MCP Tools Reference: chronicle.googleapis.com

Tool: udm_search

Search for security events in Chronicle SIEM using a UDM query.

Executes a Unified Data Model (UDM) query against Chronicle event logs within a specified time range. This tool is a direct passthrough to the UDM Search API. It can be used with a manually crafted UDM query or with a query generated by the translate_udm_query tool.

Limitations: - This tool uses a non-streaming API, which limits the practical time range for searches. - Queries spanning more than approximately one month may not complete successfully. - Please advise users to narrow the start_time and end_time if their initial request covers a larger period.

Agent Responsibilities: 1. Input Parsing: * The user's request to run a UDM search might span multiple lines. Typically, the format will be: Run udm search: Query: <UDM_QUERY_STRING> <TIME_RANGE_DESCRIPTION> * The agent MUST extract the UDM query string from the line(s) immediately following "Query:". * The agent MUST extract the time range description (e.g., "Last 7 days", "from 2025-10-22 until 2025-10-23") from the line(s) following the UDM query.

1. Provide UDM Query: The agent MUST provide the extracted UDM query string in the query argument.

2. Time Range Calculation: The agent MUST parse the extracted time range description and provide the start_time and end_time arguments as ISO 8601 formatted strings (e.g., YYYY-MM-DDTHH:MM:SSZ) to define the search window.

   • Absolute Timestamps: The tool requires absolute start and end times.
   • Handle Relative Time: If the user specifies a relative time range (e.g., "Last 7 days", "yesterday", "last 2 hours"), the agent MUST calculate the corresponding absolute start_time and end_time in ISO 8601 format. These calculations MUST be based on the time the user's request was made (current timestamp: 2025-11-19T00:00:00Z). The agent should NOT ask the user for the current date. For example, if the request was made on 2025-11-19T10:00:00Z:
     • "Last 7 days": start_time would be '2025-11-12T10:00:00Z', end_time would be '2025-11-19T10:00:00Z'.
     • "Yesterday": start_time would be '2025-11-18T00:00:00Z', end_time would be '2025-11-19T00:00:00Z'.
   • Handle Date Ranges: If the user specifies dates (e.g., "from 2025-10-22 until 2025-10-23"), this should be converted to an ISO 8601 range. Assume this means inclusive of the start date up to the end of the end date. Example: "from 2025-10-22 until 2025-10-23" translates to start_time: '2025-10-22T00:00:00Z' and end_time: '2025-10-24T00:00:00Z'.
   • Use Translated Time Range: If translate_udm_query returned a time_range, those values can be used directly.

3. Response Parsing: The agent must parse the raw JSON response, which follows the UdmSearchResponse structure, to extract the 'events' list and other information.

Workflow Integration: - Ideal for deep investigation after an initial alert, case, or entity has been prioritized. - Use it to retrieve detailed UDM event logs from Chronicle SIEM related to specific indicators or activities, going beyond high-level summaries from other tools. - Helps validate findings from other security platforms (SOAR, EDR, TI) by examining the underlying log evidence.

Use Cases: - Investigate specific activities or test hypotheses during incident analysis. - Retrieve raw event logs related to specific indicators (IPs, domains, users, hosts) or activities (e.g., logins, file modifications, network connections) within a defined time window when granular detail is needed.

Args: query (str): The UDM query string to execute. start_time (str): The start of the time range in ISO 8601 format (e.g., YYYY-MM-DDTHH:MM:SSZ). end_time (str): The end of the time range in ISO 8601 format (e.g., YYYY-MM-DDTHH:MM:SSZ). project_id (Optional[str]): Google Cloud project ID. Defaults to environment configuration. customer_id (Optional[str]): Chronicle customer ID. Defaults to environment configuration. max_events (int): Maximum number of event records to return. Defaults to 100. Max 10000. region (Optional[str]): Chronicle region (e.g., "us", "europe"). Defaults to environment configuration.

Returns: str: Raw JSON response from the API, corresponding to the UdmSearchResponse message. This contains: - 'events' (List[Dict]): The list of UDM event records found. - 'moreDataAvailable' (bool): Indicates if more events matched than were returned. - 'stats': Statistics related to the query (if applicable).

Example Usage: # Example 1: Search for network connections from a specific IP in the last 24 hours # Agent calculates start_time and end_time based on the current time of the request. # Assuming request time is 2025-11-19T15:00:00Z udm_search( query='principal.ip = "192.0.2.100" AND metadata.event_type = "NETWORK_CONNECTION"', start_time='2025-11-18T15:00:00Z', end_time='2025-11-19T15:00:00Z', project_id="my-project", customer_id="my-customer", region="us" )

# Example 2: Search for failed login events for a user 'jdoe'
        # Assuming translate_udm_query returned:
        # {'query': 'metadata.event_type = "USER_LOGIN" AND target.user.userid = "jdoe" AND security_result.action = "BLOCK"',
        #  'time_range': {'startTime': '2025-10-01T00:00:00Z', 'endTime': '2025-10-02T00:00:00Z'}}
        udm_search(
            query='metadata.event_type = "USER_LOGIN" AND target.user.userid = "jdoe" AND security_result.action = "BLOCK"',
            start_time='2025-10-01T00:00:00Z',
            end_time='2025-10-02T00:00:00Z',
            project_id="my-project",
            customer_id="my-customer",
            region="us",
            max_events=200
        )
        

Next Steps (using MCP-enabled tools): - Analyze Events: Parse the 'events' list from the response to examine individual event details. - Extract Indicators: Identify new indicators (IPs, domains, hashes, users, etc.) from the event fields. - Enrich Indicators: Use summarize_entity or threat intelligence tools on any new indicators found in the events. - Correlate: Compare findings with other data sources like alerts (get_alerts) or case information (get_case). - Document: Add significant findings as comments to a case using create_case_comment. - Take Action: If the events confirm malicious activity, initiate response actions using tools like execute_manual_action.

The following sample demonstrate how to use curl to invoke the udm_search MCP tool.

Curl Request
curl --location 'https://chronicle.googleapis.com/mcp' \ --header 'content-type: application/json' \ --header 'accept: application/json, text/event-stream' \ --data '{ "method": "tools/call", "params": { "name": "udm_search", "arguments": { // provide these details according to the tool's MCP specification } }, "jsonrpc": "2.0", "id": 1 }'

Input Schema

Request message for UdmSearch.

UdmSearchRequest

JSON representation
{ "projectId": string, "customerId": string, "region": string, "query": string, "startTime": string, "endTime": string, "maxEvents": integer }

Fields
projectId	string Project ID of the customer.
customerId	string Customer ID of the customer.
region	string Region of the customer.
query	string Query to search for.
startTime	string Start time of the time range to search for.
endTime	string End time of the time range to search for.
maxEvents	integer Maximum number of events to return. If not set, the default value is 100.

Output Schema

Returns results matching the query and time range in UdmSearchRequest.

UdmSearchResponse

JSON representation
{ "events": [ { object (Event) } ], "moreDataAvailable": boolean, "stats": { object (StatsData) } }

Fields
events[]	object (Event) List of matched events.
moreDataAvailable	boolean Too many events matched the search criterion, some results have been omitted.
stats	object (StatsData) LINT.ThenChange( //depot/google3/googlex/security/malachite/proto/udm_search.proto:stats_data ) Stats response for the query.

Event

JSON representation
{ "name": string, "udm": { object (UDM) } }

Fields
name	string The resource name of the event. Format: projects/{project}/locations/{location}/instances/{instance}/events/{event} where 'event' is URL-encoded Base64. The unencoded value of 'event' can also be found in udm.metadata.id.
udm	object (UDM) Event data in UDM format.

UDM

JSON representation

{ "metadata": { object (Metadata) }, "additional": { object }, "principal": { object (Noun) }, "src": { object (Noun) }, "target": { object (Noun) }, "intermediary": [ { object (Noun) } ], "observer": { object (Noun) }, "about": [ { object (Noun) } ], "securityResult": [ { object (SecurityResult) } ], "network": { object (Network) }, "extensions": { object (Extensions) }, "extracted": { object } }

Fields
metadata	object (Metadata) Event metadata such as timestamp, source product, etc.
additional	object (Struct format) Any important vendor-specific event data that cannot be adequately represented within the formal sections of the UDM model.
principal	object (Noun) Represents the acting entity that originates the activity described in the event. The principal must include at least one machine detail (hostname, MACs, IPs, port, product-specific identifiers like an EDR asset ID) or user detail (for example, username), and optionally include process details. It must NOT include any of the following fields: email, files, registry keys or values.
src	object (Noun) Represents a source entity being acted upon by the participant along with the device or process context for the source object (the machine where the source object resides). For example, if user U copies file A on machine X to file B on machine Y, both file A and machine X would be specified in the src portion of the UDM event.
target	object (Noun) Represents a target entity being referenced by the event or an object on the target entity. For example, in a firewall connection from device A to device B, A is described as the principal and B is described as the target. For a process injection by process C into target process D, process C is described as the principal and process D is described as the target.
intermediary[]	object (Noun) Represents details on one or more intermediate entities processing activity described in the event. This includes device details about a proxy server or SMTP relay server. If an active event (that has a principal and possibly target) passes through any intermediaries, they're added here. Intermediaries can impact the overall action, for example blocking or modifying an ongoing request. A rule of thumb here is that 'principal', 'target', and description of the initial action should be the same regardless of the intermediary or its action. A successful network connection from A->B should look the same in principal/target/intermediary as one blocked by firewall C: principal: A, target: B (intermediary: C).
observer	object (Noun) Represents an observer entity (for example, a packet sniffer or network-based vulnerability scanner), which is not a direct intermediary, but which observes and reports on the event in question.
about[]	object (Noun) Represents entities referenced by the event that are not otherwise described in principal, src, target, intermediary or observer. For example, it could be used to track email file attachments, domains/URLs/IPs embedded within an email body, and DLLs that are loaded during a PROCESS_LAUNCH event.
securityResult[]	object (SecurityResult) A list of security results.
network	object (Network) All network details go here, including sub-messages with details on each protocol (for example, DHCP, DNS, or HTTP).
extensions	object (Extensions) All other first-class, event-specific metadata goes in this message. Do not place protocol metadata in Extensions; put it in Network.
extracted	object (Struct format) Flattened fields extracted from the log.

Metadata

JSON representation

{ "id": string, "productLogId": string, "eventTimestamp": string, "eventTimestampAttributes": [ enum (EventTimestampAttribute) ], "collectedTimestamp": string, "ingestedTimestamp": string, "eventType": enum (EventType), "vendorName": string, "productName": string, "productVersion": string, "productEventType": string, "productDeploymentId": string, "description": string, "urlBackToProduct": string, "ingestionLabels": [ { object (Label) } ], "tags": { object (Tags) }, "enrichmentState": enum (EnrichmentState), "logType": string, "baseLabels": { object (DataAccessLabels) }, "enrichmentLabels": { object (DataAccessLabels) }, "structuredFields": { object }, "parserVersion": string }

Fields
id	string (bytes format) ID of the UDM event. Can be used for raw and normalized event retrieval. A base64-encoded string.
productLogId	string A vendor-specific event identifier to uniquely identify the event (e.g. a GUID).
eventTimestamp	string (Timestamp format) The GMT timestamp when the event was generated. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
eventTimestampAttributes[]	enum (EventTimestampAttribute) Attributes associated with event_timestamp. This field is used to distinguish between different types of timestamps that can be used to represent the event_timestamp.
collectedTimestamp	string (Timestamp format) The GMT timestamp when the event was collected by the vendor's local collection infrastructure. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
ingestedTimestamp	string (Timestamp format) The GMT timestamp when the event was ingested (received) by Chronicle. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
eventType	enum (EventType) The event type. If an event has multiple possible types, this specifies the most specific type.
vendorName	string The name of the product vendor.
productName	string The name of the product.
productVersion	string The version of the product.
productEventType	string A short, descriptive, human-readable, product-specific event name or type (e.g. "Scanned X", "User account created", "process_start").
productDeploymentId	string The deployment identifier assigned by the vendor for a product deployment.
description	string A human-readable unparsable description of the event.
urlBackToProduct	string A URL that takes the user to the source product console for this event.
ingestionLabels[]	object (Label) User-configured ingestion metadata labels.
tags	object (Tags) Tags added by Chronicle after an event is parsed. It is an error to populate this field from within a parser.
enrichmentState	enum (EnrichmentState) The enrichment state.
logType	string The string value of log type.
baseLabels	object (DataAccessLabels) Data access labels on the base event.
enrichmentLabels	object (DataAccessLabels) Data access labels from all the contextual events used to enrich the base event.
structuredFields (deprecated)	object (Struct format) This item is deprecated! Flattened fields extracted from the log.
parserVersion	string The version of the parser that generated this UDM event.

Timestamp

JSON representation
{ "seconds": string, "nanos": integer }

Fields
seconds	string (int64 format) Represents seconds of UTC time since Unix epoch 1970-01-01T00:00:00Z. Must be between -62135596800 and 253402300799 inclusive (which corresponds to 0001-01-01T00:00:00Z to 9999-12-31T23:59:59Z).
nanos	integer Non-negative fractions of a second at nanosecond resolution. This field is the nanosecond portion of the duration, not an alternative to seconds. Negative second values with fractions must still have non-negative nanos values that count forward in time. Must be between 0 and 999,999,999 inclusive.

Label

JSON representation
{ "key": string, "value": string, "source": string, "rbacEnabled": boolean }

Fields
key	string The key.
value	string The value.
source	string Where the label is derived from.
rbacEnabled	boolean Indicates whether this label can be used for Data RBAC

Tags

JSON representation
{ "tenantId": [ string ], "dataTapConfigName": [ string ] }

Fields
tenantId[]	string (bytes format) A list of subtenant ids that this event belongs to. A base64-encoded string.
dataTapConfigName[]	string A list of sink name values defined in DataTap configurations.

DataAccessLabels

JSON representation
{ "logTypes": [ string ], "ingestionLabels": [ string ], "namespaces": [ string ], "customLabels": [ string ], "ingestionKvLabels": [ { object (DataAccessIngestionLabel) } ], "allowScopedAccess": boolean }

Fields
logTypes[]	string All the LogType labels.
ingestionLabels[] (deprecated)	string This item is deprecated! All the ingestion labels.
namespaces[]	string All the namespaces.
customLabels[]	string All the complex labels (UDM search syntax based).
ingestionKvLabels[]	object (DataAccessIngestionLabel) All the ingestion labels (key/value pairs).
allowScopedAccess	boolean Are the labels ready for scoped access

DataAccessIngestionLabel

JSON representation
{ "key": string, "value": string }

Fields
key	string The key.
value	string The value.

Struct

JSON representation
{ "fields": { string: value, ... } }

Fields
fields	map (key: string, value: value (Value format)) Unordered map of dynamically typed values. An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.

FieldsEntry

JSON representation
{ "key": string, "value": value }

Fields
key	string
value	value (Value format)

Value

JSON representation
{ // Union field kind can be only one of the following: "nullValue": null, "numberValue": number, "stringValue": string, "boolValue": boolean, "structValue": { object }, "listValue": array // End of list of possible types for union field kind. }

Fields
Union field kind. The kind of value. kind can be only one of the following:
nullValue	null Represents a null value.
numberValue	number Represents a double value.
stringValue	string Represents a string value.
boolValue	boolean Represents a boolean value.
structValue	object (Struct format) Represents a structured value.
listValue	array (ListValue format) Represents a repeated Value.

ListValue

JSON representation
{ "values": [ value ] }

Fields
values[]	value (Value format) Repeated field of dynamically typed values.

Noun

JSON representation

{ "hostname": string, "domain": { object (Domain) }, "artifact": { object (Artifact) }, "urlMetadata": { object (Url) }, "browser": { object (Browser) }, "assetId": string, "user": { object (User) }, "userManagementChain": [ { object (User) } ], "group": { object (Group) }, "process": { object (Process) }, "processAncestors": [ { object (Process) } ], "asset": { object (Asset) }, "ip": [ string ], "natIp": [ string ], "port": integer, "natPort": integer, "mac": [ string ], "administrativeDomain": string, "namespace": string, "url": string, "file": { object (File) }, "email": string, "registry": { object (Registry) }, "application": string, "platform": enum (Platform), "platformVersion": string, "platformPatchLevel": string, "cloud": { object (Cloud) }, "location": { object (Location) }, "ipLocation": [ { object (Location) } ], "ipGeoArtifact": [ { object (Artifact) } ], "resource": { object (Resource) }, "resourceAncestors": [ { object (Resource) } ], "labels": [ { object (Label) } ], "objectReference": { object (Id) }, "investigation": { object (Investigation) }, "network": { object (Network) }, "securityResult": [ { object (SecurityResult) } ] }

Fields
hostname	string Client hostname or domain name field. Hostname also doubles as the domain for remote entities. This field can be used as an entity indicator for asset entities.
domain	object (Domain) Information about the domain.
artifact	object (Artifact) Information about an artifact.
urlMetadata	object (Url) Information about the URL.
browser	object (Browser) Information about an entry in the web browser's local history database.
assetId	string The asset ID. This field can be used as an entity indicator for asset entities.
user	object (User) Information about the user.
userManagementChain[]	object (User) Information about the user's management chain (reporting hierarchy). Note: user_management_chain is only populated when data is exported to BigQuery since recursive fields (e.g. user.managers) are not supported by BigQuery.
group	object (Group) Information about the group.
process	object (Process) Information about the process.
processAncestors[]	object (Process) Information about the process's ancestors ordered from immediate ancestor (parent process) to root. Note: process_ancestors is only populated when data is exported to BigQuery since recursive fields (e.g. process.parent_process) are not supported by BigQuery.
asset	object (Asset) Information about the asset.
ip[]	string A list of IP addresses associated with a network connection. This field can be used as an entity indicator for asset entities.
natIp[]	string A list of NAT translated IP addresses associated with a network connection.
port	integer Source or destination network port number when a specific network connection is described within an event.
natPort	integer NAT external network port number when a specific network connection is described within an event.
mac[]	string List of MAC addresses associated with a device. This field can be used as an entity indicator for asset entities.
administrativeDomain	string Domain which the device belongs to (for example, the Microsoft Windows domain).
namespace	string Namespace which the device belongs to, such as "AD forest". Uses for this field include Microsoft Windows AD forest, the name of subsidiary, or the name of acquisition. This field can be used along with an asset indicator to identify an asset.
url	string The URL.
file	object (File) Information about the file.
email	string Email address. Only filled in for security_result.about
registry	object (Registry) Registry information.
application	string The name of an application or service. Some SSO solutions only capture the name of a target application such as "Atlassian" or "Chronicle".
platform	enum (Platform) Platform.
platformVersion	string Platform version. For example, "Microsoft Windows 1803".
platformPatchLevel	string Platform patch level. For example, "Build 17134.48"
cloud (deprecated)	object (Cloud) This item is deprecated! Cloud metadata. Deprecated: cloud should be populated in entity Attribute as generic metadata (e.g. asset.attribute.cloud).
location	object (Location) Physical location. For cloud environments, set the region in location.name.
ipLocation[] (deprecated)	object (Location) This item is deprecated! Deprecated: use ip_geo_artifact.location instead.
ipGeoArtifact[]	object (Artifact) Enriched geographic information corresponding to an IP address. Specifically, location and network data.
resource	object (Resource) Information about the resource (e.g. scheduled task, calendar entry). This field should not be used for files, registry, or processes because these objects are already part of Noun.
resourceAncestors[]	object (Resource) Information about the resource's ancestors ordered from immediate ancestor (starting with parent resource).
labels[] (deprecated)	object (Label) This item is deprecated! Labels are key-value pairs. For example: key = "env", value = "prod". Deprecated: labels should be populated in entity Attribute as generic metadata (e.g. user.attribute.labels).
objectReference	object (Id) Finding to which the Analyst updated the feedback.
investigation	object (Investigation) Analyst feedback/investigation for alerts.
network	object (Network) Network details, including sub-messages with details on each protocol (for example, DHCP, DNS, or HTTP).
securityResult[]	object (SecurityResult) A list of security results.

Domain

JSON representation

{ "name": string, "prevalence": { object (Prevalence) }, "firstSeenTime": string, "lastSeenTime": string, "registrar": string, "contactEmail": string, "whoisServer": string, "nameServer": [ string ], "creationTime": string, "updateTime": string, "expirationTime": string, "auditUpdateTime": string, "status": string, "registrant": { object (User) }, "admin": { object (User) }, "tech": { object (User) }, "billing": { object (User) }, "zone": { object (User) }, "whoisRecordRawText": string, "registryDataRawText": string, "ianaRegistrarId": integer, "privateRegistration": boolean, "categories": [ string ], "favicon": { object (Favicon) }, "jarm": string, "lastDnsRecords": [ { object (DNSRecord) } ], "lastDnsRecordsTime": string, "lastHttpsCertificate": { object (SSLCertificate) }, "lastHttpsCertificateTime": string, "popularityRanks": [ { object (PopularityRank) } ], "tags": [ string ], "whoisTime": string }

Fields
name	string The domain name. This field can be used as an entity indicator for Domain entities.
prevalence	object (Prevalence) The prevalence of the domain within the customer's environment.
firstSeenTime	string (Timestamp format) First seen timestamp of the domain in the customer's environment. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
lastSeenTime	string (Timestamp format) Last seen timestamp of the domain in the customer's environment. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
registrar	string Registrar name . FOr example, "Wild West Domains, Inc. (R120-LROR)", "GoDaddy.com, LLC", or "PDR LTD. D/B/A PUBLICDOMAINREGISTRY.COM".
contactEmail	string Contact email address.
whoisServer	string Whois server name.
nameServer[]	string Repeated list of name servers.
creationTime	string (Timestamp format) Domain creation time. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
updateTime	string (Timestamp format) Last updated time. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
expirationTime	string (Timestamp format) Expiration time. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
auditUpdateTime	string (Timestamp format) Audit updated time. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
status	string Domain status. See https://www.icann.org/resources/pages/epp-status-codes-2014-06-16-en for meanings of possible values
registrant	object (User) Parsed contact information for the registrant of the domain.
admin	object (User) Parsed contact information for the administrative contact for the domain.
tech	object (User) Parsed contact information for the technical contact for the domain
billing	object (User) Parsed contact information for the billing contact of the domain.
zone	object (User) Parsed contact information for the zone.
whoisRecordRawText	string (bytes format) WHOIS raw text. A base64-encoded string.
registryDataRawText	string (bytes format) Registry Data raw text. A base64-encoded string.
ianaRegistrarId	integer IANA Registrar ID. See https://www.iana.org/assignments/registrar-ids/registrar-ids.xhtml
privateRegistration	boolean Indicates whether the domain appears to be using a private registration service to mask the owner's contact information.
categories[]	string Categories assign to the domain as retrieved from VirusTotal.
favicon	object (Favicon) Includes difference hash and MD5 hash of the domain's favicon.
jarm	string Domain's JARM hash.
lastDnsRecords[]	object (DNSRecord) Domain's DNS records from the last scan.
lastDnsRecordsTime	string (Timestamp format) Date when the DNS records list was retrieved by VirusTotal. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
lastHttpsCertificate	object (SSLCertificate) SSL certificate object retrieved last time the domain was analyzed.
lastHttpsCertificateTime	string (Timestamp format) When the certificate was retrieved by VirusTotal. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
popularityRanks[]	object (PopularityRank) Domain's position in popularity ranks such as Alexa, Quantcast, Statvoo, etc
tags[]	string List of representative attributes.
whoisTime	string (Timestamp format) Date of the last update of the WHOIS record. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".

Prevalence

JSON representation
{ "rollingMax": integer, "dayCount": integer, "rollingMaxSubDomains": integer, "dayMax": integer, "dayMaxSubDomains": integer }

Fields
rollingMax	integer The maximum number of assets per day accessing the resource over the trailing day_count days.
dayCount	integer The number of days over which rolling_max is calculated.
rollingMaxSubDomains	integer The maximum number of assets per day accessing the domain along with sub-domains over the trailing day_count days. This field is only valid for domains.
dayMax	integer The max prevalence score in a day interval window.
dayMaxSubDomains	integer The max prevalence score in a day interval window across sub-domains. This field is only valid for domains.

User

JSON representation

{ "productObjectId": string, "userid": string, "userDisplayName": string, "firstName": string, "middleName": string, "lastName": string, "phoneNumbers": [ string ], "personalAddress": { object (Location) }, "attribute": { object (Attribute) }, "firstSeenTime": string, "accountType": enum (AccountType), "groupid": string, "groupIdentifiers": [ string ], "windowsSid": string, "emailAddresses": [ string ], "employeeId": string, "title": string, "companyName": string, "department": [ string ], "officeAddress": { object (Location) }, "managers": [ { object (User) } ], "hireDate": string, "terminationDate": string, "timeOff": [ { object (TimeOff) } ], "lastLoginTime": string, "lastPasswordChangeTime": string, "passwordExpirationTime": string, "accountExpirationTime": string, "accountLockoutTime": string, "lastBadPasswordAttemptTime": string, "userAuthenticationStatus": enum (AuthenticationStatus), "roleName": string, "roleDescription": string, "userRole": enum (Role) }

Fields
productObjectId	string A vendor-specific identifier to uniquely identify the entity (e.g. a GUID, LDAP, OID, or similar). This field can be used as an entity indicator for user entities.
userid	string The ID of the user. This field can be used as an entity indicator for user entities.
userDisplayName	string The display name of the user (e.g. "John Locke").
firstName	string First name of the user (e.g. "John").
middleName	string Middle name of the user.
lastName	string Last name of the user (e.g. "Locke").
phoneNumbers[]	string Phone numbers for the user.
personalAddress	object (Location) Personal address of the user.
attribute	object (Attribute) Generic entity metadata attributes of the user.
firstSeenTime	string (Timestamp format) The first observed time for a user. The value is calculated on the basis of the first time the identifier was observed. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
accountType	enum (AccountType) Type of user account (for example, service, domain, or cloud). This is somewhat aligned to: https://attack.mitre.org/techniques/T1078/
groupid (deprecated)	string This item is deprecated! The ID of the group that the user belongs to. Deprecated in favor of the repeated group_identifiers field.
groupIdentifiers[]	string Product object identifiers of the group(s) the user belongs to A vendor-specific identifier to uniquely identify the group(s) the user belongs to (a GUID, LDAP OID, or similar).
windowsSid	string The Microsoft Windows SID of the user. This field can be used as an entity indicator for user entities.
emailAddresses[]	string Email addresses of the user. This field can be used as an entity indicator for user entities.
employeeId	string Human capital management identifier. This field can be used as an entity indicator for user entities.
title	string User job title.
companyName	string User job company name.
department[]	string User job department
officeAddress	object (Location) User job office location.
managers[]	object (User) User job manager(s).
hireDate	string (Timestamp format) User job employment hire date. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
terminationDate	string (Timestamp format) User job employment termination date. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
timeOff[]	object (TimeOff) User time off leaves from active work.
lastLoginTime	string (Timestamp format) User last login timestamp. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
lastPasswordChangeTime	string (Timestamp format) User last password change timestamp. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
passwordExpirationTime	string (Timestamp format) User password expiration timestamp. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
accountExpirationTime	string (Timestamp format) User account expiration timestamp. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
accountLockoutTime	string (Timestamp format) User account lockout timestamp. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
lastBadPasswordAttemptTime	string (Timestamp format) User last bad password attempt timestamp. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
userAuthenticationStatus	enum (AuthenticationStatus) System authentication status for user.
roleName (deprecated)	string This item is deprecated! System role name for user. Deprecated: use attribute.roles.
roleDescription (deprecated)	string This item is deprecated! System role description for user. Deprecated: use attribute.roles.
userRole (deprecated)	enum (Role) This item is deprecated! System role for user. Deprecated: use attribute.roles.

Location

JSON representation
{ "city": string, "state": string, "countryOrRegion": string, "name": string, "deskName": string, "floorName": string, "regionLatitude": number, "regionLongitude": number, "regionCoordinates": { object (LatLng) } }

Fields
city	string The city.
state	string The state.
countryOrRegion	string The country or region.
name	string Custom location name (e.g. building or site name like "London Office"). For cloud environments, this is the region (e.g. "us-west2").
deskName	string Desk name or individual location, typically for an employee in an office. (e.g. "IN-BLR-BCPC-11-1121D").
floorName	string Floor name, number or a combination of the two for a building. (e.g. "1-A").
regionLatitude (deprecated)	number This item is deprecated! Deprecated: use region_coordinates.
regionLongitude (deprecated)	number This item is deprecated! Deprecated: use region_coordinates.
regionCoordinates	object (LatLng) Coordinates for the associated region. See https://cloud.google.com/vision/docs/reference/rest/v1/LatLng for a description of the fields.

LatLng

JSON representation
{ "latitude": number, "longitude": number }

Fields
latitude	number The latitude in degrees. It must be in the range [-90.0, +90.0].
longitude	number The longitude in degrees. It must be in the range [-180.0, +180.0].

Attribute

JSON representation
{ "cloud": { object (Cloud) }, "labels": [ { object (Label) } ], "permissions": [ { object (Permission) } ], "roles": [ { object (Role) } ], "creationTime": string, "lastUpdateTime": string }

Fields
cloud	object (Cloud) Cloud metadata attributes such as project ID, account ID, or organizational hierarchy.
labels[]	object (Label) Set of labels for the entity. Should only be used for product labels (for example, Google Cloud resource labels or Azure AD sensitivity labels. Should not be used for arbitrary key-value mappings.
permissions[]	object (Permission) System permissions for IAM entity (human principal, service account, group).
roles[]	object (Role) System IAM roles to be assumed by resources to use the role's permissions for access control.
creationTime	string (Timestamp format) Time the resource or entity was created or provisioned. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
lastUpdateTime	string (Timestamp format) Time the resource or entity was last updated. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".

Cloud

JSON representation
{ "environment": enum (CloudEnvironment), "vpc": { object (Resource) }, "project": { object (Resource) }, "availabilityZone": string }

Fields
environment	enum (CloudEnvironment) The Cloud environment.
vpc (deprecated)	object (Resource) This item is deprecated! The cloud environment VPC. Deprecated.
project (deprecated)	object (Resource) This item is deprecated! The cloud environment project information. Deprecated: Use Resource.resource_ancestors
availabilityZone	string The cloud environment availability zone (different from region which is location.name).

Resource

JSON representation
{ "type": string, "resourceType": enum (ResourceType), "resourceSubtype": string, "id": string, "name": string, "parent": string, "productObjectId": string, "attribute": { object (Attribute) }, "scheduledTask": { object (ScheduledTask) }, "volume": { object (Volume) }, "service": { object (Service) } }

Fields
type (deprecated)	string This item is deprecated! Deprecated: use resource_type instead.
resourceType	enum (ResourceType) Resource type.
resourceSubtype	string Resource sub-type (e.g. "BigQuery", "Bigtable").
id (deprecated)	string This item is deprecated! Deprecated: Use resource.name or resource.product_object_id.
name	string The full name of the resource. For example, Google Cloud: //cloudresourcemanager.googleapis.com/projects/wombat-123, and AWS: arn:aws:iam::123456789012:user/johndoe.
parent (deprecated)	string This item is deprecated! The parent of the resource. For a database table, the parent is the database. For a storage object, the bucket name. Deprecated: use resource_ancestors.name.
productObjectId	string A vendor-specific identifier to uniquely identify the entity (a GUID, OID, or similar) This field can be used as an entity indicator for a Resource entity.
attribute	object (Attribute) Generic entity metadata attributes of the resource.
scheduledTask	object (ScheduledTask) Information about a scheduled task associated with the resource.
volume	object (Volume) Information about a storage volume associated with the resource.
service	object (Service) Information about a Windows service associated with the resource.

ScheduledTask

JSON representation
{ "minute": integer, "hour": integer, "monthDay": integer, "month": integer, "weekDay": integer, "comment": string, "author": string }

Fields
minute	integer The minute of the hour (0-59).
hour	integer The hour of the day (0-23).
monthDay	integer The day of the month (1-31).
month	integer The month of the year (1-12).
weekDay	integer The day of the week (0-6, Sunday=0).
comment	string A comment or description for the task.
author	string The author or creator of the task.

Volume

JSON representation
{ "fileSystem": string, "mountPoint": string, "devicePath": string, "isMounted": boolean, "isReadOnly": boolean, "name": string }

Fields
fileSystem	string The name of the file system on the volume (e.g., "NTFS", "FAT32").
mountPoint	string The path where the volume is mounted (e.g., "C:", "/mnt/data").
devicePath	string The system path to the device (e.g., "\.\HarddiskVolume1", "/dev/sda1").
isMounted	boolean Indicates whether the volume is currently mounted.
isReadOnly	boolean Indicates whether the volume is mounted as read-only.
name	string The user-assigned label or name for the volume.

Service

JSON representation
{ "displayName": string, "serviceType": enum (ServiceType), "startupType": enum (StartupType), "state": enum (State) }

Fields
displayName	string The user-friendly display name of the service.
serviceType	enum (ServiceType) The type of service.
startupType	enum (StartupType) The startup type of the service.
state	enum (State) Output only. The status of the service.

Permission

JSON representation
{ "name": string, "description": string, "type": enum (PermissionType) }

Fields
name	string Name of the permission (e.g. chronicle.analyst.updateRule).
description	string Description of the permission (e.g. 'Ability to update detect rules').
type	enum (PermissionType) Type of the permission.

Role

JSON representation
{ "name": string, "description": string, "type": enum (Type) }

Fields
name	string System role name for user.
description	string System role description for user.
type	enum (Type) System role type for well known roles.

TimeOff

JSON representation
{ "interval": { object (Interval) }, "description": string }

Fields
interval	object (Interval) Interval duration of the leave.
description	string Description of the leave if available (e.g. 'Vacation').

Interval

JSON representation
{ "startTime": string, "endTime": string }

Fields
startTime	string (Timestamp format) Optional. Inclusive start of the interval. If specified, a Timestamp matching this interval will have to be the same or after the start. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
endTime	string (Timestamp format) Optional. Exclusive end of the interval. If specified, a Timestamp matching this interval will have to be before the end. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".

Favicon

JSON representation
{ "rawMd5": string, "dhash": string }

Fields
rawMd5	string Favicon's MD5 hash.
dhash	string Difference hash.

DNSRecord

JSON representation
{ "type": string, "value": string, "ttl": string, "priority": string, "retry": string, "refresh": string, "minimum": string, "expire": string, "serial": string, "rname": string }

Fields
type	string Type.
value	string Value.
ttl	string (Duration format) Time to live. A duration in seconds with up to nine fractional digits, ending with 's'. Example: "3.5s".
priority	string (int64 format) Priority.
retry	string (int64 format) Retry.
refresh	string (Duration format) Refresh. A duration in seconds with up to nine fractional digits, ending with 's'. Example: "3.5s".
minimum	string (Duration format) Minimum. A duration in seconds with up to nine fractional digits, ending with 's'. Example: "3.5s".
expire	string (Duration format) Expire. A duration in seconds with up to nine fractional digits, ending with 's'. Example: "3.5s".
serial	string (int64 format) Serial.
rname	string Rname.

Duration

JSON representation
{ "seconds": string, "nanos": integer }

Fields
seconds	string (int64 format) Signed seconds of the span of time. Must be from -315,576,000,000 to +315,576,000,000 inclusive. Note: these bounds are computed from: 60 sec/min * 60 min/hr * 24 hr/day * 365.25 days/year * 10000 years
nanos	integer Signed fractions of a second at nanosecond resolution of the span of time. Durations less than one second are represented with a 0 seconds field and a positive or negative nanos field. For durations of one second or more, a non-zero value for the nanos field must be of the same sign as the seconds field. Must be from -999,999,999 to +999,999,999 inclusive.

SSLCertificate

JSON representation

{ "certSignature": { object (CertSignature) }, "extension": { object (Extension) }, "certExtensions": { object }, "firstSeenTime": string, "issuer": { object (Subject) }, "ec": { object (EC) }, "serialNumber": string, "signatureAlgorithm": string, "size": string, "subject": { object (Subject) }, "thumbprint": string, "thumbprintSha256": string, "validity": { object (Validity) }, "version": string, "publicKey": { object (PublicKey) } }

Fields
certSignature	object (CertSignature) Certificate's signature and algorithm.
extension (deprecated)	object (Extension) This item is deprecated! (DEPRECATED) certificate's extension.
certExtensions	object (Struct format) Certificate's extensions.
firstSeenTime	string (Timestamp format) Date the certificate was first retrieved by VirusTotal. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
issuer	object (Subject) Certificate's issuer data.
ec	object (EC) EC public key information.
serialNumber	string Certificate's serial number hexdump.
signatureAlgorithm	string Algorithm used for the signature (for example, "sha1RSA").
size	string (int64 format) Certificate content length.
subject	object (Subject) Certificate's subject data.
thumbprint	string Certificate's content SHA1 hash.
thumbprintSha256	string Certificate's content SHA256 hash.
validity	object (Validity) Certificate's validity period.
version	string Certificate version (typically "V1", "V2" or "V3").
publicKey	object (PublicKey) Public key information.

CertSignature

JSON representation
{ "signature": string, "signatureAlgorithm": string }

Fields
signature	string Signature.
signatureAlgorithm	string Algorithm.

Extension

JSON representation

{ "ca": boolean, "subjectKeyId": string, "authorityKeyId": { object (AuthorityKeyId) }, "keyUsage": string, "caInfoAccess": string, "crlDistributionPoints": string, "extendedKeyUsage": string, "subjectAlternativeName": string, "certificatePolicies": string, "netscapeCertComment": string, "certTemplateNameDc": string, "netscapeCertificate": boolean, "peLogotype": boolean, "oldAuthorityKeyId": boolean }

Fields
ca	boolean Whether the subject acts as a certificate authority (CA) or not.
subjectKeyId	string Identifies the public key being certified.
authorityKeyId	object (AuthorityKeyId) Identifies the public key to be used to verify the signature on this certificate or CRL.
keyUsage	string The purpose for which the certified public key is used.
caInfoAccess	string Authority information access locations are URLs that are added to a certificate in its authority information access extension.
crlDistributionPoints	string CRL distribution points to which a certificate user should refer to ascertain if the certificate has been revoked.
extendedKeyUsage	string One or more purposes for which the certified public key may be used, in addition to or in place of the basic purposes indicated in the key usage extension field.
subjectAlternativeName	string Contains one or more alternative names, using any of a variety of name forms, for the entity that is bound by the CA to the certified public key.
certificatePolicies	string Different certificate policies will relate to different applications which may use the certified key.
netscapeCertComment	string Used to include free-form text comments inside certificates.
certTemplateNameDc	string BMP data value "DomainController". See MS Q291010.
netscapeCertificate	boolean Identify whether the certificate subject is an SSL client, an SSL server, or a CA.
peLogotype	boolean Whether the certificate includes a logotype.
oldAuthorityKeyId	boolean Whether the certificate has an old authority key identifier extension.

AuthorityKeyId

JSON representation
{ "keyid": string, "serialNumber": string }

Fields
keyid	string Key hexdump.
serialNumber	string Serial number hexdump.

Subject

JSON representation
{ "countryName": string, "commonName": string, "locality": string, "organization": string, "organizationalUnit": string, "stateOrProvinceName": string }

Fields
countryName	string C: Country name.
commonName	string CN: CommonName.
locality	string L: Locality.
organization	string O: Organization.
organizationalUnit	string OU: OrganizationalUnit.
stateOrProvinceName	string ST: StateOrProvinceName.

EC

JSON representation
{ "oid": string, "pub": string }

Fields
oid	string Curve name.
pub	string Public key hexdump.

Validity

JSON representation
{ "expiryTime": string, "issueTime": string }

Fields
expiryTime	string (Timestamp format) Expiry date. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
issueTime	string (Timestamp format) Issue date. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".

PublicKey

JSON representation
{ "algorithm": string, "rsa": { object (RSA) } }

Fields
algorithm	string Any of "RSA", "DSA" or "EC". Indicates the algorithm used to generate the certificate.
rsa	object (RSA) RSA public key information.

RSA

JSON representation
{ "keySize": string, "modulus": string, "exponent": string }

Fields
keySize	string (int64 format) Key size.
modulus	string Key modulus hexdump.
exponent	string Key exponent hexdump.

PopularityRank

JSON representation
{ "giver": string, "rank": string, "ingestionTime": string }

Fields
giver	string Name of the rank serial number hexdump.
rank	string (int64 format) Rank position.
ingestionTime	string (Timestamp format) Timestamp when the rank was ingested. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".

Artifact

JSON representation

{ "ip": string, "prevalence": { object (Prevalence) }, "firstSeenTime": string, "lastSeenTime": string, "location": { object (Location) }, "network": { object (Network) }, "asOwner": string, "asn": string, "jarm": string, "lastHttpsCertificate": { object (SSLCertificate) }, "lastHttpsCertificateDate": string, "regionalInternetRegistry": string, "tags": [ string ], "whois": string, "whoisDate": string, "tunnels": [ { object (Tunnels) } ], "anonymous": boolean, "artifactClient": { object (ArtifactClient) }, "risks": [ string ] }

Fields
ip	string IP address of the artifact. This field can be used as an entity indicator for an external destination IP entity.
prevalence	object (Prevalence) The prevalence of the artifact within the customer's environment.
firstSeenTime	string (Timestamp format) First seen timestamp of the IP in the customer's environment. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
lastSeenTime	string (Timestamp format) Last seen timestamp of the IP address in the customer's environment. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
location	object (Location) Location of the Artifact's IP address.
network	object (Network) Network information related to the Artifact's IP address.
asOwner	string Owner of the Autonomous System to which the IP address belongs.
asn	string (int64 format) Autonomous System Number to which the IP address belongs.
jarm	string The JARM hash for the IP address. (https://engineering.salesforce.com/easily-identify-malicious-servers-on-the-internet-with-jarm-e095edac525a).
lastHttpsCertificate	object (SSLCertificate) SSL certificate information about the IP address.
lastHttpsCertificateDate	string (Timestamp format) Most recent date for the certificate in VirusTotal. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
regionalInternetRegistry	string RIR (one of the current RIRs: AFRINIC, ARIN, APNIC, LACNIC or RIPE NCC).
tags[]	string Identification attributes
whois	string WHOIS information as returned from the pertinent WHOIS server.
whoisDate	string (Timestamp format) Date of the last update of the WHOIS record in VirusTotal. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
tunnels[]	object (Tunnels) VPN tunnels.
anonymous	boolean Whether the VPN tunnels are configured for anonymous browsing or not.
artifactClient	object (ArtifactClient) Entity or software accessing or utilizing network resources.
risks[]	string This field lists potential risks associated with the network activity.

Network

JSON representation

{ "sentBytes": string, "receivedBytes": string, "totalBytes": string, "sentPackets": string, "receivedPackets": string, "sessionDuration": string, "sessionId": string, "parentSessionId": string, "applicationProtocolVersion": string, "communityId": string, "direction": enum (Direction), "ipProtocol": enum (IpProtocol), "applicationProtocol": enum (ApplicationProtocol), "ftp": { object (Ftp) }, "email": { object (Email) }, "dns": { object (Dns) }, "dhcp": { object (Dhcp) }, "http": { object (Http) }, "tls": { object (Tls) }, "smtp": { object (Smtp) }, "asn": string, "dnsDomain": string, "carrierName": string, "organizationName": string, "ipSubnetRange": string, "isProxy": boolean, "proxyInfo": { object (ProxyInfo) }, "connectionState": enum (ConnectionState) }

Fields
sentBytes	string The number of bytes sent.
receivedBytes	string The number of bytes received.
totalBytes	string (int64 format) The number of total bytes.
sentPackets	string (int64 format) The number of packets sent.
receivedPackets	string (int64 format) The number of packets received.
sessionDuration	string (Duration format) The duration of the session as the number of seconds and nanoseconds. For seconds, network.session_duration.seconds, the type is a 64-bit integer. For nanoseconds, network.session_duration.nanos, the type is a 32-bit integer. A duration in seconds with up to nine fractional digits, ending with 's'. Example: "3.5s".
sessionId	string The ID of the network session.
parentSessionId	string The ID of the parent network session.
applicationProtocolVersion	string The version of the application protocol. e.g. "1.1, 2.0"
communityId	string Community ID network flow value.
direction	enum (Direction) The direction of network traffic.
ipProtocol	enum (IpProtocol) The IP protocol.
applicationProtocol	enum (ApplicationProtocol) The application protocol.
ftp	object (Ftp) FTP info.
email	object (Email) Email info for the sender/recipient.
dns	object (Dns) DNS info.
dhcp	object (Dhcp) DHCP info.
http	object (Http) HTTP info.
tls	object (Tls) TLS info.
smtp	object (Smtp) SMTP info. Store fields specific to SMTP not covered by Email.
asn	string Autonomous system number.
dnsDomain	string DNS domain name.
carrierName	string Carrier identification.
organizationName	string Organization name (e.g Google).
ipSubnetRange	string Associated human-readable IP subnet range (e.g. 10.1.2.0/24).
isProxy	boolean Whether the IP address is a known proxy.
proxyInfo	object (ProxyInfo) Proxy information. Only set if is_proxy is true.
connectionState	enum (ConnectionState) Output only. The state of the network connection.

Ftp

JSON representation
{ "command": string }

Fields
command	string The FTP command.

Email

JSON representation
{ "from": string, "replyTo": string, "to": [ string ], "cc": [ string ], "bcc": [ string ], "mailId": string, "subject": [ string ], "bounceAddress": string }

Fields
from	string The 'from' address.
replyTo	string The 'reply to' address.
to[]	string A list of 'to' addresses.
cc[]	string A list of 'cc' addresses.
bcc[]	string A list of 'bcc' addresses.
mailId	string The mail (or message) ID.
subject[]	string The subject line(s) of the email.
bounceAddress	string The envelope from address. https://en.wikipedia.org/wiki/Bounce_address

Dns

JSON representation
{ "id": integer, "response": boolean, "opcode": integer, "authoritative": boolean, "truncated": boolean, "recursionDesired": boolean, "recursionAvailable": boolean, "responseCode": integer, "questions": [ { object (Question) } ], "answers": [ { object (ResourceRecord) } ], "authority": [ { object (ResourceRecord) } ], "additional": [ { object (ResourceRecord) } ] }

Fields
id	integer (uint32 format) DNS query id.
response	boolean Set to true if the event is a DNS response. See QR field from RFC1035.
opcode	integer (uint32 format) The DNS OpCode used to specify the type of DNS query (for example, QUERY, IQUERY, or STATUS).
authoritative	boolean Other DNS header flags. See RFC1035, section 4.1.1.
truncated	boolean Whether the DNS response was truncated.
recursionDesired	boolean Whether a recursive DNS lookup is desired.
recursionAvailable	boolean Whether a recursive DNS lookup is available.
responseCode	integer (uint32 format) Response code. See RCODE from RFC1035.
questions[]	object (Question) A list of domain protocol message questions.
answers[]	object (ResourceRecord) A list of answers to the domain name query.
authority[]	object (ResourceRecord) A list of domain name servers which verified the answers to the domain name queries.
additional[]	object (ResourceRecord) A list of additional domain name servers that can be used to verify the answer to the domain.

Question

JSON representation
{ "name": string, "type": integer, "class": integer, "prevalence": { object (Prevalence) } }

Fields
name	string The domain name.
type	integer (uint32 format) The code specifying the type of the query.
class	integer (uint32 format) The code specifying the class of the query.
prevalence	object (Prevalence) The prevalence of the domain within the customer's environment.

ResourceRecord

JSON representation
{ "name": string, "type": integer, "class": integer, "ttl": integer, "data": string, "binaryData": string }

Fields
name	string The name of the owner of the resource record.
type	integer (uint32 format) The code specifying the type of the resource record.
class	integer (uint32 format) The code specifying the class of the resource record.
ttl	integer (uint32 format) The time interval for which the resource record can be cached before the source of the information should again be queried.
data	string The payload or response to the DNS question for all responses encoded in UTF-8 format
binaryData	string (bytes format) The raw bytes of any non-UTF8 strings that might be included as part of a DNS response. A base64-encoded string.

Dhcp

JSON representation

{ "opcode": enum (OpCode), "htype": integer, "hlen": integer, "hops": integer, "transactionId": integer, "seconds": integer, "flags": integer, "ciaddr": string, "yiaddr": string, "siaddr": string, "giaddr": string, "chaddr": string, "sname": string, "file": string, "options": [ { object (Option) } ], "type": enum (MessageType), "leaseTimeSeconds": integer, "clientHostname": string, "clientIdentifier": string, "requestedAddress": string, "clientIdentifierString": string }

Fields
opcode	enum (OpCode) The BOOTP op code.
htype	integer (uint32 format) Hardware address type.
hlen	integer (uint32 format) Hardware address length.
hops	integer (uint32 format) Hardware ops.
transactionId	integer (uint32 format) Transaction ID.
seconds	integer (uint32 format) Seconds elapsed since client began address acquisition/renewal process.
flags	integer (uint32 format) Flags.
ciaddr	string Client IP address (ciaddr).
yiaddr	string Your IP address (yiaddr).
siaddr	string IP address of the next bootstrap server.
giaddr	string Relay agent IP address (giaddr).
chaddr	string Client hardware address (chaddr).
sname	string Server name that the client wishes to boot from.
file	string Boot image filename.
options[]	object (Option) List of DHCP options.
type	enum (MessageType) DHCP message type.
leaseTimeSeconds	integer (uint32 format) Lease time in seconds. See RFC2132, section 9.2.
clientHostname	string Client hostname. See RFC2132, section 3.14.
clientIdentifier	string (bytes format) Client identifier. See RFC2132, section 9.14. Note: Make sure to update the client_identifier_string field as well if you update this field. A base64-encoded string.
requestedAddress	string Requested IP address. See RFC2132, section 9.1.
clientIdentifierString	string Client identifier as string. See RFC2132, section 9.14. This field holds the string value of the client_identifier.

Option

JSON representation
{ "code": integer, "data": string }

Fields
code	integer (uint32 format) Code. See RFC1533.
data	string (bytes format) Data. A base64-encoded string.

Http

JSON representation
{ "method": string, "referralUrl": string, "userAgent": string, "responseCode": integer, "parsedUserAgent": { object (UserAgentProto) } }

Fields
method	string The HTTP request method (e.g. "GET", "POST", "PATCH", "DELETE").
referralUrl	string The URL for the HTTP referer.
userAgent	string The User-Agent request header which includes the application type, operating system, software vendor or software version of the requesting software user agent.
responseCode	integer The response status code, for example 200, 302, 404, or 500.
parsedUserAgent	object (UserAgentProto) The parsed user_agent string.

UserAgentProto

JSON representation

{ "family": enum (Family), "subFamily": string, "platform": string, "device": string, "deviceVersion": string, "carrier": string, "security": string, "locale": string, "os": string, "osVariant": string, "browser": string, "browserVersion": string, "browserEngineVersion": string, "googleToolbarVersion": string, "javaProfile": string, "javaProfileVersion": string, "javaConfiguration": string, "javaConfigurationVersion": string, "messaging": string, "messagingVersion": string, "annotation": [ { object (Annotation) } ] }

Fields
family	enum (Family) User agent family captures the type of browser/app at a high-level e.g. MSIE, Gecko, Safari etc..
subFamily	string Sub-family identifies individual regexps when a family has more than 1. This is used to generate the right UA string from a protobuf. Examples in the AppleWebKit family: Chrome and Safari. Can also be an arbitrary identifier.
platform	string The platform describes the environment in which the browser or app runs. For desktop user agents, Platform is a string describing the OS family e.g. Windows, Macintosh, Linux. For mobile user agents, Platform either describes the OS family (if available) or the hardware maker. e.g. Linux, or HTC, LG, Palm.
device	string (Usually) Mobile specific: name of hardware device, may or may not contain the full model name. e.g. iPhone, Palm750, SPH-M800. Reduced to "K" for Android devices with reduced User-Agent and no client hints (https://www.chromium.org/updates/ua-reduction/).
deviceVersion	string (Usually) Mobile specific: version of hardware device Unavailable with reduced User-Agent and no client hints (https://www.chromium.org/updates/ua-reduction/).
carrier	string Mobile specific: name of mobile carrier
security	string Security level reported by user agent, either U, I or N. Unavailable with reduced User-Agent and no client hints (https://www.chromium.org/updates/ua-reduction/).
locale	string Locale in which the browser is running as country code and optionally language pair. Unavailable with reduced User-Agent and no client hints (https://www.chromium.org/updates/ua-reduction/).
os	string Full name of the operating system e.g. "Darwin/9.7.0", "Android 1.5", "Windows 98" Version is reduced, and other data might also be missing, for reduced User-Agent and no client hints (https://www.chromium.org/updates/ua-reduction/).
osVariant	string Extra qualifier for the OS e.g. "(i386)", "Build/CUPCAKE", "PalmSource/Palm-D061" Unavailable with reduced User-Agent and no client hints (https://www.chromium.org/updates/ua-reduction/).
browser	string Product brand within the family: Firefox, Netscape, Camino etc.. Or Earth, Windows-Media-Player etc.. for non-browser user agents.
browserVersion	string Minor and lower versions unavailable with reduced User-Agent and no client hints (https://www.chromium.org/updates/ua-reduction/).
browserEngineVersion	string Version of the rendering engine e.g. "8.01" for "Opera/8.01"
googleToolbarVersion	string Version number of GoogleToolbar, if installed. Applies only to MSIE and Firefox at this time.
javaProfile	string Mobile specific: e.g. Profile/MIDP-2.0
javaProfileVersion	string
javaConfiguration	string Mobile specific: e.g. Configuration/CLDC-1.1
javaConfigurationVersion	string
messaging	string Mobile specific: e.g. MMP/2.0
messagingVersion	string
annotation[]	object (Annotation)

Annotation

JSON representation
{ "key": string, "value": string }

Fields
key	string
value	string

Tls

JSON representation
{ "client": { object (Client) }, "server": { object (Server) }, "cipher": string, "curve": string, "version": string, "versionProtocol": string, "established": boolean, "nextProtocol": string, "resumed": boolean }

Fields
client	object (Client) Certificate information for the client certificate.
server	object (Server) Certificate information for the server certificate.
cipher	string Cipher used during the connection.
curve	string Elliptical curve used for a given cipher.
version	string TLS version.
versionProtocol	string Protocol.
established	boolean Indicates whether the TLS negotiation was successful.
nextProtocol	string Protocol to be used for tunnel.
resumed	boolean Indicates whether the TLS connection was resumed from a previous TLS negotiation.

Client

JSON representation
{ "certificate": { object (Certificate) }, "ja3": string, "serverName": string, "supportedCiphers": [ string ] }

Fields
certificate	object (Certificate) Client certificate.
ja3	string JA3 hash from the TLS ClientHello, as a hex-encoded string.
serverName	string Host name of the server, that the client is connecting to.
supportedCiphers[]	string Ciphers supported by the client during client hello.

Certificate

JSON representation
{ "version": string, "serial": string, "subject": string, "issuer": string, "md5": string, "sha1": string, "sha256": string, "notBefore": string, "notAfter": string }

Fields
version	string Certificate version.
serial	string Certificate serial number.
subject	string Subject of the certificate.
issuer	string Issuer of the certificate.
md5	string The MD5 hash of the certificate, as a hex-encoded string.
sha1	string The SHA1 hash of the certificate, as a hex-encoded string.
sha256	string The SHA256 hash of the certificate, as a hex-encoded string.
notBefore	string (Timestamp format) Indicates when the certificate is first valid. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
notAfter	string (Timestamp format) Indicates when the certificate is no longer valid. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".

Server

JSON representation
{ "certificate": { object (Certificate) }, "ja3s": string }

Fields
certificate	object (Certificate) Server certificate.
ja3s	string JA3 hash from the TLS ServerHello, as a hex-encoded string.

Smtp

JSON representation
{ "helo": string, "mailFrom": string, "rcptTo": [ string ], "serverResponse": [ string ], "messagePath": string, "isWebmail": boolean, "isTls": boolean }

Fields
helo	string The client's 'HELO'/'EHLO' string.
mailFrom	string The client's 'MAIL FROM' string.
rcptTo[]	string The client's 'RCPT TO' string(s).
serverResponse[]	string The server's response(s) to the client.
messagePath	string The message's path (extracted from the headers).
isWebmail	boolean If the message was sent via a webmail client.
isTls	boolean If the connection switched to TLS.

ProxyInfo

JSON representation
{ "anonymous": boolean, "anonymousVpn": boolean, "publicProxy": boolean, "torExitNode": boolean, "smartDnsProxy": boolean, "hostingProvider": boolean, "vpnDatacenter": boolean, "residentialProxy": boolean, "vpnServiceName": string, "proxyOverVpn": boolean, "relayProxy": boolean }

Fields
anonymous	boolean Whether the IP address is anonymous.
anonymousVpn	boolean Whether the IP address is an anonymous VPN.
publicProxy	boolean Whether the IP address is a public proxy.
torExitNode	boolean Whether the IP address is a tor exit node.
smartDnsProxy	boolean Whether the IP address is a smart DNS proxy.
hostingProvider	boolean Whether the IP address is a hosting provider.
vpnDatacenter	boolean Whether the IP address is a VPN datacenter.
residentialProxy	boolean Whether the IP address is a residential proxy.
vpnServiceName	string The name of the VPN service.
proxyOverVpn	boolean Whether the IP address is a proxy over VPN.
relayProxy	boolean Whether the IP address is a relay proxy.

Tunnels

JSON representation
{ "provider": string, "type": string }

Fields
provider	string The provider of the VPN tunnels being used.
type	string The type of the VPN tunnels.

ArtifactClient

JSON representation
{ "behaviors": [ string ], "proxies": [ string ] }

Fields
behaviors[]	string The behaviors of the client accessing the network.
proxies[]	string The type of proxies used by the client.

Url

JSON representation
{ "url": string, "categories": [ string ], "favicon": { object (Favicon) }, "htmlMeta": { object }, "lastFinalUrl": string, "lastHttpResponseCode": integer, "lastHttpResponseContentLength": string, "lastHttpResponseContentSha256": string, "lastHttpResponseCookies": { object }, "lastHttpResponseHeaders": { object }, "tags": [ string ], "title": string, "trackers": [ { object (Tracker) } ] }

Fields
url	string URL.
categories[]	string Categorisation done by VirusTotal partners.
favicon	object (Favicon) Difference hash and MD5 hash of the URL's.
htmlMeta	object (Struct format) Meta tags (only for URLs downloading HTML).
lastFinalUrl	string If the original URL redirects, where does it end.
lastHttpResponseCode	integer HTTP response code of the last response.
lastHttpResponseContentLength	string (int64 format) Length in bytes of the content received.
lastHttpResponseContentSha256	string URL response body's SHA256 hash.
lastHttpResponseCookies	object (Struct format) Website's cookies.
lastHttpResponseHeaders	object (Struct format) Headers and values of the last HTTP response.
tags[]	string Tags.
title	string Webpage title.
trackers[]	object (Tracker) Trackers found in the URL in a historical manner.

Tracker

JSON representation
{ "tracker": string, "id": string, "timestamp": string, "url": string }

Fields
tracker	string Tracker name.
id	string Tracker ID, if available.
timestamp	string (Timestamp format) Tracker ingestion date. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
url	string Tracker script URL.

Browser

JSON representation

{ "browserType": enum (BrowserType), "browserVersion": string, "firstVisitTime": string, "lastVisitTime": string, "profile": string, "typed": boolean, "visitType": enum (UrlVisitType), "hidden": boolean, "requestOriginUri": string, "visitCount": string, "visitCountCriteria": string, "indexedContent": string, "firstBookmarkedTime": string, "cookies": [ { object (Cookie) } ], "typedCount": string, "visitSource": enum (VisitSource) }

Fields
browserType	enum (BrowserType) The browser that recorded the history entry (e.g. "Chrome", "Firefox", "Safari", etc.).
browserVersion	string The browser version.
firstVisitTime	string (Timestamp format) The timestamp indicating the initial visit to the URL. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
lastVisitTime	string (Timestamp format) The timestamp indicating the most recent visit to the URL. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
profile	string The browser profile associated with the history entry.
typed	boolean A boolean value indicating if the URL was typed by the user.
visitType	enum (UrlVisitType) Describes the type of navigation or visit (e.g., direct, redirect, etc.).
hidden	boolean A boolean value indicating if the history entry is hidden.
requestOriginUri	string Indicates the URI from which the current visit originated.
visitCount	string (int64 format) The total number of times the Url has been visited.
visitCountCriteria	string Describes the criteria used to calculate the visit_count.
indexedContent	string Represents the textual content of a web page. This field should be kept short. Large strings may affect latency and payload sizes.
firstBookmarkedTime	string (Timestamp format) The timestamp indicating the first time the URL was bookmarked. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
cookies[]	object (Cookie) Information about the cookies.
typedCount	string (int64 format) The number of times the URL was visited with this specific visit type and visit source.
visitSource	enum (VisitSource) The source of the visit.

Cookie

JSON representation
{ "name": string, "value": string, "domain": string, "path": string, "expirationTime": string, "httpOnly": boolean, "secure": boolean, "maxAge": string, "sameSite": enum (CookieSameSite), "session": boolean, "partitioned": boolean }

Fields
name	string The unique name identifying the cookie.
value	string The data stored within the cookie.
domain	string The domain for which the cookie is valid.
path	string The URL path for which the cookie is valid.
expirationTime	string (Timestamp format) The date and time when the cookie will expire. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
httpOnly	boolean Indicates if the cookie is inaccessible via client-side scripts (e.g., JavaScript).
secure	boolean Indicates if the cookie should only be sent over secure HTTPS connections.
maxAge	string (int64 format) The maximum age of the cookie in seconds.
sameSite	enum (CookieSameSite) Affects cross-site request behavior.
session	boolean Indicates if the cookie is persistent.
partitioned	boolean Shows if the cookies is stored using partitioned storage.

Group

JSON representation
{ "productObjectId": string, "creationTime": string, "groupDisplayName": string, "attribute": { object (Attribute) }, "emailAddresses": [ string ], "windowsSid": string }

Fields
productObjectId	string Product globally unique user object identifier, such as an LDAP Object Identifier.
creationTime (deprecated)	string (Timestamp format) This item is deprecated! Group creation time. Deprecated: creation_time should be populated in Attribute as generic metadata. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
groupDisplayName	string Group display name. e.g. "Finance".
attribute	object (Attribute) Generic entity metadata attributes of the group.
emailAddresses[]	string Email addresses of the group.
windowsSid	string Microsoft Windows SID of the group.

Process

JSON representation

{ "pid": string, "parentPid": string, "parentProcess": { object (Process) }, "file": { object (File) }, "commandLine": string, "commandLineHistory": [ string ], "productSpecificProcessId": string, "accessMask": string, "integrityLevelRid": string, "euid": string, "ruid": string, "egid": string, "rgid": string, "pgid": string, "sessionLeaderPid": string, "tty": string, "tokenElevationType": enum (TokenElevationType), "productSpecificParentProcessId": string, "ipv6": boolean, "kernelDuration": string, "userDuration": string, "realDuration": string }

Fields
pid	string The process ID. This field can be used as an entity indicator for process entities.
parentPid (deprecated)	string This item is deprecated! The ID of the parent process. Deprecated: use parent_process.pid instead.
parentProcess	object (Process) Information about the parent process.
file	object (File) Information about the file in use by the process.
commandLine	string The command line command that created the process. This field can be used as an entity indicator for process entities.
commandLineHistory[]	string The command line history of the process.
productSpecificProcessId	string A product specific process id.
accessMask	string A bit mask representing the level of access.
integrityLevelRid	string The Microsoft Windows integrity level relative ID (RID) of the process.
euid	string The effective user ID of the process.
ruid	string The real user ID of the process.
egid	string The effective group ID of the process.
rgid	string The real group ID of the process.
pgid	string The identifier that points to the process group ID leader.
sessionLeaderPid	string The process ID of the session leader process.
tty	string The teletype terminal which the command was executed within.
tokenElevationType	enum (TokenElevationType) The elevation type of the process on Microsoft Windows. This determines if any privileges are removed when UAC is enabled.
productSpecificParentProcessId (deprecated)	string This item is deprecated! A product specific id for the parent process. Please use parent_process.product_specific_process_id instead.
ipv6	boolean This is used to determine if the process is an IPv6 process.
kernelDuration	string (Duration format) The kernel time spent in the process. A duration in seconds with up to nine fractional digits, ending with 's'. Example: "3.5s".
userDuration	string (Duration format) The user time spent in the process. A duration in seconds with up to nine fractional digits, ending with 's'. Example: "3.5s".
realDuration	string (Duration format) The real time spent in the process. This is the sum of the kernel and user time. A duration in seconds with up to nine fractional digits, ending with 's'. Example: "3.5s".

File

JSON representation

{ "sha256": string, "md5": string, "sha1": string, "size": string, "fullPath": string, "mimeType": string, "fileMetadata": { object (FileMetadata) }, "securityResult": { object (SecurityResult) }, "peFile": { object (FileMetadataPE) }, "ssdeep": string, "vhash": string, "ahash": string, "authentihash": string, "symhash": string, "prefetchFileMetadata": { object (PrefetchFileMetadata) }, "fileType": enum (FileType), "capabilitiesTags": [ string ], "names": [ string ], "tags": [ string ], "lastModificationTime": string, "createTime": string, "lastAccessTime": string, "prevalence": { object (Prevalence) }, "firstSeenTime": string, "lastSeenTime": string, "statMode": string, "statInode": string, "statDev": string, "statNlink": string, "statFlags": integer, "lastAnalysisTime": string, "embeddedUrls": [ string ], "embeddedDomains": [ string ], "embeddedIps": [ string ], "exifInfo": { object (ExifInfo) }, "signatureInfo": { object (SignatureInfo) }, "pdfInfo": { object (PDFInfo) }, "firstSubmissionTime": string, "lastSubmissionTime": string, "mainIcon": { object (Favicon) }, "ntfs": { object (NtfsFileMetadata) }, "appCompatCache": { object (AppCompatMetadata) } }

Fields
sha256	string The SHA256 hash of the file, as a hex-encoded string. This field can be used as an entity indicator for file entities.
md5	string The MD5 hash of the file, as a hex-encoded string. This field can be used as an entity indicator for file entities.
sha1	string The SHA1 hash of the file, as a hex-encoded string. This field can be used as an entity indicator for file entities.
size	string The size of the file in bytes.
fullPath	string The full path identifying the location of the file on the system. This field can be used as an entity indicator for file entities.
mimeType	string The MIME (Multipurpose Internet Mail Extensions) type of the file, for example "PE", "PDF", or "powershell script".
fileMetadata (deprecated)	object (FileMetadata) This item is deprecated! Metadata associated with the file. Deprecate FileMetadata in favor of using fields in File.
securityResult	object (SecurityResult) Google Cloud Threat Intelligence (GCTI) security result for the file including threat context and detection metadata.
peFile	object (FileMetadataPE) Metadata about the Portable Executable (PE) file.
ssdeep	string Ssdeep of the file
vhash	string Vhash of the file.
ahash (deprecated)	string This item is deprecated! Deprecated. Use authentihash instead.
authentihash	string Authentihash of the file.
symhash	string SymHash of the file. Used for Mach-O (e.g. MacOS) binaries, to identify similar files based on their symbol table.
prefetchFileMetadata	object (PrefetchFileMetadata) Metadata about the prefetch file.
fileType	enum (FileType) FileType field.
capabilitiesTags[]	string Capabilities tags.
names[]	string Names fields.
tags[]	string Tags for the file.
lastModificationTime	string (Timestamp format) Timestamp when the file was last updated. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
createTime	string (Timestamp format) Timestamp when the file was created. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
lastAccessTime	string (Timestamp format) Timestamp when the file was accessed. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
prevalence	object (Prevalence) Prevalence of the file hash in the customer's environment.
firstSeenTime	string (Timestamp format) Timestamp the file was first seen in the customer's environment. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
lastSeenTime	string (Timestamp format) Timestamp the file was last seen in the customer's environment. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
statMode	string The mode of the file. A bit string indicating the permissions and privileges of the file.
statInode	string The file identifier. Unique identifier of object within a file system.
statDev	string The file system identifier to which the object belongs.
statNlink	string Number of links to file.
statFlags	integer (uint32 format) User defined flags for file.
lastAnalysisTime	string (Timestamp format) Timestamp the file was last analysed. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
embeddedUrls[]	string Embedded urls found in the file.
embeddedDomains[]	string Embedded domains found in the file.
embeddedIps[]	string Embedded IP addresses found in the file.
exifInfo	object (ExifInfo) Exif metadata from different file formats extracted by exiftool.
signatureInfo	object (SignatureInfo) File signature information extracted from different tools.
pdfInfo	object (PDFInfo) Information about the PDF file structure.
firstSubmissionTime	string (Timestamp format) First submission time of the file. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
lastSubmissionTime	string (Timestamp format) Last submission time of the file. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
mainIcon	object (Favicon) Icon's relevant hashes.
ntfs	object (NtfsFileMetadata) NTFS metadata.
appCompatCache	object (AppCompatMetadata) Windows AppCompatCache (Application Compatibility) metadata.

FileMetadata

JSON representation
{ "pe": { object (PeFileMetadata) } }

Fields
pe (deprecated)	object (PeFileMetadata) This item is deprecated! Metadata for Microsoft Windows PE files. Deprecate PeFileMetadata in favor of single File proto.

PeFileMetadata

JSON representation
{ "importHash": string }

Fields
importHash	string Hash of PE imports.

SecurityResult

JSON representation

{ "about": { object (Noun) }, "category": [ enum (SecurityCategory) ], "categoryDetails": [ string ], "threatName": string, "ruleSet": string, "ruleSetDisplayName": string, "rulesetCategoryDisplayName": string, "ruleId": string, "ruleName": string, "ruleVersion": string, "ruleType": string, "ruleAuthor": string, "ruleLabels": [ { object (Label) } ], "alertState": enum (AlertState), "detectionFields": [ { object (Label) } ], "outcomes": [ { object (Label) } ], "variables": { string: { object (FindingVariable) }, ... }, "summary": string, "description": string, "action": [ enum (Action) ], "actionDetails": string, "severity": enum (ProductSeverity), "confidence": enum (ProductConfidence), "priority": enum (ProductPriority), "riskScore": number, "confidenceScore": number, "analyticsMetadata": [ { object (AnalyticsMetadata) } ], "severityDetails": string, "confidenceDetails": string, "priorityDetails": string, "urlBackToProduct": string, "threatId": string, "threatFeedName": string, "threatIdNamespace": enum (Namespace), "threatStatus": enum (ThreatStatus), "attackDetails": { object (AttackDetails) }, "firstDiscoveredTime": string, "associations": [ { object (Association) } ], "campaigns": [ string ], "reports": [ string ], "verdict": { object (Verdict) }, "lastUpdatedTime": string, "verdictInfo": [ { object (VerdictInfo) } ], "threatVerdict": enum (ThreatVerdict), "lastDiscoveredTime": string, "detectionDepth": string, "threatCollections": [ { object (ThreatCollectionItem) } ] }

Fields
about	object (Noun) If the security result is about a specific entity (Noun), add it here. This field is not populated when the SecurityResult appears in a detection.
category[]	enum (SecurityCategory) The security category. This field is not populated when the SecurityResult appears in a detection.
categoryDetails[]	string For vendor-specific categories. For web categorization, put type in here such as "gambling" or "porn". This field is not populated when the SecurityResult appears in a detection.
threatName	string A vendor-assigned classification common across multiple customers (for example, "W32/File-A", "Slammer"). This field is not populated when the SecurityResult appears in a detection.
ruleSet	string The curated detection's rule set identifier. (for example, "windows-threats") This is primarily set in rule-generated detections and alerts.
ruleSetDisplayName	string The curated detections rule set display name. This is primarily set in rule-generated detections and alerts.
rulesetCategoryDisplayName	string The curated detection rule set category display name. (for example, if rule_set_display_name is "CDIR SCC Enhanced Exfiltration", the rule_set_category is "Cloud Threats"). This is primarily set in rule-generated detections and alerts.
ruleId	string A vendor-specific ID for a rule, varying by observer type (e.g. "08123", "5d2b44d0-5ef6-40f5-a704-47d61d3babbe").
ruleName	string Name of the security rule (e.g. "BlockInboundToOracle").
ruleVersion	string Version of the security rule. (e.g. "v1.1", "00001", "1604709794", "2020-11-16T23:04:19+00:00"). Note that rule versions are source-dependant and lexical ordering should not be assumed.
ruleType	string The type of security rule.
ruleAuthor	string Author of the security rule. This field is not populated when the SecurityResult appears in a detection.
ruleLabels[]	object (Label) A list of rule labels that can't be captured by the other fields in security result (e.g. "reference : AnotherRule", "contributor : John"). This is primarily set in rule-generated detections and alerts.
alertState	enum (AlertState) The alerting types of this security result. This is primarily set for rule-generated detections and alerts.
detectionFields[]	object (Label) An ordered list of values, that represent fields in detections for a security finding. This list represents mapping of names of requested entities to their values (the security result matched variables). For Collection SecurityResults, prefer variables instead.
outcomes[] (deprecated)	object (Label) This item is deprecated! A list of outcomes that represent the results of this security finding. This list represents a mapping of names of the requested outcomes, to a stringified version of their values. This is only populated when the SecurityResult appears in a detection. This is deprecated. Use variables instead.
variables	map (key: string, value: object (FindingVariable)) A list of outcomes and match variables that represent the results of this security finding. This list represents a mapping of names of the requested outcomes or match variables, to their values. This is only populated when the SecurityResult appears in a detection. An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
summary	string A short human-readable summary (e.g. "failed login occurred")
description	string A human-readable description (e.g. "user password was wrong"). This can be more detailed than the summary.
action[]	enum (Action) Actions taken for this event. This field is not populated when the SecurityResult appears in a detection.
actionDetails	string The detail of the action taken as provided by the vendor. This field is not populated when the SecurityResult appears in a detection.
severity	enum (ProductSeverity) The severity of the result.
confidence	enum (ProductConfidence) The confidence level of the result as estimated by the product. This field is not populated when the SecurityResult appears in a detection.
priority	enum (ProductPriority) The priority of the result. This field is not populated when the SecurityResult appears in a detection.
riskScore	number The risk score of the security result.
confidenceScore	number The confidence score of the security result. This field is not populated when the SecurityResult appears in a detection.
analyticsMetadata[]	object (AnalyticsMetadata) Stores metadata about each risk analytic metric the rule uses. This field is not populated when the SecurityResult appears in a detection.
severityDetails	string Vendor-specific severity. This field is not populated when the SecurityResult appears in a detection.
confidenceDetails	string Additional detail with regards to the confidence of a security event as estimated by the product vendor. This field is not populated when the SecurityResult appears in a detection.
priorityDetails	string Vendor-specific information about the security result priority. This field is not populated when the SecurityResult appears in a detection.
urlBackToProduct	string URL that takes the user to the source product console for this event. This field is not populated when the SecurityResult appears in a detection.
threatId	string Vendor-specific ID for a threat. This field is not populated when the SecurityResult appears in a detection.
threatFeedName	string Vendor feed name for a threat indicator feed. This field is not populated when the SecurityResult appears in a detection.
threatIdNamespace	enum (Namespace) The attribute threat_id_namespace qualifies threat_id with an id namespace to get an unique id. The attribute threat_id by itself is not unique across Chronicle as it is a vendor specific id. This field is not populated when the SecurityResult appears in a detection.
threatStatus	enum (ThreatStatus) Current status of the threat This field is not populated when the SecurityResult appears in a detection.
attackDetails	object (AttackDetails) MITRE ATT&CK details. This field is not populated when the SecurityResult appears in a detection.
firstDiscoveredTime	string (Timestamp format) First time the IoC threat was discovered in the provider. This field is not populated when the SecurityResult appears in a detection. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
associations[]	object (Association) Associations related to the threat.
campaigns[] (deprecated)	string This item is deprecated! Campaigns using this IOC threat. This is deprecated. Use threat_collections instead.
reports[] (deprecated)	string This item is deprecated! Reports that reference this IOC threat. These are the report IDs. This is deprecated. Use threat_collections instead.
verdict (deprecated)	object (Verdict) This item is deprecated! Verdict about the IoC from the provider. This field is now deprecated. Use VerdictInfo instead.
lastUpdatedTime	string (Timestamp format) Last time the IoC threat was updated in the provider. This field is not populated when the SecurityResult appears in a detection. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
verdictInfo[]	object (VerdictInfo) Verdict information about the IoC from the provider. This field is not populated when the SecurityResult appears in a detection.
threatVerdict	enum (ThreatVerdict) GCTI threat verdict on the security result entity. This field is not populated when the SecurityResult appears in a detection.
lastDiscoveredTime	string (Timestamp format) Last time the IoC was seen in the provider data. This field is not populated when the SecurityResult appears in a detection. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
detectionDepth	string (int64 format) The depth of the detection chain. Applies only to composite detections.
threatCollections[]	object (ThreatCollectionItem) GTI collections associated with the security result.

VariablesEntry

JSON representation
{ "key": string, "value": { object (FindingVariable) } }

Fields
key	string
value	object (FindingVariable)

FindingVariable

JSON representation

{ "type": enum (Type), "value": string, "sourcePath": string, // Union field typed_value can be only one of the following: "boolVal": boolean, "bytesVal": string, "doubleVal": number, "int64Val": string, "uint64Val": string, "stringVal": string, "timestampTime": string, "nullVal": boolean, "boolSeq": { object (BoolSequence) }, "bytesSeq": { object (BytesSequence) }, "doubleSeq": { object (DoubleSequence) }, "int64Seq": { object (Int64Sequence) }, "uint64Seq": { object (Uint64Sequence) }, "stringSeq": { object (StringSequence) } // End of list of possible types for union field typed_value. }

Fields
type	enum (Type) The type of the variable.
value	string The value in string form.
sourcePath	string The UDM field path for the field which this value was derived from. Example: principal.user.username
Union field typed_value. The typed value of the variable. typed_value can be only one of the following:
boolVal	boolean The value in boolean format.
bytesVal	string (bytes format) The value in bytes format. A base64-encoded string.
doubleVal	number The value in double format.
int64Val	string (int64 format) The value in int64 format.
uint64Val	string The value in uint64 format.
stringVal	string The value in string format. Enum values are returned as strings.
timestampTime	string (Timestamp format) The value in timestamp format. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
nullVal	boolean Whether the value is null.
boolSeq	object (BoolSequence) The value in boolsequence format.
bytesSeq	object (BytesSequence) The value in bytessequence format.
doubleSeq	object (DoubleSequence) The value in doublesequence format.
int64Seq	object (Int64Sequence) The value in int64sequence format.
uint64Seq	object (Uint64Sequence) The value in uint64sequence format.
stringSeq	object (StringSequence) The value in stringsequence format.

BoolSequence

JSON representation
{ "boolVals": [ boolean ] }

Fields
boolVals[]	boolean bool sequence.

BytesSequence

JSON representation
{ "bytesVals": [ string ] }

Fields
bytesVals[]	string (bytes format) bytes sequence. A base64-encoded string.

DoubleSequence

JSON representation
{ "doubleVals": [ number ] }

Fields
doubleVals[]	number double sequence.

Int64Sequence

JSON representation
{ "int64Vals": [ string ] }

Fields
int64Vals[]	string (int64 format) int64 sequence.

Uint64Sequence

JSON representation
{ "uint64Vals": [ string ] }

Fields
uint64Vals[]	string uint64 sequence.

StringSequence

JSON representation
{ "stringVals": [ string ] }

Fields
stringVals[]	string string sequence.

AnalyticsMetadata

JSON representation
{ "analytic": string }

Fields
analytic	string Name of the analytic.

AttackDetails

JSON representation
{ "version": string, "tactics": [ { object (Tactic) } ], "techniques": [ { object (Technique) } ] }

Fields
version	string ATT&CK version (e.g. 12.1).
tactics[]	object (Tactic) Tactics employed.
techniques[]	object (Technique) Techniques employed.

Tactic

JSON representation
{ "id": string, "name": string }

Fields
id	string Tactic ID (e.g. "TA0043").
name	string Tactic Name (e.g. "Reconnaissance")

Technique

JSON representation
{ "id": string, "name": string, "subtechniqueId": string, "subtechniqueName": string }

Fields
id	string Technique ID (e.g. "T1595").
name	string Technique Name (e.g. "Active Scanning").
subtechniqueId	string Subtechnique ID (e.g. "T1595.001").
subtechniqueName	string Subtechnique Name (e.g. "Scanning IP Blocks").

Association

JSON representation

{ "id": string, "countryCode": [ string ], "type": enum (AssociationType), "name": string, "description": string, "role": string, "sourceCountry": string, "alias": [ { object (AssociationAlias) } ], "firstReferenceTime": string, "lastReferenceTime": string, "industriesAffected": [ string ], "associatedActors": [ { object (Association) } ], "regionCode": { object (Location) }, "sponsorRegion": { object (Location) }, "targetedRegions": [ { object (Location) } ], "tags": [ string ] }

Fields
id	string Unique association id generated by mandiant.
countryCode[]	string Country from which the threat actor/ malware is originated.
type	enum (AssociationType) Signifies the type of association.
name	string Name of the threat actor/malware.
description	string Human readable description about the association.
role	string Role of the malware. Not applicable for threat actor.
sourceCountry (deprecated)	string This item is deprecated! Name of the country the threat originated from.
alias[]	object (AssociationAlias) Different aliases of the threat actor given by different sources.
firstReferenceTime	string (Timestamp format) First time the threat actor was referenced or seen. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
lastReferenceTime	string (Timestamp format) Last time the threat actor was referenced or seen. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
industriesAffected[]	string List of industries the threat actor affects.
associatedActors[]	object (Association) List of associated threat actors for a malware. Not applicable for threat actors.
regionCode	object (Location) Name of the country, the threat is originating from.
sponsorRegion	object (Location) Sponsor region of the threat actor.
targetedRegions[]	object (Location) Targeted regions.
tags[]	string Tags.

AssociationAlias

JSON representation
{ "name": string, "company": string }

Fields
name	string Name of the alias.
company	string Name of the provider who gave the association's name.

Verdict

JSON representation
{ "sourceCount": integer, "responseCount": integer, "neighbourInfluence": string, "verdict": { object (ProviderMLVerdict) }, "analystVerdict": { object (AnalystVerdict) } }

Fields
sourceCount	integer Number of sources from which intelligence was extracted.
responseCount	integer Total response count across all sources.
neighbourInfluence	string Describes the neighbour influence of the verdict.
verdict	object (ProviderMLVerdict) ML Verdict provided by sources like Mandiant.
analystVerdict	object (AnalystVerdict) Human analyst verdict provided by sources like Mandiant.

ProviderMLVerdict

JSON representation
{ "sourceProvider": string, "benignCount": integer, "maliciousCount": integer, "confidenceScore": integer, "mandiantSources": [ { object (Source) } ], "thirdPartySources": [ { object (Source) } ] }

Fields
sourceProvider	string Source provider giving the ML verdict.
benignCount	integer Count of responses where this IoC was marked benign.
maliciousCount	integer Count of responses where this IoC was marked malicious.
confidenceScore	integer Confidence score of the verdict.
mandiantSources[]	object (Source) List of mandiant sources from which the verdict was generated.
thirdPartySources[]	object (Source) List of third-party sources from which the verdict was generated.

Source

JSON representation
{ "name": string, "benignCount": integer, "maliciousCount": integer, "quality": enum (ProductConfidence), "responseCount": integer, "sourceCount": integer, "threatIntelligenceSources": [ { object (Source) } ] }

Fields
name	string Name of the IoC source.
benignCount	integer Count of responses where this IoC was marked benign.
maliciousCount	integer Count of responses where this IoC was marked malicious.
quality	enum (ProductConfidence) Quality of the IoC mapping extracted from the source.
responseCount	integer Total response count from this source.
sourceCount	integer Number of sources from which intelligence was extracted.
threatIntelligenceSources[]	object (Source) Different threat intelligence sources from which IoC info was extracted.

AnalystVerdict

JSON representation
{ "confidenceScore": integer, "verdictTime": string, "verdictResponse": enum (VerdictResponse) }

Fields
confidenceScore	integer Confidence score of the verdict.
verdictTime	string (Timestamp format) Timestamp at which the verdict was generated. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
verdictResponse	enum (VerdictResponse) Details of the verdict.

VerdictInfo

JSON representation

{ "sourceCount": integer, "responseCount": integer, "neighbourInfluence": string, "verdictType": enum (VerdictType), "sourceProvider": string, "benignCount": integer, "maliciousCount": integer, "confidenceScore": integer, "iocStats": [ { object (IoCStats) } ], "verdictTime": string, "verdictResponse": enum (VerdictResponse), "globalCustomerCount": integer, "globalHitsCount": integer, "pwn": boolean, "categoryDetails": string, "pwnFirstTaggedTime": string }

Fields
sourceCount	integer Number of sources from which intelligence was extracted.
responseCount	integer Total response count across all sources.
neighbourInfluence	string Describes the near neighbor influence of the verdict.
verdictType	enum (VerdictType) Type of verdict.
sourceProvider	string Source provider giving the machine learning verdict.
benignCount	integer Count of responses where this IoC was marked as benign.
maliciousCount	integer Count of responses where this IoC was marked as malicious.
confidenceScore	integer Confidence score of the verdict.
iocStats[]	object (IoCStats) List of IoCStats from which the verdict was generated.
verdictTime	string (Timestamp format) Timestamp when the verdict was generated. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
verdictResponse	enum (VerdictResponse) Details about the verdict.
globalCustomerCount	integer Global customer count over the last 30 days
globalHitsCount	integer Global hit count over the last 30 days.
pwn	boolean Whether one or more Mandiant incident response customers had this indicator in their environment.
categoryDetails	string Tags related to the verdict.
pwnFirstTaggedTime	string (Timestamp format) The timestamp of the first time a pwn was associated to this entity. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".

IoCStats

JSON representation
{ "iocStatsType": enum (IoCStatsType), "firstLevelSource": string, "secondLevelSource": string, "benignCount": integer, "quality": enum (ProductConfidence), "maliciousCount": integer, "responseCount": integer, "sourceCount": integer }

Fields
iocStatsType	enum (IoCStatsType) Describes the source of the IoCStat.
firstLevelSource	string Name of first level IoC source, for example Mandiant or a third-party.
secondLevelSource	string Name of the second-level IoC source, for example Crowdsourced Threat Analysis or Knowledge Graph.
benignCount	integer Count of responses where the IoC was identified as benign.
quality	enum (ProductConfidence) Level of confidence in the IoC mapping extracted from the source.
maliciousCount	integer Count of responses where the IoC was identified as malicious.
responseCount	integer Total number of response from the source.
sourceCount	integer Number of sources from which information was extracted.

ThreatCollectionItem

JSON representation
{ "id": string, "type": enum (ThreatCollectionType), "altNames": [ string ] }

Fields
id	string The ID of the threat collection.
type	enum (ThreatCollectionType) The type of threat collection (e.g., "campaign").
altNames[]	string The name of the threat collection.

FileMetadataPE

JSON representation

{ "imphash": string, "entryPoint": string, "entryPointExiftool": string, "compilationTime": string, "compilationExiftoolTime": string, "section": [ { object (FileMetadataSection) } ], "imports": [ { object (FileMetadataImports) } ], "resource": [ { object (FileMetadataPeResourceInfo) } ], "resourcesTypeCount": [ { object (StringToInt64MapEntry) } ], "resourcesLanguageCount": [ { object (StringToInt64MapEntry) } ], "resourcesTypeCountStr": [ { object (Label) } ], "resourcesLanguageCountStr": [ { object (Label) } ], "signatureInfo": { object (FileMetadataSignatureInfo) } }

Fields
imphash	string Imphash of the file.
entryPoint	string (int64 format) info.pe-entry-point.
entryPointExiftool	string (int64 format) info.exiftool.EntryPoint.
compilationTime	string (Timestamp format) info.pe-timestamp. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
compilationExiftoolTime	string (Timestamp format) info.exiftool.TimeStamp. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
section[]	object (FileMetadataSection) FilemetadataSection fields.
imports[]	object (FileMetadataImports) FilemetadataImports fields.
resource[]	object (FileMetadataPeResourceInfo) FilemetadataPeResourceInfo fields.
resourcesTypeCount[] (deprecated)	object (StringToInt64MapEntry) This item is deprecated! Deprecated: use resources_type_count_str.
resourcesLanguageCount[] (deprecated)	object (StringToInt64MapEntry) This item is deprecated! Deprecated: use resources_language_count_str.
resourcesTypeCountStr[]	object (Label) Number of resources by resource type. Example: RT_ICON: 10, RT_DIALOG: 5
resourcesLanguageCountStr[]	object (Label) Number of resources by language. Example: NEUTRAL: 20, ENGLISH US: 10
signatureInfo (deprecated)	object (FileMetadataSignatureInfo) This item is deprecated! FilemetadataSignatureInfo field. deprecated, user File.signature_info instead.

FileMetadataSection

JSON representation
{ "name": string, "entropy": number, "rawSizeBytes": string, "virtualSizeBytes": string, "md5Hex": string }

Fields
name	string Name of the section.
entropy	number Entropy of the section.
rawSizeBytes	string (int64 format) Raw file size in bytes.
virtualSizeBytes	string (int64 format) Virtual file size in bytes.
md5Hex	string MD5 hex of the file.

FileMetadataImports

JSON representation
{ "library": string, "functions": [ string ] }

Fields
library	string Library field.
functions[]	string Function field.

FileMetadataPeResourceInfo

JSON representation
{ "sha256Hex": string, "filetypeMagic": string, "languageCode": string, "entropy": number, "fileType": string }

Fields
sha256Hex	string SHA256_hex field..
filetypeMagic	string Type of resource content, as identified by the magic Python module.
languageCode	string Human-readable version of the language and sublanguage identifiers, as defined in the Microsoft Windows PE specification. Examples: | Language | Sublanguage | Field value | | LANG_NEUTRAL | SUBLANG_NEUTRAL | NEUTRAL | | LANG_FRENCH | - | FRENCH | | LANG_ENGLISH | SUBLANG_ENGLISH US | ENGLISH US |
entropy	number Entropy of the resource.
fileType	string File type. Note that this value may not match any of the well-known type identifiers defined in the ResourceType enum.

StringToInt64MapEntry

JSON representation
{ // Union field _key can be only one of the following: "key": string // End of list of possible types for union field _key. // Union field _value can be only one of the following: "value": string // End of list of possible types for union field _value. }

Fields
Union field _key. _key can be only one of the following:
key	string Key field.
Union field _value. _value can be only one of the following:
value	string (int64 format) Value field.

FileMetadataSignatureInfo

JSON representation
{ "verificationMessage": string, "verified": boolean, "signer": [ string ], "signers": [ { object (SignerInfo) } ], "x509": [ { object (X509) } ] }

Fields
verificationMessage	string Status of the certificate. Valid values are "Signed", "Unsigned" or a description of the certificate anomaly, if found.
verified	boolean True if verification_message == "Signed"
signer[] (deprecated)	string This item is deprecated! Deprecated: use signers field.
signers[]	object (SignerInfo) File metadata signer information. The order of the signers matters. Each element is a higher level authority, being the last the root authority.
x509[]	object (X509) List of certificates.

SignerInfo

JSON representation

{ // Union field _name can be only one of the following: "name": string // End of list of possible types for union field _name. // Union field _status can be only one of the following: "status": string // End of list of possible types for union field _status. // Union field _valid_usage can be only one of the following: "validUsage": string // End of list of possible types for union field _valid_usage. // Union field _cert_issuer can be only one of the following: "certIssuer": string // End of list of possible types for union field _cert_issuer. }

Fields
Union field _name. _name can be only one of the following:
name	string Common name of the signers/certificate. The order of the signers matters. Each element is a higher level authority, the last being the root authority.
Union field _status. _status can be only one of the following:
status	string It can say "Valid" or state the problem with the certificate if any (e.g. "This certificate or one of the certificates in the certificate chain is not time valid.").
Union field _valid_usage. _valid_usage can be only one of the following:
validUsage	string Indicates which situations the certificate is valid for (e.g. "Code Signing").
Union field _cert_issuer. _cert_issuer can be only one of the following:
certIssuer	string Company that issued the certificate.

X509

JSON representation
{ "name": string, "algorithm": string, "thumbprint": string, "certIssuer": string, "serialNumber": string }

Fields
name	string Certificate name.
algorithm	string Certificate algorithm.
thumbprint	string Certificate thumbprint.
certIssuer	string Issuer of the certificate.
serialNumber	string Certificate serial number.

PrefetchFileMetadata

JSON representation
{ "runCount": string, "prefetchHash": string }

Fields
runCount	string (int64 format) The number of times the application has been run.
prefetchHash	string A hash of the executable path used to identify the prefetch file.

ExifInfo

JSON representation
{ "originalFile": string, "product": string, "company": string, "fileDescription": string, "entryPoint": string, "compilationTime": string }

Fields
originalFile	string original file name.
product	string product name.
company	string company name.
fileDescription	string description of a file.
entryPoint	string (int64 format) entry point.
compilationTime	string (Timestamp format) Compilation time. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".

SignatureInfo

JSON representation
{ "sigcheck": { object (FileMetadataSignatureInfo) }, "codesign": { object (FileMetadataCodesign) } }

Fields
sigcheck	object (FileMetadataSignatureInfo) Signature information extracted from the sigcheck tool.
codesign	object (FileMetadataCodesign) Signature information extracted from the codesign utility.

FileMetadataCodesign

JSON representation
{ "id": string, "format": string, "compilationTime": string, "teamId": string }

Fields
id	string Code sign identifier.
format	string Code sign format.
compilationTime	string (Timestamp format) Code sign timestamp Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
teamId	string The assigned team identifier of the developer who signed the application.

PDFInfo

JSON representation

{ "js": string, "javascript": string, "launchActionCount": string, "objectStreamCount": string, "endobjCount": string, "header": string, "acroform": string, "autoaction": string, "embeddedFile": string, "encrypted": string, "flash": string, "jbig2Compression": string, "objCount": string, "endstreamCount": string, "pageCount": string, "streamCount": string, "openaction": string, "startxref": string, "suspiciousColors": string, "trailer": string, "xfa": string, "xref": string }

Fields
js	string (int64 format) Number of /JS tags found in the PDF file. Should be the same as javascript field in normal scenarios.
javascript	string (int64 format) Number of /JavaScript tags found in the PDF file. Should be the same as the js field in normal scenarios.
launchActionCount	string (int64 format) Number of /Launch tags found in the PDF file.
objectStreamCount	string (int64 format) Number of object streams.
endobjCount	string (int64 format) Number of object definitions (endobj keyword).
header	string PDF version.
acroform	string (int64 format) Number of /AcroForm tags found in the PDF.
autoaction	string (int64 format) Number of /AA tags found in the PDF.
embeddedFile	string (int64 format) Number of /EmbeddedFile tags found in the PDF.
encrypted	string (int64 format) Whether the document is encrypted or not. This is defined by the /Encrypt tag.
flash	string (int64 format) Number of /RichMedia tags found in the PDF.
jbig2Compression	string (int64 format) Number of /JBIG2Decode tags found in the PDF.
objCount	string (int64 format) Number of objects definitions (obj keyword).
endstreamCount	string (int64 format) Number of defined stream objects (stream keyword).
pageCount	string (int64 format) Number of pages in the PDF.
streamCount	string (int64 format) Number of defined stream objects (stream keyword).
openaction	string (int64 format) Number of /OpenAction tags found in the PDF.
startxref	string (int64 format) Number of startxref keywords in the PDF.
suspiciousColors	string (int64 format) Number of colors expressed with more than 3 bytes (CVE-2009-3459).
trailer	string (int64 format) Number of trailer keywords in the PDF.
xfa	string (int64 format) Number of \XFA tags found in the PDF.
xref	string (int64 format) Number of xref keywords in the PDF.

NtfsFileMetadata

JSON representation
{ "changeTime": string, "filenameCreateTime": string, "filenameModifyTime": string, "filenameAccessTime": string, "filenameChangeTime": string, "usnJournal": [ { object (UsnJournal) } ] }

Fields
changeTime	string (Timestamp format) NTFS MFT entry changed timestamp. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
filenameCreateTime	string (Timestamp format) NTFS $FILE_NAME attribute created timestamp. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
filenameModifyTime	string (Timestamp format) NTFS $FILE_NAME attribute modified timestamp. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
filenameAccessTime	string (Timestamp format) NTFS $FILE_NAME attribute accessed timestamp. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
filenameChangeTime	string (Timestamp format) NTFS $FILE_NAME attribute changed timestamp. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
usnJournal[]	object (UsnJournal) NTFS USN journal.

UsnJournal

JSON representation
{ "attributesFlag": string, "attributes": enum (Attribute), "fileAttributes": [ enum (Attribute) ], "allocated": boolean, "reason": enum (Reason) }

Fields
attributesFlag	string File attributes flags from the USN record (e.g., "0x20").
attributes (deprecated)	enum (Attribute) This item is deprecated! Deprecated: Use file_attributes instead. File attributes from the USN record.
fileAttributes[]	enum (Attribute) File attributes from the USN record.
allocated	boolean Indicates whether the file is allocated in the Master File Table (MFT).
reason	enum (Reason) Human-readable string describing the reason for the USN journal entry (e.g., "USN_REASON_FILE_CREATE").

AppCompatMetadata

JSON representation
{ "sequence": integer, "executed": boolean, "controlSet": string }

Fields
sequence	integer Indicates the chronological order in which the entry was added to the cache.
executed	boolean Indicates whether the file associated with the entry was executed.
controlSet	string Indicates which registry Control Set the AppCompatCache data belongs to (e.g., "ControlSet001").

Asset

JSON representation

{ "productObjectId": string, "hostname": string, "assetId": string, "ip": [ string ], "mac": [ string ], "natIp": [ string ], "firstSeenTime": string, "hardware": [ { object (Hardware) } ], "platformSoftware": { object (PlatformSoftware) }, "software": [ { object (Software) } ], "location": { object (Location) }, "category": string, "type": enum (AssetType), "networkDomain": string, "creationTime": string, "firstDiscoverTime": string, "lastDiscoverTime": string, "systemLastUpdateTime": string, "lastBootTime": string, "labels": [ { object (Label) } ], "deploymentStatus": enum (DeploymentStatus), "vulnerabilities": [ { object (Vulnerability) } ], "attribute": { object (Attribute) }, "wmiPersistenceItem": { object (WmiPersistenceItem) } }

Fields
productObjectId	string A vendor-specific identifier to uniquely identify the entity (a GUID or similar). This field can be used as an entity indicator for asset entities.
hostname	string Asset hostname or domain name field. This field can be used as an entity indicator for asset entities.
assetId	string The asset ID. Value must contain the ':' character. For example, cs:abcdd23434. This field can be used as an entity indicator for asset entities.
ip[]	string A list of IP addresses associated with an asset. This field can be used as an entity indicator for asset entities.
mac[]	string List of MAC addresses associated with an asset. This field can be used as an entity indicator for asset entities.
natIp[]	string List of NAT IP addresses associated with an asset.
firstSeenTime	string (Timestamp format) The first observed time for an asset. The value is calculated on the basis of the first time the identifier was observed. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
hardware[]	object (Hardware) The asset hardware specifications.
platformSoftware	object (PlatformSoftware) The asset operating system platform software.
software[]	object (Software) The asset software details.
location	object (Location) Location of the asset.
category	string The category of the asset (e.g. "End User Asset", "Workstation", "Server").
type	enum (AssetType) The type of the asset (e.g. workstation or laptop or server).
networkDomain	string The network domain of the asset (e.g. "corp.acme.com")
creationTime (deprecated)	string (Timestamp format) This item is deprecated! Time the asset was created or provisioned. Deprecate: creation_time should be populated in Attribute as generic metadata. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
firstDiscoverTime	string (Timestamp format) Time the asset was first discovered (by asset management/discoverability software). Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
lastDiscoverTime	string (Timestamp format) Time the asset was last discovered (by asset management/discoverability software). Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
systemLastUpdateTime	string (Timestamp format) Time the asset system or OS was last updated. For all other operations that are not system updates (such as resizing a VM), use Attribute.last_update_time. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
lastBootTime	string (Timestamp format) Time the asset was last boot started. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
labels[] (deprecated)	object (Label) This item is deprecated! Metadata labels for the asset. Deprecated: labels should be populated in Attribute as generic metadata.
deploymentStatus	enum (DeploymentStatus) The deployment status of the asset for device lifecycle purposes.
vulnerabilities[]	object (Vulnerability) Vulnerabilities discovered on asset.
attribute	object (Attribute) Generic entity metadata attributes of the asset.
wmiPersistenceItem	object (WmiPersistenceItem) Information about a WMI persistence item.

Hardware

JSON representation
{ "serialNumber": string, "manufacturer": string, "model": string, "cpuPlatform": string, "cpuModel": string, "cpuClockSpeed": string, "cpuMaxClockSpeed": string, "cpuNumberCores": string, "ram": string }

Fields
serialNumber	string Hardware serial number.
manufacturer	string Hardware manufacturer.
model	string Hardware model.
cpuPlatform	string Platform of the hardware CPU (e.g. "Intel Broadwell").
cpuModel	string Model description of the hardware CPU (e.g. "2.8 GHz Quad-Core Intel Core i5").
cpuClockSpeed	string Clock speed of the hardware CPU in MHz.
cpuMaxClockSpeed	string Maximum possible clock speed of the hardware CPU in MHz.
cpuNumberCores	string Number of CPU cores.
ram	string Amount of the hardware ramdom access memory (RAM) in Mb.

PlatformSoftware

JSON representation
{ "platform": enum (Platform), "platformVersion": string, "platformPatchLevel": string }

Fields
platform	enum (Platform) The platform operating system.
platformVersion	string The platform software version ( e.g. "Microsoft Windows 1803").
platformPatchLevel	string The platform software patch level ( e.g. "Build 17134.48", "SP1").

Software

JSON representation
{ "name": string, "version": string, "permissions": [ { object (Permission) } ], "description": string, "vendorName": string }

Fields
name	string The name of the software.
version	string The version of the software.
permissions[]	object (Permission) System permissions granted to the software. For example, "android.permission.WRITE_EXTERNAL_STORAGE"
description	string The description of the software.
vendorName	string The name of the software vendor.

Vulnerability

JSON representation

{ "about": { object (Noun) }, "name": string, "description": string, "vendor": string, "scanStartTime": string, "scanEndTime": string, "firstFound": string, "lastFound": string, "severity": enum (Severity), "severityDetails": string, "cvssBaseScore": number, "cvssVector": string, "cvssVersion": string, "cveId": string, "cveDescription": string, "vendorVulnerabilityId": string, "vendorKnowledgeBaseArticleId": string }

Fields
about	object (Noun) If the vulnerability is about a specific noun (e.g. executable), then add it here.
name	string Name of the vulnerability (e.g. "Unsupported OS Version detected").
description	string Description of the vulnerability.
vendor	string Vendor of scan that discovered vulnerability.
scanStartTime	string (Timestamp format) If the vulnerability was discovered during an asset scan, then this field should be populated with the time the scan started. This field can be left unset if the start time is not available or not applicable. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
scanEndTime	string (Timestamp format) If the vulnerability was discovered during an asset scan, then this field should be populated with the time the scan ended. This field can be left unset if the end time is not available or not applicable. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
firstFound	string (Timestamp format) Products that maintain a history of vuln scans should populate first_found with the time that a scan first detected the vulnerability on this asset. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
lastFound	string (Timestamp format) Products that maintain a history of vuln scans should populate last_found with the time that a scan last detected the vulnerability on this asset. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
severity	enum (Severity) The severity of the vulnerability.
severityDetails	string Vendor-specific severity
cvssBaseScore	number CVSS Base Score in the range of 0.0 to 10.0. Useful for sorting.
cvssVector	string Vector of CVSS properties (e.g. "AV:L/AC:H/Au:N/C:N/I:P/A:C") Can be linked to via: https://nvd.nist.gov/vuln-metrics/cvss/v2-calculator
cvssVersion	string Version of CVSS Vector/Score.
cveId	string Common Vulnerabilities and Exposures Id. https://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures https://cve.mitre.org/about/faqs.html#what_is_cve_id
cveDescription	string Common Vulnerabilities and Exposures Description. https://cve.mitre.org/about/faqs.html#what_is_cve_record
vendorVulnerabilityId	string Vendor specific vulnerability id (e.g. Microsoft security bulletin id).
vendorKnowledgeBaseArticleId	string Vendor specific knowledge base article (e.g. "KBXXXXXX" from Microsoft). https://en.wikipedia.org/wiki/Microsoft_Knowledge_Base https://access.redhat.com/knowledgebase

WmiPersistenceItem

JSON representation
{ "caption": string, "name": string, "settingId": string, "derivation": string, "propertyCount": string, "relPath": string, "dynasty": string, "wmiSuperClass": string, "wmiClass": string, "genus": string }

Fields
caption	string A brief title or caption for the WMI object.
name	string The name of the WMI object.
settingId	string The identifier for the setting.
derivation	string The base class from which the WMI class is derived (e.g., CIM_Setting).
propertyCount	string (int64 format) The number of properties in the WMI object.
relPath	string The relative path to the WMI object (e.g., Win32_StartupCommand.Command=''').
dynasty	string The top-level class in the WMI inheritance hierarchy (e.g., CMI_Setting).
wmiSuperClass	string The immediate parent class in the WMI inheritance hierarchy.
wmiClass	string The name of the WMI class.
genus	string (int64 format) An integer representing the type or version of the WMI object.

Registry

JSON representation
{ "registryKey": string, "registryValueName": string, "registryValueData": string, "registryValueType": enum (Type), "registryValueBinaryData": string }

Fields
registryKey	string Registry key associated with an application or system component (e.g., HKEY_, HKCU\Environment...).
registryValueName	string Name of the registry value associated with an application or system component (e.g. TEMP).
registryValueData	string Data associated with a registry value (e.g. %USERPROFILE%\Local Settings\Temp).
registryValueType	enum (Type) Type of the registry value.
registryValueBinaryData	string (bytes format) Binary data associated with a registry value. This field is only populated if the registry value type is BINARY. This field is not populated for other registry value types. A base64-encoded string.

Id

JSON representation
{ "namespace": enum (Namespace), "id": string, "stringId": string }

Fields
namespace	enum (Namespace) Namespace the id belongs to.
id	string (bytes format) Full raw ID. A base64-encoded string.
stringId	string Some ids are stored as strings that are not able to be translated to bytes, so store these separately. Ex. detection id of the form de_aaaaaaaa-aaaa...

Investigation

JSON representation

{ "comments": [ string ], // Union field _verdict can be only one of the following: "verdict": enum (Verdict) // End of list of possible types for union field _verdict. // Union field _reputation can be only one of the following: "reputation": enum (Reputation) // End of list of possible types for union field _reputation. // Union field _severity_score can be only one of the following: "severityScore": integer // End of list of possible types for union field _severity_score. // Union field _status can be only one of the following: "status": enum (Status) // End of list of possible types for union field _status. // Union field _priority can be only one of the following: "priority": enum (Priority) // End of list of possible types for union field _priority. // Union field _root_cause can be only one of the following: "rootCause": string // End of list of possible types for union field _root_cause. // Union field _reason can be only one of the following: "reason": enum (Reason) // End of list of possible types for union field _reason. // Union field _risk_score can be only one of the following: "riskScore": integer // End of list of possible types for union field _risk_score. // Union field _id can be only one of the following: "id": string // End of list of possible types for union field _id. }

Fields
comments[]	string Comment added by the Analyst.
Union field _verdict. _verdict can be only one of the following:
verdict	enum (Verdict) Describes reason a finding investigation was resolved.
Union field _reputation. _reputation can be only one of the following:
reputation	enum (Reputation) Describes whether a finding was useful or not-useful.
Union field _severity_score. _severity_score can be only one of the following:
severityScore	integer (uint32 format) Severity score for a finding set by an analyst.
Union field _status. _status can be only one of the following:
status	enum (Status) Describes the workflow status of a finding.
Union field _priority. _priority can be only one of the following:
priority	enum (Priority) Priority of the Alert or Finding set by analyst.
Union field _root_cause. _root_cause can be only one of the following:
rootCause	string Root cause of the Alert or Finding set by analyst.
Union field _reason. _reason can be only one of the following:
reason	enum (Reason) Reason for closing the Case or Alert.
Union field _risk_score. _risk_score can be only one of the following:
riskScore	integer (uint32 format) Risk score for a finding set by an analyst.
Union field _id. _id can be only one of the following:
id	string Identifier for the investigation

Extensions

JSON representation

{ "auth": { object (Authentication) }, "vulns": { object (Vulnerabilities) }, "entityRisk": { object (EntityRisk) }, "linuxUtmp": { object (LinuxUtmp) }, "windowsEventLog": { object (WindowsEventLog) }, "resourceUsage": { object (ResourceUsage) }, "systemEventDetails": { object (SystemEventDetails) }, "outlookMetadata": { object (OutlookMetadata) }, "srum": { object (Srum) }, "userAssist": { object (UserAssist) } }

Fields
auth	object (Authentication) An authentication extension.
vulns	object (Vulnerabilities) A vulnerability extension.
entityRisk	object (EntityRisk) An entity risk change extension.
linuxUtmp	object (LinuxUtmp) A Linux Utmp extension. This captures details specific to Linux Utmp events, which record login and logout sessions on a Linux system.
windowsEventLog	object (WindowsEventLog) A Windows Event Log extension. This captures details specific to Windows Event Log events, providing structured information from various Windows logs.
resourceUsage	object (ResourceUsage) A resource usage extension. This captures details about what entity (e.g., process, user) is using a specific resource.
systemEventDetails	object (SystemEventDetails) A system event details extension. This captures additional details for system-level events, such as message type, sender image ID, and subsystem.
outlookMetadata	object (OutlookMetadata) A Microsoft Outlook specific metadata extension. This includes metadata related to Outlook items, such as comments, templates, and security flags.
srum	object (Srum) A SRUM extension. This captures details specific to Windows System Resource Usage Monitor (SRUM) events, providing insights into application resource consumption.
userAssist	object (UserAssist) A UserAssist extension. This captures details specific to Windows User Assist events, which track application usage and execution.

Authentication

JSON representation
{ "type": enum (AuthType), "mechanism": [ enum (Mechanism) ], "authDetails": string, "outcome": enum (Outcome) }

Fields
type	enum (AuthType) The type of authentication.
mechanism[]	enum (Mechanism) The authentication mechanism.
authDetails	string The vendor defined details of the authentication.
outcome	enum (Outcome) The outcome of the authentication event.

Vulnerabilities

JSON representation
{ "vulnerabilities": [ { object (Vulnerability) } ] }

Fields
vulnerabilities[]	object (Vulnerability) A list of vulnerabilities.

EntityRisk

JSON representation

{ "riskVersion": string, "riskWindow": { object (Interval) }, "DEPRECATEDRiskScore": integer, "detectionsCount": integer, "firstDetectionTime": string, "lastDetectionTime": string, "riskScore": number, "normalizedRiskScore": integer, "riskWindowSize": string, "lastResetTime": string, "detailUri": string, "riskWindowHasNewDetections": boolean, // Union field _risk_delta can be only one of the following: "riskDelta": { object (RiskDelta) } // End of list of possible types for union field _risk_delta. // Union field _raw_risk_delta can be only one of the following: "rawRiskDelta": { object (RiskDelta) } // End of list of possible types for union field _raw_risk_delta. }

Fields
riskVersion	string Version of the risk score calculation algorithm.
riskWindow	object (Interval) Time window used when computing the risk score for an entity, for example 24 hours or 7 days.
DEPRECATEDRiskScore (deprecated)	integer This item is deprecated! Deprecated risk score.
detectionsCount	integer Number of detections that make up the risk score within the time window.
firstDetectionTime	string (Timestamp format) Timestamp of the first detection within the specified time window. This field is empty when there are no detections. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
lastDetectionTime	string (Timestamp format) Timestamp of the last detection within the specified time window. This field is empty when there are no detections. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
riskScore	number Raw risk score for the entity.
normalizedRiskScore	integer Normalized risk score for the entity. This value is between 0-1000.
riskWindowSize	string (Duration format) Risk window duration for the entity. A duration in seconds with up to nine fractional digits, ending with 's'. Example: "3.5s".
lastResetTime	string (Timestamp format) Timestamp for UEBA risk score reset based deduplication. Used specifically for risk based meta rules. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
detailUri	string Link to the Google Security Operations UI with information about the entity risk score. If the SecOps instance has multiple frontend paths configured, this will be a relative path that can be used to construct the full URL.
riskWindowHasNewDetections	boolean Whether there are new detections for the risk window.
Union field _risk_delta. _risk_delta can be only one of the following:
riskDelta	object (RiskDelta) Represents the change in risk score for an entity between the end of the previous time window and the end of the current time window.
Union field _raw_risk_delta. _raw_risk_delta can be only one of the following:
rawRiskDelta	object (RiskDelta) Represents the change in raw risk score for an entity between the end of the previous time window and the end of the current time window.

RiskDelta

JSON representation
{ "previousRangeEndTime": string, "riskScoreDelta": integer, "previousRiskScore": integer, "riskScoreNumericDelta": integer }

Fields
previousRangeEndTime	string (Timestamp format) End time of the previous time window. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
riskScoreDelta	integer Difference in the normalized risk score from the previous recorded value.
previousRiskScore	integer Risk score from previous risk window
riskScoreNumericDelta	integer Numeric change between current and previous risk score

LinuxUtmp

JSON representation
{ "recordType": enum (RecordType) }

Fields
recordType	enum (RecordType) The activity record type.

WindowsEventLog

JSON representation
{ "channel": enum (Channel), "eventId": string, "activityId": string }

Fields
channel	enum (Channel) The channel of the event.
eventId	string A unique identifier for a specific type of event.
activityId	string A GUID (Globally Unique Identifier) used to link a sequence of related events together.

ResourceUsage

JSON representation
{ "usedEntity": string, "usedEntityId": string }

Fields
usedEntity	string The name of the entity (e.g., process, user) that is using the resource.
usedEntityId	string A numerical identifier for the entity using the resource (e.g., PID, UID).

SystemEventDetails

JSON representation
{ "messageType": string, "senderImageId": string, "subsystem": string }

Fields
messageType	string The specific type or category of the message.
senderImageId	string An identifier for the image associated with the sender of the message.
subsystem	string The subsystem or component that generated the event.

OutlookMetadata

JSON representation
{ "comment": string, "template": string, "title": string, "securityFlagsCount": integer }

Fields
comment	string A user-defined comment or note associated with the Outlook item.
template	string The name of the template file used to create the Outlook item.
title	string The title of the Outlook item.
securityFlagsCount	integer Count of Security-related flags for the message, such as encryption or signing status.

Srum

JSON representation
{ "id": string, "backgroundBytesRead": string, "backgroundBytesWritten": string, "backgroundContextSwitches": string, "backgroundCycleCount": string, "backgroundFlushesCount": string, "backgroundReadOperations": string, "backgroundWriteOperations": string, "interfaceLuid": string }

Fields
id	string A unique identifier for the SRUM record or the application/user being monitored.
backgroundBytesRead	string (int64 format) The number of bytes read by the application while running in the background.
backgroundBytesWritten	string (int64 format) The number of bytes written by the application while running in the background.
backgroundContextSwitches	string (int64 format) The number of context switches performed by the application's threads while in the background.
backgroundCycleCount	string (int64 format) The amount of CPU cycle time consumed by the application in the background, measured in clock cycles.
backgroundFlushesCount	string (int64 format) The number of flush operations performed by the application in the background.
backgroundReadOperations	string (int64 format) The number of read operations performed by the application in the background.
backgroundWriteOperations	string (int64 format) The number of write operations performed by the application in the background.
interfaceLuid	string The Locally Unique Identifier (LUID) for the network interface used for data transfer.

UserAssist

JSON representation
{ "applicationFocusCount": string, "applicationFocusDuration": string, "executionsCount": string, "entryIndex": string }

Fields
applicationFocusCount	string (int64 format) The number of times the application associated with the entry gained focus.
applicationFocusDuration	string (Duration format) The total duration the application associated with the entry was in focus. A duration in seconds with up to nine fractional digits, ending with 's'. Example: "3.5s".
executionsCount	string (int64 format) The number of times the application associated with the entry has been executed.
entryIndex	string (int64 format) The index or identifier of the user assist entry, unique per user.

StatsData

JSON representation
{ "results": [ { object (StatsColumnData) } ], "tooManyResults": boolean, "hasJoin": boolean, "hasDataTable": boolean }

Fields
results[]	object (StatsColumnData) Result rows that are queried.
tooManyResults	boolean If true, there are too many results to return and some have been omitted.
hasJoin	boolean Indicates to the frontend that the result is a join-stats result.
hasDataTable	boolean Indicates to the frontend that the result contains a data-table.

StatsColumnData

JSON representation
{ "column": string, "values": [ { object (StatsColumnType) } ] }

Fields
column	string Used to store column names.
values[]	object (StatsColumnType) Store list of values in a column.

StatsColumnType

JSON representation
{ // Union field type can be only one of the following: "value": { object (StatsColumnValue) }, "list": { object (StatsList) } // End of list of possible types for union field type. }

Fields
Union field type. Store single value or list of values in a column. type can be only one of the following:
value	object (StatsColumnValue) Single value in a column.
list	object (StatsList) List of values in a column e.g. IPs

StatsColumnValue

JSON representation
{ // Union field value can be only one of the following: "nullVal": boolean, "boolVal": boolean, "bytesVal": string, "doubleVal": number, "int64Val": string, "uint64Val": string, "stringVal": string, "timestampVal": string, "dateVal": { object (Date) }, "protoVal": { "@type": string, field1: ..., ... } // End of list of possible types for union field value. }

Fields
Union field value. Value of the column based on data type value can be only one of the following:
nullVal	boolean True if the value is NULL.
boolVal	boolean Boolean value.
bytesVal	string (bytes format) Bytes value. A base64-encoded string.
doubleVal	number Double value.
int64Val	string (int64 format) Integer value (signed).
uint64Val	string Un-signed integer value.
stringVal	string String value. Enum values are returned as strings.
timestampVal	string (Timestamp format) Timestamp values. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
dateVal	object (Date) Date values.
protoVal	object For any proto values that are not any of the above. An object containing fields of an arbitrary type. An additional field "@type" contains a URI identifying the type. Example: { "id": 1234, "@type": "types.example.com/standard/id" }.

Date

JSON representation
{ "year": integer, "month": integer, "day": integer }

Fields
year	integer Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.
month	integer Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.
day	integer Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

Any

JSON representation
{ "typeUrl": string, "value": string }

Fields
typeUrl	string A URL/resource name that uniquely identifies the type of the serialized protocol buffer message. This string must contain at least one "/" character. The last segment of the URL's path must represent the fully qualified name of the type (as in path/google.protobuf.Duration). The name should be in a canonical form (e.g., leading "." is not accepted). In practice, teams usually precompile into the binary all types that they expect it to use in the context of Any. However, for URLs which use the scheme http, https, or no scheme, one can optionally set up a type server that maps type URLs to message definitions as follows: If no scheme is provided, https is assumed. An HTTP GET on the URL must yield a google.protobuf.Type value in binary format, or produce an error. Applications are allowed to cache lookup results based on the URL, or have them precompiled into a binary to avoid any lookup. Therefore, binary compatibility needs to be preserved on changes to types. (Use versioned type names to manage breaking changes.) Note: this functionality is not currently available in the official protobuf release, and it is not used for type URLs beginning with type.googleapis.com. As of May 2023, there are no widely used type server implementations and no plans to implement one. Schemes other than http, https (or the empty scheme) might be used with implementation specific semantics.
value	string (bytes format) Must be a valid serialized protocol buffer of the above specified type. A base64-encoded string.

StatsList

JSON representation
{ "values": [ { object (StatsColumnValue) } ] }

Fields
values[]	object (StatsColumnValue) List of values in one cell of the column.

Tool Annotations

Destructive Hint: ❌ | Idempotent Hint: ✅ | Read Only Hint: ✅ | Open World Hint: ❌