngestionTime *timestamppb.Timestamp `protobuf:"bytes,3,opt,name=ingestion_time,json=ingestionTime,proto3" json:"ingestion_time,omitempty"`
// contains filtered or unexported fields
}Domain's position in popularity ranks for sources such as Alexa, Quantcast, or Statvoo.
func (*PopularityRank) Descriptor
func (*PopularityRank) Descriptor() ([]byte, []int)Deprecated: Use PopularityRank.ProtoReflect.Descriptor instead.
func (*PopularityRank) GetGiver
func (x *PopularityRank) GetGiver() stringfunc (*PopularityRank) GetIngestionTime
func (x *PopularityRank) GetIngestionTime() *timestamppb.Timestampfunc (*PopularityRank) GetRank
func (x *PopularityRank) GetRank() int64func (*PopularityRank) ProtoMessage
func (*PopularityRank) ProtoMessage()func (*PopularityRank) ProtoReflect
func (x *PopularityRank) ProtoReflect() protoreflect.Messagefunc (*PopularityRank) Reset
func (x *PopularityRank) Reset()func (*PopularityRank) String
func (x *PopularityRank) String() stringPrefetchFileMetadata
type PrefetchFileMetadata struct {
// The number of times the application has been run.
RunCount int64 `protobuf:"varint,1,opt,name=run_count,json=runCount,proto3" json:"run_count,omitempty"`
// A hash of the executable path used to identify the prefetch file.
PrefetchHash string `protobuf:"bytes,2,opt,name=prefetch_hash,json=prefetchHash,proto3" json:"prefetch_hash,omitempty"`
// contains filtered or unexported fields
}Windows Prefetch file metadata.
func (*PrefetchFileMetadata) Descriptor
func (*PrefetchFileMetadata) Descriptor() ([]byte, []int)Deprecated: Use PrefetchFileMetadata.ProtoReflect.Descriptor instead.
func (*PrefetchFileMetadata) GetPrefetchHash
func (x *PrefetchFileMetadata) GetPrefetchHash() stringfunc (*PrefetchFileMetadata) GetRunCount
func (x *PrefetchFileMetadata) GetRunCount() int64func (*PrefetchFileMetadata) ProtoMessage
func (*PrefetchFileMetadata) ProtoMessage()func (*PrefetchFileMetadata) ProtoReflect
func (x *PrefetchFileMetadata) ProtoReflect() protoreflect.Messagefunc (*PrefetchFileMetadata) Reset
func (x *PrefetchFileMetadata) Reset()func (*PrefetchFileMetadata) String
func (x *PrefetchFileMetadata) String() stringPrevalence
type Prevalence struct {
// The maximum number of assets per day accessing the resource over the
// trailing day_count days.
RollingMax int32 `protobuf:"varint,1,opt,name=rolling_max,json=rollingMax,proto3" json:"rolling_max,omitempty"`
// The number of days over which rolling_max is calculated.
DayCount int32 `protobuf:"varint,2,opt,name=day_count,json=dayCount,proto3" json:"day_count,omitempty"`
// The maximum number of assets per day accessing the domain along with
// sub-domains over the trailing day_count days. This field is only valid for
// domains.
RollingMaxSubDomains int32 `protobuf:"varint,3,opt,name=rolling_max_sub_domains,json=rollingMaxSubDomains,proto3" json:"rolling_max_sub_domains,omitempty"`
// The max prevalence score in a day interval window.
DayMax int32 `protobuf:"varint,4,opt,name=day_max,json=dayMax,proto3" json:"day_max,omitempty"`
// The max prevalence score in a day interval window across sub-domains. This
// field is only valid for domains.
DayMaxSubDomains int32 `protobuf:"varint,5,opt,name=day_max_sub_domains,json=dayMaxSubDomains,proto3" json:"day_max_sub_domains,omitempty"`
// contains filtered or unexported fields
}The prevalence of a resource within the customer's environment. This measures how common it is for assets to access the resource.
func (*Prevalence) Descriptor
func (*Prevalence) Descriptor() ([]byte, []int)Deprecated: Use Prevalence.ProtoReflect.Descriptor instead.
func (*Prevalence) GetDayCount
func (x *Prevalence) GetDayCount() int32func (*Prevalence) GetDayMax
func (x *Prevalence) GetDayMax() int32func (*Prevalence) GetDayMaxSubDomains
func (x *Prevalence) GetDayMaxSubDomains() int32func (*Prevalence) GetRollingMax
func (x *Prevalence) GetRollingMax() int32func (*Prevalence) GetRollingMaxSubDomains
func (x *Prevalence) GetRollingMaxSubDomains() int32func (*Prevalence) ProtoMessage
func (*Prevalence) ProtoMessage()func (*Prevalence) ProtoReflect
func (x *Prevalence) ProtoReflect() protoreflect.Messagefunc (*Prevalence) Reset
func (x *Prevalence) Reset()func (*Prevalence) String
func (x *Prevalence) String() stringPriority
type Priority int32Priority that is assigned to a Case or Alert.
Priority_PRIORITY_UNSPECIFIED, Priority_PRIORITY_INFO, Priority_PRIORITY_LOW, Priority_PRIORITY_MEDIUM, Priority_PRIORITY_HIGH, Priority_PRIORITY_CRITICAL
const (
// Default priority level.
Priority_PRIORITY_UNSPECIFIED Priority = 0
// Informational priority.
Priority_PRIORITY_INFO Priority = 100
// Low priority.
Priority_PRIORITY_LOW Priority = 200
// Medium priority.
Priority_PRIORITY_MEDIUM Priority = 300
// High priority.
Priority_PRIORITY_HIGH Priority = 400
// Critical priority.
Priority_PRIORITY_CRITICAL Priority = 500
)func (Priority) Descriptor
func (Priority) Descriptor() protoreflect.EnumDescriptorfunc (Priority) Enum
func (Priority) EnumDescriptor
Deprecated: Use Priority.Descriptor instead.
func (Priority) Number
func (x Priority) Number() protoreflect.EnumNumberfunc (Priority) String
func (Priority) Type
func (Priority) Type() protoreflect.EnumTypeProcess
type Process struct {
// The process ID.
// This field can be used as an entity indicator for process entities.
Pid string `protobuf:"bytes,1,opt,name=pid,proto3" json:"pid,omitempty"`
// The ID of the parent process.
// Deprecated: use parent_process.pid instead.
//
// Deprecated: Marked as deprecated in backstory/udm.proto.
ParentPid string `protobuf:"bytes,2,opt,name=parent_pid,json=parentPid,proto3" json:"parent_pid,omitempty"`
// Information about the parent process.
ParentProcess *Process `protobuf:"bytes,7,opt,name=parent_process,json=parentProcess,proto3" json:"parent_process,omitempty"`
// Information about the file in use by the process.
File *File `protobuf:"bytes,3,opt,name=file,proto3" json:"file,omitempty"`
// The command line command that created the process.
// This field can be used as an entity indicator for process entities.
CommandLine string `protobuf:"bytes,4,opt,name=command_line,json=commandLine,proto3" json:"command_line,omitempty"`
// The command line history of the process.
CommandLineHistory []string `protobuf:"bytes,9,rep,name=command_line_history,json=commandLineHistory,proto3" json:"command_line_history,omitempty"`
// A product specific process id.
ProductSpecificProcessId string `protobuf:"bytes,5,opt,name=product_specific_process_id,json=productSpecificProcessId,proto3" json:"product_specific_process_id,omitempty"`
// A bit mask representing the level of access.
AccessMask uint64 `protobuf:"varint,8,opt,name=access_mask,json=accessMask,proto3" json:"access_mask,omitempty"`
// The Microsoft Windows integrity level relative ID (RID) of the process.
IntegrityLevelRid uint64 `protobuf:"varint,11,opt,name=integrity_level_rid,json=integrityLevelRid,proto3" json:"integrity_level_rid,omitempty"`
// The effective user ID of the process.
Euid string `protobuf:"bytes,12,opt,name=euid,proto3" json:"euid,omitempty"`
// The real user ID of the process.
Ruid string `protobuf:"bytes,13,opt,name=ruid,proto3" json:"ruid,omitempty"`
// The effective group ID of the process.
Egid string `protobuf:"bytes,14,opt,name=egid,proto3" json:"egid,omitempty"`
// The real group ID of the process.
Rgid string `protobuf:"bytes,15,opt,name=rgid,proto3" json:"rgid,omitempty"`
// The identifier that points to the process group ID leader.
Pgid string `protobuf:"bytes,16,opt,name=pgid,proto3" json:"pgid,omitempty"`
// The process ID of the session leader process.
SessionLeaderPid string `protobuf:"bytes,17,opt,name=session_leader_pid,json=sessionLeaderPid,proto3" json:"session_leader_pid,omitempty"`
// The teletype terminal which the command was executed within.
Tty string `protobuf:"bytes,18,opt,name=tty,proto3" json:"tty,omitempty"`
// The elevation type of the process on Microsoft Windows. This determines if
// any privileges are removed when UAC is enabled.
TokenElevationType Process_TokenElevationType `protobuf:"varint,10,opt,name=token_elevation_type,json=tokenElevationType,proto3,enum=google.backstory.Process_TokenElevationType" json:"token_elevation_type,omitempty"`
// A product specific id for the parent process.
// Please use parent_process.product_specific_process_id instead.
//
// Deprecated: Marked as deprecated in backstory/udm.proto.
ProductSpecificParentProcessId string `protobuf:"bytes,6,opt,name=product_specific_parent_process_id,json=productSpecificParentProcessId,proto3" json:"product_specific_parent_process_id,omitempty"`
// This is used to determine if the process is an IPv6 process.
Ipv6 bool `protobuf:"varint,19,opt,name=ipv6,proto3" json:"ipv6,omitempty"`
// The kernel time spent in the process.
KernelDuration *durationpb.Duration `protobuf:"bytes,20,opt,name=kernel_duration,json=kernelDuration,proto3" json:"kernel_duration,omitempty"`
// The user time spent in the process.
UserDuration *durationpb.Duration `protobuf:"bytes,21,opt,name=user_duration,json=userDuration,proto3" json:"user_duration,omitempty"`
// The real time spent in the process. This is the sum of the kernel and user
// time.
RealDuration *durationpb.Duration `protobuf:"bytes,22,opt,name=real_duration,json=realDuration,proto3" json:"real_duration,omitempty"`
// The state of the process.
State Process_State `protobuf:"varint,23,opt,name=state,proto3,enum=google.backstory.Process_State" json:"state,omitempty"`
// contains filtered or unexported fields
}Information about a process.
func (*Process) Descriptor
Deprecated: Use Process.ProtoReflect.Descriptor instead.
func (*Process) GetAccessMask
func (*Process) GetCommandLine
func (*Process) GetCommandLineHistory
func (*Process) GetEgid
func (*Process) GetEuid
func (*Process) GetFile
func (*Process) GetIntegrityLevelRid
func (*Process) GetIpv6
func (*Process) GetKernelDuration
func (x *Process) GetKernelDuration() *durationpb.Durationfunc (*Process) GetParentPid
Deprecated: Marked as deprecated in backstory/udm.proto.
func (*Process) GetParentProcess
func (*Process) GetPgid
func (*Process) GetPid
func (*Process) GetProductSpecificParentProcessId
Deprecated: Marked as deprecated in backstory/udm.proto.
func (*Process) GetProductSpecificProcessId
func (*Process) GetRealDuration
func (x *Process) GetRealDuration() *durationpb.Durationfunc (*Process) GetRgid
func (*Process) GetRuid
func (*Process) GetSessionLeaderPid
func (*Process) GetState
func (x *Process) GetState() Process_Statefunc (*Process) GetTokenElevationType
func (x *Process) GetTokenElevationType() Process_TokenElevationTypefunc (*Process) GetTty
func (*Process) GetUserDuration
func (x *Process) GetUserDuration() *durationpb.Durationfunc (*Process) ProtoMessage
func (*Process) ProtoMessage()func (*Process) ProtoReflect
func (x *Process) ProtoReflect() protoreflect.Messagefunc (*Process) Reset
func (x *Process) Reset()func (*Process) String
Process_State
type Process_State int32The state of the process. See https://psutil.readthedocs.io/en/stable/#process-status-constants.
Process_STATE_UNSPECIFIED, Process_RUNNING, Process_SLEEPING, Process_DISK_SLEEP, Process_STOPPED, Process_TRACING_STOP, Process_ZOMBIE, Process_DEAD, Process_WAKE_KILL, Process_WAKING, Process_PARKED, Process_IDLE, Process_LOCKED, Process_WAITING, Process_SUSPENDED
const (
// Undetermined state.
Process_STATE_UNSPECIFIED Process_State = 0
// Process is running or runnable.
Process_RUNNING Process_State = 1
// Process is waiting for an event.
Process_SLEEPING Process_State = 2
// Process is in uninterruptible sleep, typically I/O.
Process_DISK_SLEEP Process_State = 3
// Process is stopped.
Process_STOPPED Process_State = 4
// Process is stopped by debugger.
Process_TRACING_STOP Process_State = 5
// Process is terminated but not reaped by parent.
Process_ZOMBIE Process_State = 6
// Process is terminated.
Process_DEAD Process_State = 7
// Process is woken to be killed.
Process_WAKE_KILL Process_State = 8
// Process is waking from sleep.
Process_WAKING Process_State = 9
// Linux specific: process is parked.
Process_PARKED Process_State = 10
// Linux, macOS, and FreeBSD specific: process is idle.
Process_IDLE Process_State = 11
// FreeBSD specific: process is locked.
Process_LOCKED Process_State = 12
// FreeBSD specific: process is waiting.
Process_WAITING Process_State = 13
// NetBSD specific: process is suspended.
Process_SUSPENDED Process_State = 14
)func (Process_State) Descriptor
func (Process_State) Descriptor() protoreflect.EnumDescriptorfunc (Process_State) Enum
func (x Process_State) Enum() *Process_Statefunc (Process_State) EnumDescriptor
func (Process_State) EnumDescriptor() ([]byte, []int)Deprecated: Use Process_State.Descriptor instead.
func (Process_State) Number
func (x Process_State) Number() protoreflect.EnumNumberfunc (Process_State) String
func (x Process_State) String() stringfunc (Process_State) Type
func (Process_State) Type() protoreflect.EnumTypeProcess_TokenElevationType
type Process_TokenElevationType int32The elevation type of the process's token. See https://learn.microsoft.com/en-us/windows/win32/api/winnt/ne-winnt-token_elevation_type
Process_UNKNOWN, Process_TYPE_1, Process_TYPE_2, Process_TYPE_3
const (
// An undetermined token type.
Process_UNKNOWN Process_TokenElevationType = 0
// A full token with no privileges removed or groups disabled.
Process_TYPE_1 Process_TokenElevationType = 1
// An elevated token with no privileges removed or groups disabled. Used
// when running as administrator.
Process_TYPE_2 Process_TokenElevationType = 2
// A limited token with administrative privileges removed and
// administrative groups disabled.
Process_TYPE_3 Process_TokenElevationType = 3
)func (Process_TokenElevationType) Descriptor
func (Process_TokenElevationType) Descriptor() protoreflect.EnumDescriptorfunc (Process_TokenElevationType) Enum
func (x Process_TokenElevationType) Enum() *Process_TokenElevationTypefunc (Process_TokenElevationType) EnumDescriptor
func (Process_TokenElevationType) EnumDescriptor() ([]byte, []int)Deprecated: Use Process_TokenElevationType.Descriptor instead.
func (Process_TokenElevationType) Number
func (x Process_TokenElevationType) Number() protoreflect.EnumNumberfunc (Process_TokenElevationType) String
func (x Process_TokenElevationType) String() stringfunc (Process_TokenElevationType) Type
func (Process_TokenElevationType) Type() protoreflect.EnumTypeProxyInfo
type ProxyInfo struct {
// Whether the IP address is anonymous.
Anonymous bool `protobuf:"varint,1,opt,name=anonymous,proto3" json:"anonymous,omitempty"`
// Whether the IP address is an anonymous VPN.
AnonymousVpn bool `protobuf:"varint,2,opt,name=anonymous_vpn,json=anonymousVpn,proto3" json:"anonymous_vpn,omitempty"`
// Whether the IP address is a public proxy.
PublicProxy bool `protobuf:"varint,3,opt,name=public_proxy,json=publicProxy,proto3" json:"public_proxy,omitempty"`
// Whether the IP address is a tor exit node.
TorExitNode bool `protobuf:"varint,4,opt,name=tor_exit_node,json=torExitNode,proto3" json:"tor_exit_node,omitempty"`
// Whether the IP address is a smart DNS proxy.
SmartDnsProxy bool `protobuf:"varint,5,opt,name=smart_dns_proxy,json=smartDnsProxy,proto3" json:"smart_dns_proxy,omitempty"`
// Whether the IP address is a hosting provider.
HostingProvider bool `protobuf:"varint,6,opt,name=hosting_provider,json=hostingProvider,proto3" json:"hosting_provider,omitempty"`
// Whether the IP address is a VPN datacenter.
VpnDatacenter bool `protobuf:"varint,7,opt,name=vpn_datacenter,json=vpnDatacenter,proto3" json:"vpn_datacenter,omitempty"`
// Whether the IP address is a residential proxy.
ResidentialProxy bool `protobuf:"varint,8,opt,name=residential_proxy,json=residentialProxy,proto3" json:"residential_proxy,omitempty"`
// The name of the VPN service.
VpnServiceName string `protobuf:"bytes,9,opt,name=vpn_service_name,json=vpnServiceName,proto3" json:"vpn_service_name,omitempty"`
// Whether the IP address is a proxy over VPN.
ProxyOverVpn bool `protobuf:"varint,10,opt,name=proxy_over_vpn,json=proxyOverVpn,proto3" json:"proxy_over_vpn,omitempty"`
// Whether the IP address is a relay proxy.
RelayProxy bool `protobuf:"varint,11,opt,name=relay_proxy,json=relayProxy,proto3" json:"relay_proxy,omitempty"`
// contains filtered or unexported fields
}Proxy information.
func (*ProxyInfo) Descriptor
Deprecated: Use ProxyInfo.ProtoReflect.Descriptor instead.
func (*ProxyInfo) GetAnonymous
func (*ProxyInfo) GetAnonymousVpn
func (*ProxyInfo) GetHostingProvider
func (*ProxyInfo) GetProxyOverVpn
func (*ProxyInfo) GetPublicProxy
func (*ProxyInfo) GetRelayProxy
func (*ProxyInfo) GetResidentialProxy
func (*ProxyInfo) GetSmartDnsProxy
func (*ProxyInfo) GetTorExitNode
func (*ProxyInfo) GetVpnDatacenter
func (*ProxyInfo) GetVpnServiceName
func (*ProxyInfo) ProtoMessage
func (*ProxyInfo) ProtoMessage()func (*ProxyInfo) ProtoReflect
func (x *ProxyInfo) ProtoReflect() protoreflect.Messagefunc (*ProxyInfo) Reset
func (x *ProxyInfo) Reset()func (*ProxyInfo) String
Reason
type Reason int32Reason for closing an Alert or Case in the SOAR product.
Reason_REASON_UNSPECIFIED, Reason_REASON_NOT_MALICIOUS, Reason_REASON_MALICIOUS, Reason_REASON_MAINTENANCE
const (
// Default reason.
Reason_REASON_UNSPECIFIED Reason = 0
// Case or Alert not malicious.
Reason_REASON_NOT_MALICIOUS Reason = 1
// Case or Alert is malicious.
Reason_REASON_MALICIOUS Reason = 2
// Case or Alert is under maintenance.
Reason_REASON_MAINTENANCE Reason = 3
)func (Reason) Descriptor
func (Reason) Descriptor() protoreflect.EnumDescriptorfunc (Reason) Enum
func (Reason) EnumDescriptor
Deprecated: Use Reason.Descriptor instead.
func (Reason) Number
func (x Reason) Number() protoreflect.EnumNumberfunc (Reason) String
func (Reason) Type
func (Reason) Type() protoreflect.EnumTypeReference
type Reference struct {
// Only one of event or entity will be populated for a single
// reference.
// Start one-of
// Event being referenced.
Event *UDM `protobuf:"bytes,1,opt,name=event,proto3" json:"event,omitempty"`
// Entity being referenced. In cases where the entity graph is overridden by
// data table, this will represent the original entity.
// End one-of
Entity *Entity `protobuf:"bytes,2,opt,name=entity,proto3" json:"entity,omitempty"`
// The data table rows joined with the event.
JoinedDataTableRows []*DataTableRowInfo `protobuf:"bytes,4,rep,name=joined_data_table_rows,json=joinedDataTableRows,proto3" json:"joined_data_table_rows,omitempty"`
// The entity graph enrichment details. Only set when the reference is an
// Entity which has been overridden by a data table or appended from a data
// table.
GraphEnrichment *EntityGraphEnrichment `protobuf:"bytes,5,opt,name=graph_enrichment,json=graphEnrichment,proto3" json:"graph_enrichment,omitempty"`
// Id being referenced. This field will also be populated for both event and
// entity with the event id. For detections, only this field will be
// populated.
Id *Id `protobuf:"bytes,3,opt,name=id,proto3" json:"id,omitempty"`
// The log batch token of the event being referenced. This field is
// used to fetch the raw log associated with the event in some legacy systems.
// This field is only populated for events/entities.
LogBatchToken string `protobuf:"bytes,6,opt,name=log_batch_token,json=logBatchToken,proto3" json:"log_batch_token,omitempty"`
// contains filtered or unexported fields
}Reference to model primatives including event and entity. As support is added for fast retrieval of objects by identifiers, this will be expanded to include ID references rather than full object copies.
func (*Reference) Descriptor
Deprecated: Use Reference.ProtoReflect.Descriptor instead.
func (*Reference) GetEntity
func (*Reference) GetEvent
func (*Reference) GetGraphEnrichment
func (x *Reference) GetGraphEnrichment() *EntityGraphEnrichmentfunc (*Reference) GetId
func (*Reference) GetJoinedDataTableRows
func (x *Reference) GetJoinedDataTableRows() []*DataTableRowInfofunc (*Reference) GetLogBatchToken
func (*Reference) ProtoMessage
func (*Reference) ProtoMessage()func (*Reference) ProtoReflect
func (x *Reference) ProtoReflect() protoreflect.Messagefunc (*Reference) Reset
func (x *Reference) Reset()func (*Reference) String
Registry
type Registry struct {
// Registry key associated with an application or system component
// (e.g., HKEY_, HKCU\Environment...).
RegistryKey string `protobuf:"bytes,1,opt,name=registry_key,json=registryKey,proto3" json:"registry_key,omitempty"`
// Name of the registry value associated with an application or system
// component (e.g. TEMP).
RegistryValueName string `protobuf:"bytes,2,opt,name=registry_value_name,json=registryValueName,proto3" json:"registry_value_name,omitempty"`
// Data associated with a registry value
// (e.g. %USERPROFILE%\Local Settings\Temp).
RegistryValueData string `protobuf:"bytes,3,opt,name=registry_value_data,json=registryValueData,proto3" json:"registry_value_data,omitempty"`
// Type of the registry value.
RegistryValueType Registry_Type `protobuf:"varint,4,opt,name=registry_value_type,json=registryValueType,proto3,enum=google.backstory.Registry_Type" json:"registry_value_type,omitempty"`
// Binary data associated with a registry value. This field is only populated
// if the registry value type is BINARY. This field is not populated for
// other registry value types.
RegistryValueBinaryData []byte `protobuf:"bytes,5,opt,name=registry_value_binary_data,json=registryValueBinaryData,proto3" json:"registry_value_binary_data,omitempty"`
// contains filtered or unexported fields
}Information about a registry key or value.
func (*Registry) Descriptor
Deprecated: Use Registry.ProtoReflect.Descriptor instead.
func (*Registry) GetRegistryKey
func (*Registry) GetRegistryValueBinaryData
func (*Registry) GetRegistryValueData
func (*Registry) GetRegistryValueName
func (*Registry) GetRegistryValueType
func (x *Registry) GetRegistryValueType() Registry_Typefunc (*Registry) ProtoMessage
func (*Registry) ProtoMessage()func (*Registry) ProtoReflect
func (x *Registry) ProtoReflect() protoreflect.Messagefunc (*Registry) Reset
func (x *Registry) Reset()func (*Registry) String
Registry_Type
type Registry_Type int32Type of the registry value. These values are based on the Windows Registry value types: https://learn.microsoft.com/en-us/windows/win32/sysinfo/registry-value-types
Registry_TYPE_UNSPECIFIED, Registry_NONE, Registry_SZ, Registry_EXPAND_SZ, Registry_BINARY, Registry_DWORD, Registry_DWORD_LITTLE_ENDIAN, Registry_DWORD_BIG_ENDIAN, Registry_LINK, Registry_MULTI_SZ, Registry_RESOURCE_LIST, Registry_QWORD, Registry_QWORD_LITTLE_ENDIAN
const (
// Default registry value type used when the type is unknown.
Registry_TYPE_UNSPECIFIED Registry_Type = 0
// The registry value is not set and only the key exists.
Registry_NONE Registry_Type = 1
// A null-terminated string.
Registry_SZ Registry_Type = 2
// A null-terminated string that contains unexpanded references to
// environment variables
Registry_EXPAND_SZ Registry_Type = 3
// Binary data in any form.
Registry_BINARY Registry_Type = 4
// A 32-bit number.
Registry_DWORD Registry_Type = 5
// A 32-bit number in little-endian format.
Registry_DWORD_LITTLE_ENDIAN Registry_Type = 6
// A 32-bit number in big-endian format.
Registry_DWORD_BIG_ENDIAN Registry_Type = 7
// A null-terminated Unicode string that contains the target path of a
// symbolic link.
Registry_LINK Registry_Type = 8
// A sequence of null-terminated strings, terminated by an empty string
Registry_MULTI_SZ Registry_Type = 9
// A device driver resource list.
Registry_RESOURCE_LIST Registry_Type = 10
// A 64-bit number.
Registry_QWORD Registry_Type = 11
// A 64-bit number in little-endian format.
Registry_QWORD_LITTLE_ENDIAN Registry_Type = 12
)func (Registry_Type) Descriptor
func (Registry_Type) Descriptor() protoreflect.EnumDescriptorfunc (Registry_Type) Enum
func (x Registry_Type) Enum() *Registry_Typefunc (Registry_Type) EnumDescriptor
func (Registry_Type) EnumDescriptor() ([]byte, []int)Deprecated: Use Registry_Type.Descriptor instead.
func (Registry_Type) Number
func (x Registry_Type) Number() protoreflect.EnumNumberfunc (Registry_Type) String
func (x Registry_Type) String() stringfunc (Registry_Type) Type
func (Registry_Type) Type() protoreflect.EnumTypeRelation
type Relation struct {
// Entity (b) that the primary entity (a) is related to.
Entity *Noun `protobuf:"bytes,1,opt,name=entity,proto3" json:"entity,omitempty"`
// Type of the related entity (b) in this relationship.
EntityType EntityMetadata_EntityType `protobuf:"varint,2,opt,name=entity_type,json=entityType,proto3,enum=google.backstory.EntityMetadata_EntityType" json:"entity_type,omitempty"`
// Type of relationship.
Relationship Relation_Relationship `protobuf:"varint,3,opt,name=relationship,proto3,enum=google.backstory.Relation_Relationship" json:"relationship,omitempty"`
// Directionality of relationship between primary entity (a) and the
// related entity (b).
Direction Relation_Directionality `protobuf:"varint,4,opt,name=direction,proto3,enum=google.backstory.Relation_Directionality" json:"direction,omitempty"`
// UID of the relationship.
Uid []byte `protobuf:"bytes,5,opt,name=uid,proto3" json:"uid,omitempty"`
// Label to identify the Noun of the relation.
EntityLabel Relation_EntityLabel `protobuf:"varint,6,opt,name=entity_label,json=entityLabel,proto3,enum=google.backstory.Relation_EntityLabel" json:"entity_label,omitempty"`
// contains filtered or unexported fields
}Defines the relationship between the entity (a) and another entity (b).
func (*Relation) Descriptor
Deprecated: Use Relation.ProtoReflect.Descriptor instead.
func (*Relation) GetDirection
func (x *Relation) GetDirection() Relation_Directionalityfunc (*Relation) GetEntity
func (*Relation) GetEntityLabel
func (x *Relation) GetEntityLabel() Relation_EntityLabelfunc (*Relation) GetEntityType
func (x *Relation) GetEntityType() EntityMetadata_EntityTypefunc (*Relation) GetRelationship
func (x *Relation) GetRelationship() Relation_Relationshipfunc (*Relation) GetUid
func (*Relation) ProtoMessage
func (*Relation) ProtoMessage()func (*Relation) ProtoReflect
func (x *Relation) ProtoReflect() protoreflect.Messagefunc (*Relation) Reset
func (x *Relation) Reset()func (*Relation) String
Relation_Directionality
type Relation_Directionality int32Describes the relationship model as directed or undirected.
Relation_DIRECTIONALITY_UNSPECIFIED, Relation_BIDIRECTIONAL, Relation_UNIDIRECTIONAL
const (
// Default value.
Relation_DIRECTIONALITY_UNSPECIFIED Relation_Directionality = 0
// Modeled in both directions. Primary entity (a) to related entity (b) and
// related entity (b) to primary entity (a).
Relation_BIDIRECTIONAL Relation_Directionality = 1
// Modeled in a single direction. Primary entity (a) to related entity (b).
Relation_UNIDIRECTIONAL Relation_Directionality = 2
)func (Relation_Directionality) Descriptor
func (Relation_Directionality) Descriptor() protoreflect.EnumDescriptorfunc (Relation_Directionality) Enum
func (x Relation_Directionality) Enum() *Relation_Directionalityfunc (Relation_Directionality) EnumDescriptor
func (Relation_Directionality) EnumDescriptor() ([]byte, []int)Deprecated: Use Relation_Directionality.Descriptor instead.
func (Relation_Directionality) Number
func (x Relation_Directionality) Number() protoreflect.EnumNumberfunc (Relation_Directionality) String
func (x Relation_Directionality) String() stringfunc (Relation_Directionality) Type
func (Relation_Directionality) Type() protoreflect.EnumTypeRelation_EntityLabel
type Relation_EntityLabel int32Entity label of the relation.
Relation_ENTITY_LABEL_UNSPECIFIED, Relation_PRINCIPAL, Relation_TARGET, Relation_OBSERVER, Relation_SRC, Relation_NETWORK, Relation_SECURITY_RESULT, Relation_INTERMEDIARY
const (
// Default value.
Relation_ENTITY_LABEL_UNSPECIFIED Relation_EntityLabel = 0
// The Noun represents a principal type object.
Relation_PRINCIPAL Relation_EntityLabel = 1
// The Noun represents a target type object.
Relation_TARGET Relation_EntityLabel = 2
// The Noun represents an observer type object.
Relation_OBSERVER Relation_EntityLabel = 3
// The Noun represents src type object.
Relation_SRC Relation_EntityLabel = 4
// The Noun represents a network type object.
Relation_NETWORK Relation_EntityLabel = 5
// The Noun represents a SecurityResult object.
Relation_SECURITY_RESULT Relation_EntityLabel = 6
// The Noun represents an intermediary type object.
Relation_INTERMEDIARY Relation_EntityLabel = 7
)func (Relation_EntityLabel) Descriptor
func (Relation_EntityLabel) Descriptor() protoreflect.EnumDescriptorfunc (Relation_EntityLabel) Enum
func (x Relation_EntityLabel) Enum() *Relation_EntityLabelfunc (Relation_EntityLabel) EnumDescriptor
func (Relation_EntityLabel) EnumDescriptor() ([]byte, []int)Deprecated: Use Relation_EntityLabel.Descriptor instead.
func (Relation_EntityLabel) Number
func (x Relation_EntityLabel) Number() protoreflect.EnumNumberfunc (Relation_EntityLabel) String
func (x Relation_EntityLabel) String() stringfunc (Relation_EntityLabel) Type
func (Relation_EntityLabel) Type() protoreflect.EnumTypeRelation_Relationship
type Relation_Relationship int32Type of relationship between the primary entity (a) and related entity (b).
Relation_RELATIONSHIP_UNSPECIFIED, Relation_OWNS, Relation_ADMINISTERS, Relation_MEMBER, Relation_EXECUTES, Relation_DOWNLOADED_FROM, Relation_CONTACTS
const (
// Default value
Relation_RELATIONSHIP_UNSPECIFIED Relation_Relationship = 0
// Related entity is owned by the primary entity (e.g. user owns device
// asset).
Relation_OWNS Relation_Relationship = 1
// Related entity is administered by the primary entity (e.g. user
// administers a group).
Relation_ADMINISTERS Relation_Relationship = 2
// Primary entity is a member of the related entity (e.g. user is a member
// of a group).
Relation_MEMBER Relation_Relationship = 3
// Primary entity may have executed the related entity.
Relation_EXECUTES Relation_Relationship = 4
// Primary entity may have been downloaded from the related entity.
Relation_DOWNLOADED_FROM Relation_Relationship = 5
// Primary entity contacts the related entity.
Relation_CONTACTS Relation_Relationship = 6
)func (Relation_Relationship) Descriptor
func (Relation_Relationship) Descriptor() protoreflect.EnumDescriptorfunc (Relation_Relationship) Enum
func (x Relation_Relationship) Enum() *Relation_Relationshipfunc (Relation_Relationship) EnumDescriptor
func (Relation_Relationship) EnumDescriptor() ([]byte, []int)Deprecated: Use Relation_Relationship.Descriptor instead.
func (Relation_Relationship) Number
func (x Relation_Relationship) Number() protoreflect.EnumNumberfunc (Relation_Relationship) String
func (x Relation_Relationship) String() stringfunc (Relation_Relationship) Type
func (Relation_Relationship) Type() protoreflect.EnumTypeReputation
type Reputation int32Categorization options for the usefulness of a finding.
Reputation_REPUTATION_UNSPECIFIED, Reputation_USEFUL, Reputation_NOT_USEFUL
const (
// An unspecified reputation.
Reputation_REPUTATION_UNSPECIFIED Reputation = 0
// A categorization of the finding as useful.
Reputation_USEFUL Reputation = 1
// A categorization of the finding as not useful.
Reputation_NOT_USEFUL Reputation = 2
)func (Reputation) Descriptor
func (Reputation) Descriptor() protoreflect.EnumDescriptorfunc (Reputation) Enum
func (x Reputation) Enum() *Reputationfunc (Reputation) EnumDescriptor
func (Reputation) EnumDescriptor() ([]byte, []int)Deprecated: Use Reputation.Descriptor instead.
func (Reputation) Number
func (x Reputation) Number() protoreflect.EnumNumberfunc (Reputation) String
func (x Reputation) String() stringfunc (Reputation) Type
func (Reputation) Type() protoreflect.EnumTypeResource
type Resource struct {
// Deprecated: use resource_type instead.
//
// Deprecated: Marked as deprecated in backstory/udm.proto.
Type string `protobuf:"bytes,1,opt,name=type,proto3" json:"type,omitempty"`
// Resource type.
ResourceType Resource_ResourceType `protobuf:"varint,5,opt,name=resource_type,json=resourceType,proto3,enum=google.backstory.Resource_ResourceType" json:"resource_type,omitempty"`
// Resource sub-type (e.g. "BigQuery", "Bigtable").
ResourceSubtype string `protobuf:"bytes,6,opt,name=resource_subtype,json=resourceSubtype,proto3" json:"resource_subtype,omitempty"`
// Deprecated: Use resource.name or resource.product_object_id.
//
// Deprecated: Marked as deprecated in backstory/udm.proto.
Id string `protobuf:"bytes,2,opt,name=id,proto3" json:"id,omitempty"`
// The full name of the resource. For example,
// Google Cloud: //cloudresourcemanager.googleapis.com/projects/wombat-123,
// and AWS: arn:aws:iam::123456789012:user/johndoe.
Name string `protobuf:"bytes,3,opt,name=name,proto3" json:"name,omitempty"`
// The parent of the resource.
// For a database table, the parent is the database. For a storage object,
// the bucket name. Deprecated: use resource_ancestors.name.
//
// Deprecated: Marked as deprecated in backstory/udm.proto.
Parent string `protobuf:"bytes,4,opt,name=parent,proto3" json:"parent,omitempty"`
// A vendor-specific identifier to uniquely identify the entity (a GUID,
// OID, or similar)
// This field can be used as an entity indicator for a Resource entity.
ProductObjectId string `protobuf:"bytes,8,opt,name=product_object_id,json=productObjectId,proto3" json:"product_object_id,omitempty"`
// Generic entity metadata attributes of the resource.
Attribute *Attribute `protobuf:"bytes,7,opt,name=attribute,proto3" json:"attribute,omitempty"`
// DEPRECATED: use windows_scheduled_task for Windows scheduled tasks or
// scheduled_cron_task for cron jobs.
// Information about a scheduled task associated with the resource.
//
// Deprecated: Marked as deprecated in backstory/udm.proto.
ScheduledTask *ScheduledTask `protobuf:"bytes,9,opt,name=scheduled_task,json=scheduledTask,proto3" json:"scheduled_task,omitempty"`
// Information about a scheduled cron task associated with the resource.
ScheduledCronTask *ScheduledCronTask `protobuf:"bytes,12,opt,name=scheduled_cron_task,json=scheduledCronTask,proto3" json:"scheduled_cron_task,omitempty"`
// Information about a scheduled anacron task associated with the resource.
ScheduledAnacronTask *ScheduledAnacronTask `protobuf:"bytes,13,opt,name=scheduled_anacron_task,json=scheduledAnacronTask,proto3" json:"scheduled_anacron_task,omitempty"`
// Information about a Windows scheduled task associated with the resource.
WindowsScheduledTask *WindowsScheduledTask `protobuf:"bytes,14,opt,name=windows_scheduled_task,json=windowsScheduledTask,proto3" json:"windows_scheduled_task,omitempty"`
// Information about a storage volume associated with the resource.
Volume *Volume `protobuf:"bytes,10,opt,name=volume,proto3" json:"volume,omitempty"`
// Information about a Windows service associated with the resource.
Service *Service `protobuf:"bytes,11,opt,name=service,proto3" json:"service,omitempty"`
// contains filtered or unexported fields
}Information about a resource such as a task, Cloud Storage bucket, database, disk, logical policy, or something similar.
func (*Resource) Descriptor
Deprecated: Use Resource.ProtoReflect.Descriptor instead.
func (*Resource) GetAttribute
func (*Resource) GetId
Deprecated: Marked as deprecated in backstory/udm.proto.
func (*Resource) GetName
func (*Resource) GetParent
Deprecated: Marked as deprecated in backstory/udm.proto.
func (*Resource) GetProductObjectId
func (*Resource) GetResourceSubtype
func (*Resource) GetResourceType
func (x *Resource) GetResourceType() Resource_ResourceTypefunc (*Resource) GetScheduledAnacronTask
func (x *Resource) GetScheduledAnacronTask() *ScheduledAnacronTaskfunc (*Resource) GetScheduledCronTask
func (x *Resource) GetScheduledCronTask() *ScheduledCronTaskfunc (*Resource) GetScheduledTask
func (x *Resource) GetScheduledTask() *ScheduledTaskDeprecated: Marked as deprecated in backstory/udm.proto.
func (*Resource) GetService
func (*Resource) GetType
Deprecated: Marked as deprecated in backstory/udm.proto.
func (*Resource) GetVolume
func (*Resource) GetWindowsScheduledTask
func (x *Resource) GetWindowsScheduledTask() *WindowsScheduledTaskfunc (*Resource) ProtoMessage
func (*Resource) ProtoMessage()func (*Resource) ProtoReflect
func (x *Resource) ProtoReflect() protoreflect.Messagefunc (*Resource) Reset
func (x *Resource) Reset()func (*Resource) String
ResourceUsage
type ResourceUsage struct {
// The name of the entity (e.g., process, user) that is using the resource.
UsedEntity string `protobuf:"bytes,1,opt,name=used_entity,json=usedEntity,proto3" json:"used_entity,omitempty"`
// A numerical identifier for the entity using the resource (e.g., PID, UID).
UsedEntityId string `protobuf:"bytes,2,opt,name=used_entity_id,json=usedEntityId,proto3" json:"used_entity_id,omitempty"`
// contains filtered or unexported fields
}The ResourceUsage extension captures details about what is using a resource.
func (*ResourceUsage) Descriptor
func (*ResourceUsage) Descriptor() ([]byte, []int)Deprecated: Use ResourceUsage.ProtoReflect.Descriptor instead.
func (*ResourceUsage) GetUsedEntity
func (x *ResourceUsage) GetUsedEntity() stringfunc (*ResourceUsage) GetUsedEntityId
func (x *ResourceUsage) GetUsedEntityId() stringfunc (*ResourceUsage) ProtoMessage
func (*ResourceUsage) ProtoMessage()func (*ResourceUsage) ProtoReflect
func (x *ResourceUsage) ProtoReflect() protoreflect.Messagefunc (*ResourceUsage) Reset
func (x *ResourceUsage) Reset()func (*ResourceUsage) String
func (x *ResourceUsage) String() stringResource_ResourceType
type Resource_ResourceType int32The type of resource.
Resource_UNSPECIFIED, Resource_MUTEX, Resource_TASK, Resource_PIPE, Resource_DEVICE, Resource_FIREWALL_RULE, Resource_MAILBOX_FOLDER, Resource_VPC_NETWORK, Resource_VIRTUAL_MACHINE, Resource_STORAGE_BUCKET, Resource_STORAGE_OBJECT, Resource_DATABASE, Resource_TABLE, Resource_CLOUD_PROJECT, Resource_CLOUD_ORGANIZATION, Resource_SERVICE_ACCOUNT, Resource_ACCESS_POLICY, Resource_CLUSTER, Resource_SETTING, Resource_DATASET, Resource_BACKEND_SERVICE, Resource_POD, Resource_CONTAINER, Resource_FUNCTION, Resource_RUNTIME, Resource_IP_ADDRESS, Resource_DISK, Resource_VOLUME, Resource_IMAGE, Resource_SNAPSHOT, Resource_REPOSITORY, Resource_CREDENTIAL, Resource_LOAD_BALANCER, Resource_GATEWAY, Resource_SUBNET, Resource_USER, Resource_SERVICE
const (
// Default type.
Resource_UNSPECIFIED Resource_ResourceType = 0
// Mutex.
Resource_MUTEX Resource_ResourceType = 1
// Task.
Resource_TASK Resource_ResourceType = 2
// Named pipe.
Resource_PIPE Resource_ResourceType = 3
// Device.
Resource_DEVICE Resource_ResourceType = 4
// Firewall rule.
Resource_FIREWALL_RULE Resource_ResourceType = 5
// Mailbox folder.
Resource_MAILBOX_FOLDER Resource_ResourceType = 6
// VPC Network.
Resource_VPC_NETWORK Resource_ResourceType = 7
// Virtual machine.
Resource_VIRTUAL_MACHINE Resource_ResourceType = 8
// Storage bucket.
Resource_STORAGE_BUCKET Resource_ResourceType = 9
// Storage object.
Resource_STORAGE_OBJECT Resource_ResourceType = 10
// Database.
Resource_DATABASE Resource_ResourceType = 11
// Data table.
Resource_TABLE Resource_ResourceType = 12
// Cloud project.
Resource_CLOUD_PROJECT Resource_ResourceType = 13
// Cloud organization.
Resource_CLOUD_ORGANIZATION Resource_ResourceType = 14
// Service account.
Resource_SERVICE_ACCOUNT Resource_ResourceType = 15
// Access policy.
Resource_ACCESS_POLICY Resource_ResourceType = 16
// Cluster.
Resource_CLUSTER Resource_ResourceType = 17
// Settings.
Resource_SETTING Resource_ResourceType = 18
// Dataset.
Resource_DATASET Resource_ResourceType = 19
// Endpoint that receive traffic from a load balancer or proxy.
Resource_BACKEND_SERVICE Resource_ResourceType = 20
// Pod, which is a collection of containers. Often used in Kubernetes.
Resource_POD Resource_ResourceType = 21
// Container.
Resource_CONTAINER Resource_ResourceType = 22
// Cloud function.
Resource_FUNCTION Resource_ResourceType = 23
// Runtime.
Resource_RUNTIME Resource_ResourceType = 24
// IP address.
Resource_IP_ADDRESS Resource_ResourceType = 25
// Disk.
Resource_DISK Resource_ResourceType = 26
// Volume.
Resource_VOLUME Resource_ResourceType = 27
// Machine image.
Resource_IMAGE Resource_ResourceType = 28
// Snapshot.
Resource_SNAPSHOT Resource_ResourceType = 29
// Repository.
Resource_REPOSITORY Resource_ResourceType = 30
// Credential, e.g. access keys, ssh keys, tokens, certificates.
Resource_CREDENTIAL Resource_ResourceType = 31
// Load balancer.
Resource_LOAD_BALANCER Resource_ResourceType = 32
// Gateway.
Resource_GATEWAY Resource_ResourceType = 33
// Subnet.
Resource_SUBNET Resource_ResourceType = 34
// User.
Resource_USER Resource_ResourceType = 35
// Service.
Resource_SERVICE Resource_ResourceType = 36
)func (Resource_ResourceType) Descriptor
func (Resource_ResourceType) Descriptor() protoreflect.EnumDescriptorfunc (Resource_ResourceType) Enum
func (x Resource_ResourceType) Enum() *Resource_ResourceTypefunc (Resource_ResourceType) EnumDescriptor
func (Resource_ResourceType) EnumDescriptor() ([]byte, []int)Deprecated: Use Resource_ResourceType.Descriptor instead.
func (Resource_ResourceType) Number
func (x Resource_ResourceType) Number() protoreflect.EnumNumberfunc (Resource_ResourceType) String
func (x Resource_ResourceType) String() stringfunc (Resource_ResourceType) Type
func (Resource_ResourceType) Type() protoreflect.EnumTypeResponsePlatformInfo
type ResponsePlatformInfo struct {
// Id of the alert in SOAR product.
AlertId string `protobuf:"bytes,2,opt,name=alert_id,json=alertId,proto3" json:"alert_id,omitempty"`
// Type of SOAR product.
ResponsePlatformType ResponsePlatformInfo_ResponsePlatformType `protobuf:"varint,3,opt,name=response_platform_type,json=responsePlatformType,proto3,enum=google.backstory.ResponsePlatformInfo_ResponsePlatformType" json:"response_platform_type,omitempty"`
// contains filtered or unexported fields
}Related info of an Alert in customer's SOAR platform.
func (*ResponsePlatformInfo) Descriptor
func (*ResponsePlatformInfo) Descriptor() ([]byte, []int)Deprecated: Use ResponsePlatformInfo.ProtoReflect.Descriptor instead.
func (*ResponsePlatformInfo) GetAlertId
func (x *ResponsePlatformInfo) GetAlertId() stringfunc (*ResponsePlatformInfo) GetResponsePlatformType
func (x *ResponsePlatformInfo) GetResponsePlatformType() ResponsePlatformInfo_ResponsePlatformTypefunc (*ResponsePlatformInfo) ProtoMessage
func (*ResponsePlatformInfo) ProtoMessage()func (*ResponsePlatformInfo) ProtoReflect
func (x *ResponsePlatformInfo) ProtoReflect() protoreflect.Messagefunc (*ResponsePlatformInfo) Reset
func (x *ResponsePlatformInfo) Reset()func (*ResponsePlatformInfo) String
func (x *ResponsePlatformInfo) String() stringResponsePlatformInfo_ResponsePlatformType
type ResponsePlatformInfo_ResponsePlatformType int32Available response platforms.
ResponsePlatformInfo_RESPONSE_PLATFORM_TYPE_UNSPECIFIED, ResponsePlatformInfo_RESPONSE_PLATFORM_TYPE_SIEMPLIFY
const (
// Response platform not specified.
ResponsePlatformInfo_RESPONSE_PLATFORM_TYPE_UNSPECIFIED ResponsePlatformInfo_ResponsePlatformType = 0
// Siemplify
ResponsePlatformInfo_RESPONSE_PLATFORM_TYPE_SIEMPLIFY ResponsePlatformInfo_ResponsePlatformType = 1
)func (ResponsePlatformInfo_ResponsePlatformType) Descriptor
func (ResponsePlatformInfo_ResponsePlatformType) Descriptor() protoreflect.EnumDescriptorfunc (ResponsePlatformInfo_ResponsePlatformType) Enum
func (x ResponsePlatformInfo_ResponsePlatformType) Enum() *ResponsePlatformInfo_ResponsePlatformTypefunc (ResponsePlatformInfo_ResponsePlatformType) EnumDescriptor
func (ResponsePlatformInfo_ResponsePlatformType) EnumDescriptor() ([]byte, []int)Deprecated: Use ResponsePlatformInfo_ResponsePlatformType.Descriptor instead.
func (ResponsePlatformInfo_ResponsePlatformType) Number
func (x ResponsePlatformInfo_ResponsePlatformType) Number() protoreflect.EnumNumberfunc (ResponsePlatformInfo_ResponsePlatformType) String
func (x ResponsePlatformInfo_ResponsePlatformType) String() stringfunc (ResponsePlatformInfo_ResponsePlatformType) Type
func (ResponsePlatformInfo_ResponsePlatformType) Type() protoreflect.EnumTypeRiskDelta
type RiskDelta struct {
// End time of the previous time window.
PreviousRangeEndTime *timestamppb.Timestamp `protobuf:"bytes,1,opt,name=previous_range_end_time,json=previousRangeEndTime,proto3" json:"previous_range_end_time,omitempty"`
// Difference in the normalized risk score from the previous recorded value.
RiskScoreDelta int32 `protobuf:"varint,2,opt,name=risk_score_delta,json=riskScoreDelta,proto3" json:"risk_score_delta,omitempty"`
// Risk score from previous risk window
PreviousRiskScore int32 `protobuf:"varint,3,opt,name=previous_risk_score,json=previousRiskScore,proto3" json:"previous_risk_score,omitempty"`
// Numeric change between current and previous risk score
RiskScoreNumericDelta int32 `protobuf:"varint,4,opt,name=risk_score_numeric_delta,json=riskScoreNumericDelta,proto3" json:"risk_score_numeric_delta,omitempty"`
// contains filtered or unexported fields
}Describes the difference in risk score between two points in time.
func (*RiskDelta) Descriptor
Deprecated: Use RiskDelta.ProtoReflect.Descriptor instead.
func (*RiskDelta) GetPreviousRangeEndTime
func (x *RiskDelta) GetPreviousRangeEndTime() *timestamppb.Timestampfunc (*RiskDelta) GetPreviousRiskScore
func (*RiskDelta) GetRiskScoreDelta
func (*RiskDelta) GetRiskScoreNumericDelta
func (*RiskDelta) ProtoMessage
func (*RiskDelta) ProtoMessage()func (*RiskDelta) ProtoReflect
func (x *RiskDelta) ProtoReflect() protoreflect.Messagefunc (*RiskDelta) Reset
func (x *RiskDelta) Reset()func (*RiskDelta) String
Role
type Role struct {
// System role name for user.
Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
// System role description for user.
Description string `protobuf:"bytes,2,opt,name=description,proto3" json:"description,omitempty"`
// System role type for well known roles.
Type Role_Type `protobuf:"varint,3,opt,name=type,proto3,enum=google.backstory.Role_Type" json:"type,omitempty"`
// contains filtered or unexported fields
}System role for resource access and modification.
func (*Role) Descriptor
Deprecated: Use Role.ProtoReflect.Descriptor instead.
func (*Role) GetDescription
func (*Role) GetName
func (*Role) GetType
func (*Role) ProtoMessage
func (*Role) ProtoMessage()func (*Role) ProtoReflect
func (x *Role) ProtoReflect() protoreflect.Messagefunc (*Role) Reset
func (x *Role) Reset()func (*Role) String
Role_Type
type Role_Type int32Well-known system roles.
Role_TYPE_UNSPECIFIED, Role_ADMINISTRATOR, Role_SERVICE_ACCOUNT
const (
// Default user role.
Role_TYPE_UNSPECIFIED Role_Type = 0
// Product administrator with elevated privileges.
Role_ADMINISTRATOR Role_Type = 1
// System service account for automated privilege access.
Role_SERVICE_ACCOUNT Role_Type = 2
)func (Role_Type) Descriptor
func (Role_Type) Descriptor() protoreflect.EnumDescriptorfunc (Role_Type) Enum
func (Role_Type) EnumDescriptor
Deprecated: Use Role_Type.Descriptor instead.
func (Role_Type) Number
func (x Role_Type) Number() protoreflect.EnumNumberfunc (Role_Type) String
func (Role_Type) Type
func (Role_Type) Type() protoreflect.EnumTypeSSLCertificate
type SSLCertificate struct {
// Certificate's signature and algorithm.
CertSignature *SSLCertificate_CertSignature `protobuf:"bytes,1,opt,name=cert_signature,json=certSignature,proto3" json:"cert_signature,omitempty"`
// (DEPRECATED) certificate's extension.
//
// Deprecated: Marked as deprecated in backstory/udm.proto.
Extension *SSLCertificate_Extension `protobuf:"bytes,2,opt,name=extension,proto3" json:"extension,omitempty"`
// Certificate's extensions.
CertExtensions *structpb.Struct `protobuf:"bytes,14,opt,name=cert_extensions,json=certExtensions,proto3" json:"cert_extensions,omitempty"`
// Date the certificate was first retrieved by VirusTotal.
FirstSeenTime *timestamppb.Timestamp `protobuf:"bytes,3,opt,name=first_seen_time,json=firstSeenTime,proto3" json:"first_seen_time,omitempty"`
// Certificate's issuer data.
Issuer *SSLCertificate_Subject `protobuf:"bytes,4,opt,name=issuer,proto3" json:"issuer,omitempty"`
// EC public key information.
Ec *SSLCertificate_EC `protobuf:"bytes,5,opt,name=ec,proto3" json:"ec,omitempty"`
// Certificate's serial number hexdump.
SerialNumber string `protobuf:"bytes,6,opt,name=serial_number,json=serialNumber,proto3" json:"serial_number,omitempty"`
// Algorithm used for the signature (for example, "sha1RSA").
SignatureAlgorithm string `protobuf:"bytes,7,opt,name=signature_algorithm,json=signatureAlgorithm,proto3" json:"signature_algorithm,omitempty"`
// Certificate content length.
Size int64 `protobuf:"varint,8,opt,name=size,proto3" json:"size,omitempty"`
// Certificate's subject data.
Subject *SSLCertificate_Subject `protobuf:"bytes,9,opt,name=subject,proto3" json:"subject,omitempty"`
// Certificate's content SHA1 hash.
Thumbprint string `protobuf:"bytes,10,opt,name=thumbprint,proto3" json:"thumbprint,omitempty"`
// Certificate's content SHA256 hash.
ThumbprintSha256 string `protobuf:"bytes,11,opt,name=thumbprint_sha256,json=thumbprintSha256,proto3" json:"thumbprint_sha256,omitempty"`
// Certificate's validity period.
Validity *SSLCertificate_Validity `protobuf:"bytes,12,opt,name=validity,proto3" json:"validity,omitempty"`
// Certificate version (typically "V1", "V2" or "V3").
Version string `protobuf:"bytes,13,opt,name=version,proto3" json:"version,omitempty"`
// Public key information.
PublicKey *SSLCertificate_PublicKey `protobuf:"bytes,15,opt,name=public_key,json=publicKey,proto3" json:"public_key,omitempty"`
// contains filtered or unexported fields
}SSL certificate.
func (*SSLCertificate) Descriptor
func (*SSLCertificate) Descriptor() ([]byte, []int)Deprecated: Use SSLCertificate.ProtoReflect.Descriptor instead.
func (*SSLCertificate) GetCertExtensions
func (x *SSLCertificate) GetCertExtensions() *structpb.Structfunc (*SSLCertificate) GetCertSignature
func (x *SSLCertificate) GetCertSignature() *SSLCertificate_CertSignaturefunc (*SSLCertificate) GetEc
func (x *SSLCertificate) GetEc() *SSLCertificate_ECfunc (*SSLCertificate) GetExtension
func (x *SSLCertificate) GetExtension() *SSLCertificate_ExtensionDeprecated: Marked as deprecated in backstory/udm.proto.
func (*SSLCertificate) GetFirstSeenTime
func (x *SSLCertificate) GetFirstSeenTime() *timestamppb.Timestampfunc (*SSLCertificate) GetIssuer
func (x *SSLCertificate) GetIssuer() *SSLCertificate_Subjectfunc (*SSLCertificate) GetPublicKey
func (x *SSLCertificate) GetPublicKey() *SSLCertificate_PublicKeyfunc (*SSLCertificate) GetSerialNumber
func (x *SSLCertificate) GetSerialNumber() stringfunc (*SSLCertificate) GetSignatureAlgorithm
func (x *SSLCertificate) GetSignatureAlgorithm() stringfunc (*SSLCertificate) GetSize
func (x *SSLCertificate) GetSize() int64func (*SSLCertificate) GetSubject
func (x *SSLCertificate) GetSubject() *SSLCertificate_Subjectfunc (*SSLCertificate) GetThumbprint
func (x *SSLCertificate) GetThumbprint() stringfunc (*SSLCertificate) GetThumbprintSha256
func (x *SSLCertificate) GetThumbprintSha256() stringfunc (*SSLCertificate) GetValidity
func (x *SSLCertificate) GetValidity() *SSLCertificate_Validityfunc (*SSLCertificate) GetVersion
func (x *SSLCertificate) GetVersion() stringfunc (*SSLCertificate) ProtoMessage
func (*SSLCertificate) ProtoMessage()func (*SSLCertificate) ProtoReflect
func (x *SSLCertificate) ProtoReflect() protoreflect.Messagefunc (*SSLCertificate) Reset
func (x *SSLCertificate) Reset()func (*SSLCertificate) String
func (x *SSLCertificate) String() stringSSLCertificate_AuthorityKeyId
type SSLCertificate_AuthorityKeyId struct {
// Key hexdump.
Keyid string `protobuf:"bytes,1,opt,name=keyid,proto3" json:"keyid,omitempty"`
// Serial number hexdump.
SerialNumber string `protobuf:"bytes,2,opt,name=serial_number,json=serialNumber,proto3" json:"serial_number,omitempty"`
// contains filtered or unexported fields
}Identifies the public key to be used to verify the signature on this certificate or CRL.
func (*SSLCertificate_AuthorityKeyId) Descriptor
func (*SSLCertificate_AuthorityKeyId) Descriptor() ([]byte, []int)Deprecated: Use SSLCertificate_AuthorityKeyId.ProtoReflect.Descriptor instead.
func (*SSLCertificate_AuthorityKeyId) GetKeyid
func (x *SSLCertificate_AuthorityKeyId) GetKeyid() stringfunc (*SSLCertificate_AuthorityKeyId) GetSerialNumber
func (x *SSLCertificate_AuthorityKeyId) GetSerialNumber() stringfunc (*SSLCertificate_AuthorityKeyId) ProtoMessage
func (*SSLCertificate_AuthorityKeyId) ProtoMessage()func (*SSLCertificate_AuthorityKeyId) ProtoReflect
func (x *SSLCertificate_AuthorityKeyId) ProtoReflect() protoreflect.Messagefunc (*SSLCertificate_AuthorityKeyId) Reset
func (x *SSLCertificate_AuthorityKeyId) Reset()func (*SSLCertificate_AuthorityKeyId) String
func (x *SSLCertificate_AuthorityKeyId) String() stringSSLCertificate_CertSignature
type SSLCertificate_CertSignature struct {
// Signature.
Signature string `protobuf:"bytes,1,opt,name=signature,proto3" json:"signature,omitempty"`
// Algorithm.
SignatureAlgorithm string `protobuf:"bytes,2,opt,name=signature_algorithm,json=signatureAlgorithm,proto3" json:"signature_algorithm,omitempty"`
// contains filtered or unexported fields
}Certificate's signature and algorithm.
func (*SSLCertificate_CertSignature) Descriptor
func (*SSLCertificate_CertSignature) Descriptor() ([]byte, []int)Deprecated: Use SSLCertificate_CertSignature.ProtoReflect.Descriptor instead.
func (*SSLCertificate_CertSignature) GetSignature
func (x *SSLCertificate_CertSignature) GetSignature() stringfunc (*SSLCertificate_CertSignature) GetSignatureAlgorithm
func (x *SSLCertificate_CertSignature) GetSignatureAlgorithm() stringfunc (*SSLCertificate_CertSignature) ProtoMessage
func (*SSLCertificate_CertSignature) ProtoMessage()func (*SSLCertificate_CertSignature) ProtoReflect
func (x *SSLCertificate_CertSignature) ProtoReflect() protoreflect.Messagefunc (*SSLCertificate_CertSignature) Reset
func (x *SSLCertificate_CertSignature) Reset()func (*SSLCertificate_CertSignature) String
func (x *SSLCertificate_CertSignature) String() stringSSLCertificate_EC
type SSLCertificate_EC struct {
// Curve name.
Oid string `protobuf:"bytes,1,opt,name=oid,proto3" json:"oid,omitempty"`
// Public key hexdump.
Pub string `protobuf:"bytes,2,opt,name=pub,proto3" json:"pub,omitempty"`
// contains filtered or unexported fields
}EC public key information.
func (*SSLCertificate_EC) Descriptor
func (*SSLCertificate_EC) Descriptor() ([]byte, []int)Deprecated: Use SSLCertificate_EC.ProtoReflect.Descriptor instead.
func (*SSLCertificate_EC) GetOid
func (x *SSLCertificate_EC) GetOid() stringfunc (*SSLCertificate_EC) GetPub
func (x *SSLCertificate_EC) GetPub() stringfunc (*SSLCertificate_EC) ProtoMessage
func (*SSLCertificate_EC) ProtoMessage()func (*SSLCertificate_EC) ProtoReflect
func (x *SSLCertificate_EC) ProtoReflect() protoreflect.Messagefunc (*SSLCertificate_EC) Reset
func (x *SSLCertificate_EC) Reset()func (*SSLCertificate_EC) String
func (x *SSLCertificate_EC) String() stringSSLCertificate_Extension
type SSLCertificate_Extension struct {
// Whether the subject acts as a certificate authority (CA) or not.
Ca bool `protobuf:"varint,1,opt,name=ca,proto3" json:"ca,omitempty"`
// Identifies the public key being certified.
SubjectKeyId string `protobuf:"bytes,2,opt,name=subject_key_id,json=subjectKeyId,proto3" json:"subject_key_id,omitempty"`
// Identifies the public key to be used to verify the signature on this
// certificate or CRL.
AuthorityKeyId *SSLCertificate_AuthorityKeyId `protobuf:"bytes,3,opt,name=authority_key_id,json=authorityKeyId,proto3" json:"authority_key_id,omitempty"`
// The purpose for which the certified public key is used.
KeyUsage string `protobuf:"bytes,6,opt,name=key_usage,json=keyUsage,proto3" json:"key_usage,omitempty"`
// Authority information access locations are URLs that are added to a
// certificate in its authority information access extension.
CaInfoAccess string `protobuf:"bytes,7,opt,name=ca_info_access,json=caInfoAccess,proto3" json:"ca_info_access,omitempty"`
// CRL distribution points to which a certificate user should refer to
// ascertain if the certificate has been revoked.
CrlDistributionPoints string `protobuf:"bytes,8,opt,name=crl_distribution_points,json=crlDistributionPoints,proto3" json:"crl_distribution_points,omitempty"`
// One or more purposes for which the certified public key may be used, in
// addition to or in place of the basic purposes indicated in the key usage
// extension field.
ExtendedKeyUsage string `protobuf:"bytes,9,opt,name=extended_key_usage,json=extendedKeyUsage,proto3" json:"extended_key_usage,omitempty"`
// Contains one or more alternative names, using any of a variety of name
// forms, for the entity that is bound by the CA to the certified public
// key.
SubjectAlternativeName string `protobuf:"bytes,10,opt,name=subject_alternative_name,json=subjectAlternativeName,proto3" json:"subject_alternative_name,omitempty"`
// Different certificate policies will relate to different applications
// which may use the certified key.
CertificatePolicies string `protobuf:"bytes,11,opt,name=certificate_policies,json=certificatePolicies,proto3" json:"certificate_policies,omitempty"`
// Used to include free-form text comments inside certificates.
NetscapeCertComment string `protobuf:"bytes,12,opt,name=netscape_cert_comment,json=netscapeCertComment,proto3" json:"netscape_cert_comment,omitempty"`
// BMP data value "DomainController". See MS Q291010.
CertTemplateNameDc string `protobuf:"bytes,13,opt,name=cert_template_name_dc,json=certTemplateNameDc,proto3" json:"cert_template_name_dc,omitempty"`
// Identify whether the certificate subject is an SSL client, an SSL server,
// or a CA.
NetscapeCertificate bool `protobuf:"varint,14,opt,name=netscape_certificate,json=netscapeCertificate,proto3" json:"netscape_certificate,omitempty"`
// Whether the certificate includes a logotype.
PeLogotype bool `protobuf:"varint,15,opt,name=pe_logotype,json=peLogotype,proto3" json:"pe_logotype,omitempty"`
// Whether the certificate has an old authority key identifier extension.
OldAuthorityKeyId bool `protobuf:"varint,16,opt,name=old_authority_key_id,json=oldAuthorityKeyId,proto3" json:"old_authority_key_id,omitempty"`
// contains filtered or unexported fields
}Certificate's extensions.
func (*SSLCertificate_Extension) Descriptor
func (*SSLCertificate_Extension) Descriptor() ([]byte, []int)Deprecated: Use SSLCertificate_Extension.ProtoReflect.Descriptor instead.
func (*SSLCertificate_Extension) GetAuthorityKeyId
func (x *SSLCertificate_Extension) GetAuthorityKeyId() *SSLCertificate_AuthorityKeyIdfunc (*SSLCertificate_Extension) GetCa
func (x *SSLCertificate_Extension) GetCa() boolfunc (*SSLCertificate_Extension) GetCaInfoAccess
func (x *SSLCertificate_Extension) GetCaInfoAccess() stringfunc (*SSLCertificate_Extension) GetCertTemplateNameDc
func (x *SSLCertificate_Extension) GetCertTemplateNameDc() stringfunc (*SSLCertificate_Extension) GetCertificatePolicies
func (x *SSLCertificate_Extension) GetCertificatePolicies() stringfunc (*SSLCertificate_Extension) GetCrlDistributionPoints
func (x *SSLCertificate_Extension) GetCrlDistributionPoints() stringfunc (*SSLCertificate_Extension) GetExtendedKeyUsage
func (x *SSLCertificate_Extension) GetExtendedKeyUsage() stringfunc (*SSLCertificate_Extension) GetKeyUsage
func (x *SSLCertificate_Extension) GetKeyUsage() stringfunc (*SSLCertificate_Extension) GetNetscapeCertComment
func (x *SSLCertificate_Extension) GetNetscapeCertComment() stringfunc (*SSLCertificate_Extension) GetNetscapeCertificate
func (x *SSLCertificate_Extension) GetNetscapeCertificate() boolfunc (*SSLCertificate_Extension) GetOldAuthorityKeyId
func (x *SSLCertificate_Extension) GetOldAuthorityKeyId() boolfunc (*SSLCertificate_Extension) GetPeLogotype
func (x *SSLCertificate_Extension) GetPeLogotype() boolfunc (*SSLCertificate_Extension) GetSubjectAlternativeName
func (x *SSLCertificate_Extension) GetSubjectAlternativeName() stringfunc (*SSLCertificate_Extension) GetSubjectKeyId
func (x *SSLCertificate_Extension) GetSubjectKeyId() stringfunc (*SSLCertificate_Extension) ProtoMessage
func (*SSLCertificate_Extension) ProtoMessage()func (*SSLCertificate_Extension) ProtoReflect
func (x *SSLCertificate_Extension) ProtoReflect() protoreflect.Messagefunc (*SSLCertificate_Extension) Reset
func (x *SSLCertificate_Extension) Reset()func (*SSLCertificate_Extension) String
func (x *SSLCertificate_Extension) String() stringSSLCertificate_PublicKey
type SSLCertificate_PublicKey struct {
// Any of "RSA", "DSA" or "EC". Indicates the algorithm used to generate the
// certificate.
Algorithm string `protobuf:"bytes,1,opt,name=algorithm,proto3" json:"algorithm,omitempty"`
// RSA public key information.
Rsa *SSLCertificate_RSA `protobuf:"bytes,2,opt,name=rsa,proto3" json:"rsa,omitempty"`
// contains filtered or unexported fields
}Subject public key info.
func (*SSLCertificate_PublicKey) Descriptor
func (*SSLCertificate_PublicKey) Descriptor() ([]byte, []int)Deprecated: Use SSLCertificate_PublicKey.ProtoReflect.Descriptor instead.
func (*SSLCertificate_PublicKey) GetAlgorithm
func (x *SSLCertificate_PublicKey) GetAlgorithm() stringfunc (*SSLCertificate_PublicKey) GetRsa
func (x *SSLCertificate_PublicKey) GetRsa() *SSLCertificate_RSAfunc (*SSLCertificate_PublicKey) ProtoMessage
func (*SSLCertificate_PublicKey) ProtoMessage()func (*SSLCertificate_PublicKey) ProtoReflect
func (x *SSLCertificate_PublicKey) ProtoReflect() protoreflect.Messagefunc (*SSLCertificate_PublicKey) Reset
func (x *SSLCertificate_PublicKey) Reset()func (*SSLCertificate_PublicKey) String
func (x *SSLCertificate_PublicKey) String() stringSSLCertificate_RSA
type SSLCertificate_RSA struct {
// Key size.
KeySize int64 `protobuf:"varint,1,opt,name=key_size,json=keySize,proto3" json:"key_size,omitempty"`
// Key modulus hexdump.
Modulus string `protobuf:"bytes,2,opt,name=modulus,proto3" json:"modulus,omitempty"`
// Key exponent hexdump.
Exponent string `protobuf:"bytes,3,opt,name=exponent,proto3" json:"exponent,omitempty"`
// contains filtered or unexported fields
}RSA public key information.
func (*SSLCertificate_RSA) Descriptor
func (*SSLCertificate_RSA) Descriptor() ([]byte, []int)Deprecated: Use SSLCertificate_RSA.ProtoReflect.Descriptor instead.
func (*SSLCertificate_RSA) GetExponent
func (x *SSLCertificate_RSA) GetExponent() stringfunc (*SSLCertificate_RSA) GetKeySize
func (x *SSLCertificate_RSA) GetKeySize() int64func (*SSLCertificate_RSA) GetModulus
func (x *SSLCertificate_RSA) GetModulus() stringfunc (*SSLCertificate_RSA) ProtoMessage
func (*SSLCertificate_RSA) ProtoMessage()func (*SSLCertificate_RSA) ProtoReflect
func (x *SSLCertificate_RSA) ProtoReflect() protoreflect.Messagefunc (*SSLCertificate_RSA) Reset
func (x *SSLCertificate_RSA) Reset()func (*SSLCertificate_RSA) String
func (x *SSLCertificate_RSA) String() stringSSLCertificate_Subject
type SSLCertificate_Subject struct {
// C: Country name.
CountryName string `protobuf:"bytes,1,opt,name=country_name,json=countryName,proto3" json:"country_name,omitempty"`
// CN: CommonName.
CommonName string `protobuf:"bytes,2,opt,name=common_name,json=commonName,proto3" json:"common_name,omitempty"`
// L: Locality.
Locality string `protobuf:"bytes,3,opt,name=locality,proto3" json:"locality,omitempty"`
// O: Organization.
Organization string `protobuf:"bytes,4,opt,name=organization,proto3" json:"organization,omitempty"`
// OU: OrganizationalUnit.
OrganizationalUnit string `protobuf:"bytes,5,opt,name=organizational_unit,json=organizationalUnit,proto3" json:"organizational_unit,omitempty"`
// ST: StateOrProvinceName.
StateOrProvinceName string `protobuf:"bytes,6,opt,name=state_or_province_name,json=stateOrProvinceName,proto3" json:"state_or_province_name,omitempty"`
// contains filtered or unexported fields
}Subject data.
func (*SSLCertificate_Subject) Descriptor
func (*SSLCertificate_Subject) Descriptor() ([]byte, []int)Deprecated: Use SSLCertificate_Subject.ProtoReflect.Descriptor instead.
func (*SSLCertificate_Subject) GetCommonName
func (x *SSLCertificate_Subject) GetCommonName() stringfunc (*SSLCertificate_Subject) GetCountryName
func (x *SSLCertificate_Subject) GetCountryName() stringfunc (*SSLCertificate_Subject) GetLocality
func (x *SSLCertificate_Subject) GetLocality() stringfunc (*SSLCertificate_Subject) GetOrganization
func (x *SSLCertificate_Subject) GetOrganization() stringfunc (*SSLCertificate_Subject) GetOrganizationalUnit
func (x *SSLCertificate_Subject) GetOrganizationalUnit() stringfunc (*SSLCertificate_Subject) GetStateOrProvinceName
func (x *SSLCertificate_Subject) GetStateOrProvinceName() stringfunc (*SSLCertificate_Subject) ProtoMessage
func (*SSLCertificate_Subject) ProtoMessage()func (*SSLCertificate_Subject) ProtoReflect
func (x *SSLCertificate_Subject) ProtoReflect() protoreflect.Messagefunc (*SSLCertificate_Subject) Reset
func (x *SSLCertificate_Subject) Reset()func (*SSLCertificate_Subject) String
func (x *SSLCertificate_Subject) String() stringSSLCertificate_Validity
type SSLCertificate_Validity struct {
// Expiry date.
ExpiryTime *timestamppb.Timestamp `protobuf:"bytes,1,opt,name=expiry_time,json=expiryTime,proto3" json:"expiry_time,omitempty"`
// Issue date.
IssueTime *timestamppb.Timestamp `protobuf:"bytes,2,opt,name=issue_time,json=issueTime,proto3" json:"issue_time,omitempty"`
// contains filtered or unexported fields
}Defines certificate's validity period.
func (*SSLCertificate_Validity) Descriptor
func (*SSLCertificate_Validity) Descriptor() ([]byte, []int)Deprecated: Use SSLCertificate_Validity.ProtoReflect.Descriptor instead.
func (*SSLCertificate_Validity) GetExpiryTime
func (x *SSLCertificate_Validity) GetExpiryTime() *timestamppb.Timestampfunc (*SSLCertificate_Validity) GetIssueTime
func (x *SSLCertificate_Validity) GetIssueTime() *timestamppb.Timestampfunc (*SSLCertificate_Validity) ProtoMessage
func (*SSLCertificate_Validity) ProtoMessage()func (*SSLCertificate_Validity) ProtoReflect
func (x *SSLCertificate_Validity) ProtoReflect() protoreflect.Messagefunc (*SSLCertificate_Validity) Reset
func (x *SSLCertificate_Validity) Reset()func (*SSLCertificate_Validity) String
func (x *SSLCertificate_Validity) String() stringScheduledAnacronTask
type ScheduledAnacronTask struct {
// Anacrontab period field. Value is an integer in days,
// or a string like "@daily", "@weekly", or "@monthly".
Period string `protobuf:"bytes,1,opt,name=period,proto3" json:"period,omitempty"`
// The delay in minutes before the job is run.
DelayMinutes int64 `protobuf:"varint,2,opt,name=delay_minutes,json=delayMinutes,proto3" json:"delay_minutes,omitempty"`
// The unique identifier of the job.
JobId string `protobuf:"bytes,3,opt,name=job_id,json=jobId,proto3" json:"job_id,omitempty"`
// The PATH environment variable defined in the anacrontab file.
Path string `protobuf:"bytes,4,opt,name=path,proto3" json:"path,omitempty"`
// The original source line from the anacrontab file.
SourceLine string `protobuf:"bytes,5,opt,name=source_line,json=sourceLine,proto3" json:"source_line,omitempty"`
// contains filtered or unexported fields
}Information about a scheduled anacron task.
func (*ScheduledAnacronTask) Descriptor
func (*ScheduledAnacronTask) Descriptor() ([]byte, []int)Deprecated: Use ScheduledAnacronTask.ProtoReflect.Descriptor instead.
func (*ScheduledAnacronTask) GetDelayMinutes
func (x *ScheduledAnacronTask) GetDelayMinutes() int64func (*ScheduledAnacronTask) GetJobId
func (x *ScheduledAnacronTask) GetJobId() stringfunc (*ScheduledAnacronTask) GetPath
func (x *ScheduledAnacronTask) GetPath() stringfunc (*ScheduledAnacronTask) GetPeriod
func (x *ScheduledAnacronTask) GetPeriod() stringfunc (*ScheduledAnacronTask) GetSourceLine
func (x *ScheduledAnacronTask) GetSourceLine() stringfunc (*ScheduledAnacronTask) ProtoMessage
func (*ScheduledAnacronTask) ProtoMessage()func (*ScheduledAnacronTask) ProtoReflect
func (x *ScheduledAnacronTask) ProtoReflect() protoreflect.Messagefunc (*ScheduledAnacronTask) Reset
func (x *ScheduledAnacronTask) Reset()func (*ScheduledAnacronTask) String
func (x *ScheduledAnacronTask) String() stringScheduledCronTask
type ScheduledCronTask struct {
// Crontab minute field. Value is an integer between 0 and 59 and can also be
// a range or list of values (e.g., "0-59", "0-59/5", "0,15,30,45") and it //
// can also be an asterisk (*) to indicate first-last minutes. More on crontab
// format can be found here: https://www.linux.org/docs/man5/crontab.html
Minute string `protobuf:"bytes,1,opt,name=minute,proto3" json:"minute,omitempty"`
// Crontab hour field. Value is an integer between 0 and 23,
// a range or list of values (e.g., "0-6", "*/2", "1,2"), or
// an asterisk (*) to indicate first-last hours.
Hour string `protobuf:"bytes,2,opt,name=hour,proto3" json:"hour,omitempty"`
// Crontab day of month field. Value is an integer between 1 and 31,
// a range or list of values (e.g., "1-7", "1-31/7", "1,15"), or
// an asterisk (*) to indicate first-last days of month.
MonthDay string `protobuf:"bytes,3,opt,name=month_day,json=monthDay,proto3" json:"month_day,omitempty"`
// Crontab month field. Value is an integer between 1 and 12 or a 3-letter
// name (e.g., "Jan"), a range or list of values (e.g.,
// "1-3", "*/2", "1,6"), or an asterisk (*) to indicate first-last months.
Month string `protobuf:"bytes,4,opt,name=month,proto3" json:"month,omitempty"`
// Crontab day of week field. Value is an integer between 0 and 7 (0 or 7
// is Sunday) or a 3-letter name (e.g., "Fri"), a range
// or list of values (e.g., "1-5", "0,6"), or an asterisk
// (*) to indicate first-last days of week.
WeekDay string `protobuf:"bytes,5,opt,name=week_day,json=weekDay,proto3" json:"week_day,omitempty"`
// A comment or description for the task.
Comment string `protobuf:"bytes,6,opt,name=comment,proto3" json:"comment,omitempty"`
// The author or creator of the task.
Author string `protobuf:"bytes,7,opt,name=author,proto3" json:"author,omitempty"`
// Crontab special string or event (e.g., "@reboot", "@daily").
Event string `protobuf:"bytes,8,opt,name=event,proto3" json:"event,omitempty"`
// The PATH environment variable defined in the crontab file.
Path string `protobuf:"bytes,9,opt,name=path,proto3" json:"path,omitempty"`
// contains filtered or unexported fields
}Information about a scheduled cron task.
func (*ScheduledCronTask) Descriptor
func (*ScheduledCronTask) Descriptor() ([]byte, []int)Deprecated: Use ScheduledCronTask.ProtoReflect.Descriptor instead.
func (*ScheduledCronTask) GetAuthor
func (x *ScheduledCronTask) GetAuthor() stringfunc (*ScheduledCronTask) GetComment
func (x *ScheduledCronTask) GetComment() stringfunc (*ScheduledCronTask) GetEvent
func (x *ScheduledCronTask) GetEvent() stringfunc (*ScheduledCronTask) GetHour
func (x *ScheduledCronTask) GetHour() stringfunc (*ScheduledCronTask) GetMinute
func (x *ScheduledCronTask) GetMinute() stringfunc (*ScheduledCronTask) GetMonth
func (x *ScheduledCronTask) GetMonth() stringfunc (*ScheduledCronTask) GetMonthDay
func (x *ScheduledCronTask) GetMonthDay() stringfunc (*ScheduledCronTask) GetPath
func (x *ScheduledCronTask) GetPath() stringfunc (*ScheduledCronTask) GetWeekDay
func (x *ScheduledCronTask) GetWeekDay() stringfunc (*ScheduledCronTask) ProtoMessage
func (*ScheduledCronTask) ProtoMessage()func (*ScheduledCronTask) ProtoReflect
func (x *ScheduledCronTask) ProtoReflect() protoreflect.Messagefunc (*ScheduledCronTask) Reset
func (x *ScheduledCronTask) Reset()func (*ScheduledCronTask) String
func (x *ScheduledCronTask) String() stringScheduledTask (deprecated)
type ScheduledTask struct {
// The minute of the hour (0-59).
Minute int32 `protobuf:"varint,1,opt,name=minute,proto3" json:"minute,omitempty"`
// The hour of the day (0-23).
Hour int32 `protobuf:"varint,2,opt,name=hour,proto3" json:"hour,omitempty"`
// The day of the month (1-31).
MonthDay int32 `protobuf:"varint,3,opt,name=month_day,json=monthDay,proto3" json:"month_day,omitempty"`
// The month of the year (1-12).
Month int32 `protobuf:"varint,4,opt,name=month,proto3" json:"month,omitempty"`
// The day of the week (0-6, Sunday=0).
WeekDay int32 `protobuf:"varint,5,opt,name=week_day,json=weekDay,proto3" json:"week_day,omitempty"`
// A comment or description for the task.
Comment string `protobuf:"bytes,6,opt,name=comment,proto3" json:"comment,omitempty"`
// The account name that authored or last modified the scheduled task.
Author string `protobuf:"bytes,7,opt,name=author,proto3" json:"author,omitempty"`
// contains filtered or unexported fields
}Deprecated: use WindowsScheduledTask for Windows scheduled tasks or ScheduledCronTask for cron jobs. Information about a scheduled task.
Deprecated: Marked as deprecated in backstory/udm.proto.
func (*ScheduledTask) Descriptor (deprecated)
func (*ScheduledTask) Descriptor() ([]byte, []int)Deprecated: Use ScheduledTask.ProtoReflect.Descriptor instead.
func (*ScheduledTask) GetAuthor (deprecated)
func (x *ScheduledTask) GetAuthor() stringfunc (*ScheduledTask) GetComment (deprecated)
func (x *ScheduledTask) GetComment() stringfunc (*ScheduledTask) GetHour (deprecated)
func (x *ScheduledTask) GetHour() int32func (*ScheduledTask) GetMinute (deprecated)
func (x *ScheduledTask) GetMinute() int32func (*ScheduledTask) GetMonth (deprecated)
func (x *ScheduledTask) GetMonth() int32func (*ScheduledTask) GetMonthDay (deprecated)
func (x *ScheduledTask) GetMonthDay() int32func (*ScheduledTask) GetWeekDay (deprecated)
func (x *ScheduledTask) GetWeekDay() int32func (*ScheduledTask) ProtoMessage (deprecated)
func (*ScheduledTask) ProtoMessage()func (*ScheduledTask) ProtoReflect (deprecated)
func (x *ScheduledTask) ProtoReflect() protoreflect.Messagefunc (*ScheduledTask) Reset (deprecated)
func (x *ScheduledTask) Reset()func (*ScheduledTask) String (deprecated)
func (x *ScheduledTask) String() stringSecurityResult
type SecurityResult struct {
// If the security result is about a specific entity (Noun), add it here.
// This field is not populated when the SecurityResult appears in a detection.
About *Noun `protobuf:"bytes,1,opt,name=about,proto3" json:"about,omitempty"`
// The security category.
// This field is not populated when the SecurityResult appears in a detection.
Category []SecurityResult_SecurityCategory `protobuf:"varint,2,rep,packed,name=category,proto3,enum=google.backstory.SecurityResult_SecurityCategory" json:"category,omitempty"`
// For vendor-specific categories. For web categorization, put type in here
// such as "gambling" or "porn".
// This field is not populated when the SecurityResult appears in a detection.
CategoryDetails []string `protobuf:"bytes,3,rep,name=category_details,json=categoryDetails,proto3" json:"category_details,omitempty"`
// A vendor-assigned classification common across multiple customers
// (for example, "W32/File-A", "Slammer").
// This field is not populated when the SecurityResult appears in a detection.
ThreatName string `protobuf:"bytes,4,opt,name=threat_name,json=threatName,proto3" json:"threat_name,omitempty"`
// The curated detection's rule set identifier.
// (for example, "windows-threats")
// This is primarily set in rule-generated detections and alerts.
RuleSet string `protobuf:"bytes,29,opt,name=rule_set,json=ruleSet,proto3" json:"rule_set,omitempty"`
// The curated detections rule set display name.
// This is primarily set in rule-generated detections and alerts.
RuleSetDisplayName string `protobuf:"bytes,30,opt,name=rule_set_display_name,json=ruleSetDisplayName,proto3" json:"rule_set_display_name,omitempty"`
// The curated detection rule set category display name.
// (for example, if rule_set_display_name is "CDIR SCC Enhanced Exfiltration",
// the rule_set_category is "Cloud Threats").
// This is primarily set in rule-generated detections and alerts.
RulesetCategoryDisplayName string `protobuf:"bytes,41,opt,name=ruleset_category_display_name,json=rulesetCategoryDisplayName,proto3" json:"ruleset_category_display_name,omitempty"`
// A vendor-specific ID for a rule, varying by observer type
// (e.g. "08123", "5d2b44d0-5ef6-40f5-a704-47d61d3babbe").
RuleId string `protobuf:"bytes,16,opt,name=rule_id,json=ruleId,proto3" json:"rule_id,omitempty"`
// Name of the security rule
// (e.g. "BlockInboundToOracle").
RuleName string `protobuf:"bytes,5,opt,name=rule_name,json=ruleName,proto3" json:"rule_name,omitempty"`
// The display name of the security result.
// This is populated from 'name_override' Outcome Variable, if present.
// Otherwise, this field is not set.
DisplayName string `protobuf:"bytes,49,opt,name=display_name,json=displayName,proto3" json:"display_name,omitempty"`
// Version of the security rule.
// (e.g. "v1.1", "00001", "1604709794", "2020-11-16T23:04:19+00:00").
// Note that rule versions are source-dependant and lexical ordering
// should not be assumed.
RuleVersion string `protobuf:"bytes,20,opt,name=rule_version,json=ruleVersion,proto3" json:"rule_version,omitempty"`
// The type of security rule.
RuleType string `protobuf:"bytes,22,opt,name=rule_type,json=ruleType,proto3" json:"rule_type,omitempty"`
// Author of the security rule.
// This field is not populated when the SecurityResult appears in a detection.
RuleAuthor string `protobuf:"bytes,25,opt,name=rule_author,json=ruleAuthor,proto3" json:"rule_author,omitempty"`
// A list of rule labels that can't be captured by the other fields
// in security result
// (e.g. "reference : AnotherRule", "contributor : John").
// This is primarily set in rule-generated detections and alerts.
RuleLabels []*Label `protobuf:"bytes,26,rep,name=rule_labels,json=ruleLabels,proto3" json:"rule_labels,omitempty"`
// The alerting types of this security result.
// This is primarily set for rule-generated detections and alerts.
AlertState SecurityResult_AlertState `protobuf:"varint,21,opt,name=alert_state,json=alertState,proto3,enum=google.backstory.SecurityResult_AlertState" json:"alert_state,omitempty"`
// An ordered list of values, that represent fields in detections for a
// security finding. This list represents mapping of names of requested
// entities to their values (the security result matched variables).
//
// For Collection SecurityResults, prefer variables instead.
DetectionFields []*Label `protobuf:"bytes,23,rep,name=detection_fields,json=detectionFields,proto3" json:"detection_fields,omitempty"`
// A list of outcomes that represent the results of this security finding.
// This list represents a mapping of names of the requested outcomes,
// to a stringified version of their values.
//
// This is only populated when the SecurityResult appears in a detection.
// This is deprecated. Use variables instead.
//
// Deprecated: Marked as deprecated in backstory/udm.proto.
Outcomes []*Label `protobuf:"bytes,28,rep,name=outcomes,proto3" json:"outcomes,omitempty"`
// A list of outcomes and match variables that represent the results of this
// security finding. This list represents a mapping of names of the requested
// outcomes or match variables, to their values.
//
// This is only populated when the SecurityResult appears in a detection.
Variables map[string]*FindingVariable `protobuf:"bytes,44,rep,name=variables,proto3" json:"variables,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
// A short human-readable summary (e.g. "failed login occurred")
Summary string `protobuf:"bytes,6,opt,name=summary,proto3" json:"summary,omitempty"`
// A human-readable description (e.g. "user password was wrong").
// This can be more detailed than the summary.
Description string `protobuf:"bytes,7,opt,name=description,proto3" json:"description,omitempty"`
// Actions taken for this event.
// This field is not populated when the SecurityResult appears in a detection.
Action []SecurityResult_Action `protobuf:"varint,8,rep,packed,name=action,proto3,enum=google.backstory.SecurityResult_Action" json:"action,omitempty"`
// The detail of the action taken as provided by the vendor.
// This field is not populated when the SecurityResult appears in a detection.
ActionDetails string `protobuf:"bytes,19,opt,name=action_details,json=actionDetails,proto3" json:"action_details,omitempty"`
// The severity of the result.
Severity SecurityResult_ProductSeverity `protobuf:"varint,9,opt,name=severity,proto3,enum=google.backstory.SecurityResult_ProductSeverity" json:"severity,omitempty"`
// The confidence level of the result as estimated by the product.
// This field is not populated when the SecurityResult appears in a detection.
Confidence SecurityResult_ProductConfidence `protobuf:"varint,10,opt,name=confidence,proto3,enum=google.backstory.SecurityResult_ProductConfidence" json:"confidence,omitempty"`
// The priority of the result.
// This field is not populated when the SecurityResult appears in a detection.
Priority SecurityResult_ProductPriority `protobuf:"varint,11,opt,name=priority,proto3,enum=google.backstory.SecurityResult_ProductPriority" json:"priority,omitempty"`
// The risk score of the security result.
RiskScore float32 `protobuf:"fixed32,31,opt,name=risk_score,json=riskScore,proto3" json:"risk_score,omitempty"`
// The confidence score of the security result.
// This field is not populated when the SecurityResult appears in a detection.
ConfidenceScore float32 `protobuf:"fixed32,42,opt,name=confidence_score,json=confidenceScore,proto3" json:"confidence_score,omitempty"`
// Stores metadata about each risk analytic metric the rule uses.
// This field is not populated when the SecurityResult appears in a detection.
AnalyticsMetadata []*AnalyticsMetadata `protobuf:"bytes,43,rep,name=analytics_metadata,json=analyticsMetadata,proto3" json:"analytics_metadata,omitempty"`
// Vendor-specific severity.
// This field is not populated when the SecurityResult appears in a detection.
SeverityDetails string `protobuf:"bytes,12,opt,name=severity_details,json=severityDetails,proto3" json:"severity_details,omitempty"`
// Additional detail with regards to the confidence of a security event as
// estimated by the product vendor.
// This field is not populated when the SecurityResult appears in a detection.
ConfidenceDetails string `protobuf:"bytes,13,opt,name=confidence_details,json=confidenceDetails,proto3" json:"confidence_details,omitempty"`
// Vendor-specific information about the security result priority.
// This field is not populated when the SecurityResult appears in a detection.
PriorityDetails string `protobuf:"bytes,14,opt,name=priority_details,json=priorityDetails,proto3" json:"priority_details,omitempty"`
// URL that takes the user to the source product console for this event.
// This field is not populated when the SecurityResult appears in a detection.
UrlBackToProduct string `protobuf:"bytes,15,opt,name=url_back_to_product,json=urlBackToProduct,proto3" json:"url_back_to_product,omitempty"`
// Vendor-specific ID for a threat.
// This field is not populated when the SecurityResult appears in a detection.
ThreatId string `protobuf:"bytes,17,opt,name=threat_id,json=threatId,proto3" json:"threat_id,omitempty"`
// Vendor feed name for a threat indicator feed.
// This field is not populated when the SecurityResult appears in a detection.
ThreatFeedName string `protobuf:"bytes,27,opt,name=threat_feed_name,json=threatFeedName,proto3" json:"threat_feed_name,omitempty"`
// The attribute threat_id_namespace qualifies threat_id with an id namespace
// to get an
// unique id. The attribute threat_id by itself is not unique across Chronicle
// as it is a vendor specific id.
// This field is not populated when the SecurityResult appears in a detection.
ThreatIdNamespace Id_Namespace `protobuf:"varint,24,opt,name=threat_id_namespace,json=threatIdNamespace,proto3,enum=google.backstory.Id_Namespace" json:"threat_id_namespace,omitempty"`
// Current status of the threat
// This field is not populated when the SecurityResult appears in a detection.
ThreatStatus SecurityResult_ThreatStatus `protobuf:"varint,18,opt,name=threat_status,json=threatStatus,proto3,enum=google.backstory.SecurityResult_ThreatStatus" json:"threat_status,omitempty"`
// MITRE ATT&CK details.
// This field is not populated when the SecurityResult appears in a detection.
AttackDetails *AttackDetails `protobuf:"bytes,32,opt,name=attack_details,json=attackDetails,proto3" json:"attack_details,omitempty"`
// First time the IoC threat was discovered in the provider.
// This field is not populated when the SecurityResult appears in a detection.
FirstDiscoveredTime *timestamppb.Timestamp `protobuf:"bytes,33,opt,name=first_discovered_time,json=firstDiscoveredTime,proto3" json:"first_discovered_time,omitempty"`
// Associations related to the threat.
Associations []*SecurityResult_Association `protobuf:"bytes,34,rep,name=associations,proto3" json:"associations,omitempty"`
// Campaigns using this IOC threat.
// This is deprecated. Use threat_collections instead.
//
// Deprecated: Marked as deprecated in backstory/udm.proto.
Campaigns []string `protobuf:"bytes,35,rep,name=campaigns,proto3" json:"campaigns,omitempty"`
// Reports that reference this IOC threat. These are the report IDs.
// This is deprecated. Use threat_collections instead.
//
// Deprecated: Marked as deprecated in backstory/udm.proto.
Reports []string `protobuf:"bytes,46,rep,name=reports,proto3" json:"reports,omitempty"`
// Verdict about the IoC from the provider.
// This field is now deprecated. Use VerdictInfo instead.
//
// Deprecated: Marked as deprecated in backstory/udm.proto.
Verdict *SecurityResult_Verdict `protobuf:"bytes,36,opt,name=verdict,proto3" json:"verdict,omitempty"`
// Last time the IoC threat was updated in the provider.
// This field is not populated when the SecurityResult appears in a detection.
LastUpdatedTime *timestamppb.Timestamp `protobuf:"bytes,37,opt,name=last_updated_time,json=lastUpdatedTime,proto3" json:"last_updated_time,omitempty"`
// Verdict information about the IoC from the provider.
// This field is not populated when the SecurityResult appears in a detection.
VerdictInfo []*SecurityResult_VerdictInfo `protobuf:"bytes,38,rep,name=verdict_info,json=verdictInfo,proto3" json:"verdict_info,omitempty"`
// GCTI threat verdict on the security result entity.
// This field is not populated when the SecurityResult appears in a detection.
ThreatVerdict ThreatVerdict `protobuf:"varint,39,opt,name=threat_verdict,json=threatVerdict,proto3,enum=google.backstory.ThreatVerdict" json:"threat_verdict,omitempty"`
// Last time the IoC was seen in the provider data.
// This field is not populated when the SecurityResult appears in a detection.
LastDiscoveredTime *timestamppb.Timestamp `protobuf:"bytes,40,opt,name=last_discovered_time,json=lastDiscoveredTime,proto3" json:"last_discovered_time,omitempty"`
// The depth of the detection chain.
// Applies only to composite detections.
DetectionDepth int64 `protobuf:"varint,47,opt,name=detection_depth,json=detectionDepth,proto3" json:"detection_depth,omitempty"`
// GTI collections associated with the security result.
ThreatCollections []*SecurityResult_ThreatCollectionItem `protobuf:"bytes,48,rep,name=threat_collections,json=threatCollections,proto3" json:"threat_collections,omitempty"`
// contains filtered or unexported fields
}Security related metadata for the event. A security result might be something like "virus detected and quarantined," "malicious connection blocked," or "sensitive data included in document foo.doc." Each security result, of which there may be more than one, may either pertain to the whole event, or to a specific object or device referenced in the event (e.g. a malicious file that was detected, or a sensitive document sent as an email attachment). For security results that apply to a particular object referenced in the event, the security_results message MUST contain details about the implicated object (such as process, user, IP, domain, URL, IP, or email address) in the about field. For security results that apply to the entire event (e.g. SPAM found in this email), the about field must remain empty.
func (*SecurityResult) Descriptor
func (*SecurityResult) Descriptor() ([]byte, []int)Deprecated: Use SecurityResult.ProtoReflect.Descriptor instead.
func (*SecurityResult) GetAbout
func (x *SecurityResult) GetAbout() *Nounfunc (*SecurityResult) GetAction
func (x *SecurityResult) GetAction() []SecurityResult_Actionfunc (*SecurityResult) GetActionDetails
func (x *SecurityResult) GetActionDetails() stringfunc (*SecurityResult) GetAlertState
func (x *SecurityResult) GetAlertState() SecurityResult_AlertStatefunc (*SecurityResult) GetAnalyticsMetadata
func (x *SecurityResult) GetAnalyticsMetadata() []*AnalyticsMetadatafunc (*SecurityResult) GetAssociations
func (x *SecurityResult) GetAssociations() []*SecurityResult_Associationfunc (*SecurityResult) GetAttackDetails
func (x *SecurityResult) GetAttackDetails() *AttackDetailsfunc (*SecurityResult) GetCampaigns
func (x *SecurityResult) GetCampaigns() []stringDeprecated: Marked as deprecated in backstory/udm.proto.
func (*SecurityResult) GetCategory
func (x *SecurityResult) GetCategory() []SecurityResult_SecurityCategoryfunc (*SecurityResult) GetCategoryDetails
func (x *SecurityResult) GetCategoryDetails() []stringfunc (*SecurityResult) GetConfidence
func (x *SecurityResult) GetConfidence() SecurityResult_ProductConfidencefunc (*SecurityResult) GetConfidenceDetails
func (x *SecurityResult) GetConfidenceDetails() stringfunc (*SecurityResult) GetConfidenceScore
func (x *SecurityResult) GetConfidenceScore() float32func (*SecurityResult) GetDescription
func (x *SecurityResult) GetDescription() stringfunc (*SecurityResult) GetDetectionDepth
func (x *SecurityResult) GetDetectionDepth() int64func (*SecurityResult) GetDetectionFields
func (x *SecurityResult) GetDetectionFields() []*Labelfunc (*SecurityResult) GetDisplayName
func (x *SecurityResult) GetDisplayName() stringfunc (*SecurityResult) GetFirstDiscoveredTime
func (x *SecurityResult) GetFirstDiscoveredTime() *timestamppb.Timestampfunc (*SecurityResult) GetLastDiscoveredTime
func (x *SecurityResult) GetLastDiscoveredTime() *timestamppb.Timestampfunc (*SecurityResult) GetLastUpdatedTime
func (x *SecurityResult) GetLastUpdatedTime() *timestamppb.Timestampfunc (*SecurityResult) GetOutcomes
func (x *SecurityResult) GetOutcomes() []*LabelDeprecated: Marked as deprecated in backstory/udm.proto.
func (*SecurityResult) GetPriority
func (x *SecurityResult) GetPriority() SecurityResult_ProductPriorityfunc (*SecurityResult) GetPriorityDetails
func (x *SecurityResult) GetPriorityDetails() stringfunc (*SecurityResult) GetReports
func (x *SecurityResult) GetReports() []stringDeprecated: Marked as deprecated in backstory/udm.proto.
func (*SecurityResult) GetRiskScore
func (x *SecurityResult) GetRiskScore() float32func (*SecurityResult) GetRuleAuthor
func (x *SecurityResult) GetRuleAuthor() stringfunc (*SecurityResult) GetRuleId
func (x *SecurityResult) GetRuleId() stringfunc (*SecurityResult) GetRuleLabels
func (x *SecurityResult) GetRuleLabels() []*Labelfunc (*SecurityResult) GetRuleName
func (x *SecurityResult) GetRuleName() stringfunc (*SecurityResult) GetRuleSet
func (x *SecurityResult) GetRuleSet() stringfunc (*SecurityResult) GetRuleSetDisplayName
func (x *SecurityResult) GetRuleSetDisplayName() stringfunc (*SecurityResult) GetRuleType
func (x *SecurityResult) GetRuleType() stringfunc (*SecurityResult) GetRuleVersion
func (x *SecurityResult) GetRuleVersion() stringfunc (*SecurityResult) GetRulesetCategoryDisplayName
func (x *SecurityResult) GetRulesetCategoryDisplayName() stringfunc (*SecurityResult) GetSeverity
func (x *SecurityResult) GetSeverity() SecurityResult_ProductSeverityfunc (*SecurityResult) GetSeverityDetails
func (x *SecurityResult) GetSeverityDetails() stringfunc (*SecurityResult) GetSummary
func (x *SecurityResult) GetSummary() stringfunc (*SecurityResult) GetThreatCollections
func (x *SecurityResult) GetThreatCollections() []*SecurityResult_ThreatCollectionItemfunc (*SecurityResult) GetThreatFeedName
func (x *SecurityResult) GetThreatFeedName() stringfunc (*SecurityResult) GetThreatId
func (x *SecurityResult) GetThreatId() stringfunc (*SecurityResult) GetThreatIdNamespace
func (x *SecurityResult) GetThreatIdNamespace() Id_Namespacefunc (*SecurityResult) GetThreatName
func (x *SecurityResult) GetThreatName() stringfunc (*SecurityResult) GetThreatStatus
func (x *SecurityResult) GetThreatStatus() SecurityResult_ThreatStatusfunc (*SecurityResult) GetThreatVerdict
func (x *SecurityResult) GetThreatVerdict() ThreatVerdictfunc (*SecurityResult) GetUrlBackToProduct
func (x *SecurityResult) GetUrlBackToProduct() stringfunc (*SecurityResult) GetVariables
func (x *SecurityResult) GetVariables() map[string]*FindingVariablefunc (*SecurityResult) GetVerdict
func (x *SecurityResult) GetVerdict() *SecurityResult_VerdictDeprecated: Marked as deprecated in backstory/udm.proto.
func (*SecurityResult) GetVerdictInfo
func (x *SecurityResult) GetVerdictInfo() []*SecurityResult_VerdictInfofunc (*SecurityResult) ProtoMessage
func (*SecurityResult) ProtoMessage()func (*SecurityResult) ProtoReflect
func (x *SecurityResult) ProtoReflect() protoreflect.Messagefunc (*SecurityResult) Reset
func (x *SecurityResult) Reset()func (*SecurityResult) String
func (x *SecurityResult) String() stringSecurityResult_Action
type SecurityResult_Action int32Enum representing different possible actions taken by the product that created the event. Google SecOps classifies:
- ALLOW and ALLOW_WITH_MODIFICATION actions as "successful".
- BLOCK, QUARANTINE, FAIL, and CHALLENGE actions as "failed". This includes all corresponding metrics (for example, AUTH_ATTEMPTS_FAIL, FILE_EXECUTIONS_FAIL, RESOURCE_READ_FAIL, and so on).
- UNKNOWN_ACTION actions as neither "successful" nor "failed", because, for example, logs might not provide information whether a login event occurred but some kind of "unknown" error was issued nonetheless.
SecurityResult_UNKNOWN_ACTION, SecurityResult_ALLOW, SecurityResult_BLOCK, SecurityResult_ALLOW_WITH_MODIFICATION, SecurityResult_QUARANTINE, SecurityResult_FAIL, SecurityResult_CHALLENGE
const (
// The default action.
SecurityResult_UNKNOWN_ACTION SecurityResult_Action = 0
// Allowed.
SecurityResult_ALLOW SecurityResult_Action = 1
// Blocked.
SecurityResult_BLOCK SecurityResult_Action = 2
// Strip, modify something
// (e.g. File or email was disinfected or rewritten and still forwarded).
SecurityResult_ALLOW_WITH_MODIFICATION SecurityResult_Action = 3
// Put somewhere for later analysis (does NOT imply block).
SecurityResult_QUARANTINE SecurityResult_Action = 4
// Failed (e.g. the event was allowed but failed).
SecurityResult_FAIL SecurityResult_Action = 5
// Challenged (e.g. the user was challenged by a Captcha, 2FA).
SecurityResult_CHALLENGE SecurityResult_Action = 6
)func (SecurityResult_Action) Descriptor
func (SecurityResult_Action) Descriptor() protoreflect.EnumDescriptorfunc (SecurityResult_Action) Enum
func (x SecurityResult_Action) Enum() *SecurityResult_Actionfunc (SecurityResult_Action) EnumDescriptor
func (SecurityResult_Action) EnumDescriptor() ([]byte, []int)Deprecated: Use SecurityResult_Action.Descriptor instead.
func (SecurityResult_Action) Number
func (x SecurityResult_Action) Number() protoreflect.EnumNumberfunc (SecurityResult_Action) String
func (x SecurityResult_Action) String() stringfunc (SecurityResult_Action) Type
func (SecurityResult_Action) Type() protoreflect.EnumTypeSecurityResult_AlertState
type SecurityResult_AlertState int32The type of alerting set up for a security result.
SecurityResult_UNSPECIFIED, SecurityResult_NOT_ALERTING, SecurityResult_ALERTING
const (
// The security result type is not known.
SecurityResult_UNSPECIFIED SecurityResult_AlertState = 0
// The security result is not an alert.
SecurityResult_NOT_ALERTING SecurityResult_AlertState = 1
// The security result is an alert.
SecurityResult_ALERTING SecurityResult_AlertState = 2
)func (SecurityResult_AlertState) Descriptor
func (SecurityResult_AlertState) Descriptor() protoreflect.EnumDescriptorfunc (SecurityResult_AlertState) Enum
func (x SecurityResult_AlertState) Enum() *SecurityResult_AlertStatefunc (SecurityResult_AlertState) EnumDescriptor
func (SecurityResult_AlertState) EnumDescriptor() ([]byte, []int)Deprecated: Use SecurityResult_AlertState.Descriptor instead.
func (SecurityResult_AlertState) Number
func (x SecurityResult_AlertState) Number() protoreflect.EnumNumberfunc (SecurityResult_AlertState) String
func (x SecurityResult_AlertState) String() stringfunc (SecurityResult_AlertState) Type
func (SecurityResult_AlertState) Type() protoreflect.EnumTypeSecurityResult_AnalystVerdict
type SecurityResult_AnalystVerdict struct {
// Confidence score of the verdict.
ConfidenceScore int32 `protobuf:"varint,1,opt,name=confidence_score,json=confidenceScore,proto3" json:"confidence_score,omitempty"`
// Timestamp at which the verdict was generated.
VerdictTime *timestamppb.Timestamp `protobuf:"bytes,2,opt,name=verdict_time,json=verdictTime,proto3" json:"verdict_time,omitempty"`
// Details of the verdict.
VerdictResponse SecurityResult_VerdictResponse `protobuf:"varint,3,opt,name=verdict_response,json=verdictResponse,proto3,enum=google.backstory.SecurityResult_VerdictResponse" json:"verdict_response,omitempty"`
// contains filtered or unexported fields
}Verdict provided by the human analyst. These fields are used to model Mandiant sources.
func (*SecurityResult_AnalystVerdict) Descriptor
func (*SecurityResult_AnalystVerdict) Descriptor() ([]byte, []int)Deprecated: Use SecurityResult_AnalystVerdict.ProtoReflect.Descriptor instead.
func (*SecurityResult_AnalystVerdict) GetConfidenceScore
func (x *SecurityResult_AnalystVerdict) GetConfidenceScore() int32func (*SecurityResult_AnalystVerdict) GetVerdictResponse
func (x *SecurityResult_AnalystVerdict) GetVerdictResponse() SecurityResult_VerdictResponsefunc (*SecurityResult_AnalystVerdict) GetVerdictTime
func (x *SecurityResult_AnalystVerdict) GetVerdictTime() *timestamppb.Timestampfunc (*SecurityResult_AnalystVerdict) ProtoMessage
func (*SecurityResult_AnalystVerdict) ProtoMessage()func (*SecurityResult_AnalystVerdict) ProtoReflect
func (x *SecurityResult_AnalystVerdict) ProtoReflect() protoreflect.Messagefunc (*SecurityResult_AnalystVerdict) Reset
func (x *SecurityResult_AnalystVerdict) Reset()func (*SecurityResult_AnalystVerdict) String
func (x *SecurityResult_AnalystVerdict) String() stringSecurityResult_Association
type SecurityResult_Association struct {
// Unique association id generated by mandiant.
Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
// Country from which the threat actor/ malware is originated.
CountryCode []string `protobuf:"bytes,2,rep,name=country_code,json=countryCode,proto3" json:"country_code,omitempty"`
// Signifies the type of association.
Type SecurityResult_Association_AssociationType `protobuf:"varint,3,opt,name=type,proto3,enum=google.backstory.SecurityResult_Association_AssociationType" json:"type,omitempty"`
// Name of the threat actor/malware.
Name string `protobuf:"bytes,4,opt,name=name,proto3" json:"name,omitempty"`
// Human readable description about the association.
Description string `protobuf:"bytes,5,opt,name=description,proto3" json:"description,omitempty"`
// Role of the malware. Not applicable for threat actor.
Role string `protobuf:"bytes,6,opt,name=role,proto3" json:"role,omitempty"`
// Name of the country the threat originated from.
//
// Deprecated: Marked as deprecated in backstory/udm.proto.
SourceCountry string `protobuf:"bytes,7,opt,name=source_country,json=sourceCountry,proto3" json:"source_country,omitempty"`
// Different aliases of the threat actor given by different sources.
Alias []*SecurityResult_Association_AssociationAlias `protobuf:"bytes,8,rep,name=alias,proto3" json:"alias,omitempty"`
// First time the threat actor was referenced or seen.
FirstReferenceTime *timestamppb.Timestamp `protobuf:"bytes,9,opt,name=first_reference_time,json=firstReferenceTime,proto3" json:"first_reference_time,omitempty"`
// Last time the threat actor was referenced or seen.
LastReferenceTime *timestamppb.Timestamp `protobuf:"bytes,10,opt,name=last_reference_time,json=lastReferenceTime,proto3" json:"last_reference_time,omitempty"`
// List of industries the threat actor affects.
IndustriesAffected []string `protobuf:"bytes,11,rep,name=industries_affected,json=industriesAffected,proto3" json:"industries_affected,omitempty"`
// List of associated threat actors for a malware. Not applicable for threat
// actors.
AssociatedActors []*SecurityResult_Association `protobuf:"bytes,12,rep,name=associated_actors,json=associatedActors,proto3" json:"associated_actors,omitempty"`
// Name of the country, the threat is originating from.
RegionCode *Location `protobuf:"bytes,13,opt,name=region_code,json=regionCode,proto3" json:"region_code,omitempty"`
// Sponsor region of the threat actor.
SponsorRegion *Location `protobuf:"bytes,14,opt,name=sponsor_region,json=sponsorRegion,proto3" json:"sponsor_region,omitempty"`
// Targeted regions.
TargetedRegions []*Location `protobuf:"bytes,15,rep,name=targeted_regions,json=targetedRegions,proto3" json:"targeted_regions,omitempty"`
// Tags.
Tags []string `protobuf:"bytes,16,rep,name=tags,proto3" json:"tags,omitempty"`
// contains filtered or unexported fields
}Associations represents different metadata about malware and threat actors involved with an IoC.
func (*SecurityResult_Association) Descriptor
func (*SecurityResult_Association) Descriptor() ([]byte, []int)Deprecated: Use SecurityResult_Association.ProtoReflect.Descriptor instead.
func (*SecurityResult_Association) GetAlias
func (x *SecurityResult_Association) GetAlias() []*SecurityResult_Association_AssociationAliasfunc (*SecurityResult_Association) GetAssociatedActors
func (x *SecurityResult_Association) GetAssociatedActors() []*SecurityResult_Associationfunc (*SecurityResult_Association) GetCountryCode
func (x *SecurityResult_Association) GetCountryCode() []stringfunc (*SecurityResult_Association) GetDescription
func (x *SecurityResult_Association) GetDescription() stringfunc (*SecurityResult_Association) GetFirstReferenceTime
func (x *SecurityResult_Association) GetFirstReferenceTime() *timestamppb.Timestampfunc (*SecurityResult_Association) GetId
func (x *SecurityResult_Association) GetId() stringfunc (*SecurityResult_Association) GetIndustriesAffected
func (x *SecurityResult_Association) GetIndustriesAffected() []stringfunc (*SecurityResult_Association) GetLastReferenceTime
func (x *SecurityResult_Association) GetLastReferenceTime() *timestamppb.Timestampfunc (*SecurityResult_Association) GetName
func (x *SecurityResult_Association) GetName() stringfunc (*SecurityResult_Association) GetRegionCode
func (x *SecurityResult_Association) GetRegionCode() *Locationfunc (*SecurityResult_Association) GetRole
func (x *SecurityResult_Association) GetRole() stringfunc (*SecurityResult_Association) GetSourceCountry
func (x *SecurityResult_Association) GetSourceCountry() stringDeprecated: Marked as deprecated in backstory/udm.proto.
func (*SecurityResult_Association) GetSponsorRegion
func (x *SecurityResult_Association) GetSponsorRegion() *Locationfunc (*SecurityResult_Association) GetTags
func (x *SecurityResult_Association) GetTags() []stringfunc (*SecurityResult_Association) GetTargetedRegions
func (x *SecurityResult_Association) GetTargetedRegions() []*Locationfunc (*SecurityResult_Association) GetType
func (x *SecurityResult_Association) GetType() SecurityResult_Association_AssociationTypefunc (*SecurityResult_Association) ProtoMessage
func (*SecurityResult_Association) ProtoMessage()func (*SecurityResult_Association) ProtoReflect
func (x *SecurityResult_Association) ProtoReflect() protoreflect.Messagefunc (*SecurityResult_Association) Reset
func (x *SecurityResult_Association) Reset()func (*SecurityResult_Association) String
func (x *SecurityResult_Association) String() stringSecurityResult_Association_AssociationAlias
type SecurityResult_Association_AssociationAlias struct {
// Name of the alias.
Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
// Name of the provider who gave the association's name.
Company string `protobuf:"bytes,2,opt,name=company,proto3" json:"company,omitempty"`
// contains filtered or unexported fields
}Association Alias used to represent Mandiant Threat Intelligence.
func (*SecurityResult_Association_AssociationAlias) Descriptor
func (*SecurityResult_Association_AssociationAlias) Descriptor() ([]byte, []int)Deprecated: Use SecurityResult_Association_AssociationAlias.ProtoReflect.Descriptor instead.
func (*SecurityResult_Association_AssociationAlias) GetCompany
func (x *SecurityResult_Association_AssociationAlias) GetCompany() stringfunc (*SecurityResult_Association_AssociationAlias) GetName
func (x *SecurityResult_Association_AssociationAlias) GetName() stringfunc (*SecurityResult_Association_AssociationAlias) ProtoMessage
func (*SecurityResult_Association_AssociationAlias) ProtoMessage()func (*SecurityResult_Association_AssociationAlias) ProtoReflect
func (x *SecurityResult_Association_AssociationAlias) ProtoReflect() protoreflect.Messagefunc (*SecurityResult_Association_AssociationAlias) Reset
func (x *SecurityResult_Association_AssociationAlias) Reset()func (*SecurityResult_Association_AssociationAlias) String
func (x *SecurityResult_Association_AssociationAlias) String() stringSecurityResult_Association_AssociationType
type SecurityResult_Association_AssociationType int32Represents different possible Association types. Can be threat or malware. Used to represent Mandiant threat intelligence.
SecurityResult_Association_ASSOCIATION_TYPE_UNSPECIFIED, SecurityResult_Association_THREAT_ACTOR, SecurityResult_Association_MALWARE, SecurityResult_Association_SOFTWARE_TOOLKIT
const (
// The default Association Type.
SecurityResult_Association_ASSOCIATION_TYPE_UNSPECIFIED SecurityResult_Association_AssociationType = 0
// Association type Threat actor.
SecurityResult_Association_THREAT_ACTOR SecurityResult_Association_AssociationType = 1
// Association type Malware.
SecurityResult_Association_MALWARE SecurityResult_Association_AssociationType = 2
// Association type Software toolkit.
SecurityResult_Association_SOFTWARE_TOOLKIT SecurityResult_Association_AssociationType = 3
)func (SecurityResult_Association_AssociationType) Descriptor
func (SecurityResult_Association_AssociationType) Descriptor() protoreflect.EnumDescriptorfunc (SecurityResult_Association_AssociationType) Enum
func (x SecurityResult_Association_AssociationType) Enum() *SecurityResult_Association_AssociationTypefunc (SecurityResult_Association_AssociationType) EnumDescriptor
func (SecurityResult_Association_AssociationType) EnumDescriptor() ([]byte, []int)Deprecated: Use SecurityResult_Association_AssociationType.Descriptor instead.
func (SecurityResult_Association_AssociationType) Number
func (x SecurityResult_Association_AssociationType) Number() protoreflect.EnumNumberfunc (SecurityResult_Association_AssociationType) String
func (x SecurityResult_Association_AssociationType) String() stringfunc (SecurityResult_Association_AssociationType) Type
func (SecurityResult_Association_AssociationType) Type() protoreflect.EnumTypeSecurityResult_IoCStats
type SecurityResult_IoCStats struct {
// Describes the source of the IoCStat.
IocStatsType SecurityResult_IoCStatsType `protobuf:"varint,1,opt,name=ioc_stats_type,json=iocStatsType,proto3,enum=google.backstory.SecurityResult_IoCStatsType" json:"ioc_stats_type,omitempty"`
// Name of first level IoC source, for example Mandiant or a third-party.
FirstLevelSource string `protobuf:"bytes,2,opt,name=first_level_source,json=firstLevelSource,proto3" json:"first_level_source,omitempty"`
// Name of the second-level IoC source, for example Crowdsourced Threat
// Analysis or Knowledge Graph.
SecondLevelSource string `protobuf:"bytes,3,opt,name=second_level_source,json=secondLevelSource,proto3" json:"second_level_source,omitempty"`
// Count of responses where the IoC was identified as benign.
BenignCount int32 `protobuf:"varint,4,opt,name=benign_count,json=benignCount,proto3" json:"benign_count,omitempty"`
// Level of confidence in the IoC mapping extracted from the source.
Quality SecurityResult_ProductConfidence `protobuf:"varint,5,opt,name=quality,proto3,enum=google.backstory.SecurityResult_ProductConfidence" json:"quality,omitempty"`
// Count of responses where the IoC was identified as malicious.
MaliciousCount int32 `protobuf:"varint,6,opt,name=malicious_count,json=maliciousCount,proto3" json:"malicious_count,omitempty"`
// Total number of response from the source.
ResponseCount int32 `protobuf:"varint,7,opt,name=response_count,json=responseCount,proto3" json:"response_count,omitempty"`
// Number of sources from which information was extracted.
SourceCount int32 `protobuf:"varint,8,opt,name=source_count,json=sourceCount,proto3" json:"source_count,omitempty"`
// contains filtered or unexported fields
}Information about the threat intelligence source. These fields are used to model Mandiant sources.
func (*SecurityResult_IoCStats) Descriptor
func (*SecurityResult_IoCStats) Descriptor() ([]byte, []int)Deprecated: Use SecurityResult_IoCStats.ProtoReflect.Descriptor instead.
func (*SecurityResult_IoCStats) GetBenignCount
func (x *SecurityResult_IoCStats) GetBenignCount() int32func (*SecurityResult_IoCStats) GetFirstLevelSource
func (x *SecurityResult_IoCStats) GetFirstLevelSource() stringfunc (*SecurityResult_IoCStats) GetIocStatsType
func (x *SecurityResult_IoCStats) GetIocStatsType() SecurityResult_IoCStatsTypefunc (*SecurityResult_IoCStats) GetMaliciousCount
func (x *SecurityResult_IoCStats) GetMaliciousCount() int32func (*SecurityResult_IoCStats) GetQuality
func (x *SecurityResult_IoCStats) GetQuality() SecurityResult_ProductConfidencefunc (*SecurityResult_IoCStats) GetResponseCount
func (x *SecurityResult_IoCStats) GetResponseCount() int32func (*SecurityResult_IoCStats) GetSecondLevelSource
func (x *SecurityResult_IoCStats) GetSecondLevelSource() stringfunc (*SecurityResult_IoCStats) GetSourceCount
func (x *SecurityResult_IoCStats) GetSourceCount() int32func (*SecurityResult_IoCStats) ProtoMessage
func (*SecurityResult_IoCStats) ProtoMessage()func (*SecurityResult_IoCStats) ProtoReflect
func (x *SecurityResult_IoCStats) ProtoReflect() protoreflect.Messagefunc (*SecurityResult_IoCStats) Reset
func (x *SecurityResult_IoCStats) Reset()func (*SecurityResult_IoCStats) String
func (x *SecurityResult_IoCStats) String() stringSecurityResult_IoCStatsType
type SecurityResult_IoCStatsType int32Type of IoCStat based on source.
SecurityResult_UNSPECIFIED_IOC_STATS_TYPE, SecurityResult_MANDIANT_SOURCES, SecurityResult_THIRD_PARTY_SOURCES, SecurityResult_THREAT_INTELLIGENCE_IOC_STATS
const (
// IoCStat source is unidentified.
SecurityResult_UNSPECIFIED_IOC_STATS_TYPE SecurityResult_IoCStatsType = 0
// IoCStat is from a Mandiant Source.
SecurityResult_MANDIANT_SOURCES SecurityResult_IoCStatsType = 1
// IoCStat is from a third-party source.
SecurityResult_THIRD_PARTY_SOURCES SecurityResult_IoCStatsType = 2
// IoCStat is from a threat intelligence feed.
SecurityResult_THREAT_INTELLIGENCE_IOC_STATS SecurityResult_IoCStatsType = 3
)func (SecurityResult_IoCStatsType) Descriptor
func (SecurityResult_IoCStatsType) Descriptor() protoreflect.EnumDescriptorfunc (SecurityResult_IoCStatsType) Enum
func (x SecurityResult_IoCStatsType) Enum() *SecurityResult_IoCStatsTypefunc (SecurityResult_IoCStatsType) EnumDescriptor
func (SecurityResult_IoCStatsType) EnumDescriptor() ([]byte, []int)Deprecated: Use SecurityResult_IoCStatsType.Descriptor instead.
func (SecurityResult_IoCStatsType) Number
func (x SecurityResult_IoCStatsType) Number() protoreflect.EnumNumberfunc (SecurityResult_IoCStatsType) String
func (x SecurityResult_IoCStatsType) String() stringfunc (SecurityResult_IoCStatsType) Type
func (SecurityResult_IoCStatsType) Type() protoreflect.EnumTypeSecurityResult_ProductConfidence
type SecurityResult_ProductConfidence int32A level of confidence in the result.
SecurityResult_UNKNOWN_CONFIDENCE, SecurityResult_LOW_CONFIDENCE, SecurityResult_MEDIUM_CONFIDENCE, SecurityResult_HIGH_CONFIDENCE
const (
// The default confidence level.
SecurityResult_UNKNOWN_CONFIDENCE SecurityResult_ProductConfidence = 0
// Low confidence.
SecurityResult_LOW_CONFIDENCE SecurityResult_ProductConfidence = 200
// Medium confidence.
SecurityResult_MEDIUM_CONFIDENCE SecurityResult_ProductConfidence = 300
// High confidence.
SecurityResult_HIGH_CONFIDENCE SecurityResult_ProductConfidence = 400
)func (SecurityResult_ProductConfidence) Descriptor
func (SecurityResult_ProductConfidence) Descriptor() protoreflect.EnumDescriptorfunc (SecurityResult_ProductConfidence) Enum
func (x SecurityResult_ProductConfidence) Enum() *SecurityResult_ProductConfidencefunc (SecurityResult_ProductConfidence) EnumDescriptor
func (SecurityResult_ProductConfidence) EnumDescriptor() ([]byte, []int)Deprecated: Use SecurityResult_ProductConfidence.Descriptor instead.
func (SecurityResult_ProductConfidence) Number
func (x SecurityResult_ProductConfidence) Number() protoreflect.EnumNumberfunc (SecurityResult_ProductConfidence) String
func (x SecurityResult_ProductConfidence) String() stringfunc (SecurityResult_ProductConfidence) Type
func (SecurityResult_ProductConfidence) Type() protoreflect.EnumTypeSecurityResult_ProductPriority
type SecurityResult_ProductPriority int32A product priority level.
SecurityResult_UNKNOWN_PRIORITY, SecurityResult_LOW_PRIORITY, SecurityResult_MEDIUM_PRIORITY, SecurityResult_HIGH_PRIORITY
const (
// Default priority level.
SecurityResult_UNKNOWN_PRIORITY SecurityResult_ProductPriority = 0
// Low priority.
SecurityResult_LOW_PRIORITY SecurityResult_ProductPriority = 200
// Medium priority.
SecurityResult_MEDIUM_PRIORITY SecurityResult_ProductPriority = 300
// High priority.
SecurityResult_HIGH_PRIORITY SecurityResult_ProductPriority = 400
)func (SecurityResult_ProductPriority) Descriptor
func (SecurityResult_ProductPriority) Descriptor() protoreflect.EnumDescriptorfunc (SecurityResult_ProductPriority) Enum
func (x SecurityResult_ProductPriority) Enum() *SecurityResult_ProductPriorityfunc (SecurityResult_ProductPriority) EnumDescriptor
func (SecurityResult_ProductPriority) EnumDescriptor() ([]byte, []int)Deprecated: Use SecurityResult_ProductPriority.Descriptor instead.
func (SecurityResult_ProductPriority) Number
func (x SecurityResult_ProductPriority) Number() protoreflect.EnumNumberfunc (SecurityResult_ProductPriority) String
func (x SecurityResult_ProductPriority) String() stringfunc (SecurityResult_ProductPriority) Type
func (SecurityResult_ProductPriority) Type() protoreflect.EnumTypeSecurityResult_ProductSeverity
type SecurityResult_ProductSeverity int32Defined by the product
SecurityResult_UNKNOWN_SEVERITY, SecurityResult_INFORMATIONAL, SecurityResult_ERROR, SecurityResult_NONE, SecurityResult_LOW, SecurityResult_MEDIUM, SecurityResult_HIGH, SecurityResult_CRITICAL
const (
// The default severity level.
SecurityResult_UNKNOWN_SEVERITY SecurityResult_ProductSeverity = 0
// Info severity.
SecurityResult_INFORMATIONAL SecurityResult_ProductSeverity = 100
// An error.
SecurityResult_ERROR SecurityResult_ProductSeverity = 150
// No malicious result.
SecurityResult_NONE SecurityResult_ProductSeverity = 101
// Low-severity malicious result.
SecurityResult_LOW SecurityResult_ProductSeverity = 200
// Medium-severity malicious result.
SecurityResult_MEDIUM SecurityResult_ProductSeverity = 300
// High-severity malicious result.
SecurityResult_HIGH SecurityResult_ProductSeverity = 400
// Critical-severity malicious result.
SecurityResult_CRITICAL SecurityResult_ProductSeverity = 500
)func (SecurityResult_ProductSeverity) Descriptor
func (SecurityResult_ProductSeverity) Descriptor() protoreflect.EnumDescriptorfunc (SecurityResult_ProductSeverity) Enum
func (x SecurityResult_ProductSeverity) Enum() *SecurityResult_ProductSeverityfunc (SecurityResult_ProductSeverity) EnumDescriptor
func (SecurityResult_ProductSeverity) EnumDescriptor() ([]byte, []int)Deprecated: Use SecurityResult_ProductSeverity.Descriptor instead.
func (SecurityResult_ProductSeverity) Number
func (x SecurityResult_ProductSeverity) Number() protoreflect.EnumNumberfunc (SecurityResult_ProductSeverity) String
func (x SecurityResult_ProductSeverity) String() stringfunc (SecurityResult_ProductSeverity) Type
func (SecurityResult_ProductSeverity) Type() protoreflect.EnumTypeSecurityResult_ProviderMLVerdict
type SecurityResult_ProviderMLVerdict struct {
// Source provider giving the ML verdict.
SourceProvider string `protobuf:"bytes,1,opt,name=source_provider,json=sourceProvider,proto3" json:"source_provider,omitempty"`
// Count of responses where this IoC was marked benign.
BenignCount int32 `protobuf:"varint,2,opt,name=benign_count,json=benignCount,proto3" json:"benign_count,omitempty"`
// Count of responses where this IoC was marked malicious.
MaliciousCount int32 `protobuf:"varint,3,opt,name=malicious_count,json=maliciousCount,proto3" json:"malicious_count,omitempty"`
// Confidence score of the verdict.
ConfidenceScore int32 `protobuf:"varint,4,opt,name=confidence_score,json=confidenceScore,proto3" json:"confidence_score,omitempty"`
// List of mandiant sources from which the verdict was generated.
MandiantSources []*SecurityResult_Source `protobuf:"bytes,5,rep,name=mandiant_sources,json=mandiantSources,proto3" json:"mandiant_sources,omitempty"`
// List of third-party sources from which the verdict was generated.
ThirdPartySources []*SecurityResult_Source `protobuf:"bytes,6,rep,name=third_party_sources,json=thirdPartySources,proto3" json:"third_party_sources,omitempty"`
// contains filtered or unexported fields
}Deprecated. MLVerdict result provided from threat providers, like Mandiant. These fields are used to model Mandiant sources.
func (*SecurityResult_ProviderMLVerdict) Descriptor
func (*SecurityResult_ProviderMLVerdict) Descriptor() ([]byte, []int)Deprecated: Use SecurityResult_ProviderMLVerdict.ProtoReflect.Descriptor instead.
func (*SecurityResult_ProviderMLVerdict) GetBenignCount
func (x *SecurityResult_ProviderMLVerdict) GetBenignCount() int32func (*SecurityResult_ProviderMLVerdict) GetConfidenceScore
func (x *SecurityResult_ProviderMLVerdict) GetConfidenceScore() int32func (*SecurityResult_ProviderMLVerdict) GetMaliciousCount
func (x *SecurityResult_ProviderMLVerdict) GetMaliciousCount() int32func (*SecurityResult_ProviderMLVerdict) GetMandiantSources
func (x *SecurityResult_ProviderMLVerdict) GetMandiantSources() []*SecurityResult_Sourcefunc (*SecurityResult_ProviderMLVerdict) GetSourceProvider
func (x *SecurityResult_ProviderMLVerdict) GetSourceProvider() stringfunc (*SecurityResult_ProviderMLVerdict) GetThirdPartySources
func (x *SecurityResult_ProviderMLVerdict) GetThirdPartySources() []*SecurityResult_Sourcefunc (*SecurityResult_ProviderMLVerdict) ProtoMessage
func (*SecurityResult_ProviderMLVerdict) ProtoMessage()func (*SecurityResult_ProviderMLVerdict) ProtoReflect
func (x *SecurityResult_ProviderMLVerdict) ProtoReflect() protoreflect.Messagefunc (*SecurityResult_ProviderMLVerdict) Reset
func (x *SecurityResult_ProviderMLVerdict) Reset()func (*SecurityResult_ProviderMLVerdict) String
func (x *SecurityResult_ProviderMLVerdict) String() stringSecurityResult_SecurityCategory
type SecurityResult_SecurityCategory int32SecurityCategory is used to standardize security categories across products so one event is not categorized as "malware" and another as a "virus".
SecurityResult_UNKNOWN_CATEGORY, SecurityResult_SOFTWARE_MALICIOUS, SecurityResult_SOFTWARE_SUSPICIOUS, SecurityResult_SOFTWARE_PUA, SecurityResult_NETWORK_MALICIOUS, SecurityResult_NETWORK_SUSPICIOUS, SecurityResult_NETWORK_CATEGORIZED_CONTENT, SecurityResult_NETWORK_DENIAL_OF_SERVICE, SecurityResult_NETWORK_RECON, SecurityResult_NETWORK_COMMAND_AND_CONTROL, SecurityResult_ACL_VIOLATION, SecurityResult_AUTH_VIOLATION, SecurityResult_EXPLOIT, SecurityResult_DATA_EXFILTRATION, SecurityResult_DATA_AT_REST, SecurityResult_DATA_DESTRUCTION, SecurityResult_TOR_EXIT_NODE, SecurityResult_MAIL_SPAM, SecurityResult_MAIL_PHISHING, SecurityResult_MAIL_SPOOFING, SecurityResult_POLICY_VIOLATION, SecurityResult_SOCIAL_ENGINEERING, SecurityResult_PHISHING
const (
// The default category.
SecurityResult_UNKNOWN_CATEGORY SecurityResult_SecurityCategory = 0
// Malware, spyware, rootkit.
SecurityResult_SOFTWARE_MALICIOUS SecurityResult_SecurityCategory = 10000
// Below the conviction threshold; probably bad.
SecurityResult_SOFTWARE_SUSPICIOUS SecurityResult_SecurityCategory = 10100
// Potentially Unwanted App (such as adware).
SecurityResult_SOFTWARE_PUA SecurityResult_SecurityCategory = 10200
// Includes C&C or network exploit.
SecurityResult_NETWORK_MALICIOUS SecurityResult_SecurityCategory = 20000
// Suspicious activity, such as potential reverse tunnel.
SecurityResult_NETWORK_SUSPICIOUS SecurityResult_SecurityCategory = 20100
// Non-security related: URL has category like gambling or porn.
SecurityResult_NETWORK_CATEGORIZED_CONTENT SecurityResult_SecurityCategory = 20200
// DoS, DDoS.
SecurityResult_NETWORK_DENIAL_OF_SERVICE SecurityResult_SecurityCategory = 20300
// Port scan detected by an IDS, probing of web app.
SecurityResult_NETWORK_RECON SecurityResult_SecurityCategory = 20400
// If we know this is a C&C channel.
SecurityResult_NETWORK_COMMAND_AND_CONTROL SecurityResult_SecurityCategory = 20500
// Unauthorized access attempted, including attempted access to files,
// web services, processes, web objects, etc.
SecurityResult_ACL_VIOLATION SecurityResult_SecurityCategory = 30000
// Authentication failed (e.g. bad password or bad 2-factor authentication).
SecurityResult_AUTH_VIOLATION SecurityResult_SecurityCategory = 40000
// Exploit: For all manner of exploits including attempted overflows, bad
// protocol encodings, ROP, SQL injection, etc. For both network and host-
// based exploits.
SecurityResult_EXPLOIT SecurityResult_SecurityCategory = 50000
// DLP: Sensitive data transmission, copy to thumb drive.
SecurityResult_DATA_EXFILTRATION SecurityResult_SecurityCategory = 60000
// DLP: Sensitive data found at rest in a scan.
SecurityResult_DATA_AT_REST SecurityResult_SecurityCategory = 60100
// Attempt to destroy/delete data.
SecurityResult_DATA_DESTRUCTION SecurityResult_SecurityCategory = 60200
// TOR Exit Nodes.
SecurityResult_TOR_EXIT_NODE SecurityResult_SecurityCategory = 60300
// Spam email, message, etc.
SecurityResult_MAIL_SPAM SecurityResult_SecurityCategory = 70000
// Phishing email, chat messages, etc.
SecurityResult_MAIL_PHISHING SecurityResult_SecurityCategory = 70100
// Spoofed source email address, etc.
SecurityResult_MAIL_SPOOFING SecurityResult_SecurityCategory = 70200
// Security-related policy violation (e.g. firewall/proxy/HIPS rule
// violated, NAC block action).
SecurityResult_POLICY_VIOLATION SecurityResult_SecurityCategory = 80000
// Threats which manipulate to break normal security procedures.
SecurityResult_SOCIAL_ENGINEERING SecurityResult_SecurityCategory = 90001
// Phishing pages, pops, https phishing etc.
SecurityResult_PHISHING SecurityResult_SecurityCategory = 90002
)func (SecurityResult_SecurityCategory) Descriptor
func (SecurityResult_SecurityCategory) Descriptor() protoreflect.EnumDescriptorfunc (SecurityResult_SecurityCategory) Enum
func (x SecurityResult_SecurityCategory) Enum() *SecurityResult_SecurityCategoryfunc (SecurityResult_SecurityCategory) EnumDescriptor
func (SecurityResult_SecurityCategory) EnumDescriptor() ([]byte, []int)Deprecated: Use SecurityResult_SecurityCategory.Descriptor instead.
func (SecurityResult_SecurityCategory) Number
func (x SecurityResult_SecurityCategory) Number() protoreflect.EnumNumberfunc (SecurityResult_SecurityCategory) String
func (x SecurityResult_SecurityCategory) String() stringfunc (SecurityResult_SecurityCategory) Type
func (SecurityResult_SecurityCategory) Type() protoreflect.EnumTypeSecurityResult_Source
type SecurityResult_Source struct {
// Name of the IoC source.
Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
// Count of responses where this IoC was marked benign.
BenignCount int32 `protobuf:"varint,2,opt,name=benign_count,json=benignCount,proto3" json:"benign_count,omitempty"`
// Count of responses where this IoC was marked malicious.
MaliciousCount int32 `protobuf:"varint,3,opt,name=malicious_count,json=maliciousCount,proto3" json:"malicious_count,omitempty"`
// Quality of the IoC mapping extracted from the source.
Quality SecurityResult_ProductConfidence `protobuf:"varint,4,opt,name=quality,proto3,enum=google.backstory.SecurityResult_ProductConfidence" json:"quality,omitempty"`
// Total response count from this source.
ResponseCount int32 `protobuf:"varint,5,opt,name=response_count,json=responseCount,proto3" json:"response_count,omitempty"`
// Number of sources from which intelligence was extracted.
SourceCount int32 `protobuf:"varint,6,opt,name=source_count,json=sourceCount,proto3" json:"source_count,omitempty"`
// Different threat intelligence sources from which IoC info was extracted.
ThreatIntelligenceSources []*SecurityResult_Source `protobuf:"bytes,7,rep,name=threat_intelligence_sources,json=threatIntelligenceSources,proto3" json:"threat_intelligence_sources,omitempty"`
// contains filtered or unexported fields
}Deprecated. Information about the threat intelligence source. These fields are used to model Mandiant sources.
func (*SecurityResult_Source) Descriptor
func (*SecurityResult_Source) Descriptor() ([]byte, []int)Deprecated: Use SecurityResult_Source.ProtoReflect.Descriptor instead.
func (*SecurityResult_Source) GetBenignCount
func (x *SecurityResult_Source) GetBenignCount() int32func (*SecurityResult_Source) GetMaliciousCount
func (x *SecurityResult_Source) GetMaliciousCount() int32func (*SecurityResult_Source) GetName
func (x *SecurityResult_Source) GetName() stringfunc (*SecurityResult_Source) GetQuality
func (x *SecurityResult_Source) GetQuality() SecurityResult_ProductConfidencefunc (*SecurityResult_Source) GetResponseCount
func (x *SecurityResult_Source) GetResponseCount() int32func (*SecurityResult_Source) GetSourceCount
func (x *SecurityResult_Source) GetSourceCount() int32func (*SecurityResult_Source) GetThreatIntelligenceSources
func (x *SecurityResult_Source) GetThreatIntelligenceSources() []*SecurityResult_Sourcefunc (*SecurityResult_Source) ProtoMessage
func (*SecurityResult_Source) ProtoMessage()func (*SecurityResult_Source) ProtoReflect
func (x *SecurityResult_Source) ProtoReflect() protoreflect.Messagefunc (*SecurityResult_Source) Reset
func (x *SecurityResult_Source) Reset()func (*SecurityResult_Source) String
func (x *SecurityResult_Source) String() stringSecurityResult_ThreatCollectionItem
type SecurityResult_ThreatCollectionItem struct {
// The ID of the threat collection.
Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
// The type of threat collection (e.g., "campaign").
Type SecurityResult_ThreatCollectionType `protobuf:"varint,2,opt,name=type,proto3,enum=google.backstory.SecurityResult_ThreatCollectionType" json:"type,omitempty"`
// The name of the threat collection.
AltNames []string `protobuf:"bytes,3,rep,name=alt_names,json=altNames,proto3" json:"alt_names,omitempty"`
// contains filtered or unexported fields
}Threat Collection that is either a threat campaign or a threat report.
func (*SecurityResult_ThreatCollectionItem) Descriptor
func (*SecurityResult_ThreatCollectionItem) Descriptor() ([]byte, []int)Deprecated: Use SecurityResult_ThreatCollectionItem.ProtoReflect.Descriptor instead.
func (*SecurityResult_ThreatCollectionItem) GetAltNames
func (x *SecurityResult_ThreatCollectionItem) GetAltNames() []stringfunc (*SecurityResult_ThreatCollectionItem) GetId
func (x *SecurityResult_ThreatCollectionItem) GetId() stringfunc (*SecurityResult_ThreatCollectionItem) GetType
func (x *SecurityResult_ThreatCollectionItem) GetType() SecurityResult_ThreatCollectionTypefunc (*SecurityResult_ThreatCollectionItem) ProtoMessage
func (*SecurityResult_ThreatCollectionItem) ProtoMessage()func (*SecurityResult_ThreatCollectionItem) ProtoReflect
func (x *SecurityResult_ThreatCollectionItem) ProtoReflect() protoreflect.Messagefunc (*SecurityResult_ThreatCollectionItem) Reset
func (x *SecurityResult_ThreatCollectionItem) Reset()func (*SecurityResult_ThreatCollectionItem) String
func (x *SecurityResult_ThreatCollectionItem) String() stringSecurityResult_ThreatCollectionType
type SecurityResult_ThreatCollectionType int32Different Types of threat collections currently supported.
SecurityResult_THREAT_COLLECTION_TYPE_UNSPECIFIED, SecurityResult_CAMPAIGN, SecurityResult_REPORT
const (
// Threat collection type is unspecified.
SecurityResult_THREAT_COLLECTION_TYPE_UNSPECIFIED SecurityResult_ThreatCollectionType = 0
// Threat collection type is campaign.
SecurityResult_CAMPAIGN SecurityResult_ThreatCollectionType = 1
// Threat collection type is report.
SecurityResult_REPORT SecurityResult_ThreatCollectionType = 2
)func (SecurityResult_ThreatCollectionType) Descriptor
func (SecurityResult_ThreatCollectionType) Descriptor() protoreflect.EnumDescriptorfunc (SecurityResult_ThreatCollectionType) Enum
func (x SecurityResult_ThreatCollectionType) Enum() *SecurityResult_ThreatCollectionTypefunc (SecurityResult_ThreatCollectionType) EnumDescriptor
func (SecurityResult_ThreatCollectionType) EnumDescriptor() ([]byte, []int)Deprecated: Use SecurityResult_ThreatCollectionType.Descriptor instead.
func (SecurityResult_ThreatCollectionType) Number
func (x SecurityResult_ThreatCollectionType) Number() protoreflect.EnumNumberfunc (SecurityResult_ThreatCollectionType) String
func (x SecurityResult_ThreatCollectionType) String() stringfunc (SecurityResult_ThreatCollectionType) Type
func (SecurityResult_ThreatCollectionType) Type() protoreflect.EnumTypeSecurityResult_ThreatStatus
type SecurityResult_ThreatStatus int32Vendor-specific information about the status of a threat (ITW).
SecurityResult_THREAT_STATUS_UNSPECIFIED, SecurityResult_ACTIVE, SecurityResult_CLEARED, SecurityResult_FALSE_POSITIVE
const (
// Default threat status
SecurityResult_THREAT_STATUS_UNSPECIFIED SecurityResult_ThreatStatus = 0
// Active threat.
SecurityResult_ACTIVE SecurityResult_ThreatStatus = 1
// Cleared threat.
SecurityResult_CLEARED SecurityResult_ThreatStatus = 2
// False positive.
SecurityResult_FALSE_POSITIVE SecurityResult_ThreatStatus = 3
)func (SecurityResult_ThreatStatus) Descriptor
func (SecurityResult_ThreatStatus) Descriptor() protoreflect.EnumDescriptorfunc (SecurityResult_ThreatStatus) Enum
func (x SecurityResult_ThreatStatus) Enum() *SecurityResult_ThreatStatusfunc (SecurityResult_ThreatStatus) EnumDescriptor
func (SecurityResult_ThreatStatus) EnumDescriptor() ([]byte, []int)Deprecated: Use SecurityResult_ThreatStatus.Descriptor instead.
func (SecurityResult_ThreatStatus) Number
func (x SecurityResult_ThreatStatus) Number() protoreflect.EnumNumberfunc (SecurityResult_ThreatStatus) String
func (x SecurityResult_ThreatStatus) String() stringfunc (SecurityResult_ThreatStatus) Type
func (SecurityResult_ThreatStatus) Type() protoreflect.EnumTypeSecurityResult_Verdict
type SecurityResult_Verdict struct {
// Number of sources from which intelligence was extracted.
SourceCount int32 `protobuf:"varint,1,opt,name=source_count,json=sourceCount,proto3" json:"source_count,omitempty"`
// Total response count across all sources.
ResponseCount int32 `protobuf:"varint,2,opt,name=response_count,json=responseCount,proto3" json:"response_count,omitempty"`
// Describes the neighbour influence of the verdict.
NeighbourInfluence string `protobuf:"bytes,3,opt,name=neighbour_influence,json=neighbourInfluence,proto3" json:"neighbour_influence,omitempty"`
// ML Verdict provided by sources like Mandiant.
Verdict *SecurityResult_ProviderMLVerdict `protobuf:"bytes,4,opt,name=verdict,proto3" json:"verdict,omitempty"`
// Human analyst verdict provided by sources like Mandiant.
AnalystVerdict *SecurityResult_AnalystVerdict `protobuf:"bytes,5,opt,name=analyst_verdict,json=analystVerdict,proto3" json:"analyst_verdict,omitempty"`
// contains filtered or unexported fields
}Deprecated. Encapsulates the threat verdict provided by human analysts and ML models. These fields are used to model Mandiant sources.
func (*SecurityResult_Verdict) Descriptor
func (*SecurityResult_Verdict) Descriptor() ([]byte, []int)Deprecated: Use SecurityResult_Verdict.ProtoReflect.Descriptor instead.
func (*SecurityResult_Verdict) GetAnalystVerdict
func (x *SecurityResult_Verdict) GetAnalystVerdict() *SecurityResult_AnalystVerdictfunc (*SecurityResult_Verdict) GetNeighbourInfluence
func (x *SecurityResult_Verdict) GetNeighbourInfluence() stringfunc (*SecurityResult_Verdict) GetResponseCount
func (x *SecurityResult_Verdict) GetResponseCount() int32func (*SecurityResult_Verdict) GetSourceCount
func (x *SecurityResult_Verdict) GetSourceCount() int32func (*SecurityResult_Verdict) GetVerdict
func (x *SecurityResult_Verdict) GetVerdict() *SecurityResult_ProviderMLVerdictfunc (*SecurityResult_Verdict) ProtoMessage
func (*SecurityResult_Verdict) ProtoMessage()func (*SecurityResult_Verdict) ProtoReflect
func (x *SecurityResult_Verdict) ProtoReflect() protoreflect.Messagefunc (*SecurityResult_Verdict) Reset
func (x *SecurityResult_Verdict) Reset()func (*SecurityResult_Verdict) String
func (x *SecurityResult_Verdict) String() stringSecurityResult_VerdictInfo
type SecurityResult_VerdictInfo struct {
// Number of sources from which intelligence was extracted.
SourceCount int32 `protobuf:"varint,1,opt,name=source_count,json=sourceCount,proto3" json:"source_count,omitempty"`
// Total response count across all sources.
ResponseCount int32 `protobuf:"varint,2,opt,name=response_count,json=responseCount,proto3" json:"response_count,omitempty"`
// Describes the near neighbor influence of the verdict.
NeighbourInfluence string `protobuf:"bytes,3,opt,name=neighbour_influence,json=neighbourInfluence,proto3" json:"neighbour_influence,omitempty"`
// Type of verdict.
VerdictType SecurityResult_VerdictType `protobuf:"varint,4,opt,name=verdict_type,json=verdictType,proto3,enum=google.backstory.SecurityResult_VerdictType" json:"verdict_type,omitempty"`
// Source provider giving the machine learning verdict.
SourceProvider string `protobuf:"bytes,5,opt,name=source_provider,json=sourceProvider,proto3" json:"source_provider,omitempty"`
// Count of responses where this IoC was marked as benign.
BenignCount int32 `protobuf:"varint,6,opt,name=benign_count,json=benignCount,proto3" json:"benign_count,omitempty"`
// Count of responses where this IoC was marked as malicious.
MaliciousCount int32 `protobuf:"varint,7,opt,name=malicious_count,json=maliciousCount,proto3" json:"malicious_count,omitempty"`
// Confidence score of the verdict.
ConfidenceScore int32 `protobuf:"varint,8,opt,name=confidence_score,json=confidenceScore,proto3" json:"confidence_score,omitempty"`
// List of IoCStats from which the verdict was generated.
IocStats []*SecurityResult_IoCStats `protobuf:"bytes,9,rep,name=ioc_stats,json=iocStats,proto3" json:"ioc_stats,omitempty"`
// Timestamp when the verdict was generated.
VerdictTime *timestamppb.Timestamp `protobuf:"bytes,11,opt,name=verdict_time,json=verdictTime,proto3" json:"verdict_time,omitempty"`
// Details about the verdict.
VerdictResponse SecurityResult_VerdictResponse `protobuf:"varint,12,opt,name=verdict_response,json=verdictResponse,proto3,enum=google.backstory.SecurityResult_VerdictResponse" json:"verdict_response,omitempty"`
// Global customer count over the last 30 days
GlobalCustomerCount int32 `protobuf:"varint,13,opt,name=global_customer_count,json=globalCustomerCount,proto3" json:"global_customer_count,omitempty"`
// Global hit count over the last 30 days.
GlobalHitsCount int32 `protobuf:"varint,14,opt,name=global_hits_count,json=globalHitsCount,proto3" json:"global_hits_count,omitempty"`
// Whether one or more Mandiant incident response customers had this
// indicator in their environment.
Pwn bool `protobuf:"varint,15,opt,name=pwn,proto3" json:"pwn,omitempty"`
// Tags related to the verdict.
CategoryDetails string `protobuf:"bytes,16,opt,name=category_details,json=categoryDetails,proto3" json:"category_details,omitempty"`
// The timestamp of the first time a pwn was associated to this entity.
PwnFirstTaggedTime *timestamppb.Timestamp `protobuf:"bytes,17,opt,name=pwn_first_tagged_time,json=pwnFirstTaggedTime,proto3" json:"pwn_first_tagged_time,omitempty"`
// contains filtered or unexported fields
}Describes the threat verdict provided by human analysts and machine learning models. These fields are used to model Mandiant sources.
func (*SecurityResult_VerdictInfo) Descriptor
func (*SecurityResult_VerdictInfo) Descriptor() ([]byte, []int)Deprecated: Use SecurityResult_VerdictInfo.ProtoReflect.Descriptor instead.
func (*SecurityResult_VerdictInfo) GetBenignCount
func (x *SecurityResult_VerdictInfo) GetBenignCount() int32func (*SecurityResult_VerdictInfo) GetCategoryDetails
func (x *SecurityResult_VerdictInfo) GetCategoryDetails() stringfunc (*SecurityResult_VerdictInfo) GetConfidenceScore
func (x *SecurityResult_VerdictInfo) GetConfidenceScore() int32func (*SecurityResult_VerdictInfo) GetGlobalCustomerCount
func (x *SecurityResult_VerdictInfo) GetGlobalCustomerCount() int32func (*SecurityResult_VerdictInfo) GetGlobalHitsCount
func (x *SecurityResult_VerdictInfo) GetGlobalHitsCount() int32func (*SecurityResult_VerdictInfo) GetIocStats
func (x *SecurityResult_VerdictInfo) GetIocStats() []*SecurityResult_IoCStatsfunc (*SecurityResult_VerdictInfo) GetMaliciousCount
func (x *SecurityResult_VerdictInfo) GetMaliciousCount() int32func (*SecurityResult_VerdictInfo) GetNeighbourInfluence
func (x *SecurityResult_VerdictInfo) GetNeighbourInfluence() stringfunc (*SecurityResult_VerdictInfo) GetPwn
func (x *SecurityResult_VerdictInfo) GetPwn() boolfunc (*SecurityResult_VerdictInfo) GetPwnFirstTaggedTime
func (x *SecurityResult_VerdictInfo) GetPwnFirstTaggedTime() *timestamppb.Timestampfunc (*SecurityResult_VerdictInfo) GetResponseCount
func (x *SecurityResult_VerdictInfo) GetResponseCount() int32func (*SecurityResult_VerdictInfo) GetSourceCount
func (x *SecurityResult_VerdictInfo) GetSourceCount() int32func (*SecurityResult_VerdictInfo) GetSourceProvider
func (x *SecurityResult_VerdictInfo) GetSourceProvider() stringfunc (*SecurityResult_VerdictInfo) GetVerdictResponse
func (x *SecurityResult_VerdictInfo) GetVerdictResponse() SecurityResult_VerdictResponsefunc (*SecurityResult_VerdictInfo) GetVerdictTime
func (x *SecurityResult_VerdictInfo) GetVerdictTime() *timestamppb.Timestampfunc (*SecurityResult_VerdictInfo) GetVerdictType
func (x *SecurityResult_VerdictInfo) GetVerdictType() SecurityResult_VerdictTypefunc (*SecurityResult_VerdictInfo) ProtoMessage
func (*SecurityResult_VerdictInfo) ProtoMessage()func (*SecurityResult_VerdictInfo) ProtoReflect
func (x *SecurityResult_VerdictInfo) ProtoReflect() protoreflect.Messagefunc (*SecurityResult_VerdictInfo) Reset
func (x *SecurityResult_VerdictInfo) Reset()func (*SecurityResult_VerdictInfo) String
func (x *SecurityResult_VerdictInfo) String() stringSecurityResult_VerdictResponse
type SecurityResult_VerdictResponse int32Represents different verdict types. Used to represent Mandiant threat intelligence.
SecurityResult_VERDICT_RESPONSE_UNSPECIFIED, SecurityResult_MALICIOUS, SecurityResult_BENIGN
const (
// The default verdict response type.
SecurityResult_VERDICT_RESPONSE_UNSPECIFIED SecurityResult_VerdictResponse = 0
// VerdictResponse resulted a threat as malicious.
SecurityResult_MALICIOUS SecurityResult_VerdictResponse = 1
// VerdictResponse resulted a threat as benign.
SecurityResult_BENIGN SecurityResult_VerdictResponse = 2
)func (SecurityResult_VerdictResponse) Descriptor
func (SecurityResult_VerdictResponse) Descriptor() protoreflect.EnumDescriptorfunc (SecurityResult_VerdictResponse) Enum
func (x SecurityResult_VerdictResponse) Enum() *SecurityResult_VerdictResponsefunc (SecurityResult_VerdictResponse) EnumDescriptor
func (SecurityResult_VerdictResponse) EnumDescriptor() ([]byte, []int)Deprecated: Use SecurityResult_VerdictResponse.Descriptor instead.
func (SecurityResult_VerdictResponse) Number
func (x SecurityResult_VerdictResponse) Number() protoreflect.EnumNumberfunc (SecurityResult_VerdictResponse) String
func (x SecurityResult_VerdictResponse) String() stringfunc (SecurityResult_VerdictResponse) Type
func (SecurityResult_VerdictResponse) Type() protoreflect.EnumTypeSecurityResult_VerdictType
type SecurityResult_VerdictType int32Category of the verdict.
SecurityResult_VERDICT_TYPE_UNSPECIFIED, SecurityResult_PROVIDER_ML_VERDICT, SecurityResult_ANALYST_VERDICT
const (
// Verdict category not specified.
SecurityResult_VERDICT_TYPE_UNSPECIFIED SecurityResult_VerdictType = 0
// MLVerdict result provided from threat providers, like Mandiant. These
// fields are used to model Mandiant sources.
SecurityResult_PROVIDER_ML_VERDICT SecurityResult_VerdictType = 1
// Verdict provided by the human analyst. These fields are used to model
// Mandiant sources.
SecurityResult_ANALYST_VERDICT SecurityResult_VerdictType = 2
)func (SecurityResult_VerdictType) Descriptor
func (SecurityResult_VerdictType) Descriptor() protoreflect.EnumDescriptorfunc (SecurityResult_VerdictType) Enum
func (x SecurityResult_VerdictType) Enum() *SecurityResult_VerdictTypefunc (SecurityResult_VerdictType) EnumDescriptor
func (SecurityResult_VerdictType) EnumDescriptor() ([]byte, []int)Deprecated: Use SecurityResult_VerdictType.Descriptor instead.
func (SecurityResult_VerdictType) Number
func (x SecurityResult_VerdictType) Number() protoreflect.EnumNumberfunc (SecurityResult_VerdictType) String
func (x SecurityResult_VerdictType) String() stringfunc (SecurityResult_VerdictType) Type
func (SecurityResult_VerdictType) Type() protoreflect.EnumTypeService
type Service struct {
// The user-friendly display name of the service.
DisplayName string `protobuf:"bytes,1,opt,name=display_name,json=displayName,proto3" json:"display_name,omitempty"`
// Deprecated: use service_types instead.
// The type of service.
//
// Deprecated: Marked as deprecated in backstory/udm.proto.
ServiceType Service_ServiceType `protobuf:"varint,3,opt,name=service_type,json=serviceType,proto3,enum=google.backstory.Service_ServiceType" json:"service_type,omitempty"`
// The list of service types.
ServiceTypes []Service_ServiceType `protobuf:"varint,6,rep,packed,name=service_types,json=serviceTypes,proto3,enum=google.backstory.Service_ServiceType" json:"service_types,omitempty"`
// The startup type of the service.
StartupType Service_StartupType `protobuf:"varint,4,opt,name=startup_type,json=startupType,proto3,enum=google.backstory.Service_StartupType" json:"startup_type,omitempty"`
// The status of the service.
State Service_State `protobuf:"varint,5,opt,name=state,proto3,enum=google.backstory.Service_State" json:"state,omitempty"`
// contains filtered or unexported fields
}Information about a Windows service.
func (*Service) Descriptor
Deprecated: Use Service.ProtoReflect.Descriptor instead.
func (*Service) GetDisplayName
func (*Service) GetServiceType
func (x *Service) GetServiceType() Service_ServiceTypeDeprecated: Marked as deprecated in backstory/udm.proto.
func (*Service) GetServiceTypes
func (x *Service) GetServiceTypes() []Service_ServiceTypefunc (*Service) GetStartupType
func (x *Service) GetStartupType() Service_StartupTypefunc (*Service) GetState
func (x *Service) GetState() Service_Statefunc (*Service) ProtoMessage
func (*Service) ProtoMessage()func (*Service) ProtoReflect
func (x *Service) ProtoReflect() protoreflect.Messagefunc (*Service) Reset
func (x *Service) Reset()func (*Service) String
Service_ServiceType
type Service_ServiceType int32The type of service.
Service_SERVICE_TYPE_UNSPECIFIED, Service_KERNEL_DRIVER, Service_FILE_SYSTEM_DRIVER, Service_WIN32_OWN_PROCESS, Service_WIN32_SHARE_PROCESS, Service_ADAPTER, Service_RECOGNIZER_DRIVER, Service_INTERACTIVE_PROCESS
const (
// Default service type.
Service_SERVICE_TYPE_UNSPECIFIED Service_ServiceType = 0
// A kernel driver.
Service_KERNEL_DRIVER Service_ServiceType = 1
// A file system driver.
Service_FILE_SYSTEM_DRIVER Service_ServiceType = 2
// A process that is owned by the service. This is a Windows-specific
// service type.
Service_WIN32_OWN_PROCESS Service_ServiceType = 3
// A process that is shared by the service. This is a Windows-specific
// service type.
Service_WIN32_SHARE_PROCESS Service_ServiceType = 4
// An adapter. This is a Windows-specific service type.
Service_ADAPTER Service_ServiceType = 5
// A recognizer driver. This is a Windows-specific service type.
Service_RECOGNIZER_DRIVER Service_ServiceType = 6
// An interactive process. This is a Windows-specific service type.
Service_INTERACTIVE_PROCESS Service_ServiceType = 7
)func (Service_ServiceType) Descriptor
func (Service_ServiceType) Descriptor() protoreflect.EnumDescriptorfunc (Service_ServiceType) Enum
func (x Service_ServiceType) Enum() *Service_ServiceTypefunc (Service_ServiceType) EnumDescriptor
func (Service_ServiceType) EnumDescriptor() ([]byte, []int)Deprecated: Use Service_ServiceType.Descriptor instead.
func (Service_ServiceType) Number
func (x Service_ServiceType) Number() protoreflect.EnumNumberfunc (Service_ServiceType) String
func (x Service_ServiceType) String() stringfunc (Service_ServiceType) Type
func (Service_ServiceType) Type() protoreflect.EnumTypeService_StartupType
type Service_StartupType int32How the service is started.
Service_STARTUP_TYPE_UNSPECIFIED, Service_AUTOMATIC, Service_MANUAL, Service_DISABLED
const (
// Default startup type.
Service_STARTUP_TYPE_UNSPECIFIED Service_StartupType = 0
// The service is started automatically.
Service_AUTOMATIC Service_StartupType = 1
// The service is started manually by a user.
Service_MANUAL Service_StartupType = 2
// The service is disabled and will not start automatically.
Service_DISABLED Service_StartupType = 3
)func (Service_StartupType) Descriptor
func (Service_StartupType) Descriptor() protoreflect.EnumDescriptorfunc (Service_StartupType) Enum
func (x Service_StartupType) Enum() *Service_StartupTypefunc (Service_StartupType) EnumDescriptor
func (Service_StartupType) EnumDescriptor() ([]byte, []int)Deprecated: Use Service_StartupType.Descriptor instead.
func (Service_StartupType) Number
func (x Service_StartupType) Number() protoreflect.EnumNumberfunc (Service_StartupType) String
func (x Service_StartupType) String() stringfunc (Service_StartupType) Type
func (Service_StartupType) Type() protoreflect.EnumTypeService_State
type Service_State int32The current status of the service.
Service_STATE_UNSPECIFIED, Service_RUNNING, Service_STOPPED, Service_PAUSED, Service_COMPLETED, Service_START_PENDING, Service_STOP_PENDING, Service_PAUSE_PENDING, Service_CONTINUE_PENDING
const (
// Default service status.
Service_STATE_UNSPECIFIED Service_State = 0
// The service is running.
Service_RUNNING Service_State = 1
// The service is stopped. This is a Windows-specific service status.
Service_STOPPED Service_State = 2
// The service is paused. This is a Windows-specific service status.
Service_PAUSED Service_State = 3
// The service is completed.
Service_COMPLETED Service_State = 4
// The service is starting.
Service_START_PENDING Service_State = 5
// The service is stopping.
Service_STOP_PENDING Service_State = 6
// The service is pausing.
Service_PAUSE_PENDING Service_State = 7
// The service is continuing.
Service_CONTINUE_PENDING Service_State = 8
)func (Service_State) Descriptor
func (Service_State) Descriptor() protoreflect.EnumDescriptorfunc (Service_State) Enum
func (x Service_State) Enum() *Service_Statefunc (Service_State) EnumDescriptor
func (Service_State) EnumDescriptor() ([]byte, []int)Deprecated: Use Service_State.Descriptor instead.
func (Service_State) Number
func (x Service_State) Number() protoreflect.EnumNumberfunc (Service_State) String
func (x Service_State) String() stringfunc (Service_State) Type
func (Service_State) Type() protoreflect.EnumTypeSignatureInfo
type SignatureInfo struct {
// Signature information extracted from the sigcheck tool.
Sigcheck *FileMetadataSignatureInfo `protobuf:"bytes,1,opt,name=sigcheck,proto3" json:"sigcheck,omitempty"`
// Signature information extracted from the codesign utility.
Codesign *FileMetadataCodesign `protobuf:"bytes,2,opt,name=codesign,proto3" json:"codesign,omitempty"`
// contains filtered or unexported fields
}File signature information extracted from different tools.
func (*SignatureInfo) Descriptor
func (*SignatureInfo) Descriptor() ([]byte, []int)Deprecated: Use SignatureInfo.ProtoReflect.Descriptor instead.
func (*SignatureInfo) GetCodesign
func (x *SignatureInfo) GetCodesign() *FileMetadataCodesignfunc (*SignatureInfo) GetSigcheck
func (x *SignatureInfo) GetSigcheck() *FileMetadataSignatureInfofunc (*SignatureInfo) ProtoMessage
func (*SignatureInfo) ProtoMessage()func (*SignatureInfo) ProtoReflect
func (x *SignatureInfo) ProtoReflect() protoreflect.Messagefunc (*SignatureInfo) Reset
func (x *SignatureInfo) Reset()func (*SignatureInfo) String
func (x *SignatureInfo) String() stringSignerInfo
type SignerInfo struct {
// Common name of the signers/certificate.
// The order of the signers matters. Each element is a higher level
// authority, the last being the root authority.
Name *string `protobuf:"bytes,1,opt,name=name,proto3,oneof" json:"name,omitempty"`
// It can say "Valid" or state the problem with the certificate if any (e.g.
// "This certificate or one of the certificates in the certificate chain is
// not time valid.").
Status *string `protobuf:"bytes,2,opt,name=status,proto3,oneof" json:"status,omitempty"`
// Indicates which situations the certificate is valid for (e.g. "Code
// Signing").
ValidUsage *string `protobuf:"bytes,3,opt,name=valid_usage,json=validUsage,proto3,oneof" json:"valid_usage,omitempty"`
// Company that issued the certificate.
CertIssuer *string `protobuf:"bytes,4,opt,name=cert_issuer,json=certIssuer,proto3,oneof" json:"cert_issuer,omitempty"`
// contains filtered or unexported fields
}File metadata related to the signer information.
func (*SignerInfo) Descriptor
func (*SignerInfo) Descriptor() ([]byte, []int)Deprecated: Use SignerInfo.ProtoReflect.Descriptor instead.
func (*SignerInfo) GetCertIssuer
func (x *SignerInfo) GetCertIssuer() stringfunc (*SignerInfo) GetName
func (x *SignerInfo) GetName() stringfunc (*SignerInfo) GetStatus
func (x *SignerInfo) GetStatus() stringfunc (*SignerInfo) GetValidUsage
func (x *SignerInfo) GetValidUsage() stringfunc (*SignerInfo) ProtoMessage
func (*SignerInfo) ProtoMessage()func (*SignerInfo) ProtoReflect
func (x *SignerInfo) ProtoReflect() protoreflect.Messagefunc (*SignerInfo) Reset
func (x *SignerInfo) Reset()func (*SignerInfo) String
func (x *SignerInfo) String() stringSmtp
type Smtp struct {
// The client's 'HELO'/'EHLO' string.
Helo string `protobuf:"bytes,1,opt,name=helo,proto3" json:"helo,omitempty"`
// The client's 'MAIL FROM' string.
MailFrom string `protobuf:"bytes,2,opt,name=mail_from,json=mailFrom,proto3" json:"mail_from,omitempty"`
// The client's 'RCPT TO' string(s).
RcptTo []string `protobuf:"bytes,3,rep,name=rcpt_to,json=rcptTo,proto3" json:"rcpt_to,omitempty"`
// The server's response(s) to the client.
ServerResponse []string `protobuf:"bytes,4,rep,name=server_response,json=serverResponse,proto3" json:"server_response,omitempty"`
// The message's path (extracted from the headers).
MessagePath string `protobuf:"bytes,5,opt,name=message_path,json=messagePath,proto3" json:"message_path,omitempty"`
// If the message was sent via a webmail client.
IsWebmail bool `protobuf:"varint,6,opt,name=is_webmail,json=isWebmail,proto3" json:"is_webmail,omitempty"`
// If the connection switched to TLS.
IsTls bool `protobuf:"varint,7,opt,name=is_tls,json=isTls,proto3" json:"is_tls,omitempty"`
// contains filtered or unexported fields
}SMTP info. See RFC 2821.
func (*Smtp) Descriptor
Deprecated: Use Smtp.ProtoReflect.Descriptor instead.
func (*Smtp) GetHelo
func (*Smtp) GetIsTls
func (*Smtp) GetIsWebmail
func (*Smtp) GetMailFrom
func (*Smtp) GetMessagePath
func (*Smtp) GetRcptTo
func (*Smtp) GetServerResponse
func (*Smtp) ProtoMessage
func (*Smtp) ProtoMessage()func (*Smtp) ProtoReflect
func (x *Smtp) ProtoReflect() protoreflect.Messagefunc (*Smtp) Reset
func (x *Smtp) Reset()func (*Smtp) String
SoarAlertMetadata
type SoarAlertMetadata struct {
// Alert ID in the source SIEM system.
AlertId string `protobuf:"bytes,1,opt,name=alert_id,json=alertId,proto3" json:"alert_id,omitempty"`
// Name of the rule triggering the alert in the source SIEM.
SourceRule string `protobuf:"bytes,2,opt,name=source_rule,json=sourceRule,proto3" json:"source_rule,omitempty"`
// Name of the vendor.
Vendor string `protobuf:"bytes,3,opt,name=vendor,proto3" json:"vendor,omitempty"`
// Name of the Source SIEM system.
SourceSystem string `protobuf:"bytes,4,opt,name=source_system,json=sourceSystem,proto3" json:"source_system,omitempty"`
// Name of the product the alert is coming from.
Product string `protobuf:"bytes,5,opt,name=product,proto3" json:"product,omitempty"`
// Ticket id for the alert in the source system.
SourceSystemTicketId string `protobuf:"bytes,6,opt,name=source_system_ticket_id,json=sourceSystemTicketId,proto3" json:"source_system_ticket_id,omitempty"`
// Url to the source SIEM system.
SourceSystemUri string `protobuf:"bytes,7,opt,name=source_system_uri,json=sourceSystemUri,proto3" json:"source_system_uri,omitempty"`
// contains filtered or unexported fields
}Metadata fields of alerts coming from other SIEM systems.
func (*SoarAlertMetadata) Descriptor
func (*SoarAlertMetadata) Descriptor() ([]byte, []int)Deprecated: Use SoarAlertMetadata.ProtoReflect.Descriptor instead.
func (*SoarAlertMetadata) GetAlertId
func (x *SoarAlertMetadata) GetAlertId() stringfunc (*SoarAlertMetadata) GetProduct
func (x *SoarAlertMetadata) GetProduct() stringfunc (*SoarAlertMetadata) GetSourceRule
func (x *SoarAlertMetadata) GetSourceRule() stringfunc (*SoarAlertMetadata) GetSourceSystem
func (x *SoarAlertMetadata) GetSourceSystem() stringfunc (*SoarAlertMetadata) GetSourceSystemTicketId
func (x *SoarAlertMetadata) GetSourceSystemTicketId() stringfunc (*SoarAlertMetadata) GetSourceSystemUri
func (x *SoarAlertMetadata) GetSourceSystemUri() stringfunc (*SoarAlertMetadata) GetVendor
func (x *SoarAlertMetadata) GetVendor() stringfunc (*SoarAlertMetadata) ProtoMessage
func (*SoarAlertMetadata) ProtoMessage()func (*SoarAlertMetadata) ProtoReflect
func (x *SoarAlertMetadata) ProtoReflect() protoreflect.Messagefunc (*SoarAlertMetadata) Reset
func (x *SoarAlertMetadata) Reset()func (*SoarAlertMetadata) String
func (x *SoarAlertMetadata) String() stringSoftware
type Software struct {
// The name of the software.
Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
// The version of the software.
Version string `protobuf:"bytes,2,opt,name=version,proto3" json:"version,omitempty"`
// System permissions granted to the software.
// For example, "android.permission.WRITE_EXTERNAL_STORAGE"
Permissions []*Permission `protobuf:"bytes,3,rep,name=permissions,proto3" json:"permissions,omitempty"`
// The description of the software.
Description string `protobuf:"bytes,4,opt,name=description,proto3" json:"description,omitempty"`
// The name of the software vendor.
VendorName string `protobuf:"bytes,5,opt,name=vendor_name,json=vendorName,proto3" json:"vendor_name,omitempty"`
// contains filtered or unexported fields
}Information about a software package or application.
func (*Software) Descriptor
Deprecated: Use Software.ProtoReflect.Descriptor instead.
func (*Software) GetDescription
func (*Software) GetName
func (*Software) GetPermissions
func (x *Software) GetPermissions() []*Permissionfunc (*Software) GetVendorName
func (*Software) GetVersion
func (*Software) ProtoMessage
func (*Software) ProtoMessage()func (*Software) ProtoReflect
func (x *Software) ProtoReflect() protoreflect.Messagefunc (*Software) Reset
func (x *Software) Reset()func (*Software) String
Srum
type Srum struct {
// A unique identifier for the SRUM record or the application/user being
// monitored.
Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
// The number of bytes read by the application while running in the
// background.
BackgroundBytesRead int64 `protobuf:"varint,2,opt,name=background_bytes_read,json=backgroundBytesRead,proto3" json:"background_bytes_read,omitempty"`
// The number of bytes written by the application while running in the
// background.
BackgroundBytesWritten int64 `protobuf:"varint,3,opt,name=background_bytes_written,json=backgroundBytesWritten,proto3" json:"background_bytes_written,omitempty"`
// The number of context switches performed by the application's threads
// while in the background.
BackgroundContextSwitches int64 `protobuf:"varint,4,opt,name=background_context_switches,json=backgroundContextSwitches,proto3" json:"background_context_switches,omitempty"`
// The amount of CPU cycle time consumed by the application in the
// background, measured in clock cycles.
BackgroundCycleCount int64 `protobuf:"varint,5,opt,name=background_cycle_count,json=backgroundCycleCount,proto3" json:"background_cycle_count,omitempty"`
// The number of flush operations performed by the application in the
// background.
BackgroundFlushesCount int64 `protobuf:"varint,6,opt,name=background_flushes_count,json=backgroundFlushesCount,proto3" json:"background_flushes_count,omitempty"`
// The number of read operations performed by the application in the
// background.
BackgroundReadOperations int64 `protobuf:"varint,7,opt,name=background_read_operations,json=backgroundReadOperations,proto3" json:"background_read_operations,omitempty"`
// The number of write operations performed by the application in the
// background.
BackgroundWriteOperations int64 `protobuf:"varint,8,opt,name=background_write_operations,json=backgroundWriteOperations,proto3" json:"background_write_operations,omitempty"`
// The Locally Unique Identifier (LUID) for the network interface used for
// data transfer.
InterfaceLuid string `protobuf:"bytes,9,opt,name=interface_luid,json=interfaceLuid,proto3" json:"interface_luid,omitempty"`
// contains filtered or unexported fields
}The Srum extension captures details specific to Windows System Resource Usage Monitor (SRUM) events.
func (*Srum) Descriptor
Deprecated: Use Srum.ProtoReflect.Descriptor instead.
func (*Srum) GetBackgroundBytesRead
func (*Srum) GetBackgroundBytesWritten
func (*Srum) GetBackgroundContextSwitches
func (*Srum) GetBackgroundCycleCount
func (*Srum) GetBackgroundFlushesCount
func (*Srum) GetBackgroundReadOperations
func (*Srum) GetBackgroundWriteOperations
func (*Srum) GetId
func (*Srum) GetInterfaceLuid
func (*Srum) ProtoMessage
func (*Srum) ProtoMessage()func (*Srum) ProtoReflect
func (x *Srum) ProtoReflect() protoreflect.Messagefunc (*Srum) Reset
func (x *Srum) Reset()func (*Srum) String
Status
type Status int32Describes status of a finding.
Status_STATUS_UNSPECIFIED, Status_NEW, Status_REVIEWED, Status_CLOSED, Status_OPEN
const (
// Unspecified finding status.
Status_STATUS_UNSPECIFIED Status = 0
// New finding.
Status_NEW Status = 1
// When a finding has feedback.
Status_REVIEWED Status = 2
// When an analyst closes an finding.
Status_CLOSED Status = 3
// Open. Used to indicate that a Case / Alert is open.
Status_OPEN Status = 4
)func (Status) Descriptor
func (Status) Descriptor() protoreflect.EnumDescriptorfunc (Status) Enum
func (Status) EnumDescriptor
Deprecated: Use Status.Descriptor instead.
func (Status) Number
func (x Status) Number() protoreflect.EnumNumberfunc (Status) String
func (Status) Type
func (Status) Type() protoreflect.EnumTypeStringSequence
type StringSequence struct {
// string sequence.
StringVals []string `protobuf:"bytes,1,rep,name=string_vals,json=stringVals,proto3" json:"string_vals,omitempty"`
// contains filtered or unexported fields
}StringSequence represents a sequence of string.
func (*StringSequence) Descriptor
func (*StringSequence) Descriptor() ([]byte, []int)Deprecated: Use StringSequence.ProtoReflect.Descriptor instead.
func (*StringSequence) GetStringVals
func (x *StringSequence) GetStringVals() []stringfunc (*StringSequence) ProtoMessage
func (*StringSequence) ProtoMessage()func (*StringSequence) ProtoReflect
func (x *StringSequence) ProtoReflect() protoreflect.Messagefunc (*StringSequence) Reset
func (x *StringSequence) Reset()func (*StringSequence) String
func (x *StringSequence) String() stringStringToInt64MapEntry
type StringToInt64MapEntry struct {
// Key field.
Key *string `protobuf:"bytes,1,opt,name=key,proto3,oneof" json:"key,omitempty"`
// Value field.
Value *int64 `protobuf:"varint,2,opt,name=value,proto3,oneof" json:"value,omitempty"`
// contains filtered or unexported fields
}func (*StringToInt64MapEntry) Descriptor
func (*StringToInt64MapEntry) Descriptor() ([]byte, []int)Deprecated: Use StringToInt64MapEntry.ProtoReflect.Descriptor instead.
func (*StringToInt64MapEntry) GetKey
func (x *StringToInt64MapEntry) GetKey() stringfunc (*StringToInt64MapEntry) GetValue
func (x *StringToInt64MapEntry) GetValue() int64func (*StringToInt64MapEntry) ProtoMessage
func (*StringToInt64MapEntry) ProtoMessage()func (*StringToInt64MapEntry) ProtoReflect
func (x *StringToInt64MapEntry) ProtoReflect() protoreflect.Messagefunc (*StringToInt64MapEntry) Reset
func (x *StringToInt64MapEntry) Reset()func (*StringToInt64MapEntry) String
func (x *StringToInt64MapEntry) String() stringSystemEventDetails
type SystemEventDetails struct {
// The specific type or category of the message.
MessageType string `protobuf:"bytes,1,opt,name=message_type,json=messageType,proto3" json:"message_type,omitempty"`
// An identifier for the image associated with the sender of the message.
SenderImageId string `protobuf:"bytes,2,opt,name=sender_image_id,json=senderImageId,proto3" json:"sender_image_id,omitempty"`
// The subsystem or component that generated the event.
Subsystem string `protobuf:"bytes,3,opt,name=subsystem,proto3" json:"subsystem,omitempty"`
// contains filtered or unexported fields
}Captures additional details for system-level events.
func (*SystemEventDetails) Descriptor
func (*SystemEventDetails) Descriptor() ([]byte, []int)Deprecated: Use SystemEventDetails.ProtoReflect.Descriptor instead.
func (*SystemEventDetails) GetMessageType
func (x *SystemEventDetails) GetMessageType() stringfunc (*SystemEventDetails) GetSenderImageId
func (x *SystemEventDetails) GetSenderImageId() stringfunc (*SystemEventDetails) GetSubsystem
func (x *SystemEventDetails) GetSubsystem() stringfunc (*SystemEventDetails) ProtoMessage
func (*SystemEventDetails) ProtoMessage()func (*SystemEventDetails) ProtoReflect
func (x *SystemEventDetails) ProtoReflect() protoreflect.Messagefunc (*SystemEventDetails) Reset
func (x *SystemEventDetails) Reset()func (*SystemEventDetails) String
func (x *SystemEventDetails) String() stringTags
type Tags struct {
// A list of subtenant ids that this event belongs to.
TenantId [][]byte `protobuf:"bytes,1,rep,name=tenant_id,json=tenantId,proto3" json:"tenant_id,omitempty"`
// A list of sink name values defined in DataTap configurations.
DataTapConfigName []string `protobuf:"bytes,2,rep,name=data_tap_config_name,json=dataTapConfigName,proto3" json:"data_tap_config_name,omitempty"`
// contains filtered or unexported fields
}Tags are event metadata which is set by examining event contents post-parsing. For example, a UDM event may be assigned a tenant_id based on certain customer-defined parameters.
func (*Tags) Descriptor
Deprecated: Use Tags.ProtoReflect.Descriptor instead.
func (*Tags) GetDataTapConfigName
func (*Tags) GetTenantId
func (*Tags) ProtoMessage
func (*Tags) ProtoMessage()func (*Tags) ProtoReflect
func (x *Tags) ProtoReflect() protoreflect.Messagefunc (*Tags) Reset
func (x *Tags) Reset()func (*Tags) String
ThreatVerdict
type ThreatVerdict int32GCTI threat verdict levels.
ThreatVerdict_THREAT_VERDICT_UNSPECIFIED, ThreatVerdict_UNDETECTED, ThreatVerdict_SUSPICIOUS, ThreatVerdict_MALICIOUS
const (
// Unspecified threat verdict level.
ThreatVerdict_THREAT_VERDICT_UNSPECIFIED ThreatVerdict = 0
// Undetected threat verdict level.
ThreatVerdict_UNDETECTED ThreatVerdict = 1
// Suspicious threat verdict level.
ThreatVerdict_SUSPICIOUS ThreatVerdict = 2
// Malicious threat verdict level.
ThreatVerdict_MALICIOUS ThreatVerdict = 3
)func (ThreatVerdict) Descriptor
func (ThreatVerdict) Descriptor() protoreflect.EnumDescriptorfunc (ThreatVerdict) Enum
func (x ThreatVerdict) Enum() *ThreatVerdictfunc (ThreatVerdict) EnumDescriptor
func (ThreatVerdict) EnumDescriptor() ([]byte, []int)Deprecated: Use ThreatVerdict.Descriptor instead.
func (ThreatVerdict) Number
func (x ThreatVerdict) Number() protoreflect.EnumNumberfunc (ThreatVerdict) String
func (x ThreatVerdict) String() stringfunc (ThreatVerdict) Type
func (ThreatVerdict) Type() protoreflect.EnumTypeTimeOff
type TimeOff struct {
// Interval duration of the leave.
Interval *interval.Interval `protobuf:"bytes,1,opt,name=interval,proto3" json:"interval,omitempty"`
// Description of the leave if available (e.g. 'Vacation').
Description string `protobuf:"bytes,2,opt,name=description,proto3" json:"description,omitempty"`
// contains filtered or unexported fields
}System record for leave/time-off from a Human Capital Management (HCM) system.
func (*TimeOff) Descriptor
Deprecated: Use TimeOff.ProtoReflect.Descriptor instead.
func (*TimeOff) GetDescription
func (*TimeOff) GetInterval
func (*TimeOff) ProtoMessage
func (*TimeOff) ProtoMessage()func (*TimeOff) ProtoReflect
func (x *TimeOff) ProtoReflect() protoreflect.Messagefunc (*TimeOff) Reset
func (x *TimeOff) Reset()func (*TimeOff) String
Tls
type Tls struct {
// Certificate information for the client certificate.
Client *Tls_Client `protobuf:"bytes,1,opt,name=client,proto3" json:"client,omitempty"`
// Certificate information for the server certificate.
Server *Tls_Server `protobuf:"bytes,2,opt,name=server,proto3" json:"server,omitempty"`
// Cipher used during the connection.
Cipher string `protobuf:"bytes,3,opt,name=cipher,proto3" json:"cipher,omitempty"`
// Elliptical curve used for a given cipher.
Curve string `protobuf:"bytes,4,opt,name=curve,proto3" json:"curve,omitempty"`
// TLS version.
Version string `protobuf:"bytes,5,opt,name=version,proto3" json:"version,omitempty"`
// Protocol.
VersionProtocol string `protobuf:"bytes,6,opt,name=version_protocol,json=versionProtocol,proto3" json:"version_protocol,omitempty"`
// Indicates whether the TLS negotiation was successful.
Established bool `protobuf:"varint,7,opt,name=established,proto3" json:"established,omitempty"`
// Protocol to be used for tunnel.
NextProtocol string `protobuf:"bytes,8,opt,name=next_protocol,json=nextProtocol,proto3" json:"next_protocol,omitempty"`
// Indicates whether the TLS connection was resumed from a previous
// TLS negotiation.
Resumed bool `protobuf:"varint,9,opt,name=resumed,proto3" json:"resumed,omitempty"`
// contains filtered or unexported fields
}Transport Layer Security (TLS) information.
func (*Tls) Descriptor
Deprecated: Use Tls.ProtoReflect.Descriptor instead.
func (*Tls) GetCipher
func (*Tls) GetClient
func (x *Tls) GetClient() *Tls_Clientfunc (*Tls) GetCurve
func (*Tls) GetEstablished
func (*Tls) GetNextProtocol
func (*Tls) GetResumed
func (*Tls) GetServer
func (x *Tls) GetServer() *Tls_Serverfunc (*Tls) GetVersion
func (*Tls) GetVersionProtocol
func (*Tls) ProtoMessage
func (*Tls) ProtoMessage()func (*Tls) ProtoReflect
func (x *Tls) ProtoReflect() protoreflect.Messagefunc (*Tls) Reset
func (x *Tls) Reset()func (*Tls) String
Tls_Client
type Tls_Client struct {
// Client certificate.
Certificate *Certificate `protobuf:"bytes,1,opt,name=certificate,proto3" json:"certificate,omitempty"`
// JA3 hash from the TLS ClientHello, as a hex-encoded string.
Ja3 string `protobuf:"bytes,2,opt,name=ja3,proto3" json:"ja3,omitempty"`
// Host name of the server, that the client is connecting to.
ServerName string `protobuf:"bytes,3,opt,name=server_name,json=serverName,proto3" json:"server_name,omitempty"`
// Ciphers supported by the client during client hello.
SupportedCiphers []string `protobuf:"bytes,4,rep,name=supported_ciphers,json=supportedCiphers,proto3" json:"supported_ciphers,omitempty"`
// JA4 hash from the TLS ClientHello, as a hex-encoded string.
Ja4 string `protobuf:"bytes,5,opt,name=ja4,proto3" json:"ja4,omitempty"`
// contains filtered or unexported fields
}Transport Layer Security (TLS) information associated with the client (for example, Certificate or JA3 hash).
func (*Tls_Client) Descriptor
func (*Tls_Client) Descriptor() ([]byte, []int)Deprecated: Use Tls_Client.ProtoReflect.Descriptor instead.
func (*Tls_Client) GetCertificate
func (x *Tls_Client) GetCertificate() *Certificatefunc (*Tls_Client) GetJa3
func (x *Tls_Client) GetJa3() stringfunc (*Tls_Client) GetJa4
func (x *Tls_Client) GetJa4() stringfunc (*Tls_Client) GetServerName
func (x *Tls_Client) GetServerName() stringfunc (*Tls_Client) GetSupportedCiphers
func (x *Tls_Client) GetSupportedCiphers() []stringfunc (*Tls_Client) ProtoMessage
func (*Tls_Client) ProtoMessage()func (*Tls_Client) ProtoReflect
func (x *Tls_Client) ProtoReflect() protoreflect.Messagefunc (*Tls_Client) Reset
func (x *Tls_Client) Reset()func (*Tls_Client) String
func (x *Tls_Client) String() stringTls_Server
type Tls_Server struct {
// Server certificate.
Certificate *Certificate `protobuf:"bytes,1,opt,name=certificate,proto3" json:"certificate,omitempty"`
// JA3 hash from the TLS ServerHello, as a hex-encoded string.
Ja3S string `protobuf:"bytes,2,opt,name=ja3s,proto3" json:"ja3s,omitempty"`
// JA4 hash from the TLS ServerHello, as a hex-encoded string.
Ja4S string `protobuf:"bytes,3,opt,name=ja4s,proto3" json:"ja4s,omitempty"`
// contains filtered or unexported fields
}Transport Layer Security (TLS) information associated with the server (for example, Certificate or JA3 hash).
func (*Tls_Server) Descriptor
func (*Tls_Server) Descriptor() ([]byte, []int)Deprecated: Use Tls_Server.ProtoReflect.Descriptor instead.
func (*Tls_Server) GetCertificate
func (x *Tls_Server) GetCertificate() *Certificatefunc (*Tls_Server) GetJa3S
func (x *Tls_Server) GetJa3S() stringfunc (*Tls_Server) GetJa4S
func (x *Tls_Server) GetJa4S() stringfunc (*Tls_Server) ProtoMessage
func (*Tls_Server) ProtoMessage()func (*Tls_Server) ProtoReflect
func (x *Tls_Server) ProtoReflect() protoreflect.Messagefunc (*Tls_Server) Reset
func (x *Tls_Server) Reset()func (*Tls_Server) String
func (x *Tls_Server) String() stringTracker
type Tracker struct {
// Tracker name.
Tracker string `protobuf:"bytes,1,opt,name=tracker,proto3" json:"tracker,omitempty"`
// Tracker ID, if available.
Id string `protobuf:"bytes,2,opt,name=id,proto3" json:"id,omitempty"`
// Tracker ingestion date.
Timestamp *timestamppb.Timestamp `protobuf:"bytes,3,opt,name=timestamp,proto3" json:"timestamp,omitempty"`
// Tracker script URL.
Url string `protobuf:"bytes,4,opt,name=url,proto3" json:"url,omitempty"`
// contains filtered or unexported fields
}URL Tracker.
func (*Tracker) Descriptor
Deprecated: Use Tracker.ProtoReflect.Descriptor instead.
func (*Tracker) GetId
func (*Tracker) GetTimestamp
func (x *Tracker) GetTimestamp() *timestamppb.Timestampfunc (*Tracker) GetTracker
func (*Tracker) GetUrl
func (*Tracker) ProtoMessage
func (*Tracker) ProtoMessage()func (*Tracker) ProtoReflect
func (x *Tracker) ProtoReflect() protoreflect.Messagefunc (*Tracker) Reset
func (x *Tracker) Reset()func (*Tracker) String
Tunnels
type Tunnels struct {
// The provider of the VPN tunnels being used.
Provider string `protobuf:"bytes,1,opt,name=provider,proto3" json:"provider,omitempty"`
// The type of the VPN tunnels.
Type string `protobuf:"bytes,2,opt,name=type,proto3" json:"type,omitempty"`
// contains filtered or unexported fields
}VPN tunnels.
func (*Tunnels) Descriptor
Deprecated: Use Tunnels.ProtoReflect.Descriptor instead.
func (*Tunnels) GetProvider
func (*Tunnels) GetType
func (*Tunnels) ProtoMessage
func (*Tunnels) ProtoMessage()func (*Tunnels) ProtoReflect
func (x *Tunnels) ProtoReflect() protoreflect.Messagefunc (*Tunnels) Reset
func (x *Tunnels) Reset()func (*Tunnels) String
UDM
type UDM struct {
// Event metadata such as timestamp, source product, etc.
Metadata *Metadata `protobuf:"bytes,1,opt,name=metadata,proto3" json:"metadata,omitempty"`
// Any important vendor-specific event data that cannot be adequately
// represented within the formal sections of the UDM model.
Additional *structpb.Struct `protobuf:"bytes,2,opt,name=additional,proto3" json:"additional,omitempty"`
// Represents the acting entity that originates the activity
// described in the event. The principal must include at least one machine
// detail (hostname, MACs, IPs, port, product-specific identifiers like an
// EDR asset ID) or user detail (for example, username), and optionally
// include process details. It must NOT include any of the following fields:
// email, files, registry keys or values.
Principal *Noun `protobuf:"bytes,3,opt,name=principal,proto3" json:"principal,omitempty"`
// Represents a source entity being acted upon by the participant along with
// the device or process context for the source object (the machine where the
// source object resides). For example, if user U copies file A on machine X
// to file B on machine Y, both file A and machine X would be specified in the
// src portion of the UDM event.
Src *Noun `protobuf:"bytes,4,opt,name=src,proto3" json:"src,omitempty"`
// Represents a target entity being referenced by the event or an object on
// the target entity. For example, in a firewall connection from device A to
// device B, A is described as the principal and B is described as the target.
// For a process injection by process C into target process D, process C is
// described as the principal and process D is described as the target.
Target *Noun `protobuf:"bytes,5,opt,name=target,proto3" json:"target,omitempty"`
// Represents details on one or more intermediate entities processing activity
// described in the event. This includes device details about a proxy server
// or SMTP relay server. If an active event (that has a principal and
// possibly target) passes through any intermediaries, they're added here.
// Intermediaries can impact the overall action, for example blocking or
// modifying an ongoing request. A rule of thumb here is that 'principal',
// 'target', and description of the initial action should be the same
// regardless of the intermediary or its action. A successful network
// connection from A->B should look the same in principal/target/intermediary
// as one blocked by firewall C: principal: A, target: B (intermediary: C).
Intermediary []*Noun `protobuf:"bytes,6,rep,name=intermediary,proto3" json:"intermediary,omitempty"`
// Represents an observer entity (for example, a packet sniffer or
// network-based vulnerability scanner), which is not a direct intermediary,
// but which observes and reports on the event in question.
Observer *Noun `protobuf:"bytes,7,opt,name=observer,proto3" json:"observer,omitempty"`
// Represents entities referenced by the event that are not otherwise
// described in principal, src, target, intermediary or observer. For example,
// it could be used to track email file attachments, domains/URLs/IPs embedded
// within an email body, and DLLs that are loaded during a PROCESS_LAUNCH
// event.
About []*Noun `protobuf:"bytes,8,rep,name=about,proto3" json:"about,omitempty"`
// A list of security results.
SecurityResult []*SecurityResult `protobuf:"bytes,9,rep,name=security_result,json=securityResult,proto3" json:"security_result,omitempty"`
// All network details go here, including sub-messages with details on each
// protocol (for example, DHCP, DNS, or HTTP).
Network *Network `protobuf:"bytes,10,opt,name=network,proto3" json:"network,omitempty"`
// All other first-class, event-specific metadata goes in this message.
// Do not place protocol metadata in Extensions; put it in Network.
Extensions *Extensions `protobuf:"bytes,11,opt,name=extensions,proto3" json:"extensions,omitempty"`
// Flattened fields extracted from the log.
Extracted *structpb.Struct `protobuf:"bytes,12,opt,name=extracted,proto3" json:"extracted,omitempty"`
// Related UDM fields that are grouped together.
Grouped *GroupedFields `protobuf:"bytes,13,opt,name=grouped,proto3,oneof" json:"grouped,omitempty"`
// contains filtered or unexported fields
}A Unified Data Model event.
func (*UDM) Descriptor
Deprecated: Use UDM.ProtoReflect.Descriptor instead.
func (*UDM) GetAbout
func (*UDM) GetAdditional
func (*UDM) GetExtensions
func (x *UDM) GetExtensions() *Extensionsfunc (*UDM) GetExtracted
func (*UDM) GetGrouped
func (x *UDM) GetGrouped() *GroupedFieldsfunc (*UDM) GetIntermediary
func (*UDM) GetMetadata
func (*UDM) GetNetwork
func (*UDM) GetObserver
func (*UDM) GetPrincipal
func (*UDM) GetSecurityResult
func (x *UDM) GetSecurityResult() []*SecurityResultfunc (*UDM) GetSrc
func (*UDM) GetTarget
func (*UDM) ProtoMessage
func (*UDM) ProtoMessage()func (*UDM) ProtoReflect
func (x *UDM) ProtoReflect() protoreflect.Messagefunc (*UDM) Reset
func (x *UDM) Reset()func (*UDM) String
Uint64Sequence
type Uint64Sequence struct {
// uint64 sequence.
Uint64Vals []uint64 `protobuf:"varint,1,rep,packed,name=uint64_vals,json=uint64Vals,proto3" json:"uint64_vals,omitempty"`
// contains filtered or unexported fields
}Uint64Sequence represents a sequence of uint64s.
func (*Uint64Sequence) Descriptor
func (*Uint64Sequence) Descriptor() ([]byte, []int)Deprecated: Use Uint64Sequence.ProtoReflect.Descriptor instead.
func (*Uint64Sequence) GetUint64Vals
func (x *Uint64Sequence) GetUint64Vals() []uint64func (*Uint64Sequence) ProtoMessage
func (*Uint64Sequence) ProtoMessage()func (*Uint64Sequence) ProtoReflect
func (x *Uint64Sequence) ProtoReflect() protoreflect.Messagefunc (*Uint64Sequence) Reset
func (x *Uint64Sequence) Reset()func (*Uint64Sequence) String
func (x *Uint64Sequence) String() stringUrl
type Url struct {
// URL.
Url string `protobuf:"bytes,1,opt,name=url,proto3" json:"url,omitempty"`
// Categorisation done by VirusTotal partners.
Categories []string `protobuf:"bytes,2,rep,name=categories,proto3" json:"categories,omitempty"`
// Difference hash and MD5 hash of the URL's.
Favicon *Favicon `protobuf:"bytes,3,opt,name=favicon,proto3" json:"favicon,omitempty"`
// Meta tags (only for URLs downloading HTML).
HtmlMeta *structpb.Struct `protobuf:"bytes,4,opt,name=html_meta,json=htmlMeta,proto3" json:"html_meta,omitempty"`
// If the original URL redirects, where does it end.
LastFinalUrl string `protobuf:"bytes,5,opt,name=last_final_url,json=lastFinalUrl,proto3" json:"last_final_url,omitempty"`
// HTTP response code of the last response.
LastHttpResponseCode int32 `protobuf:"varint,6,opt,name=last_http_response_code,json=lastHttpResponseCode,proto3" json:"last_http_response_code,omitempty"`
// Length in bytes of the content received.
LastHttpResponseContentLength int64 `protobuf:"varint,7,opt,name=last_http_response_content_length,json=lastHttpResponseContentLength,proto3" json:"last_http_response_content_length,omitempty"`
// URL response body's SHA256 hash.
LastHttpResponseContentSha256 string `protobuf:"bytes,8,opt,name=last_http_response_content_sha256,json=lastHttpResponseContentSha256,proto3" json:"last_http_response_content_sha256,omitempty"`
// Website's cookies.
LastHttpResponseCookies *structpb.Struct `protobuf:"bytes,9,opt,name=last_http_response_cookies,json=lastHttpResponseCookies,proto3" json:"last_http_response_cookies,omitempty"`
// Headers and values of the last HTTP response.
LastHttpResponseHeaders *structpb.Struct `protobuf:"bytes,10,opt,name=last_http_response_headers,json=lastHttpResponseHeaders,proto3" json:"last_http_response_headers,omitempty"`
// Tags.
Tags []string `protobuf:"bytes,11,rep,name=tags,proto3" json:"tags,omitempty"`
// Webpage title.
Title string `protobuf:"bytes,12,opt,name=title,proto3" json:"title,omitempty"`
// Trackers found in the URL in a historical manner.
Trackers []*Tracker `protobuf:"bytes,13,rep,name=trackers,proto3" json:"trackers,omitempty"`
// contains filtered or unexported fields
}Url.
func (*Url) Descriptor
Deprecated: Use Url.ProtoReflect.Descriptor instead.
func (*Url) GetCategories
func (*Url) GetFavicon
func (*Url) GetHtmlMeta
func (*Url) GetLastFinalUrl
func (*Url) GetLastHttpResponseCode
func (*Url) GetLastHttpResponseContentLength
func (*Url) GetLastHttpResponseContentSha256
func (*Url) GetLastHttpResponseCookies
func (*Url) GetLastHttpResponseHeaders
func (*Url) GetTags
func (*Url) GetTitle
func (*Url) GetTrackers
func (*Url) GetUrl
func (*Url) ProtoMessage
func (*Url) ProtoMessage()func (*Url) ProtoReflect
func (x *Url) ProtoReflect() protoreflect.Messagefunc (*Url) Reset
func (x *Url) Reset()func (*Url) String
User
type User struct {
// A vendor-specific identifier to uniquely identify the entity (e.g. a GUID,
// LDAP, OID, or similar).
// This field can be used as an entity indicator for user entities.
ProductObjectId string `protobuf:"bytes,7,opt,name=product_object_id,json=productObjectId,proto3" json:"product_object_id,omitempty"`
// The ID of the user.
// This field can be used as an entity indicator for user entities.
Userid string `protobuf:"bytes,1,opt,name=userid,proto3" json:"userid,omitempty"`
// The display name of the user
// (e.g. "John Locke").
UserDisplayName string `protobuf:"bytes,3,opt,name=user_display_name,json=userDisplayName,proto3" json:"user_display_name,omitempty"`
// First name of the user (e.g. "John").
FirstName string `protobuf:"bytes,100,opt,name=first_name,json=firstName,proto3" json:"first_name,omitempty"`
// Middle name of the user.
MiddleName string `protobuf:"bytes,101,opt,name=middle_name,json=middleName,proto3" json:"middle_name,omitempty"`
// Last name of the user (e.g. "Locke").
LastName string `protobuf:"bytes,102,opt,name=last_name,json=lastName,proto3" json:"last_name,omitempty"`
// Phone numbers for the user.
PhoneNumbers []string `protobuf:"bytes,103,rep,name=phone_numbers,json=phoneNumbers,proto3" json:"phone_numbers,omitempty"`
// Personal address of the user.
PersonalAddress *Location `protobuf:"bytes,104,opt,name=personal_address,json=personalAddress,proto3" json:"personal_address,omitempty"`
// Generic entity metadata attributes of the user.
Attribute *Attribute `protobuf:"bytes,8,opt,name=attribute,proto3" json:"attribute,omitempty"`
// The first observed time for a user.
// The value is calculated on the basis of the
// first time the identifier was observed.
FirstSeenTime *timestamppb.Timestamp `protobuf:"bytes,10,opt,name=first_seen_time,json=firstSeenTime,proto3" json:"first_seen_time,omitempty"`
// Type of user account (for example, service, domain, or cloud). This is
// somewhat aligned to:
// [https://attack.mitre.org/techniques/T1078/](https://attack.mitre.org/techniques/T1078/)
AccountType User_AccountType `protobuf:"varint,9,opt,name=account_type,json=accountType,proto3,enum=google.backstory.User_AccountType" json:"account_type,omitempty"`
// The ID of the group that the user belongs to.
// Deprecated in favor of the repeated group_identifiers field.
//
// Deprecated: Marked as deprecated in backstory/udm.proto.
Groupid string `protobuf:"bytes,2,opt,name=groupid,proto3" json:"groupid,omitempty"`
// Product object identifiers of the group(s) the user belongs to
// A vendor-specific identifier to uniquely identify the group(s) the user
// belongs to (a GUID, LDAP OID, or similar).
GroupIdentifiers []string `protobuf:"bytes,200,rep,name=group_identifiers,json=groupIdentifiers,proto3" json:"group_identifiers,omitempty"`
// The Microsoft Windows SID of the user.
// This field can be used as an entity indicator for user entities.
WindowsSid string `protobuf:"bytes,4,opt,name=windows_sid,json=windowsSid,proto3" json:"windows_sid,omitempty"`
// Email addresses of the user.
// This field can be used as an entity indicator for user entities.
EmailAddresses []string `protobuf:"bytes,5,rep,name=email_addresses,json=emailAddresses,proto3" json:"email_addresses,omitempty"`
// Human capital management identifier.
// This field can be used as an entity indicator for user entities.
EmployeeId string `protobuf:"bytes,6,opt,name=employee_id,json=employeeId,proto3" json:"employee_id,omitempty"`
// User job title.
Title string `protobuf:"bytes,601,opt,name=title,proto3" json:"title,omitempty"`
// User job company name.
CompanyName string `protobuf:"bytes,602,opt,name=company_name,json=companyName,proto3" json:"company_name,omitempty"`
// User job department
Department []string `protobuf:"bytes,603,rep,name=department,proto3" json:"department,omitempty"`
// User job office location.
OfficeAddress *Location `protobuf:"bytes,604,opt,name=office_address,json=officeAddress,proto3" json:"office_address,omitempty"`
// User job manager(s).
Managers []*User `protobuf:"bytes,605,rep,name=managers,proto3" json:"managers,omitempty"`
// User job employment hire date.
HireDate *timestamppb.Timestamp `protobuf:"bytes,606,opt,name=hire_date,json=hireDate,proto3" json:"hire_date,omitempty"`
// User job employment termination date.
TerminationDate *timestamppb.Timestamp `protobuf:"bytes,607,opt,name=termination_date,json=terminationDate,proto3" json:"termination_date,omitempty"`
// User time off leaves from active work.
TimeOff []*TimeOff `protobuf:"bytes,608,rep,name=time_off,json=timeOff,proto3" json:"time_off,omitempty"`
// User last login timestamp.
LastLoginTime *timestamppb.Timestamp `protobuf:"bytes,609,opt,name=last_login_time,json=lastLoginTime,proto3" json:"last_login_time,omitempty"`
// User last password change timestamp.
LastPasswordChangeTime *timestamppb.Timestamp `protobuf:"bytes,610,opt,name=last_password_change_time,json=lastPasswordChangeTime,proto3" json:"last_password_change_time,omitempty"`
// User password expiration timestamp.
PasswordExpirationTime *timestamppb.Timestamp `protobuf:"bytes,611,opt,name=password_expiration_time,json=passwordExpirationTime,proto3" json:"password_expiration_time,omitempty"`
// User account expiration timestamp.
AccountExpirationTime *timestamppb.Timestamp `protobuf:"bytes,612,opt,name=account_expiration_time,json=accountExpirationTime,proto3" json:"account_expiration_time,omitempty"`
// User account lockout timestamp.
AccountLockoutTime *timestamppb.Timestamp `protobuf:"bytes,613,opt,name=account_lockout_time,json=accountLockoutTime,proto3" json:"account_lockout_time,omitempty"`
// User last bad password attempt timestamp.
LastBadPasswordAttemptTime *timestamppb.Timestamp `protobuf:"bytes,614,opt,name=last_bad_password_attempt_time,json=lastBadPasswordAttemptTime,proto3" json:"last_bad_password_attempt_time,omitempty"`
// System authentication status for user.
UserAuthenticationStatus Authentication_AuthenticationStatus `protobuf:"varint,701,opt,name=user_authentication_status,json=userAuthenticationStatus,proto3,enum=google.backstory.Authentication_AuthenticationStatus" json:"user_authentication_status,omitempty"`
// System role name for user.
// Deprecated: use attribute.roles.
//
// Deprecated: Marked as deprecated in backstory/udm.proto.
RoleName string `protobuf:"bytes,702,opt,name=role_name,json=roleName,proto3" json:"role_name,omitempty"`
// System role description for user.
// Deprecated: use attribute.roles.
//
// Deprecated: Marked as deprecated in backstory/udm.proto.
RoleDescription string `protobuf:"bytes,703,opt,name=role_description,json=roleDescription,proto3" json:"role_description,omitempty"`
// System role for user.
// Deprecated: use attribute.roles.
//
// Deprecated: Marked as deprecated in backstory/udm.proto.
UserRole User_Role `protobuf:"varint,704,opt,name=user_role,json=userRole,proto3,enum=google.backstory.User_Role" json:"user_role,omitempty"`
// contains filtered or unexported fields
}Information about a user.
func (*User) Descriptor
Deprecated: Use User.ProtoReflect.Descriptor instead.
func (*User) GetAccountExpirationTime
func (x *User) GetAccountExpirationTime() *timestamppb.Timestampfunc (*User) GetAccountLockoutTime
func (x *User) GetAccountLockoutTime() *timestamppb.Timestampfunc (*User) GetAccountType
func (x *User) GetAccountType() User_AccountTypefunc (*User) GetAttribute
func (*User) GetCompanyName
func (*User) GetDepartment
func (*User) GetEmailAddresses
func (*User) GetEmployeeId
func (*User) GetFirstName
func (*User) GetFirstSeenTime
func (x *User) GetFirstSeenTime() *timestamppb.Timestampfunc (*User) GetGroupIdentifiers
func (*User) GetGroupid
Deprecated: Marked as deprecated in backstory/udm.proto.
func (*User) GetHireDate
func (x *User) GetHireDate() *timestamppb.Timestampfunc (*User) GetLastBadPasswordAttemptTime
func (x *User) GetLastBadPasswordAttemptTime() *timestamppb.Timestampfunc (*User) GetLastLoginTime
func (x *User) GetLastLoginTime() *timestamppb.Timestampfunc (*User) GetLastName
func (*User) GetLastPasswordChangeTime
func (x *User) GetLastPasswordChangeTime() *timestamppb.Timestampfunc (*User) GetManagers
func (*User) GetMiddleName
func (*User) GetOfficeAddress
func (*User) GetPasswordExpirationTime
func (x *User) GetPasswordExpirationTime() *timestamppb.Timestampfunc (*User) GetPersonalAddress
func (*User) GetPhoneNumbers
func (*User) GetProductObjectId
func (*User) GetRoleDescription
Deprecated: Marked as deprecated in backstory/udm.proto.
func (*User) GetRoleName
Deprecated: Marked as deprecated in backstory/udm.proto.
func (*User) GetTerminationDate
func (x *User) GetTerminationDate() *timestamppb.Timestampfunc (*User) GetTimeOff
func (*User) GetTitle
func (*User) GetUserAuthenticationStatus
func (x *User) GetUserAuthenticationStatus() Authentication_AuthenticationStatusfunc (*User) GetUserDisplayName
func (*User) GetUserRole
Deprecated: Marked as deprecated in backstory/udm.proto.
func (*User) GetUserid
func (*User) GetWindowsSid
func (*User) ProtoMessage
func (*User) ProtoMessage()func (*User) ProtoReflect
func (x *User) ProtoReflect() protoreflect.Messagefunc (*User) Reset
func (x *User) Reset()func (*User) String
UserAssist
type UserAssist struct {
// The number of times the application associated with the entry gained
// focus.
ApplicationFocusCount int64 `protobuf:"varint,1,opt,name=application_focus_count,json=applicationFocusCount,proto3" json:"application_focus_count,omitempty"`
// The total duration the application associated with the entry was in focus.
ApplicationFocusDuration *durationpb.Duration `protobuf:"bytes,2,opt,name=application_focus_duration,json=applicationFocusDuration,proto3" json:"application_focus_duration,omitempty"`
// The number of times the application associated with the entry has been
// executed.
ExecutionsCount int64 `protobuf:"varint,3,opt,name=executions_count,json=executionsCount,proto3" json:"executions_count,omitempty"`
// The index or identifier of the user assist entry, unique per user.
EntryIndex int64 `protobuf:"varint,4,opt,name=entry_index,json=entryIndex,proto3" json:"entry_index,omitempty"`
// contains filtered or unexported fields
}The UserAssist extension captures details specific to Windows User Assist events.
func (*UserAssist) Descriptor
func (*UserAssist) Descriptor() ([]byte, []int)Deprecated: Use UserAssist.ProtoReflect.Descriptor instead.
func (*UserAssist) GetApplicationFocusCount
func (x *UserAssist) GetApplicationFocusCount() int64func (*UserAssist) GetApplicationFocusDuration
func (x *UserAssist) GetApplicationFocusDuration() *durationpb.Durationfunc (*UserAssist) GetEntryIndex
func (x *UserAssist) GetEntryIndex() int64func (*UserAssist) GetExecutionsCount
func (x *UserAssist) GetExecutionsCount() int64func (*UserAssist) ProtoMessage
func (*UserAssist) ProtoMessage()func (*UserAssist) ProtoReflect
func (x *UserAssist) ProtoReflect() protoreflect.Messagefunc (*UserAssist) Reset
func (x *UserAssist) Reset()func (*UserAssist) String
func (x *UserAssist) String() stringUser_AccountType
type User_AccountType int32User Account Type.
User_ACCOUNT_TYPE_UNSPECIFIED, User_DOMAIN_ACCOUNT_TYPE, User_LOCAL_ACCOUNT_TYPE, User_CLOUD_ACCOUNT_TYPE, User_SERVICE_ACCOUNT_TYPE, User_DEFAULT_ACCOUNT_TYPE
const (
// Default user account type.
User_ACCOUNT_TYPE_UNSPECIFIED User_AccountType = 0
// A human account part of some domain in directory services.
User_DOMAIN_ACCOUNT_TYPE User_AccountType = 1
// A local machine account.
User_LOCAL_ACCOUNT_TYPE User_AccountType = 2
// A SaaS service account type (such as Slack or GitHub).
User_CLOUD_ACCOUNT_TYPE User_AccountType = 3
// A non-human account for data access.
User_SERVICE_ACCOUNT_TYPE User_AccountType = 4
// A system built in default account.
User_DEFAULT_ACCOUNT_TYPE User_AccountType = 5
)func (User_AccountType) Descriptor
func (User_AccountType) Descriptor() protoreflect.EnumDescriptorfunc (User_AccountType) Enum
func (x User_AccountType) Enum() *User_AccountTypefunc (User_AccountType) EnumDescriptor
func (User_AccountType) EnumDescriptor() ([]byte, []int)Deprecated: Use User_AccountType.Descriptor instead.
func (User_AccountType) Number
func (x User_AccountType) Number() protoreflect.EnumNumberfunc (User_AccountType) String
func (x User_AccountType) String() stringfunc (User_AccountType) Type
func (User_AccountType) Type() protoreflect.EnumTypeUser_Role
type User_Role int32User system roles.
User_UNKNOWN_ROLE, User_ADMINISTRATOR, User_SERVICE_ACCOUNT
const (
// Default user role.
User_UNKNOWN_ROLE User_Role = 0
// Product administrator with elevated privileges.
User_ADMINISTRATOR User_Role = 1
// System service account for automated privilege access.
// Deprecated: not a role, instead set User.account_type.
//
// Deprecated: Marked as deprecated in backstory/udm.proto.
User_SERVICE_ACCOUNT User_Role = 2
)func (User_Role) Descriptor
func (User_Role) Descriptor() protoreflect.EnumDescriptorfunc (User_Role) Enum
func (User_Role) EnumDescriptor
Deprecated: Use User_Role.Descriptor instead.
func (User_Role) Number
func (x User_Role) Number() protoreflect.EnumNumberfunc (User_Role) String
func (User_Role) Type
func (User_Role) Type() protoreflect.EnumTypeUsnJournal
type UsnJournal struct {
// File attributes flags from the USN record (e.g., "0x20").
AttributesFlag string `protobuf:"bytes,1,opt,name=attributes_flag,json=attributesFlag,proto3" json:"attributes_flag,omitempty"`
// Deprecated: Use file_attributes instead.
// File attributes from the USN record.
//
// Deprecated: Marked as deprecated in backstory/udm.proto.
Attributes UsnJournal_Attribute `protobuf:"varint,2,opt,name=attributes,proto3,enum=google.backstory.UsnJournal_Attribute" json:"attributes,omitempty"`
// File attributes from the USN record.
FileAttributes []UsnJournal_Attribute `protobuf:"varint,5,rep,packed,name=file_attributes,json=fileAttributes,proto3,enum=google.backstory.UsnJournal_Attribute" json:"file_attributes,omitempty"`
// Indicates whether the file is allocated in the Master File Table (MFT).
Allocated bool `protobuf:"varint,3,opt,name=allocated,proto3" json:"allocated,omitempty"`
// Deprecated: Use reasons instead.
// Human-readable string describing the reason for the USN journal entry.
// (e.g., "USN_REASON_FILE_CREATE").
//
// Deprecated: Marked as deprecated in backstory/udm.proto.
Reason UsnJournal_Reason `protobuf:"varint,4,opt,name=reason,proto3,enum=google.backstory.UsnJournal_Reason" json:"reason,omitempty"`
// Human-readable string describing the reasons for the USN journal entry
// (e.g., "USN_REASON_FILE_CREATE").
Reasons []UsnJournal_Reason `protobuf:"varint,6,rep,packed,name=reasons,proto3,enum=google.backstory.UsnJournal_Reason" json:"reasons,omitempty"`
// contains filtered or unexported fields
}Information from the NTFS USN Journal.
func (*UsnJournal) Descriptor
func (*UsnJournal) Descriptor() ([]byte, []int)Deprecated: Use UsnJournal.ProtoReflect.Descriptor instead.
func (*UsnJournal) GetAllocated
func (x *UsnJournal) GetAllocated() boolfunc (*UsnJournal) GetAttributes
func (x *UsnJournal) GetAttributes() UsnJournal_AttributeDeprecated: Marked as deprecated in backstory/udm.proto.
func (*UsnJournal) GetAttributesFlag
func (x *UsnJournal) GetAttributesFlag() stringfunc (*UsnJournal) GetFileAttributes
func (x *UsnJournal) GetFileAttributes() []UsnJournal_Attributefunc (*UsnJournal) GetReason
func (x *UsnJournal) GetReason() UsnJournal_ReasonDeprecated: Marked as deprecated in backstory/udm.proto.
func (*UsnJournal) GetReasons
func (x *UsnJournal) GetReasons() []UsnJournal_Reasonfunc (*UsnJournal) ProtoMessage
func (*UsnJournal) ProtoMessage()func (*UsnJournal) ProtoReflect
func (x *UsnJournal) ProtoReflect() protoreflect.Messagefunc (*UsnJournal) Reset
func (x *UsnJournal) Reset()func (*UsnJournal) String
func (x *UsnJournal) String() stringUsnJournal_Attribute
type UsnJournal_Attribute int32File attributes from the USN record (e.g., "READ_ONLY, HIDDEN"). See https://learn.microsoft.com/en-us/windows/win32/fileio/file-attribute-constants for more information about the attributes.
UsnJournal_ATTRIBUTE_UNSPECIFIED, UsnJournal_READ_ONLY, UsnJournal_HIDDEN, UsnJournal_SYSTEM, UsnJournal_ARCHIVE, UsnJournal_COMPRESSED, UsnJournal_ENCRYPTED, UsnJournal_DIRECTORY, UsnJournal_DEVICE, UsnJournal_NORMAL, UsnJournal_TEMPORARY, UsnJournal_SPARSE_FILE, UsnJournal_REPARSE_POINT, UsnJournal_OFFLINE, UsnJournal_NOT_CONTENT_INDEXED, UsnJournal_NON_CONTENT_INDEXED, UsnJournal_INTEGRITY_STREAM, UsnJournal_VIRTUAL, UsnJournal_NO_SCRUB_DATA, UsnJournal_EA, UsnJournal_PINNED, UsnJournal_UNPINNED, UsnJournal_RECALL_ON_OPEN, UsnJournal_RECALL_ON_DATA_ACCESS
const (
// Unspecified attribute.
UsnJournal_ATTRIBUTE_UNSPECIFIED UsnJournal_Attribute = 0
// A file that is read-only.
UsnJournal_READ_ONLY UsnJournal_Attribute = 1
// The file or directory is hidden.
UsnJournal_HIDDEN UsnJournal_Attribute = 2
// A file or directory that the operating system uses.
UsnJournal_SYSTEM UsnJournal_Attribute = 3
// Archive file or directory.
UsnJournal_ARCHIVE UsnJournal_Attribute = 4
// A file or directory that is compressed.
UsnJournal_COMPRESSED UsnJournal_Attribute = 5
// A file or directory that is encrypted.
UsnJournal_ENCRYPTED UsnJournal_Attribute = 6
// The handle that identifies the directory.
UsnJournal_DIRECTORY UsnJournal_Attribute = 7
// Reserved for system use.
UsnJournal_DEVICE UsnJournal_Attribute = 8
// A file that does not have other attributes set.
UsnJournal_NORMAL UsnJournal_Attribute = 9
// A file that is being used for temporary storage.
UsnJournal_TEMPORARY UsnJournal_Attribute = 10
// A file that is a sparse file.
UsnJournal_SPARSE_FILE UsnJournal_Attribute = 11
// A file or directory that has an associated reparse point.
UsnJournal_REPARSE_POINT UsnJournal_Attribute = 12
// The data of a file is not available immediately.
UsnJournal_OFFLINE UsnJournal_Attribute = 13
// The file or directory is not to be indexed.
UsnJournal_NOT_CONTENT_INDEXED UsnJournal_Attribute = 14
// Deprecated: Use NOT_CONTENT_INDEXED instead.
//
// Deprecated: Marked as deprecated in backstory/udm.proto.
UsnJournal_NON_CONTENT_INDEXED UsnJournal_Attribute = 14
// The directory or user data stream is configured with integrity.
UsnJournal_INTEGRITY_STREAM UsnJournal_Attribute = 15
// Reserved for system use.
UsnJournal_VIRTUAL UsnJournal_Attribute = 16
// The user data stream not to be read by the background data integrity
// scanner.
UsnJournal_NO_SCRUB_DATA UsnJournal_Attribute = 17
// A file or directory with extended attributes.
UsnJournal_EA UsnJournal_Attribute = 18
// The file or directory should be kept fully present locally.
UsnJournal_PINNED UsnJournal_Attribute = 19
// The file or directory should not be kept fully present locally.
UsnJournal_UNPINNED UsnJournal_Attribute = 20
// The file or directory has no physical representation on the local
// system.
UsnJournal_RECALL_ON_OPEN UsnJournal_Attribute = 21
// The file or directory is not fully present locally.
UsnJournal_RECALL_ON_DATA_ACCESS UsnJournal_Attribute = 22
)func (UsnJournal_Attribute) Descriptor
func (UsnJournal_Attribute) Descriptor() protoreflect.EnumDescriptorfunc (UsnJournal_Attribute) Enum
func (x UsnJournal_Attribute) Enum() *UsnJournal_Attributefunc (UsnJournal_Attribute) EnumDescriptor
func (UsnJournal_Attribute) EnumDescriptor() ([]byte, []int)Deprecated: Use UsnJournal_Attribute.Descriptor instead.
func (UsnJournal_Attribute) Number
func (x UsnJournal_Attribute) Number() protoreflect.EnumNumberfunc (UsnJournal_Attribute) String
func (x UsnJournal_Attribute) String() stringfunc (UsnJournal_Attribute) Type
func (UsnJournal_Attribute) Type() protoreflect.EnumTypeUsnJournal_Reason
type UsnJournal_Reason int32The reason for the USN journal entry.
UsnJournal_REASON_UNSPECIFIED, UsnJournal_DATA_OVERWRITE, UsnJournal_DATA_EXTEND, UsnJournal_DATA_TRUNCATION, UsnJournal_NAMED_DATA_OVERWRITE, UsnJournal_NAMED_DATA_EXTEND, UsnJournal_NAMED_DATA_TRUNCATION, UsnJournal_FILE_CREATE, UsnJournal_FILE_DELETE, UsnJournal_EA_CHANGE, UsnJournal_SECURITY_CHANGE, UsnJournal_RENAME_OLD_NAME, UsnJournal_RENAME_NEW_NAME, UsnJournal_INDEXABLE_CHANGE, UsnJournal_BASIC_INFO_CHANGE, UsnJournal_HARD_LINK_CHANGE, UsnJournal_COMPRESSION_CHANGE, UsnJournal_ENCRYPTION_CHANGE, UsnJournal_OBJECT_ID_CHANGE, UsnJournal_REPARSE_POINT_CHANGE, UsnJournal_STREAM_CHANGE, UsnJournal_TRANSACTED_CHANGE, UsnJournal_CLOSE
const (
// Unspecified reason.
UsnJournal_REASON_UNSPECIFIED UsnJournal_Reason = 0
// Data overwrite reason.
UsnJournal_DATA_OVERWRITE UsnJournal_Reason = 1
// Data extend reason.
UsnJournal_DATA_EXTEND UsnJournal_Reason = 2
// Data truncation reason.
UsnJournal_DATA_TRUNCATION UsnJournal_Reason = 3
// Named data overwrite reason.
UsnJournal_NAMED_DATA_OVERWRITE UsnJournal_Reason = 4
// Named data extend reason.
UsnJournal_NAMED_DATA_EXTEND UsnJournal_Reason = 5
// Named data truncation reason.
UsnJournal_NAMED_DATA_TRUNCATION UsnJournal_Reason = 6
// File create reason.
UsnJournal_FILE_CREATE UsnJournal_Reason = 7
// File delete reason.
UsnJournal_FILE_DELETE UsnJournal_Reason = 8
// EA change reason.
UsnJournal_EA_CHANGE UsnJournal_Reason = 9
// Security change reason.
UsnJournal_SECURITY_CHANGE UsnJournal_Reason = 10
// Rename old name reason.
UsnJournal_RENAME_OLD_NAME UsnJournal_Reason = 11
// Rename new name reason.
UsnJournal_RENAME_NEW_NAME UsnJournal_Reason = 12
// Indexable change reason.
UsnJournal_INDEXABLE_CHANGE UsnJournal_Reason = 13
// Basic info change reason.
UsnJournal_BASIC_INFO_CHANGE UsnJournal_Reason = 14
// Hard link change reason.
UsnJournal_HARD_LINK_CHANGE UsnJournal_Reason = 15
// Compression change reason.
UsnJournal_COMPRESSION_CHANGE UsnJournal_Reason = 16
// Encryption change reason.
UsnJournal_ENCRYPTION_CHANGE UsnJournal_Reason = 17
// Object ID change reason.
UsnJournal_OBJECT_ID_CHANGE UsnJournal_Reason = 18
// Reparse point change reason.
UsnJournal_REPARSE_POINT_CHANGE UsnJournal_Reason = 19
// Stream change reason.
UsnJournal_STREAM_CHANGE UsnJournal_Reason = 20
// Transacted change reason.
UsnJournal_TRANSACTED_CHANGE UsnJournal_Reason = 21
// Close reason.
UsnJournal_CLOSE UsnJournal_Reason = 22
)func (UsnJournal_Reason) Descriptor
func (UsnJournal_Reason) Descriptor() protoreflect.EnumDescriptorfunc (UsnJournal_Reason) Enum
func (x UsnJournal_Reason) Enum() *UsnJournal_Reasonfunc (UsnJournal_Reason) EnumDescriptor
func (UsnJournal_Reason) EnumDescriptor() ([]byte, []int)Deprecated: Use UsnJournal_Reason.Descriptor instead.
func (UsnJournal_Reason) Number
func (x UsnJournal_Reason) Number() protoreflect.EnumNumberfunc (UsnJournal_Reason) String
func (x UsnJournal_Reason) String() stringfunc (UsnJournal_Reason) Type
func (UsnJournal_Reason) Type() protoreflect.EnumTypeVerdict
type Verdict int32Categorization options for the validity of a finding (for example, whether it reflects an actual security incident).
Verdict_VERDICT_UNSPECIFIED, Verdict_TRUE_POSITIVE, Verdict_FALSE_POSITIVE
const (
// An unspecified verdict.
Verdict_VERDICT_UNSPECIFIED Verdict = 0
// A categorization of the finding as a "true positive".
Verdict_TRUE_POSITIVE Verdict = 1
// A categorization of the finding as a "false positive".
Verdict_FALSE_POSITIVE Verdict = 2
)func (Verdict) Descriptor
func (Verdict) Descriptor() protoreflect.EnumDescriptorfunc (Verdict) Enum
func (Verdict) EnumDescriptor
Deprecated: Use Verdict.Descriptor instead.
func (Verdict) Number
func (x Verdict) Number() protoreflect.EnumNumberfunc (Verdict) String
func (Verdict) Type
func (Verdict) Type() protoreflect.EnumTypeVolume
type Volume struct {
// The name of the file system on the volume (e.g., "NTFS", "FAT32").
FileSystem string `protobuf:"bytes,1,opt,name=file_system,json=fileSystem,proto3" json:"file_system,omitempty"`
// The path where the volume is mounted (e.g., "C:", "/mnt/data").
MountPoint string `protobuf:"bytes,2,opt,name=mount_point,json=mountPoint,proto3" json:"mount_point,omitempty"`
// The system path to the device (e.g., "\\.\HarddiskVolume1", "/dev/sda1").
DevicePath string `protobuf:"bytes,3,opt,name=device_path,json=devicePath,proto3" json:"device_path,omitempty"`
// Indicates whether the volume is currently mounted.
IsMounted bool `protobuf:"varint,4,opt,name=is_mounted,json=isMounted,proto3" json:"is_mounted,omitempty"`
// Indicates whether the volume is mounted as read-only.
IsReadOnly bool `protobuf:"varint,5,opt,name=is_read_only,json=isReadOnly,proto3" json:"is_read_only,omitempty"`
// The user-assigned label or name for the volume.
Name string `protobuf:"bytes,6,opt,name=name,proto3" json:"name,omitempty"`
// contains filtered or unexported fields
}Information about a storage volume.
func (*Volume) Descriptor
Deprecated: Use Volume.ProtoReflect.Descriptor instead.
func (*Volume) GetDevicePath
func (*Volume) GetFileSystem
func (*Volume) GetIsMounted
func (*Volume) GetIsReadOnly
func (*Volume) GetMountPoint
func (*Volume) GetName
func (*Volume) ProtoMessage
func (*Volume) ProtoMessage()func (*Volume) ProtoReflect
func (x *Volume) ProtoReflect() protoreflect.Messagefunc (*Volume) Reset
func (x *Volume) Reset()func (*Volume) String
Vulnerabilities
type Vulnerabilities struct {
// A list of vulnerabilities.
Vulnerabilities []*Vulnerability `protobuf:"bytes,1,rep,name=vulnerabilities,proto3" json:"vulnerabilities,omitempty"`
// contains filtered or unexported fields
}The Vulnerabilities extension captures details on observed/detected vulnerabilities.
func (*Vulnerabilities) Descriptor
func (*Vulnerabilities) Descriptor() ([]byte, []int)Deprecated: Use Vulnerabilities.ProtoReflect.Descriptor instead.
func (*Vulnerabilities) GetVulnerabilities
func (x *Vulnerabilities) GetVulnerabilities() []*Vulnerabilityfunc (*Vulnerabilities) ProtoMessage
func (*Vulnerabilities) ProtoMessage()func (*Vulnerabilities) ProtoReflect
func (x *Vulnerabilities) ProtoReflect() protoreflect.Messagefunc (*Vulnerabilities) Reset
func (x *Vulnerabilities) Reset()func (*Vulnerabilities) String
func (x *Vulnerabilities) String() stringVulnerability
type Vulnerability struct {
// If the vulnerability is about a specific noun (e.g. executable),
// then add it here.
About *Noun `protobuf:"bytes,1,opt,name=about,proto3" json:"about,omitempty"`
// Name of the vulnerability (e.g. "Unsupported OS Version detected").
Name string `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`
// Description of the vulnerability.
Description string `protobuf:"bytes,3,opt,name=description,proto3" json:"description,omitempty"`
// Vendor of scan that discovered vulnerability.
Vendor string `protobuf:"bytes,13,opt,name=vendor,proto3" json:"vendor,omitempty"`
// If the vulnerability was discovered during an asset scan, then this
// field should be populated with the time the scan started.
// This field can be left unset if the start time is not available or not
// applicable.
ScanStartTime *timestamppb.Timestamp `protobuf:"bytes,4,opt,name=scan_start_time,json=scanStartTime,proto3" json:"scan_start_time,omitempty"`
// If the vulnerability was discovered during an asset scan, then this field
// should be populated with the time the scan ended.
// This field can be left unset if the end time is not available or not
// applicable.
ScanEndTime *timestamppb.Timestamp `protobuf:"bytes,5,opt,name=scan_end_time,json=scanEndTime,proto3" json:"scan_end_time,omitempty"`
// Products that maintain a history of vuln scans should populate first_found
// with the time that a scan first detected the vulnerability on this asset.
FirstFound *timestamppb.Timestamp `protobuf:"bytes,6,opt,name=first_found,json=firstFound,proto3" json:"first_found,omitempty"`
// Products that maintain a history of vuln scans should populate last_found
// with the time that a scan last detected the vulnerability on this asset.
LastFound *timestamppb.Timestamp `protobuf:"bytes,7,opt,name=last_found,json=lastFound,proto3" json:"last_found,omitempty"`
// The severity of the vulnerability.
Severity Vulnerability_Severity `protobuf:"varint,8,opt,name=severity,proto3,enum=google.backstory.Vulnerability_Severity" json:"severity,omitempty"`
// Vendor-specific severity
SeverityDetails string `protobuf:"bytes,9,opt,name=severity_details,json=severityDetails,proto3" json:"severity_details,omitempty"`
// CVSS Base Score in the range of 0.0 to 10.0.
// Useful for sorting.
CvssBaseScore float32 `protobuf:"fixed32,10,opt,name=cvss_base_score,json=cvssBaseScore,proto3" json:"cvss_base_score,omitempty"`
// Vector of CVSS properties (e.g. "AV:L/AC:H/Au:N/C:N/I:P/A:C")
// Can be linked to via:
// [https://nvd.nist.gov/vuln-metrics/cvss/v2-calculator](https://nvd.nist.gov/vuln-metrics/cvss/v2-calculator)
CvssVector string `protobuf:"bytes,11,opt,name=cvss_vector,json=cvssVector,proto3" json:"cvss_vector,omitempty"`
// Version of CVSS Vector/Score.
CvssVersion string `protobuf:"bytes,12,opt,name=cvss_version,json=cvssVersion,proto3" json:"cvss_version,omitempty"`
// Common Vulnerabilities and Exposures Id.
// [https://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures](https://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)
// [https://cve.mitre.org/about/faqs.html#what_is_cve_id](https://cve.mitre.org/about/faqs.html#what_is_cve_id)
CveId string `protobuf:"bytes,14,opt,name=cve_id,json=cveId,proto3" json:"cve_id,omitempty"`
// Common Vulnerabilities and Exposures Description.
// [https://cve.mitre.org/about/faqs.html#what_is_cve_record](https://cve.mitre.org/about/faqs.html#what_is_cve_record)
CveDescription string `protobuf:"bytes,15,opt,name=cve_description,json=cveDescription,proto3" json:"cve_description,omitempty"`
// Vendor specific vulnerability id (e.g. Microsoft security bulletin id).
VendorVulnerabilityId string `protobuf:"bytes,16,opt,name=vendor_vulnerability_id,json=vendorVulnerabilityId,proto3" json:"vendor_vulnerability_id,omitempty"`
// Vendor specific knowledge base article (e.g. "KBXXXXXX" from Microsoft).
// [https://en.wikipedia.org/wiki/Microsoft_Knowledge_Base](https://en.wikipedia.org/wiki/Microsoft_Knowledge_Base)
// [https://access.redhat.com/knowledgebase](https://access.redhat.com/knowledgebase)
VendorKnowledgeBaseArticleId string `protobuf:"bytes,17,opt,name=vendor_knowledge_base_article_id,json=vendorKnowledgeBaseArticleId,proto3" json:"vendor_knowledge_base_article_id,omitempty"`
// contains filtered or unexported fields
}A vulnerability.
func (*Vulnerability) Descriptor
func (*Vulnerability) Descriptor() ([]byte, []int)Deprecated: Use Vulnerability.ProtoReflect.Descriptor instead.
func (*Vulnerability) GetAbout
func (x *Vulnerability) GetAbout() *Nounfunc (*Vulnerability) GetCveDescription
func (x *Vulnerability) GetCveDescription() stringfunc (*Vulnerability) GetCveId
func (x *Vulnerability) GetCveId() stringfunc (*Vulnerability) GetCvssBaseScore
func (x *Vulnerability) GetCvssBaseScore() float32func (*Vulnerability) GetCvssVector
func (x *Vulnerability) GetCvssVector() stringfunc (*Vulnerability) GetCvssVersion
func (x *Vulnerability) GetCvssVersion() stringfunc (*Vulnerability) GetDescription
func (x *Vulnerability) GetDescription() stringfunc (*Vulnerability) GetFirstFound
func (x *Vulnerability) GetFirstFound() *timestamppb.Timestampfunc (*Vulnerability) GetLastFound
func (x *Vulnerability) GetLastFound() *timestamppb.Timestampfunc (*Vulnerability) GetName
func (x *Vulnerability) GetName() stringfunc (*Vulnerability) GetScanEndTime
func (x *Vulnerability) GetScanEndTime() *timestamppb.Timestampfunc (*Vulnerability) GetScanStartTime
func (x *Vulnerability) GetScanStartTime() *timestamppb.Timestampfunc (*Vulnerability) GetSeverity
func (x *Vulnerability) GetSeverity() Vulnerability_Severityfunc (*Vulnerability) GetSeverityDetails
func (x *Vulnerability) GetSeverityDetails() stringfunc (*Vulnerability) GetVendor
func (x *Vulnerability) GetVendor() stringfunc (*Vulnerability) GetVendorKnowledgeBaseArticleId
func (x *Vulnerability) GetVendorKnowledgeBaseArticleId() stringfunc (*Vulnerability) GetVendorVulnerabilityId
func (x *Vulnerability) GetVendorVulnerabilityId() stringfunc (*Vulnerability) ProtoMessage
func (*Vulnerability) ProtoMessage()func (*Vulnerability) ProtoReflect
func (x *Vulnerability) ProtoReflect() protoreflect.Messagefunc (*Vulnerability) Reset
func (x *Vulnerability) Reset()func (*Vulnerability) String
func (x *Vulnerability) String() stringVulnerability_Severity
type Vulnerability_Severity int32Severity of the vulnerability.
Vulnerability_UNKNOWN_SEVERITY, Vulnerability_LOW, Vulnerability_MEDIUM, Vulnerability_HIGH, Vulnerability_CRITICAL
const (
// The default severity level.
Vulnerability_UNKNOWN_SEVERITY Vulnerability_Severity = 0
// Low severity.
Vulnerability_LOW Vulnerability_Severity = 1
// Medium severity.
Vulnerability_MEDIUM Vulnerability_Severity = 2
// High severity.
Vulnerability_HIGH Vulnerability_Severity = 3
// Critical severity.
Vulnerability_CRITICAL Vulnerability_Severity = 4
)func (Vulnerability_Severity) Descriptor
func (Vulnerability_Severity) Descriptor() protoreflect.EnumDescriptorfunc (Vulnerability_Severity) Enum
func (x Vulnerability_Severity) Enum() *Vulnerability_Severityfunc (Vulnerability_Severity) EnumDescriptor
func (Vulnerability_Severity) EnumDescriptor() ([]byte, []int)Deprecated: Use Vulnerability_Severity.Descriptor instead.
func (Vulnerability_Severity) Number
func (x Vulnerability_Severity) Number() protoreflect.EnumNumberfunc (Vulnerability_Severity) String
func (x Vulnerability_Severity) String() stringfunc (Vulnerability_Severity) Type
func (Vulnerability_Severity) Type() protoreflect.EnumTypeWindowsEventLog
type WindowsEventLog struct {
// The channel of the event.
Channel WindowsEventLog_Channel `protobuf:"varint,1,opt,name=channel,proto3,enum=google.backstory.WindowsEventLog_Channel" json:"channel,omitempty"`
// A unique identifier for a specific type of event.
EventId string `protobuf:"bytes,2,opt,name=event_id,json=eventId,proto3" json:"event_id,omitempty"`
// A GUID (Globally Unique Identifier) used to link a sequence of related
// events together.
ActivityId string `protobuf:"bytes,3,opt,name=activity_id,json=activityId,proto3" json:"activity_id,omitempty"`
// contains filtered or unexported fields
}The WindowsEventLog extension captures details specific to Windows Event Log events.
func (*WindowsEventLog) Descriptor
func (*WindowsEventLog) Descriptor() ([]byte, []int)Deprecated: Use WindowsEventLog.ProtoReflect.Descriptor instead.
func (*WindowsEventLog) GetActivityId
func (x *WindowsEventLog) GetActivityId() stringfunc (*WindowsEventLog) GetChannel
func (x *WindowsEventLog) GetChannel() WindowsEventLog_Channelfunc (*WindowsEventLog) GetEventId
func (x *WindowsEventLog) GetEventId() stringfunc (*WindowsEventLog) ProtoMessage
func (*WindowsEventLog) ProtoMessage()func (*WindowsEventLog) ProtoReflect
func (x *WindowsEventLog) ProtoReflect() protoreflect.Messagefunc (*WindowsEventLog) Reset
func (x *WindowsEventLog) Reset()func (*WindowsEventLog) String
func (x *WindowsEventLog) String() stringWindowsEventLog_Channel
type WindowsEventLog_Channel int32The channel specifies the source or category of the event.
WindowsEventLog_CHANNEL_UNSPECIFIED, WindowsEventLog_SECURITY, WindowsEventLog_SYSTEM, WindowsEventLog_APPLICATION, WindowsEventLog_SETUP, WindowsEventLog_FORWARDED_EVENTS, WindowsEventLog_OTHER
const (
// Default channel.
WindowsEventLog_CHANNEL_UNSPECIFIED WindowsEventLog_Channel = 0
// The security channel.
WindowsEventLog_SECURITY WindowsEventLog_Channel = 1
// The system channel.
WindowsEventLog_SYSTEM WindowsEventLog_Channel = 2
// The application channel.
WindowsEventLog_APPLICATION WindowsEventLog_Channel = 3
// The setup channel.
WindowsEventLog_SETUP WindowsEventLog_Channel = 4
// The forwarded events channel.
WindowsEventLog_FORWARDED_EVENTS WindowsEventLog_Channel = 5
// The other channel.
WindowsEventLog_OTHER WindowsEventLog_Channel = 6
)func (WindowsEventLog_Channel) Descriptor
func (WindowsEventLog_Channel) Descriptor() protoreflect.EnumDescriptorfunc (WindowsEventLog_Channel) Enum
func (x WindowsEventLog_Channel) Enum() *WindowsEventLog_Channelfunc (WindowsEventLog_Channel) EnumDescriptor
func (WindowsEventLog_Channel) EnumDescriptor() ([]byte, []int)Deprecated: Use WindowsEventLog_Channel.Descriptor instead.
func (WindowsEventLog_Channel) Number
func (x WindowsEventLog_Channel) Number() protoreflect.EnumNumberfunc (WindowsEventLog_Channel) String
func (x WindowsEventLog_Channel) String() stringfunc (WindowsEventLog_Channel) Type
func (WindowsEventLog_Channel) Type() protoreflect.EnumTypeWindowsScheduledTask
type WindowsScheduledTask struct {
// The account name that authored or last modified the scheduled task.
Author string `protobuf:"bytes,1,opt,name=author,proto3" json:"author,omitempty"`
// The task's path in the Task Scheduler library.
VirtualPath string `protobuf:"bytes,2,opt,name=virtual_path,json=virtualPath,proto3" json:"virtual_path,omitempty"`
// The result which was returned the last time the registered task was run.
ExitCode int32 `protobuf:"varint,3,opt,name=exit_code,json=exitCode,proto3" json:"exit_code,omitempty"`
// The operation state of the task.
State WindowsScheduledTask_TaskState `protobuf:"varint,4,opt,name=state,proto3,enum=google.backstory.WindowsScheduledTask_TaskState" json:"state,omitempty"`
// The logon type of the task.
LogonType WindowsScheduledTask_TaskLogonType `protobuf:"varint,5,opt,name=logon_type,json=logonType,proto3,enum=google.backstory.WindowsScheduledTask_TaskLogonType" json:"logon_type,omitempty"`
// The actions of the scheduled task.
TaskActions []*WindowsScheduledTask_TaskAction `protobuf:"bytes,6,rep,name=task_actions,json=taskActions,proto3" json:"task_actions,omitempty"`
// The triggers of the scheduled task.
TaskTriggers []*WindowsScheduledTask_TaskTrigger `protobuf:"bytes,7,rep,name=task_triggers,json=taskTriggers,proto3" json:"task_triggers,omitempty"`
// contains filtered or unexported fields
}Information about a Windows scheduled task.
func (*WindowsScheduledTask) Descriptor
func (*WindowsScheduledTask) Descriptor() ([]byte, []int)Deprecated: Use WindowsScheduledTask.ProtoReflect.Descriptor instead.
func (*WindowsScheduledTask) GetAuthor
func (x *WindowsScheduledTask) GetAuthor() stringfunc (*WindowsScheduledTask) GetExitCode
func (x *WindowsScheduledTask) GetExitCode() int32func (*WindowsScheduledTask) GetLogonType
func (x *WindowsScheduledTask) GetLogonType() WindowsScheduledTask_TaskLogonTypefunc (*WindowsScheduledTask) GetState
func (x *WindowsScheduledTask) GetState() WindowsScheduledTask_TaskStatefunc (*WindowsScheduledTask) GetTaskActions
func (x *WindowsScheduledTask) GetTaskActions() []*WindowsScheduledTask_TaskActionfunc (*WindowsScheduledTask) GetTaskTriggers
func (x *WindowsScheduledTask) GetTaskTriggers() []*WindowsScheduledTask_TaskTriggerfunc (*WindowsScheduledTask) GetVirtualPath
func (x *WindowsScheduledTask) GetVirtualPath() stringfunc (*WindowsScheduledTask) ProtoMessage
func (*WindowsScheduledTask) ProtoMessage()func (*WindowsScheduledTask) ProtoReflect
func (x *WindowsScheduledTask) ProtoReflect() protoreflect.Messagefunc (*WindowsScheduledTask) Reset
func (x *WindowsScheduledTask) Reset()func (*WindowsScheduledTask) String
func (x *WindowsScheduledTask) String() stringWindowsScheduledTask_TaskAction
type WindowsScheduledTask_TaskAction struct {
// The action type of the task.
ActionType WindowsScheduledTask_TaskAction_ActionType `protobuf:"varint,1,opt,name=action_type,json=actionType,proto3,enum=google.backstory.WindowsScheduledTask_TaskAction_ActionType" json:"action_type,omitempty"`
// The arguments of the task. This field is only populated if the task
// action type is EXEC.
ExecArguments []string `protobuf:"bytes,2,rep,name=exec_arguments,json=execArguments,proto3" json:"exec_arguments,omitempty"`
// The executable working directory of the task. This field is only
// populated if the task action type is EXEC.
ExecWorkingDirectory string `protobuf:"bytes,3,opt,name=exec_working_directory,json=execWorkingDirectory,proto3" json:"exec_working_directory,omitempty"`
// The COM class IF the action is COM handler. This field is only populated
// if the task action type is COM_HANDLER.
ComClassId string `protobuf:"bytes,4,opt,name=com_class_id,json=comClassId,proto3" json:"com_class_id,omitempty"`
// The data of the task. This field is only populated if the task action
// type is COM_HANDLER.
ComData string `protobuf:"bytes,5,opt,name=com_data,json=comData,proto3" json:"com_data,omitempty"`
// contains filtered or unexported fields
}The task action.
func (*WindowsScheduledTask_TaskAction) Descriptor
func (*WindowsScheduledTask_TaskAction) Descriptor() ([]byte, []int)Deprecated: Use WindowsScheduledTask_TaskAction.ProtoReflect.Descriptor instead.
func (*WindowsScheduledTask_TaskAction) GetActionType
func (x *WindowsScheduledTask_TaskAction) GetActionType() WindowsScheduledTask_TaskAction_ActionTypefunc (*WindowsScheduledTask_TaskAction) GetComClassId
func (x *WindowsScheduledTask_TaskAction) GetComClassId() stringfunc (*WindowsScheduledTask_TaskAction) GetComData
func (x *WindowsScheduledTask_TaskAction) GetComData() stringfunc (*WindowsScheduledTask_TaskAction) GetExecArguments
func (x *WindowsScheduledTask_TaskAction) GetExecArguments() []stringfunc (*WindowsScheduledTask_TaskAction) GetExecWorkingDirectory
func (x *WindowsScheduledTask_TaskAction) GetExecWorkingDirectory() stringfunc (*WindowsScheduledTask_TaskAction) ProtoMessage
func (*WindowsScheduledTask_TaskAction) ProtoMessage()func (*WindowsScheduledTask_TaskAction) ProtoReflect
func (x *WindowsScheduledTask_TaskAction) ProtoReflect() protoreflect.Messagefunc (*WindowsScheduledTask_TaskAction) Reset
func (x *WindowsScheduledTask_TaskAction) Reset()func (*WindowsScheduledTask_TaskAction) String
func (x *WindowsScheduledTask_TaskAction) String() stringWindowsScheduledTask_TaskAction_ActionType
type WindowsScheduledTask_TaskAction_ActionType int32Enum representing the action type of the task.
WindowsScheduledTask_TaskAction_ACTION_TYPE_UNSPECIFIED, WindowsScheduledTask_TaskAction_EXEC, WindowsScheduledTask_TaskAction_COM_HANDLER, WindowsScheduledTask_TaskAction_SEND_EMAIL, WindowsScheduledTask_TaskAction_SHOW_MESSAGE
const (
// The action type is not specified.
WindowsScheduledTask_TaskAction_ACTION_TYPE_UNSPECIFIED WindowsScheduledTask_TaskAction_ActionType = 0
// This action performs a command-line operation. For example, the action
// can run a script, launch an executable, or, if the name of a document
// is provided, find its associated application and launch the application
// with the document.
WindowsScheduledTask_TaskAction_EXEC WindowsScheduledTask_TaskAction_ActionType = 1
// This action fires a handler. This action can only be used if the task
// Compatibility property is set to TASK_COMPATIBILITY_V2.
WindowsScheduledTask_TaskAction_COM_HANDLER WindowsScheduledTask_TaskAction_ActionType = 2
// This action sends an email message. This action can only be used if the
// task Compatibility property is set to TASK_COMPATIBILITY_V2.
WindowsScheduledTask_TaskAction_SEND_EMAIL WindowsScheduledTask_TaskAction_ActionType = 3
// This action shows a message box. This action can only be used if the
// task Compatibility property is set to TASK_COMPATIBILITY_V2.
WindowsScheduledTask_TaskAction_SHOW_MESSAGE WindowsScheduledTask_TaskAction_ActionType = 4
)func (WindowsScheduledTask_TaskAction_ActionType) Descriptor
func (WindowsScheduledTask_TaskAction_ActionType) Descriptor() protoreflect.EnumDescriptorfunc (WindowsScheduledTask_TaskAction_ActionType) Enum
func (x WindowsScheduledTask_TaskAction_ActionType) Enum() *WindowsScheduledTask_TaskAction_ActionTypefunc (WindowsScheduledTask_TaskAction_ActionType) EnumDescriptor
func (WindowsScheduledTask_TaskAction_ActionType) EnumDescriptor() ([]byte, []int)Deprecated: Use WindowsScheduledTask_TaskAction_ActionType.Descriptor instead.
func (WindowsScheduledTask_TaskAction_ActionType) Number
func (x WindowsScheduledTask_TaskAction_ActionType) Number() protoreflect.EnumNumberfunc (WindowsScheduledTask_TaskAction_ActionType) String
func (x WindowsScheduledTask_TaskAction_ActionType) String() stringfunc (WindowsScheduledTask_TaskAction_ActionType) Type
func (WindowsScheduledTask_TaskAction_ActionType) Type() protoreflect.EnumTypeWindowsScheduledTask_TaskLogonType
type WindowsScheduledTask_TaskLogonType int32Enum representing the logon type of the task.
WindowsScheduledTask_TASK_LOGON_TYPE_UNSPECIFIED, WindowsScheduledTask_PASSWORD, WindowsScheduledTask_S4U, WindowsScheduledTask_INTERACTIVE_TOKEN, WindowsScheduledTask_GROUP, WindowsScheduledTask_SERVICE_ACCOUNT, WindowsScheduledTask_INTERACTIVE_TOKEN_OR_PASSWORD
const (
// The logon method is not specified. Used for non-NT credentials.
WindowsScheduledTask_TASK_LOGON_TYPE_UNSPECIFIED WindowsScheduledTask_TaskLogonType = 0
// Use a password for logging on the user. The password must be supplied at
// registration time.
WindowsScheduledTask_PASSWORD WindowsScheduledTask_TaskLogonType = 1
// Use an existing interactive token to run a task. The user must log on
// using a service for user (S4U) logon. When an S4U logon is used, no
// password is stored by the system and there is no access to either the
// network or encrypted files.
WindowsScheduledTask_S4U WindowsScheduledTask_TaskLogonType = 2
// User must already be logged on. The task will be run only in an existing
// interactive session.
WindowsScheduledTask_INTERACTIVE_TOKEN WindowsScheduledTask_TaskLogonType = 3
// Logon with group credentials.
WindowsScheduledTask_GROUP WindowsScheduledTask_TaskLogonType = 4
// Indicates that a Local System, Local Service, or Network Service account
// is being used as a security context to run the task.
WindowsScheduledTask_SERVICE_ACCOUNT WindowsScheduledTask_TaskLogonType = 5
// First use the interactive token. If the user is not logged on (no
// interactive token is available), the password is used. The password
// must be specified when a task is registered. This flag is not recommended
// for new tasks because it is less reliable than TASK_LOGON_PASSWORD.
WindowsScheduledTask_INTERACTIVE_TOKEN_OR_PASSWORD WindowsScheduledTask_TaskLogonType = 6
)func (WindowsScheduledTask_TaskLogonType) Descriptor
func (WindowsScheduledTask_TaskLogonType) Descriptor() protoreflect.EnumDescriptorfunc (WindowsScheduledTask_TaskLogonType) Enum
func (x WindowsScheduledTask_TaskLogonType) Enum() *WindowsScheduledTask_TaskLogonTypefunc (WindowsScheduledTask_TaskLogonType) EnumDescriptor
func (WindowsScheduledTask_TaskLogonType) EnumDescriptor() ([]byte, []int)Deprecated: Use WindowsScheduledTask_TaskLogonType.Descriptor instead.
func (WindowsScheduledTask_TaskLogonType) Number
func (x WindowsScheduledTask_TaskLogonType) Number() protoreflect.EnumNumberfunc (WindowsScheduledTask_TaskLogonType) String
func (x WindowsScheduledTask_TaskLogonType) String() stringfunc (WindowsScheduledTask_TaskLogonType) Type
func (WindowsScheduledTask_TaskLogonType) Type() protoreflect.EnumTypeWindowsScheduledTask_TaskState
type WindowsScheduledTask_TaskState int32Enum representing the operation state of the task.
WindowsScheduledTask_TASK_STATE_UNSPECIFIED, WindowsScheduledTask_DISABLED, WindowsScheduledTask_QUEUED, WindowsScheduledTask_ACTIVE, WindowsScheduledTask_RUNNING
const (
// The state of the task is unknown or not specified.
WindowsScheduledTask_TASK_STATE_UNSPECIFIED WindowsScheduledTask_TaskState = 0
// The task is registered but is disabled and no instances of the task are
// queued or running. The task cannot be run until it is enabled.
WindowsScheduledTask_DISABLED WindowsScheduledTask_TaskState = 1
// Instances of the task are queued.
WindowsScheduledTask_QUEUED WindowsScheduledTask_TaskState = 2
// The task is ready to be executed, but no instances are queued or running.
WindowsScheduledTask_ACTIVE WindowsScheduledTask_TaskState = 3
// One or more instances of the task are running.
WindowsScheduledTask_RUNNING WindowsScheduledTask_TaskState = 4
)func (WindowsScheduledTask_TaskState) Descriptor
func (WindowsScheduledTask_TaskState) Descriptor() protoreflect.EnumDescriptorfunc (WindowsScheduledTask_TaskState) Enum
func (x WindowsScheduledTask_TaskState) Enum() *WindowsScheduledTask_TaskStatefunc (WindowsScheduledTask_TaskState) EnumDescriptor
func (WindowsScheduledTask_TaskState) EnumDescriptor() ([]byte, []int)Deprecated: Use WindowsScheduledTask_TaskState.Descriptor instead.
func (WindowsScheduledTask_TaskState) Number
func (x WindowsScheduledTask_TaskState) Number() protoreflect.EnumNumberfunc (WindowsScheduledTask_TaskState) String
func (x WindowsScheduledTask_TaskState) String() stringfunc (WindowsScheduledTask_TaskState) Type
func (WindowsScheduledTask_TaskState) Type() protoreflect.EnumTypeWindowsScheduledTask_TaskTrigger
type WindowsScheduledTask_TaskTrigger struct {
// Indicates whether the task trigger is enabled.
Enabled bool `protobuf:"varint,1,opt,name=enabled,proto3" json:"enabled,omitempty"`
// The duration of the task trigger repetition.
Duration *durationpb.Duration `protobuf:"bytes,2,opt,name=duration,proto3" json:"duration,omitempty"`
// The interval between each repetition of the task. The format for this
// string is `PThe trigger of the scheduled task.
func (*WindowsScheduledTask_TaskTrigger) Descriptor
func (*WindowsScheduledTask_TaskTrigger) Descriptor() ([]byte, []int)Deprecated: Use WindowsScheduledTask_TaskTrigger.ProtoReflect.Descriptor instead.
func (*WindowsScheduledTask_TaskTrigger) GetDuration
func (x *WindowsScheduledTask_TaskTrigger) GetDuration() *durationpb.Durationfunc (*WindowsScheduledTask_TaskTrigger) GetEnabled
func (x *WindowsScheduledTask_TaskTrigger) GetEnabled() boolfunc (*WindowsScheduledTask_TaskTrigger) GetInterval
func (x *WindowsScheduledTask_TaskTrigger) GetInterval() stringfunc (*WindowsScheduledTask_TaskTrigger) GetTriggerType
func (x *WindowsScheduledTask_TaskTrigger) GetTriggerType() WindowsScheduledTask_TaskTrigger_TriggerTypefunc (*WindowsScheduledTask_TaskTrigger) ProtoMessage
func (*WindowsScheduledTask_TaskTrigger) ProtoMessage()func (*WindowsScheduledTask_TaskTrigger) ProtoReflect
func (x *WindowsScheduledTask_TaskTrigger) ProtoReflect() protoreflect.Messagefunc (*WindowsScheduledTask_TaskTrigger) Reset
func (x *WindowsScheduledTask_TaskTrigger) Reset()func (*WindowsScheduledTask_TaskTrigger) String
func (x *WindowsScheduledTask_TaskTrigger) String() stringWindowsScheduledTask_TaskTrigger_TriggerType
type WindowsScheduledTask_TaskTrigger_TriggerType int32Enum representing the trigger type of the task. For more details, see https://learn.microsoft.com/en-us/windows/win32/api/taskschd/ne-taskschd-task_trigger_type2.
WindowsScheduledTask_TaskTrigger_TRIGGER_TYPE_UNSPECIFIED, WindowsScheduledTask_TaskTrigger_EVENT, WindowsScheduledTask_TaskTrigger_TIME, WindowsScheduledTask_TaskTrigger_DAILY, WindowsScheduledTask_TaskTrigger_WEEKLY, WindowsScheduledTask_TaskTrigger_MONTHLY, WindowsScheduledTask_TaskTrigger_MONTHLYDOW, WindowsScheduledTask_TaskTrigger_IDLE, WindowsScheduledTask_TaskTrigger_REGISTRATION, WindowsScheduledTask_TaskTrigger_BOOT, WindowsScheduledTask_TaskTrigger_LOGON, WindowsScheduledTask_TaskTrigger_SESSION_STATE_CHANGE, WindowsScheduledTask_TaskTrigger_CUSTOM_TRIGGER01
const (
// The trigger frequency is not specified.
WindowsScheduledTask_TaskTrigger_TRIGGER_TYPE_UNSPECIFIED WindowsScheduledTask_TaskTrigger_TriggerType = 0
// Triggers the task when a specific event occurs.
WindowsScheduledTask_TaskTrigger_EVENT WindowsScheduledTask_TaskTrigger_TriggerType = 1
// Triggers the task at a specific time of day.
WindowsScheduledTask_TaskTrigger_TIME WindowsScheduledTask_TaskTrigger_TriggerType = 2
// Triggers the task on a daily schedule. For example, the task starts at
// a specific time every day, every other day, or every third day.
WindowsScheduledTask_TaskTrigger_DAILY WindowsScheduledTask_TaskTrigger_TriggerType = 3
// Triggers the task on a weekly schedule. For example, the task starts at
// 8:00 AM on a specific day every week or other week.
WindowsScheduledTask_TaskTrigger_WEEKLY WindowsScheduledTask_TaskTrigger_TriggerType = 4
// Triggers the task on a monthly schedule. For example, the task starts
// on specific days of specific months.
WindowsScheduledTask_TaskTrigger_MONTHLY WindowsScheduledTask_TaskTrigger_TriggerType = 5
// Triggers the task on a monthly day-of-week schedule. For example, the
// task starts on a specific days of the week, weeks of the month, and
// months of the year.
WindowsScheduledTask_TaskTrigger_MONTHLYDOW WindowsScheduledTask_TaskTrigger_TriggerType = 6
// Triggers the task when the computer goes into an idle state.
WindowsScheduledTask_TaskTrigger_IDLE WindowsScheduledTask_TaskTrigger_TriggerType = 7
// Triggers the task when the task is registered.
WindowsScheduledTask_TaskTrigger_REGISTRATION WindowsScheduledTask_TaskTrigger_TriggerType = 8
// Triggers the task when the computer boots.
WindowsScheduledTask_TaskTrigger_BOOT WindowsScheduledTask_TaskTrigger_TriggerType = 9
// Triggers the task when a specific user logs on.
WindowsScheduledTask_TaskTrigger_LOGON WindowsScheduledTask_TaskTrigger_TriggerType = 10
// Triggers the task when a specific user session state changes.
WindowsScheduledTask_TaskTrigger_SESSION_STATE_CHANGE WindowsScheduledTask_TaskTrigger_TriggerType = 11
// Custom trigger 01.
WindowsScheduledTask_TaskTrigger_CUSTOM_TRIGGER01 WindowsScheduledTask_TaskTrigger_TriggerType = 12
)func (WindowsScheduledTask_TaskTrigger_TriggerType) Descriptor
func (WindowsScheduledTask_TaskTrigger_TriggerType) Descriptor() protoreflect.EnumDescriptorfunc (WindowsScheduledTask_TaskTrigger_TriggerType) Enum
func (x WindowsScheduledTask_TaskTrigger_TriggerType) Enum() *WindowsScheduledTask_TaskTrigger_TriggerTypefunc (WindowsScheduledTask_TaskTrigger_TriggerType) EnumDescriptor
func (WindowsScheduledTask_TaskTrigger_TriggerType) EnumDescriptor() ([]byte, []int)Deprecated: Use WindowsScheduledTask_TaskTrigger_TriggerType.Descriptor instead.
func (WindowsScheduledTask_TaskTrigger_TriggerType) Number
func (x WindowsScheduledTask_TaskTrigger_TriggerType) Number() protoreflect.EnumNumberfunc (WindowsScheduledTask_TaskTrigger_TriggerType) String
func (x WindowsScheduledTask_TaskTrigger_TriggerType) String() stringfunc (WindowsScheduledTask_TaskTrigger_TriggerType) Type
func (WindowsScheduledTask_TaskTrigger_TriggerType) Type() protoreflect.EnumTypeWmiPersistenceItem
type WmiPersistenceItem struct {
// A brief title or caption for the WMI object.
Caption string `protobuf:"bytes,1,opt,name=caption,proto3" json:"caption,omitempty"`
// The name of the WMI object.
Name string `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`
// The identifier for the setting.
SettingId string `protobuf:"bytes,3,opt,name=setting_id,json=settingId,proto3" json:"setting_id,omitempty"`
// The base class from which the WMI class is derived (e.g., CIM_Setting).
Derivation string `protobuf:"bytes,4,opt,name=derivation,proto3" json:"derivation,omitempty"`
// The number of properties in the WMI object.
PropertyCount int64 `protobuf:"varint,5,opt,name=property_count,json=propertyCount,proto3" json:"property_count,omitempty"`
// The relative path to the WMI object (e.g.,
// Win32_StartupCommand.Command=”').
RelPath string `protobuf:"bytes,6,opt,name=rel_path,json=relPath,proto3" json:"rel_path,omitempty"`
// The top-level class in the WMI inheritance hierarchy (e.g., CMI_Setting).
Dynasty string `protobuf:"bytes,7,opt,name=dynasty,proto3" json:"dynasty,omitempty"`
// The immediate parent class in the WMI inheritance hierarchy.
WmiSuperClass string `protobuf:"bytes,8,opt,name=wmi_super_class,json=wmiSuperClass,proto3" json:"wmi_super_class,omitempty"`
// The name of the WMI class.
WmiClass string `protobuf:"bytes,9,opt,name=wmi_class,json=wmiClass,proto3" json:"wmi_class,omitempty"`
// An integer representing the type or version of the WMI object.
Genus int64 `protobuf:"varint,10,opt,name=genus,proto3" json:"genus,omitempty"`
// contains filtered or unexported fields
}Information about a WMI persistence item.
func (*WmiPersistenceItem) Descriptor
func (*WmiPersistenceItem) Descriptor() ([]byte, []int)Deprecated: Use WmiPersistenceItem.ProtoReflect.Descriptor instead.
func (*WmiPersistenceItem) GetCaption
func (x *WmiPersistenceItem) GetCaption() stringfunc (*WmiPersistenceItem) GetDerivation
func (x *WmiPersistenceItem) GetDerivation() stringfunc (*WmiPersistenceItem) GetDynasty
func (x *WmiPersistenceItem) GetDynasty() stringfunc (*WmiPersistenceItem) GetGenus
func (x *WmiPersistenceItem) GetGenus() int64func (*WmiPersistenceItem) GetName
func (x *WmiPersistenceItem) GetName() stringfunc (*WmiPersistenceItem) GetPropertyCount
func (x *WmiPersistenceItem) GetPropertyCount() int64func (*WmiPersistenceItem) GetRelPath
func (x *WmiPersistenceItem) GetRelPath() stringfunc (*WmiPersistenceItem) GetSettingId
func (x *WmiPersistenceItem) GetSettingId() stringfunc (*WmiPersistenceItem) GetWmiClass
func (x *WmiPersistenceItem) GetWmiClass() stringfunc (*WmiPersistenceItem) GetWmiSuperClass
func (x *WmiPersistenceItem) GetWmiSuperClass() stringfunc (*WmiPersistenceItem) ProtoMessage
func (*WmiPersistenceItem) ProtoMessage()func (*WmiPersistenceItem) ProtoReflect
func (x *WmiPersistenceItem) ProtoReflect() protoreflect.Messagefunc (*WmiPersistenceItem) Reset
func (x *WmiPersistenceItem) Reset()func (*WmiPersistenceItem) String
func (x *WmiPersistenceItem) String() stringX509
type X509 struct {
// Certificate name.
Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
// Certificate algorithm.
Algorithm string `protobuf:"bytes,2,opt,name=algorithm,proto3" json:"algorithm,omitempty"`
// Certificate thumbprint.
Thumbprint string `protobuf:"bytes,3,opt,name=thumbprint,proto3" json:"thumbprint,omitempty"`
// Issuer of the certificate.
CertIssuer string `protobuf:"bytes,4,opt,name=cert_issuer,json=certIssuer,proto3" json:"cert_issuer,omitempty"`
// Certificate serial number.
SerialNumber string `protobuf:"bytes,5,opt,name=serial_number,json=serialNumber,proto3" json:"serial_number,omitempty"`
// contains filtered or unexported fields
}File certificate.
func (*X509) Descriptor
Deprecated: Use X509.ProtoReflect.Descriptor instead.
func (*X509) GetAlgorithm
func (*X509) GetCertIssuer
func (*X509) GetName
func (*X509) GetSerialNumber
func (*X509) GetThumbprint
func (*X509) ProtoMessage
func (*X509) ProtoMessage()func (*X509) ProtoReflect
func (x *X509) ProtoReflect() protoreflect.Messagefunc (*X509) Reset
func (x *X509) Reset()