Collection

Collection represents a container of objects (such as events, entity context metadata, detection finding metadata) and state (such as investigation details).

An example use case for Collection is to model a detection and investigation from detection finding metadata to investigative state collected in the course of the investigation. For more complex investigation and response workflows a Collection could represent an incident consisting of multiple child findings or incidents. This can be expanded on to model remediation elements of a full detection and response workflow.

JSON representation 
{
  "id": string,
  "type": enum (CollectionType),
  "idNamespace": enum (Namespace),
  "createdTime": string,
  "lastUpdatedTime": string,
  "timeWindow": {
    object (Interval)
  },
  "collectionElements": [
    {
      object (Element)
    }
  ],
  "detection": [
    {
      object (SecurityResult)
    }
  ],
  "detectionTime": string,
  "investigation": {
    object (Investigation)
  },
  "tags": [
    string
  ],
  "responsePlatformInfo": {
    object (ResponsePlatformInfo)
  },
  "caseName": string,
  "feedbackSummary": {
    object (Feedback)
  },
  "feedbackHistory": [
    {
      object (Feedback)
    }
  ],
  "soarAlert": boolean,
  "soarAlertMetadata": {
    object (SoarAlertMetadata)
  },
  "dataAccessScope": string,
  "detectionTimingDetails": [
    enum (DetectionTimingDetails)
  ],
  "latencyMetrics": {
    object (LatencyMetrics)
  },
  "ruleRunFrequency": enum (RunFrequency),
  "simulatedEventCount": string,
  "simulatedEventNames": [
    string
  ],
  "simulatedDetectionCount": string,
  "simulatedDetectionDisplayNames": [
    string
  ]
}
Fields
id

string

Unique ID for the collection. The ID is specific to the type of collection. For example, with rule detections this is the detection ID.
type

enum (CollectionType)

What the collection represents.
idNamespace

enum (Namespace)

The ID namespace used for the Collection.
createdTime

string (Timestamp format)

Time the collection was created.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
lastUpdatedTime

string (Timestamp format)

Time the collection was last updated.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
timeWindow

object (Interval)

Time interval that the collection represents.
collectionElements[]

object (Element)

Constituent elements of the collection. Each element shares an association that groups it together and is a component of the overall collection. For example, a detection collection may have several constituent elements that each share a correlation association that together represent a particular pattern or behavior.
detection[]

object (SecurityResult)

Detection metadata for findings that represent detections, can include rule details, machine learning model metadata, and indicators implicated in the detection (using the .about field).
detectionTime

string (Timestamp format)

Timestamp within the timeWindow related to the time of the collectionElements. For Rule Detections, this timestamp is the end of the the timeWindow for multi-event rules or the time of the event for single event rules. For late-arriving events that trigger new alerts, the detectionTime will be the event time of the event.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
investigation

object (Investigation)

Consolidated investigation details (categorization, status, etc) typically for collections that begin as detection findings and then evolve with analyst action and feedback into investigations around the detection output.
tags[]

string

Tags set by UC/DSML/RE for the Finding during creation.
responsePlatformInfo

object (ResponsePlatformInfo)

Alert related info of this same alert in customer's SOAR platform.
caseName

string

The resource name of the Case that this collection belongs to. Example: projects/{project id}/locations/{region}/chronicle/cases/{internal_case_id}
feedbackSummary

object (Feedback)

The current primary analyst feedback. This does not include the history of feedback given, which may be supplied in feedback.
feedbackHistory[]

object (Feedback)

The history of feedback submitted by analysts for this finding, in descending order by timestamp. This field is limited to the most recent 1000 feedback events. The primary feedback will also be included in this list.
soarAlert

boolean

A boolean field indicating that the alert is present in SOAR.
soarAlertMetadata

object (SoarAlertMetadata)

Metadata fields of alerts coming from other SIEM systems via SOAR.
dataAccessScope

string

The resource name of the DataAccessScope of this collection.
detectionTimingDetails[]

enum (DetectionTimingDetails)

Detection timing details for the collection. These details are used to determine prossible causes of latency for the detection. This field is only set for detections that are generated by rules.
latencyMetrics

object (LatencyMetrics)

The latency metrics for the specific detection. These metrics are calculated from ALL of the events that contribute to the detection, not just the sampled ones.
ruleRunFrequency

enum (RunFrequency)

The run frequency of the rule when it generated the detection.
simulatedEventCount

string (int64 format)

The total number of simulated events that contributed to this detection. Simulated events are realistic threat sequences (Raw Logs or UDM) programmatically delivered into the production ingestion pipeline to verify the entire detection lifecycle—from identification to action.
simulatedEventNames[]

string

The set of all values from event ingestionLabels where SIMULATED is set as the key, for all simulated events that participated in this detection.
simulatedDetectionCount

string (int64 format)

The total number of simulated detections that contributed to this detection. Simulated detections are detections that are generated by simulated events or by other simulated detections.
simulatedDetectionDisplayNames[]

string

The set of simulation names associated with simulated detections that contributed to this detection. These names are derived from the ingestion labels of the events that participated in the simulated detections.

Element

JSON representation 
{
  "association": {
    object (SecurityResult)
  },
  "references": [
    {
      object (Reference)
    }
  ],
  "label": string,
  "referencesSampled": boolean,
  "latencyMetrics": {
    object (LatencyMetrics)
  }
}
Fields
association

object (SecurityResult)

Metadata that provides the relevant association for the references in the element. For a detection, this can be the correlated aspect of the references that contributed to the overall detection. For example, may include sub-rule condition, machine learning model metadata, and/or indicators implicated in this component of the detection (using the .about field).
references[]

object (Reference)

References to model primatives including events and entities that share a common association. Even though a reference can have both UDM and entity, a collection of references (of a single element) will only have one type of message in it (either UDM / Entity).
label

string

A name that labels the entire references group.
referencesSampled

boolean

Copied from the detection eventSample.too_many_event_samples field. If true, the number of references will be capped at the sample limit (set at rule service). This is applicable to both UDM references and Entity references.
latencyMetrics

object (LatencyMetrics)

Latency metrics for the specific element. These are calculated from all the contributing events or entities for a single event variable, not just the sampled ones included in references. This is currently only populated for UDM events.

Reference

Reference to model primatives including event and entity. As support is added for fast retrieval of objects by identifiers, this will be expanded to include ID references rather than full object copies.

JSON representation 
{
  "event": {
    object (UDM)
  },
  "entity": {
    object (Entity)
  },
  "joinedDataTableRows": [
    {
      object (DataTableRowInfo)
    }
  ],
  "graphEnrichment": {
    object (EntityGraphEnrichment)
  },
  "id": {
    object (Id)
  },
  "logBatchToken": string
}
Fields
event

object (UDM)

Only one of event or entity will be populated for a single reference. Start one-of Event being referenced.
entity

object (Entity)

Entity being referenced. In cases where the entity graph is overridden by data table, this will represent the original entity. End one-of
joinedDataTableRows[]

object (DataTableRowInfo)

The data table rows joined with the event.
graphEnrichment

object (EntityGraphEnrichment)

The entity graph enrichment details. Only set when the reference is an Entity which has been overridden by a data table or appended from a data table.
id

object (Id)

Id being referenced. This field will also be populated for both event and entity with the event id. For detections, only this field will be populated.
logBatchToken

string

The log batch token of the event being referenced. This field is used to fetch the raw log associated with the event in some legacy systems. This field is only populated for events/entities.

UDM

A Unified Data Model event.

JSON representation 
{
  "metadata": {
    object (Metadata)
  },
  "additional": {
    object
  },
  "principal": {
    object (Noun)
  },
  "src": {
    object (Noun)
  },
  "target": {
    object (Noun)
  },
  "intermediary": [
    {
      object (Noun)
    }
  ],
  "observer": {
    object (Noun)
  },
  "about": [
    {
      object (Noun)
    }
  ],
  "securityResult": [
    {
      object (SecurityResult)
    }
  ],
  "network": {
    object (Network)
  },
  "extensions": {
    object (Extensions)
  },
  "extracted": {
    object
  },
  "grouped": {
    object (GroupedFields)
  }
}
Fields
metadata

object (Metadata)

Event metadata such as timestamp, source product, etc.
additional

object (Struct format)

Any important vendor-specific event data that cannot be adequately represented within the formal sections of the UDM model.
principal

object (Noun)

Represents the acting entity that originates the activity described in the event. The principal must include at least one machine detail (hostname, MACs, IPs, port, product-specific identifiers like an EDR asset ID) or user detail (for example, username), and optionally include process details. It must NOT include any of the following fields: email, files, registry keys or values.
src

object (Noun)

Represents a source entity being acted upon by the participant along with the device or process context for the source object (the machine where the source object resides). For example, if user U copies file A on machine X to file B on machine Y, both file A and machine X would be specified in the src portion of the UDM event.
target

object (Noun)

Represents a target entity being referenced by the event or an object on the target entity. For example, in a firewall connection from device A to device B, A is described as the principal and B is described as the target. For a process injection by process C into target process D, process C is described as the principal and process D is described as the target.
intermediary[]

object (Noun)

Represents details on one or more intermediate entities processing activity described in the event. This includes device details about a proxy server or SMTP relay server. If an active event (that has a principal and possibly target) passes through any intermediaries, they're added here. Intermediaries can impact the overall action, for example blocking or modifying an ongoing request. A rule of thumb here is that 'principal', 'target', and description of the initial action should be the same regardless of the intermediary or its action. A successful network connection from A->B should look the same in principal/target/intermediary as one blocked by firewall C: principal: A, target: B (intermediary: C).
observer

object (Noun)

Represents an observer entity (for example, a packet sniffer or network-based vulnerability scanner), which is not a direct intermediary, but which observes and reports on the event in question.
about[]

object (Noun)

Represents entities referenced by the event that are not otherwise described in principal, src, target, intermediary or observer. For example, it could be used to track email file attachments, domains/URLs/IPs embedded within an email body, and DLLs that are loaded during a PROCESS_LAUNCH event.
securityResult[]

object (SecurityResult)

A list of security results.
network

object (Network)

All network details go here, including sub-messages with details on each protocol (for example, DHCP, DNS, or HTTP).
extensions

object (Extensions)

All other first-class, event-specific metadata goes in this message. Do not place protocol metadata in Extensions; put it in Network.
extracted

object (Struct format)

Flattened fields extracted from the log.
grouped

object (GroupedFields)

Related UDM fields that are grouped together.

Metadata

General information associated with a UDM event.

JSON representation 
{
  "id": string,
  "productLogId": string,
  "eventTimestamp": string,
  "eventTimestampAttributes": [
    enum (EventTimestampAttribute)
  ],
  "collectedTimestamp": string,
  "ingestedTimestamp": string,
  "eventType": enum (EventType),
  "vendorName": string,
  "productName": string,
  "productVersion": string,
  "productEventType": string,
  "productDeploymentId": string,
  "description": string,
  "urlBackToProduct": string,
  "ingestionLabels": [
    {
      object (Label)
    }
  ],
  "tags": {
    object (Tags)
  },
  "enrichmentState": enum (EnrichmentState),
  "logType": string,
  "baseLabels": {
    object (DataAccessLabels)
  },
  "enrichmentLabels": {
    object (DataAccessLabels)
  },
  "structuredFields": {
    object
  },
  "parserVersion": string,
  "productLogLevel": enum (ProductLogLevel)
}
Fields
id

string (bytes format)

ID of the UDM event. Can be used for raw and normalized event retrieval.

A base64-encoded string.
productLogId

string

A vendor-specific event identifier to uniquely identify the event (e.g. a GUID).
eventTimestamp

string (Timestamp format)

The GMT timestamp when the event was generated.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
eventTimestampAttributes[]

enum (EventTimestampAttribute)

Attributes associated with eventTimestamp. This field is used to distinguish between different types of timestamps that can be used to represent the eventTimestamp.
collectedTimestamp

string (Timestamp format)

The GMT timestamp when the event was collected by the vendor's local collection infrastructure.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
ingestedTimestamp

string (Timestamp format)

The GMT timestamp when the event was ingested (received) by Google SecOps.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
eventType

enum (EventType)

The event type. If an event has multiple possible types, this specifies the most specific type.
vendorName

string

The name of the product vendor.
productName

string

The name of the product.
productVersion

string

The version of the product.
productEventType

string

A short, descriptive, human-readable, product-specific event name or type (e.g. "Scanned X", "User account created", "process_start").
productDeploymentId

string

The deployment identifier assigned by the vendor for a product deployment.
description

string

A human-readable unparsable description of the event.
urlBackToProduct

string

A URL that takes the user to the source product console for this event.
ingestionLabels[]

object (Label)

User-configured ingestion metadata labels.
tags

object (Tags)

Tags added by Google SecOps after an event is parsed. It is an error to populate this field from within a parser.
enrichmentState

enum (EnrichmentState)

The enrichment state.
logType

string

The string value of log type.
baseLabels

object (DataAccessLabels)

Data access labels on the base event.
enrichmentLabels

object (DataAccessLabels)

Data access labels from all the contextual events used to enrich the base event.
structuredFields
(deprecated)

object (Struct format)

Flattened fields extracted from the log.
parserVersion

string

The version of the parser that generated this UDM event.
productLogLevel

enum (ProductLogLevel)

The original log level from the product or source log message.

Tags

Tags are event metadata which is set by examining event contents post-parsing. For example, a UDM event may be assigned a tenantId based on certain customer-defined parameters.

JSON representation 
{
  "tenantId": [
    string
  ],
  "dataTapConfigName": [
    string
  ]
}
Fields
tenantId[]

string (bytes format)

A list of subtenant ids that this event belongs to.

A base64-encoded string.
dataTapConfigName[]

string

A list of sink name values defined in DataTap configurations.

DataAccessLabels

JSON representation 
{
  "logTypes": [
    string
  ],
  "ingestionLabels": [
    string
  ],
  "namespaces": [
    string
  ],
  "customLabels": [
    string
  ],
  "ingestionKvLabels": [
    {
      object (DataAccessIngestionLabel)
    }
  ],
  "allowScopedAccess": boolean
}
Fields
logTypes[]

string

All the LogType labels.
ingestionLabels[]
(deprecated)

string

All the ingestion labels.
namespaces[]

string

All the namespaces.
customLabels[]

string

All the complex labels (UDM search syntax based).
ingestionKvLabels[]

object (DataAccessIngestionLabel)

All the ingestion labels (key/value pairs).
allowScopedAccess

boolean

Are the labels ready for scoped access

DataAccessIngestionLabel

JSON representation 
{
  "key": string,
  "value": string
}
Fields
key

string

The key.
value

string

The value.

Extensions

Extensions to a UDM event.

JSON representation 
{
  "auth": {
    object (Authentication)
  },
  "vulns": {
    object (Vulnerabilities)
  },
  "entityRisk": {
    object (EntityRisk)
  },
  "linuxUtmp": {
    object (LinuxUtmp)
  },
  "windowsEventLog": {
    object (WindowsEventLog)
  },
  "resourceUsage": {
    object (ResourceUsage)
  },
  "systemEventDetails": {
    object (SystemEventDetails)
  },
  "outlookMetadata": {
    object (OutlookMetadata)
  },
  "srum": {
    object (Srum)
  },
  "userAssist": {
    object (UserAssist)
  }
}
Fields
auth

object (Authentication)

An authentication extension.
vulns

object (Vulnerabilities)

A vulnerability extension.
entityRisk

object (EntityRisk)

An entity risk change extension.
linuxUtmp

object (LinuxUtmp)

A Linux Utmp extension. This captures details specific to Linux Utmp events, which record login and logout sessions on a Linux system.
windowsEventLog

object (WindowsEventLog)

A Windows Event Log extension. This captures details specific to Windows Event Log events, providing structured information from various Windows logs.
resourceUsage

object (ResourceUsage)

A resource usage extension. This captures details about what entity, for example, a process or user, is using a specific resource.
systemEventDetails

object (SystemEventDetails)

A system event details extension. This captures additional details for system-level events, such as message type, sender image ID, and subsystem.
outlookMetadata

object (OutlookMetadata)

A Microsoft Outlook metadata extension. This includes metadata related to Outlook items, such as comments, templates, and security flags.
srum

object (Srum)

A SRUM extension. This captures details specific to Windows System Resource Usage Monitor (SRUM) events, providing insights into application resource consumption.
userAssist

object (UserAssist)

A UserAssist extension. This captures details specific to Windows User Assist events, which track application usage and execution.

Vulnerabilities

The Vulnerabilities extension captures details on observed/detected vulnerabilities.

JSON representation 
{
  "vulnerabilities": [
    {
      object (Vulnerability)
    }
  ]
}
Fields
vulnerabilities[]

object (Vulnerability)

A list of vulnerabilities.

EntityRisk

Stores information related to the risk score of an entity. Next ID: 15

JSON representation 
{
  "riskVersion": string,
  "riskWindow": {
    object (Interval)
  },
  "DEPRECATEDRiskScore": integer,
  "detectionsCount": integer,
  "firstDetectionTime": string,
  "lastDetectionTime": string,
  "riskScore": number,
  "normalizedRiskScore": integer,
  "riskWindowSize": string,
  "lastResetTime": string,
  "detailUri": string,
  "riskWindowHasNewDetections": boolean,
  "riskDelta": {
    object (RiskDelta)
  },
  "rawRiskDelta": {
    object (RiskDelta)
  }
}
Fields
riskVersion

string

Version of the risk score calculation algorithm.
riskWindow

object (Interval)

Time window used when computing the risk score for an entity, for example 24 hours or 7 days.
DEPRECATEDRiskScore
(deprecated)

integer

Deprecated risk score.
detectionsCount

integer

Number of detections that make up the risk score within the time window.
firstDetectionTime

string (Timestamp format)

Timestamp of the first detection within the specified time window. This field is empty when there are no detections.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
lastDetectionTime

string (Timestamp format)

Timestamp of the last detection within the specified time window. This field is empty when there are no detections.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
riskScore

number

Raw risk score for the entity.
normalizedRiskScore

integer

Normalized risk score for the entity. This value is between 0-1000.
riskWindowSize

string (Duration format)

Risk window duration for the entity.

A duration in seconds with up to nine fractional digits, ending with 's'. Example: "3.5s".
lastResetTime

string (Timestamp format)

Timestamp for UEBA risk score reset based deduplication. Used specifically for risk based meta rules.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
detailUri

string

Link to the Google Security Operations UI with information about the entity risk score. If the SecOps instance has multiple frontend paths configured, this will be a relative path that can be used to construct the full URL.
riskWindowHasNewDetections

boolean

Whether there are new detections for the risk window.
riskDelta

object (RiskDelta)

Represents the change in risk score for an entity between the end of the previous time window and the end of the current time window.
rawRiskDelta

object (RiskDelta)

Represents the change in raw risk score for an entity between the end of the previous time window and the end of the current time window.

RiskDelta

Describes the difference in risk score between two points in time.

JSON representation 
{
  "previousRangeEndTime": string,
  "riskScoreDelta": integer,
  "previousRiskScore": integer,
  "riskScoreNumericDelta": integer
}
Fields
previousRangeEndTime

string (Timestamp format)

End time of the previous time window.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
riskScoreDelta

integer

Difference in the normalized risk score from the previous recorded value.
previousRiskScore

integer

Risk score from previous risk window
riskScoreNumericDelta

integer

Numeric change between current and previous risk score

LinuxUtmp

The LinuxUtmp extension captures details specific to Linux Utmp events.

JSON representation 
{
  "recordType": enum (RecordType)
}
Fields
recordType

enum (RecordType)

The activity record type.

WindowsEventLog

The WindowsEventLog extension captures details specific to Windows Event Log events.

JSON representation 
{
  "channel": enum (Channel),
  "eventId": string,
  "activityId": string
}
Fields
channel

enum (Channel)

The channel of the event.
eventId

string

A unique identifier for a specific type of event.
activityId

string

A GUID (Globally Unique Identifier) used to link a sequence of related events together.

ResourceUsage

The ResourceUsage extension captures details about what is using a resource.

JSON representation 
{
  "usedEntity": string,
  "usedEntityId": string
}
Fields
usedEntity

string

The name of the entity (e.g., process, user) that is using the resource.
usedEntityId

string

A numerical identifier for the entity using the resource (e.g., PID, UID).

SystemEventDetails

Captures additional details for system-level events.

JSON representation 
{
  "messageType": string,
  "senderImageId": string,
  "subsystem": string
}
Fields
messageType

string

The specific type or category of the message.
senderImageId

string

An identifier for the image associated with the sender of the message.
subsystem

string

The subsystem or component that generated the event.

OutlookMetadata

Microsoft Outlook specific metadata.

JSON representation 
{
  "comment": string,
  "template": string,
  "title": string,
  "securityFlagsCount": integer
}
Fields
comment

string

A user-defined comment or note associated with the Outlook item.
template

string

The name of the template file used to create the Outlook item.
title

string

The title of the Outlook item.
securityFlagsCount

integer

Count of Security-related flags for the message, such as encryption or signing status.

Srum

The Srum extension captures details specific to Windows System Resource Usage Monitor (SRUM) events.

JSON representation 
{
  "id": string,
  "backgroundBytesRead": string,
  "backgroundBytesWritten": string,
  "backgroundContextSwitches": string,
  "backgroundCycleCount": string,
  "backgroundFlushesCount": string,
  "backgroundReadOperations": string,
  "backgroundWriteOperations": string,
  "interfaceLuid": string
}
Fields
id

string

A unique identifier for the SRUM record or the application/user being monitored.
backgroundBytesRead

string (int64 format)

The number of bytes read by the application while running in the background.
backgroundBytesWritten

string (int64 format)

The number of bytes written by the application while running in the background.
backgroundContextSwitches

string (int64 format)

The number of context switches performed by the application's threads while in the background.
backgroundCycleCount

string (int64 format)

The amount of CPU cycle time consumed by the application in the background, measured in clock cycles.
backgroundFlushesCount

string (int64 format)

The number of flush operations performed by the application in the background.
backgroundReadOperations

string (int64 format)

The number of read operations performed by the application in the background.
backgroundWriteOperations

string (int64 format)

The number of write operations performed by the application in the background.
interfaceLuid

string

The Locally Unique Identifier (LUID) for the network interface used for data transfer.

UserAssist

The UserAssist extension captures details specific to Windows User Assist events.

JSON representation 
{
  "applicationFocusCount": string,
  "applicationFocusDuration": string,
  "executionsCount": string,
  "entryIndex": string
}
Fields
applicationFocusCount

string (int64 format)

The number of times the application associated with the entry gained focus.
applicationFocusDuration

string (Duration format)

The total duration the application associated with the entry was in focus.

A duration in seconds with up to nine fractional digits, ending with 's'. Example: "3.5s".
executionsCount

string (int64 format)

The number of times the application associated with the entry has been executed.
entryIndex

string (int64 format)

The index or identifier of the user assist entry, unique per user.

GroupedFields

Grouped fields are aliases for groups of related UDM fields. All fields grouped together are of type string.

JSON representation 
{
  "ip": [
    string
  ],
  "domain": [
    string
  ],
  "hostname": [
    string
  ],
  "user": [
    string
  ],
  "email": [
    string
  ],
  "filePath": [
    string
  ],
  "hash": [
    string
  ],
  "processId": [
    string
  ]
}
Fields
ip[]

string

IP addresses.
domain[]

string

Domains.
hostname[]

string

Hostnames.
user[]

string

Users.
email[]

string

Emails.
filePath[]

string

File paths.
hash[]

string

File Hashes.
processId[]

string

Process Identifiers.

Entity

An Entity provides additional context about an item in a UDM event. For example, a PROCESS_LAUNCH event describes that user 'abc@example.corp' launched process 'shady.exe'. The event does not include information that user 'abc@example.com' is a recently terminated employee who administers a server storing finance data. Information stored in one or more Entities can add this additional context.

JSON representation 
{
  "metadata": {
    object (EntityMetadata)
  },
  "entity": {
    object (Noun)
  },
  "relations": [
    {
      object (Relation)
    }
  ],
  "additional": {
    object
  },
  "metric": {
    object (Metric)
  },
  "riskScore": {
    object (EntityRisk)
  }
}
Fields
metadata

object (EntityMetadata)

Entity metadata such as timestamp, product, etc.
entity

object (Noun)

Noun in the UDM event that this entity represents.
relations[]

object (Relation)

One or more relationships between the entity (a) and other entities, including the relationship type and related entity.
additional

object (Struct format)

Important entity data that cannot be adequately represented within the formal sections of the Entity.
metric

object (Metric)

Stores statistical metrics about the entity. Used if metadata.entity_type is METRIC.
riskScore

object (EntityRisk)

Stores information related to the entity's risk score.

EntityMetadata

Information about the Entity and the product where the entity was created.

JSON representation 
{
  "productEntityId": string,
  "collectedTimestamp": string,
  "creationTimestamp": string,
  "interval": {
    object (Interval)
  },
  "vendorName": string,
  "productName": string,
  "feed": string,
  "productVersion": string,
  "entityType": enum (EntityType),
  "description": string,
  "threat": [
    {
      object (SecurityResult)
    }
  ],
  "sourceType": enum (SourceType),
  "sourceLabels": [
    {
      object (Label)
    }
  ],
  "eventMetadata": {
    object (Metadata)
  },
  "structuredFields": {
    object
  },
  "extracted": {
    object
  },
  "atiPrioritization": {
    object (AtiPrioritization)
  },
  "threatIntel": {
    object (ThreatIntel)
  }
}
Fields
productEntityId

string

A vendor-specific identifier that uniquely identifies the entity (e.g. a GUID, LDAP, OID, or similar).
collectedTimestamp

string (Timestamp format)

GMT timestamp when the entity information was collected by the vendor's local collection infrastructure.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
creationTimestamp

string (Timestamp format)

GMT timestamp when the entity described by the productEntityId was created on the system where data was collected.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
interval

object (Interval)

Valid existence time range for the version of the entity represented by this entity data.
vendorName

string

Vendor name of the product that produced the entity information.
productName

string

Product name that produced the entity information.
feed

string

Vendor feed name for a threat indicator feed.
productVersion

string

Version of the product that produced the entity information.
entityType

enum (EntityType)

Entity type. If an entity has multiple possible types, this specifies the most specific type.
description

string

Human-readable description of the entity.
threat[]

object (SecurityResult)

Deprecated: Usage of this field is discouraged for indicators of compromise. Use the threatIntel field instead. Metadata provided by a threat intelligence feed that identified the entity as malicious.
sourceType

enum (SourceType)

The source of the entity.
sourceLabels[]

object (Label)

Entity source metadata labels.
eventMetadata

object (Metadata)

Metadata field from the event.
structuredFields
(deprecated)

object (Struct format)

Structured fields extracted from the log.
extracted

object (Struct format)

Flattened fields extracted from the log.
atiPrioritization
(deprecated)

object (AtiPrioritization)

Deprecated: Use the threatIntel field instead. Prioritization factors used by ATI curated rules.
threatIntel

object (ThreatIntel)

Threat intel metadata for the entity if it is an indicator of compromise. Usage of this field is preferred over usage of the threat field.

ThreatIntel

ThreatIntel contains threat intel metadata for indicators of compromise.

JSON representation 
{
  "verdict": enum (Verdict),
  "severity": enum (Severity),
  "threatScore": integer,
  "updateTime": string,
  "reviewed": boolean,
  "soaked": boolean,
  "stable": boolean,
  "attributedMalware": [
    string
  ],
  "attributedThreatActors": [
    string
  ]
}
Fields
verdict

enum (Verdict)

Qualitative verdict of the maliciousness of the indicator.
severity

enum (Severity)

Qualitative severity rating of the indicator.
threatScore

integer

Quantitative threat score of the indicator. Range is 0-100.
updateTime

string (Timestamp format)

When the threat intel was last updated.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
reviewed

boolean

Whether the threat intel has been explicitly reviewed.
soaked

boolean

Whether the threat intel has soaked (implicitly reviewed over time).
stable

boolean

Whether the threat intel is considered stable. Typically this is true when either reviewed or soaked is true.
attributedMalware[]

string

Names of associated malware families. Examples: "FIRESCALE", "SANDCLOCK"
attributedThreatActors[]

string

Names of associated threat actors. Examples: "APT41", "UN3236"

Relation

Defines the relationship between the entity (a) and another entity (b).

JSON representation 
{
  "entity": {
    object (Noun)
  },
  "entityType": enum (EntityType),
  "relationship": enum (Relationship),
  "direction": enum (Directionality),
  "uid": string,
  "entityLabel": enum (EntityLabel)
}
Fields
entity

object (Noun)

Entity (b) that the primary entity (a) is related to.
entityType

enum (EntityType)

Type of the related entity (b) in this relationship.
relationship

enum (Relationship)

Type of relationship.
direction

enum (Directionality)

Directionality of relationship between primary entity (a) and the related entity (b).
uid

string (bytes format)

UID of the relationship.

A base64-encoded string.
entityLabel

enum (EntityLabel)

Label to identify the Noun of the relation.

Metric

Stores precomputed aggregated analytic data for an entity.

JSON representation 
{
  "firstSeen": string,
  "lastSeen": string,
  "sumMeasure": {
    object (Measure)
  },
  "totalEvents": string,
  "metricName": enum (MetricName),
  "dimensions": [
    enum (Dimension)
  ],
  "exportWindow": string,
  "displayName": string,
  "outcomeVariables": [
    {
      object (MetricVariable)
    }
  ],
  "matchVariables": [
    {
      object (MetricVariable)
    }
  ],
  "timeRange": {
    object (Interval)
  }
}
Fields
firstSeen

string (Timestamp format)

Timestamp of the first time the entity was seen in the environment.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
lastSeen

string (Timestamp format)

Timestamp of the last time the entity was seen in the environment.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
sumMeasure

object (Measure)

Sum of all precomputed measures for the given metric.
totalEvents

string (int64 format)

Total number of events used to calculate the given precomputed metric.
metricName

enum (MetricName)

Name of the analytic.
dimensions[]

enum (Dimension)

All group by clauses used to calculate the metric.
exportWindow

string (int64 format)

Export window for which the metric was exported.
displayName

string

Display name of the custom metric. Google-authored metrics do not have a display name.
outcomeVariables[]

object (MetricVariable)

List of outcome variables used in the custom metric.
matchVariables[]

object (MetricVariable)

List of match variables used in the custom metric.
timeRange

object (Interval)

Time range for which the custom metric was calculated.

Measure

Describes the precomputed measure.

JSON representation 
{
  "value": number,
  "aggregateFunction": enum (AggregateFunction)
}
Fields
value

number

Value of the aggregated measure.
aggregateFunction

enum (AggregateFunction)

Function used to calculate the aggregated measure.

MetricVariable

A structure that holds the value and associated metadata for a variable used in a metric.

JSON representation 
{
  "name": string,
  "sourcePath": string,

  // The following is a list of mutually exclusive fields. At most one of the
  // fields will be set in a response:
  "boolVal": boolean,
  "bytesVal": string,
  "doubleVal": number,
  "int64Val": string,
  "uint64Val": string,
  "stringVal": string,
  "timestampTime": string,
  "nullVal": boolean,
  "boolSeq": {
    object (BoolSequence)
  },
  "bytesSeq": {
    object (BytesSequence)
  },
  "doubleSeq": {
    object (DoubleSequence)
  },
  "int64Seq": {
    object (Int64Sequence)
  },
  "uint64Seq": {
    object (Uint64Sequence)
  },
  "stringSeq": {
    object (StringSequence)
  }
  // End of mutually exclusive fields.
}
Fields
name

string

The name of the variable.
sourcePath

string

The UDM field path for the field which this value was derived from. Example: principal.hostname
The typed value of the variable. The following is a list of mutually exclusive fields. At most one of the fields will be set in a response:
boolVal

boolean

*
bytesVal

string (bytes format)

*

A base64-encoded string.
doubleVal

number

*
int64Val

string (int64 format)

*
uint64Val

string

The value in uint64 format.
stringVal

string

Enum values are returned as strings.
timestampTime

string (Timestamp format)

*

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
nullVal

boolean

*
boolSeq

object (BoolSequence)

*
bytesSeq

object (BytesSequence)

*
doubleSeq

object (DoubleSequence)

*
int64Seq

object (Int64Sequence)

*
uint64Seq

object (Uint64Sequence)

*
stringSeq

object (StringSequence)

*
End of mutually exclusive fields.

DataTableRowInfo

DataTableRowInfo captures information about a data table row including the name of the data table.

JSON representation 
{
  "dataTable": string,
  "row": {
    object
  },
  "rowId": string
}
Fields
dataTable

string

The name of data table.
row

object (Struct format)

Stores the key value pair for a data table row where the key is the name of the column for the given value.
rowId

string

The row id of the data table row.

EntityGraphEnrichment

EntityGraphEnrichment contains the data table name and the enrichment applied to the entity.

JSON representation 
{
  "dataTable": string,
  "enrichmentType": enum (EnrichmentType),
  "overriddenEntity": {
    object (Entity)
  }
}
Fields
dataTable

string

The name of the data table.
enrichmentType

enum (EnrichmentType)

The type of enrichment.
overriddenEntity

object (Entity)

The entity which has only the overridden fields populated. Only populated if the enrichment type is OVERRIDE.

LatencyMetrics

LatencyMetrics contains relevant timestamps for measuring latency per event variable. These metrics are calculated from ALL of the events that contribute to the detection, not just the sampled ones.

JSON representation 
{
  "oldestIngestionTime": string,
  "newestIngestionTime": string,
  "oldestEventTime": string,
  "newestEventTime": string,
  "ingestionLatency": string
}
Fields
oldestIngestionTime

string (Timestamp format)

The oldest ingestion timestamp from the events used to create the detection.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
newestIngestionTime

string (Timestamp format)

The newest (most recent) ingestion timestamp from the events used to create the detection.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
oldestEventTime

string (Timestamp format)

The oldest event timestamp from the events used to create the detection.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
newestEventTime

string (Timestamp format)

The newest (most recent) event timestamp from the events used to create the detection.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
ingestionLatency

string (Duration format)

The difference between newest ingestion timestamp and newest event timestamp.

A duration in seconds with up to nine fractional digits, ending with 's'. Example: "3.5s".

ResponsePlatformInfo

Related info of an Alert in customer's SOAR platform.

JSON representation 
{
  "alertId": string,
  "responsePlatformType": enum (ResponsePlatformType)
}
Fields
alertId

string

Id of the alert in SOAR product.
responsePlatformType

enum (ResponsePlatformType)

Type of SOAR product.

Feedback

JSON representation 
{
  "idpUserId": string,
  "createdTime": string,
  "verdict": enum (Verdict),
  "reputation": enum (Reputation),
  "confidenceScore": integer,
  "riskScore": integer,
  "disregarded": boolean,
  "severity": integer,
  "comment": string,
  "status": enum (Status),
  "priority": enum (Priority),
  "rootCause": string,
  "reason": enum (Reason),
  "severityDisplay": string,
  "priorityDisplay": string,
  "triageAgentInvestigationId": string,
  "userType": enum (UserType)
}
Fields
idpUserId

string

Required.
createdTime

string (Timestamp format)

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
verdict

enum (Verdict)
reputation

enum (Reputation)
confidenceScore

integer
riskScore

integer
disregarded

boolean
severity

integer
comment

string

Optional.
status

enum (Status)

Optional.
priority

enum (Priority)

Optional.
rootCause

string

Optional.
reason

enum (Reason)

Optional.
severityDisplay

string

Optional.
priorityDisplay

string

Optional.
triageAgentInvestigationId

string

Optional.
userType

enum (UserType)

SoarAlertMetadata

Metadata fields of alerts coming from other SIEM systems.

JSON representation 
{
  "alertId": string,
  "sourceRule": string,
  "vendor": string,
  "sourceSystem": string,
  "product": string,
  "sourceSystemTicketId": string,
  "sourceSystemUri": string
}
Fields
alertId

string

Alert ID in the source SIEM system.
sourceRule

string

Name of the rule triggering the alert in the source SIEM.
vendor

string

Name of the vendor.
sourceSystem

string

Name of the Source SIEM system.
product

string

Name of the product the alert is coming from.
sourceSystemTicketId

string

Ticket id for the alert in the source system.
sourceSystemUri

string

Url to the source SIEM system.