Class Collection (0.3.0)

0.3.0 (latest) 0.2.0 0.1.0

public final class Collection extends GeneratedMessage implements CollectionOrBuilder

Collection represents a container of objects (such as events, entity context metadata, detection finding metadata) and state (such as investigation details).

An example use case for Collection is to model a detection and investigation from detection finding metadata to investigative state collected in the course of the investigation. For more complex investigation and response workflows a Collection could represent an incident consisting of multiple child findings or incidents. This can be expanded on to model remediation elements of a full detection and response workflow.

Protobuf type google.backstory.Collection

Inheritance

Object > AbstractMessageLite<MessageType,BuilderType> > AbstractMessage > GeneratedMessage > Collection

Implements

CollectionOrBuilder

Inherited Members

AbstractMessage.equals(Object)

AbstractMessage.findInitializationErrors()

AbstractMessage.getInitializationErrorString()

AbstractMessage.hashCode()

AbstractMessage.hashFields(int,Map<Descriptors.FieldDescriptor,Object>)

AbstractMessage.newBuilderForType(AbstractMessage.BuilderParent)

AbstractMessage.toString()

AbstractMessageLite.<T>addAll(Iterable<T>,List<? super T>)

AbstractMessageLite.checkByteStringIsUtf8(ByteString)

AbstractMessageLite.toByteArray()

AbstractMessageLite.toByteString()

AbstractMessageLite.writeDelimitedTo(OutputStream)

AbstractMessageLite.writeTo(OutputStream)

com.google.protobuf.GeneratedMessage.<ContainingT,T>newFileScopedGeneratedExtension(java.lang.Class<?>,com.google.protobuf.Message)

com.google.protobuf.GeneratedMessage.<ContainingT,T>newMessageScopedGeneratedExtension(com.google.protobuf.Message,int,java.lang.Class<?>,com.google.protobuf.Message)

com.google.protobuf.GeneratedMessage.<ListT>makeMutableCopy(ListT)

com.google.protobuf.GeneratedMessage.<ListT>makeMutableCopy(ListT,int)

GeneratedMessage.<M>parseDelimitedWithIOException(Parser<M>,InputStream)

GeneratedMessage.<M>parseDelimitedWithIOException(Parser<M>,InputStream,ExtensionRegistryLite)

GeneratedMessage.<M>parseWithIOException(Parser<M>,CodedInputStream)

GeneratedMessage.<M>parseWithIOException(Parser<M>,CodedInputStream,ExtensionRegistryLite)

GeneratedMessage.<M>parseWithIOException(Parser<M>,InputStream)

GeneratedMessage.<M>parseWithIOException(Parser<M>,InputStream,ExtensionRegistryLite)

com.google.protobuf.GeneratedMessage.<T>emptyList(java.lang.Class<T>)

com.google.protobuf.GeneratedMessage.<V>serializeBooleanMapTo(com.google.protobuf.CodedOutputStream,com.google.protobuf.MapField<java.lang.Boolean,V>,com.google.protobuf.MapEntry<java.lang.Boolean,V>,int)

com.google.protobuf.GeneratedMessage.<V>serializeIntegerMapTo(com.google.protobuf.CodedOutputStream,com.google.protobuf.MapField<java.lang.Integer,V>,com.google.protobuf.MapEntry<java.lang.Integer,V>,int)

com.google.protobuf.GeneratedMessage.<V>serializeLongMapTo(com.google.protobuf.CodedOutputStream,com.google.protobuf.MapField<java.lang.Long,V>,com.google.protobuf.MapEntry<java.lang.Long,V>,int)

com.google.protobuf.GeneratedMessage.<V>serializeStringMapTo(com.google.protobuf.CodedOutputStream,com.google.protobuf.MapField<java.lang.String,V>,com.google.protobuf.MapEntry<java.lang.String,V>,int)

com.google.protobuf.GeneratedMessage.canUseUnsafe()

GeneratedMessage.computeStringSize(int,Object)

GeneratedMessage.computeStringSizeNoTag(Object)

com.google.protobuf.GeneratedMessage.emptyBooleanList()

com.google.protobuf.GeneratedMessage.emptyDoubleList()

com.google.protobuf.GeneratedMessage.emptyFloatList()

com.google.protobuf.GeneratedMessage.emptyIntList()

com.google.protobuf.GeneratedMessage.emptyLongList()

GeneratedMessage.getAllFields()

GeneratedMessage.getDescriptorForType()

GeneratedMessage.getField(Descriptors.FieldDescriptor)

GeneratedMessage.getOneofFieldDescriptor(Descriptors.OneofDescriptor)

GeneratedMessage.getParserForType()

GeneratedMessage.getRepeatedField(Descriptors.FieldDescriptor,int)

GeneratedMessage.getRepeatedFieldCount(Descriptors.FieldDescriptor)

GeneratedMessage.getSerializedSize()

GeneratedMessage.getUnknownFields()

GeneratedMessage.hasField(Descriptors.FieldDescriptor)

GeneratedMessage.hasOneof(Descriptors.OneofDescriptor)

GeneratedMessage.internalGetFieldAccessorTable()

GeneratedMessage.internalGetMapField(int)

com.google.protobuf.GeneratedMessage.internalGetMapFieldReflection(int)

GeneratedMessage.isInitialized()

com.google.protobuf.GeneratedMessage.isStringEmpty(java.lang.Object)

GeneratedMessage.makeExtensionsImmutable()

com.google.protobuf.GeneratedMessage.mergeFromAndMakeImmutableInternal(com.google.protobuf.CodedInputStream,com.google.protobuf.ExtensionRegistryLite)

com.google.protobuf.GeneratedMessage.newInstance(com.google.protobuf.GeneratedMessage.UnusedPrivateParameter)

GeneratedMessage.parseUnknownField(CodedInputStream,UnknownFieldSet.Builder,ExtensionRegistryLite,int)

com.google.protobuf.GeneratedMessage.parseUnknownFieldProto3(com.google.protobuf.CodedInputStream,com.google.protobuf.UnknownFieldSet.Builder,com.google.protobuf.ExtensionRegistryLite,int)

GeneratedMessage.writeReplace()

GeneratedMessage.writeString(CodedOutputStream,int,Object)

GeneratedMessage.writeStringNoTag(CodedOutputStream,Object)

GeneratedMessage.writeTo(CodedOutputStream)

Object.clone()

Object.finalize()

Object.getClass()

Object.notify()

Object.notifyAll()

Object.wait()

Object.wait(long)

Object.wait(long,int)

Static Fields

CASE_NAME_FIELD_NUMBER

public static final int CASE_NAME_FIELD_NUMBER

Field Value
Type	Description
int

COLLECTION_ELEMENTS_FIELD_NUMBER

public static final int COLLECTION_ELEMENTS_FIELD_NUMBER

Field Value
Type	Description
int

CREATED_TIME_FIELD_NUMBER

public static final int CREATED_TIME_FIELD_NUMBER

Field Value
Type	Description
int

DATA_ACCESS_SCOPE_FIELD_NUMBER

public static final int DATA_ACCESS_SCOPE_FIELD_NUMBER

Field Value
Type	Description
int

DETECTION_FIELD_NUMBER

public static final int DETECTION_FIELD_NUMBER

Field Value
Type	Description
int

DETECTION_TIME_FIELD_NUMBER

public static final int DETECTION_TIME_FIELD_NUMBER

Field Value
Type	Description
int

DETECTION_TIMING_DETAILS_FIELD_NUMBER

public static final int DETECTION_TIMING_DETAILS_FIELD_NUMBER

Field Value
Type	Description
int

ID_FIELD_NUMBER

public static final int ID_FIELD_NUMBER

Field Value
Type	Description
int

ID_NAMESPACE_FIELD_NUMBER

public static final int ID_NAMESPACE_FIELD_NUMBER

Field Value
Type	Description
int

INVESTIGATION_FIELD_NUMBER

public static final int INVESTIGATION_FIELD_NUMBER

Field Value
Type	Description
int

LAST_UPDATED_TIME_FIELD_NUMBER

public static final int LAST_UPDATED_TIME_FIELD_NUMBER

Field Value
Type	Description
int

LATENCY_METRICS_FIELD_NUMBER

public static final int LATENCY_METRICS_FIELD_NUMBER

Field Value
Type	Description
int

RESPONSE_PLATFORM_INFO_FIELD_NUMBER

public static final int RESPONSE_PLATFORM_INFO_FIELD_NUMBER

Field Value
Type	Description
int

RULE_RUN_FREQUENCY_FIELD_NUMBER

public static final int RULE_RUN_FREQUENCY_FIELD_NUMBER

Field Value
Type	Description
int

SIMULATED_EVENT_COUNT_FIELD_NUMBER

public static final int SIMULATED_EVENT_COUNT_FIELD_NUMBER

Field Value
Type	Description
int

SIMULATED_EVENT_NAMES_FIELD_NUMBER

public static final int SIMULATED_EVENT_NAMES_FIELD_NUMBER

Field Value
Type	Description
int

SOAR_ALERT_FIELD_NUMBER

public static final int SOAR_ALERT_FIELD_NUMBER

Field Value
Type	Description
int

SOAR_ALERT_METADATA_FIELD_NUMBER

public static final int SOAR_ALERT_METADATA_FIELD_NUMBER

Field Value
Type	Description
int

TAGS_FIELD_NUMBER

public static final int TAGS_FIELD_NUMBER

Field Value
Type	Description
int

TIME_WINDOW_FIELD_NUMBER

public static final int TIME_WINDOW_FIELD_NUMBER

Field Value
Type	Description
int

TYPE_FIELD_NUMBER

public static final int TYPE_FIELD_NUMBER

Field Value
Type	Description
int

Static Methods

getDefaultInstance()

public static Collection getDefaultInstance()

Returns
Type	Description
Collection

getDescriptor()

public static final Descriptors.Descriptor getDescriptor()

Returns
Type	Description
Descriptor

newBuilder()

public static Collection.Builder newBuilder()

Returns
Type	Description
Collection.Builder

newBuilder(Collection prototype)

public static Collection.Builder newBuilder(Collection prototype)

Parameter
Name	Description
prototype	Collection

Returns
Type	Description
Collection.Builder

parseDelimitedFrom(InputStream input)

public static Collection parseDelimitedFrom(InputStream input)

Parameter
Name	Description
input	InputStream

Returns
Type	Description
Collection

Exceptions
Type	Description
IOException

parseDelimitedFrom(InputStream input, ExtensionRegistryLite extensionRegistry)

public static Collection parseDelimitedFrom(InputStream input, ExtensionRegistryLite extensionRegistry)

Parameters
Name	Description
input	InputStream
extensionRegistry	ExtensionRegistryLite

Returns
Type	Description
Collection

Exceptions
Type	Description
IOException

parseFrom(byte[] data)

public static Collection parseFrom(byte[] data)

Parameter
Name	Description
data	byte[]

Returns
Type	Description
Collection

Exceptions
Type	Description
InvalidProtocolBufferException

parseFrom(byte[] data, ExtensionRegistryLite extensionRegistry)

public static Collection parseFrom(byte[] data, ExtensionRegistryLite extensionRegistry)

Parameters
Name	Description
data	byte[]
extensionRegistry	ExtensionRegistryLite

Returns
Type	Description
Collection

Exceptions
Type	Description
InvalidProtocolBufferException

parseFrom(ByteString data)

public static Collection parseFrom(ByteString data)

Parameter
Name	Description
data	ByteString

Returns
Type	Description
Collection

Exceptions
Type	Description
InvalidProtocolBufferException

parseFrom(ByteString data, ExtensionRegistryLite extensionRegistry)

public static Collection parseFrom(ByteString data, ExtensionRegistryLite extensionRegistry)

Parameters
Name	Description
data	ByteString
extensionRegistry	ExtensionRegistryLite

Returns
Type	Description
Collection

Exceptions
Type	Description
InvalidProtocolBufferException

parseFrom(CodedInputStream input)

public static Collection parseFrom(CodedInputStream input)

Parameter
Name	Description
input	CodedInputStream

Returns
Type	Description
Collection

Exceptions
Type	Description
IOException

parseFrom(CodedInputStream input, ExtensionRegistryLite extensionRegistry)

public static Collection parseFrom(CodedInputStream input, ExtensionRegistryLite extensionRegistry)

Parameters
Name	Description
input	CodedInputStream
extensionRegistry	ExtensionRegistryLite

Returns
Type	Description
Collection

Exceptions
Type	Description
IOException

parseFrom(InputStream input)

public static Collection parseFrom(InputStream input)

Parameter
Name	Description
input	InputStream

Returns
Type	Description
Collection

Exceptions
Type	Description
IOException

parseFrom(InputStream input, ExtensionRegistryLite extensionRegistry)

public static Collection parseFrom(InputStream input, ExtensionRegistryLite extensionRegistry)

Parameters
Name	Description
input	InputStream
extensionRegistry	ExtensionRegistryLite

Returns
Type	Description
Collection

Exceptions
Type	Description
IOException

parseFrom(ByteBuffer data)

public static Collection parseFrom(ByteBuffer data)

Parameter
Name	Description
data	ByteBuffer

Returns
Type	Description
Collection

Exceptions
Type	Description
InvalidProtocolBufferException

parseFrom(ByteBuffer data, ExtensionRegistryLite extensionRegistry)

public static Collection parseFrom(ByteBuffer data, ExtensionRegistryLite extensionRegistry)

Parameters
Name	Description
data	ByteBuffer
extensionRegistry	ExtensionRegistryLite

Returns
Type	Description
Collection

Exceptions
Type	Description
InvalidProtocolBufferException

parser()

public static Parser<Collection> parser()

Returns
Type	Description
Parser<Collection>

Methods

equals(Object obj)

public boolean equals(Object obj)

Parameter
Name	Description
obj	Object

Returns
Type	Description
boolean

Overrides

AbstractMessage.equals(Object other)

getCaseName()

public String getCaseName()

The resource name of the Case that this collection belongs to. Example: projects/{project id}/locations/{region}/chronicle/cases/{internal_case_id}

string case_name = 14;

Returns
Type	Description
String	The caseName.

getCaseNameBytes()

public ByteString getCaseNameBytes()

The resource name of the Case that this collection belongs to. Example: projects/{project id}/locations/{region}/chronicle/cases/{internal_case_id}

string case_name = 14;

Returns
Type	Description
ByteString	The bytes for caseName.

getCollectionElements(int index)

public Element getCollectionElements(int index)

Constituent elements of the collection. Each element shares an association that groups it together and is a component of the overall collection. For example, a detection collection may have several constituent elements that each share a correlation association that together represent a particular pattern or behavior.

repeated .google.backstory.Element collection_elements = 9;

Parameter
Name	Description
index	int

Returns
Type	Description
Element

getCollectionElementsCount()

public int getCollectionElementsCount()

Constituent elements of the collection. Each element shares an association that groups it together and is a component of the overall collection. For example, a detection collection may have several constituent elements that each share a correlation association that together represent a particular pattern or behavior.

repeated .google.backstory.Element collection_elements = 9;

Returns
Type	Description
int

getCollectionElementsList()

public List<Element> getCollectionElementsList()

Constituent elements of the collection. Each element shares an association that groups it together and is a component of the overall collection. For example, a detection collection may have several constituent elements that each share a correlation association that together represent a particular pattern or behavior.

repeated .google.backstory.Element collection_elements = 9;

Returns
Type	Description
List<Element>

getCollectionElementsOrBuilder(int index)

public ElementOrBuilder getCollectionElementsOrBuilder(int index)

Constituent elements of the collection. Each element shares an association that groups it together and is a component of the overall collection. For example, a detection collection may have several constituent elements that each share a correlation association that together represent a particular pattern or behavior.

repeated .google.backstory.Element collection_elements = 9;

Parameter
Name	Description
index	int

Returns
Type	Description
ElementOrBuilder

getCollectionElementsOrBuilderList()

public List<? extends ElementOrBuilder> getCollectionElementsOrBuilderList()

Constituent elements of the collection. Each element shares an association that groups it together and is a component of the overall collection. For example, a detection collection may have several constituent elements that each share a correlation association that together represent a particular pattern or behavior.

repeated .google.backstory.Element collection_elements = 9;

Returns
Type	Description
List<? extends com.google.backstory.ElementOrBuilder>

getCreatedTime()

public Timestamp getCreatedTime()

Time the collection was created.

.google.protobuf.Timestamp created_time = 5;

Returns
Type	Description
Timestamp	The createdTime.

getCreatedTimeOrBuilder()

public TimestampOrBuilder getCreatedTimeOrBuilder()

Time the collection was created.

.google.protobuf.Timestamp created_time = 5;

Returns
Type	Description
TimestampOrBuilder

getDataAccessScope()

public String getDataAccessScope()

The resource name of the DataAccessScope of this collection.

string data_access_scope = 19;

Returns
Type	Description
String	The dataAccessScope.

getDataAccessScopeBytes()

public ByteString getDataAccessScopeBytes()

The resource name of the DataAccessScope of this collection.

string data_access_scope = 19;

Returns
Type	Description
ByteString	The bytes for dataAccessScope.

getDefaultInstanceForType()

public Collection getDefaultInstanceForType()

Returns
Type	Description
Collection

getDetection(int index)

public SecurityResult getDetection(int index)

Detection metadata for findings that represent detections, can include rule details, machine learning model metadata, and indicators implicated in the detection (using the .about field).

repeated .google.backstory.SecurityResult detection = 3;

Parameter
Name	Description
index	int

Returns
Type	Description
SecurityResult

getDetectionCount()

public int getDetectionCount()

Detection metadata for findings that represent detections, can include rule details, machine learning model metadata, and indicators implicated in the detection (using the .about field).

repeated .google.backstory.SecurityResult detection = 3;

Returns
Type	Description
int

getDetectionList()

public List<SecurityResult> getDetectionList()

Detection metadata for findings that represent detections, can include rule details, machine learning model metadata, and indicators implicated in the detection (using the .about field).

repeated .google.backstory.SecurityResult detection = 3;

Returns
Type	Description
List<SecurityResult>

getDetectionOrBuilder(int index)

public SecurityResultOrBuilder getDetectionOrBuilder(int index)

Detection metadata for findings that represent detections, can include rule details, machine learning model metadata, and indicators implicated in the detection (using the .about field).

repeated .google.backstory.SecurityResult detection = 3;

Parameter
Name	Description
index	int

Returns
Type	Description
SecurityResultOrBuilder

getDetectionOrBuilderList()

public List<? extends SecurityResultOrBuilder> getDetectionOrBuilderList()

Detection metadata for findings that represent detections, can include rule details, machine learning model metadata, and indicators implicated in the detection (using the .about field).

repeated .google.backstory.SecurityResult detection = 3;

Returns
Type	Description
List<? extends com.google.backstory.SecurityResultOrBuilder>

getDetectionTime()

public Timestamp getDetectionTime()

Timestamp within the time_window related to the time of the collection_elements. For Rule Detections, this timestamp is the end of the the time_window for multi-event rules or the time of the event for single event rules. For late-arriving events that trigger new alerts, the detection_time will be the event time of the event.

.google.protobuf.Timestamp detection_time = 10;

Returns
Type	Description
Timestamp	The detectionTime.

getDetectionTimeOrBuilder()

public TimestampOrBuilder getDetectionTimeOrBuilder()

Timestamp within the time_window related to the time of the collection_elements. For Rule Detections, this timestamp is the end of the the time_window for multi-event rules or the time of the event for single event rules. For late-arriving events that trigger new alerts, the detection_time will be the event time of the event.

.google.protobuf.Timestamp detection_time = 10;

Returns
Type	Description
TimestampOrBuilder

getDetectionTimingDetails(int index)

public Collection.DetectionTimingDetails getDetectionTimingDetails(int index)

Detection timing details for the collection. These details are used to determine prossible causes of latency for the detection. This field is only set for detections that are generated by rules.

repeated .google.backstory.Collection.DetectionTimingDetails detection_timing_details = 20;

Parameter
Name	Description
index	int The index of the element to return.

Returns
Type	Description
Collection.DetectionTimingDetails	The detectionTimingDetails at the given index.

getDetectionTimingDetailsCount()

public int getDetectionTimingDetailsCount()

Detection timing details for the collection. These details are used to determine prossible causes of latency for the detection. This field is only set for detections that are generated by rules.

repeated .google.backstory.Collection.DetectionTimingDetails detection_timing_details = 20;

Returns
Type	Description
int	The count of detectionTimingDetails.

getDetectionTimingDetailsList()

public List<Collection.DetectionTimingDetails> getDetectionTimingDetailsList()

Detection timing details for the collection. These details are used to determine prossible causes of latency for the detection. This field is only set for detections that are generated by rules.

repeated .google.backstory.Collection.DetectionTimingDetails detection_timing_details = 20;

Returns
Type	Description
List<DetectionTimingDetails>	A list containing the detectionTimingDetails.

getDetectionTimingDetailsValue(int index)

public int getDetectionTimingDetailsValue(int index)

Detection timing details for the collection. These details are used to determine prossible causes of latency for the detection. This field is only set for detections that are generated by rules.

repeated .google.backstory.Collection.DetectionTimingDetails detection_timing_details = 20;

Parameter
Name	Description
index	int The index of the value to return.

Returns
Type	Description
int	The enum numeric value on the wire of detectionTimingDetails at the given index.

getDetectionTimingDetailsValueList()

public List<Integer> getDetectionTimingDetailsValueList()

Detection timing details for the collection. These details are used to determine prossible causes of latency for the detection. This field is only set for detections that are generated by rules.

repeated .google.backstory.Collection.DetectionTimingDetails detection_timing_details = 20;

Returns
Type	Description
List<Integer>	A list containing the enum numeric values on the wire for detectionTimingDetails.

getId()

public String getId()

Unique ID for the collection. The ID is specific to the type of collection. For example, with rule detections this is the detection ID.

string id = 7;

Returns
Type	Description
String	The id.

getIdBytes()

public ByteString getIdBytes()

Unique ID for the collection. The ID is specific to the type of collection. For example, with rule detections this is the detection ID.

string id = 7;

Returns
Type	Description
ByteString	The bytes for id.

getIdNamespace()

public Id.Namespace getIdNamespace()

The ID namespace used for the Collection.

.google.backstory.Id.Namespace id_namespace = 12;

Returns
Type	Description
Id.Namespace	The idNamespace.

getIdNamespaceValue()

public int getIdNamespaceValue()

The ID namespace used for the Collection.

.google.backstory.Id.Namespace id_namespace = 12;

Returns
Type	Description
int	The enum numeric value on the wire for idNamespace.

getInvestigation()

public Investigation getInvestigation()

Consolidated investigation details (categorization, status, etc) typically for collections that begin as detection findings and then evolve with analyst action and feedback into investigations around the detection output.

.google.backstory.Investigation investigation = 4;

Returns
Type	Description
Investigation	The investigation.

getInvestigationOrBuilder()

public InvestigationOrBuilder getInvestigationOrBuilder()

Consolidated investigation details (categorization, status, etc) typically for collections that begin as detection findings and then evolve with analyst action and feedback into investigations around the detection output.

.google.backstory.Investigation investigation = 4;

Returns
Type	Description
InvestigationOrBuilder

getLastUpdatedTime()

public Timestamp getLastUpdatedTime()

Time the collection was last updated.

.google.protobuf.Timestamp last_updated_time = 6;

Returns
Type	Description
Timestamp	The lastUpdatedTime.

getLastUpdatedTimeOrBuilder()

public TimestampOrBuilder getLastUpdatedTimeOrBuilder()

Time the collection was last updated.

.google.protobuf.Timestamp last_updated_time = 6;

Returns
Type	Description
TimestampOrBuilder

getLatencyMetrics()

public LatencyMetrics getLatencyMetrics()

The latency metrics for the specific detection. These metrics are calculated from ALL of the events that contribute to the detection, not just the sampled ones.

.google.backstory.LatencyMetrics latency_metrics = 21;

Returns
Type	Description
LatencyMetrics	The latencyMetrics.

getLatencyMetricsOrBuilder()

public LatencyMetricsOrBuilder getLatencyMetricsOrBuilder()

The latency metrics for the specific detection. These metrics are calculated from ALL of the events that contribute to the detection, not just the sampled ones.

.google.backstory.LatencyMetrics latency_metrics = 21;

Returns
Type	Description
LatencyMetricsOrBuilder

getParserForType()

public Parser<Collection> getParserForType()

Returns
Type	Description
Parser<Collection>

Overrides

GeneratedMessage.getParserForType()

getResponsePlatformInfo()

public ResponsePlatformInfo getResponsePlatformInfo()

Alert related info of this same alert in customer's SOAR platform.

.google.backstory.ResponsePlatformInfo response_platform_info = 13;

Returns
Type	Description
ResponsePlatformInfo	The responsePlatformInfo.

getResponsePlatformInfoOrBuilder()

public ResponsePlatformInfoOrBuilder getResponsePlatformInfoOrBuilder()

Alert related info of this same alert in customer's SOAR platform.

.google.backstory.ResponsePlatformInfo response_platform_info = 13;

Returns
Type	Description
ResponsePlatformInfoOrBuilder

getRuleRunFrequency()

public Collection.RunFrequency getRuleRunFrequency()

The run frequency of the rule when it generated the detection.

.google.backstory.Collection.RunFrequency rule_run_frequency = 22;

Returns
Type	Description
Collection.RunFrequency	The ruleRunFrequency.

getRuleRunFrequencyValue()

public int getRuleRunFrequencyValue()

The run frequency of the rule when it generated the detection.

.google.backstory.Collection.RunFrequency rule_run_frequency = 22;

Returns
Type	Description
int	The enum numeric value on the wire for ruleRunFrequency.

getSerializedSize()

public int getSerializedSize()

Returns
Type	Description
int

Overrides

GeneratedMessage.getSerializedSize()

getSimulatedEventCount()

public long getSimulatedEventCount()

The total number of simulated events that contributed to this detection. Simulated events are realistic threat sequences (Raw Logs or UDM) programmatically delivered into the production ingestion pipeline to verify the entire detection lifecycle—from identification to action.

int64 simulated_event_count = 23;

Returns
Type	Description
long	The simulatedEventCount.

getSimulatedEventNames(int index)

public String getSimulatedEventNames(int index)

The set of all values from event ingestion_labels where SIMULATED is set as the key, for all simulated events that participated in this detection.

repeated string simulated_event_names = 24;

Parameter
Name	Description
index	int The index of the element to return.

Returns
Type	Description
String	The simulatedEventNames at the given index.

getSimulatedEventNamesBytes(int index)

public ByteString getSimulatedEventNamesBytes(int index)

The set of all values from event ingestion_labels where SIMULATED is set as the key, for all simulated events that participated in this detection.

repeated string simulated_event_names = 24;

Parameter
Name	Description
index	int The index of the value to return.

Returns
Type	Description
ByteString	The bytes of the simulatedEventNames at the given index.

getSimulatedEventNamesCount()

public int getSimulatedEventNamesCount()

The set of all values from event ingestion_labels where SIMULATED is set as the key, for all simulated events that participated in this detection.

repeated string simulated_event_names = 24;

Returns
Type	Description
int	The count of simulatedEventNames.

getSimulatedEventNamesList()

public ProtocolStringList getSimulatedEventNamesList()

The set of all values from event ingestion_labels where SIMULATED is set as the key, for all simulated events that participated in this detection.

repeated string simulated_event_names = 24;

Returns
Type	Description
ProtocolStringList	A list containing the simulatedEventNames.

getSoarAlert()

public boolean getSoarAlert()

A boolean field indicating that the alert is present in SOAR.

bool soar_alert = 17;

Returns
Type	Description
boolean	The soarAlert.

getSoarAlertMetadata()

public SoarAlertMetadata getSoarAlertMetadata()

Metadata fields of alerts coming from other SIEM systems via SOAR.

.google.backstory.SoarAlertMetadata soar_alert_metadata = 18;

Returns
Type	Description
SoarAlertMetadata	The soarAlertMetadata.

getSoarAlertMetadataOrBuilder()

public SoarAlertMetadataOrBuilder getSoarAlertMetadataOrBuilder()

Metadata fields of alerts coming from other SIEM systems via SOAR.

.google.backstory.SoarAlertMetadata soar_alert_metadata = 18;

Returns
Type	Description
SoarAlertMetadataOrBuilder

getTags(int index)

public String getTags(int index)

Tags set by UC/DSML/RE for the Finding during creation.

repeated string tags = 11;

Parameter
Name	Description
index	int The index of the element to return.

Returns
Type	Description
String	The tags at the given index.

getTagsBytes(int index)

public ByteString getTagsBytes(int index)

Tags set by UC/DSML/RE for the Finding during creation.

repeated string tags = 11;

Parameter
Name	Description
index	int The index of the value to return.

Returns
Type	Description
ByteString	The bytes of the tags at the given index.

getTagsCount()

public int getTagsCount()

Tags set by UC/DSML/RE for the Finding during creation.

repeated string tags = 11;

Returns
Type	Description
int	The count of tags.

getTagsList()

public ProtocolStringList getTagsList()

Tags set by UC/DSML/RE for the Finding during creation.

repeated string tags = 11;

Returns
Type	Description
ProtocolStringList	A list containing the tags.

getTimeWindow()

public Interval getTimeWindow()

Time interval that the collection represents.

.google.type.Interval time_window = 8;

Returns
Type	Description
com.google.type.Interval	The timeWindow.

getTimeWindowOrBuilder()

public IntervalOrBuilder getTimeWindowOrBuilder()

Time interval that the collection represents.

.google.type.Interval time_window = 8;

Returns
Type	Description
com.google.type.IntervalOrBuilder

getType()

public Collection.CollectionType getType()

What the collection represents.

.google.backstory.Collection.CollectionType type = 1;

Returns
Type	Description
Collection.CollectionType	The type.

getTypeValue()

public int getTypeValue()

What the collection represents.

.google.backstory.Collection.CollectionType type = 1;

Returns
Type	Description
int	The enum numeric value on the wire for type.

hasCreatedTime()

public boolean hasCreatedTime()

Time the collection was created.

.google.protobuf.Timestamp created_time = 5;

Returns
Type	Description
boolean	Whether the createdTime field is set.

hasDetectionTime()

public boolean hasDetectionTime()

Timestamp within the time_window related to the time of the collection_elements. For Rule Detections, this timestamp is the end of the the time_window for multi-event rules or the time of the event for single event rules. For late-arriving events that trigger new alerts, the detection_time will be the event time of the event.

.google.protobuf.Timestamp detection_time = 10;

Returns
Type	Description
boolean	Whether the detectionTime field is set.

hasInvestigation()

public boolean hasInvestigation()

Consolidated investigation details (categorization, status, etc) typically for collections that begin as detection findings and then evolve with analyst action and feedback into investigations around the detection output.

.google.backstory.Investigation investigation = 4;

Returns
Type	Description
boolean	Whether the investigation field is set.

hasLastUpdatedTime()

public boolean hasLastUpdatedTime()

Time the collection was last updated.

.google.protobuf.Timestamp last_updated_time = 6;

Returns
Type	Description
boolean	Whether the lastUpdatedTime field is set.

hasLatencyMetrics()

public boolean hasLatencyMetrics()

The latency metrics for the specific detection. These metrics are calculated from ALL of the events that contribute to the detection, not just the sampled ones.

.google.backstory.LatencyMetrics latency_metrics = 21;

Returns
Type	Description
boolean	Whether the latencyMetrics field is set.

hasResponsePlatformInfo()

public boolean hasResponsePlatformInfo()

Alert related info of this same alert in customer's SOAR platform.

.google.backstory.ResponsePlatformInfo response_platform_info = 13;

Returns
Type	Description
boolean	Whether the responsePlatformInfo field is set.

hasSoarAlertMetadata()

public boolean hasSoarAlertMetadata()

Metadata fields of alerts coming from other SIEM systems via SOAR.

.google.backstory.SoarAlertMetadata soar_alert_metadata = 18;

Returns
Type	Description
boolean	Whether the soarAlertMetadata field is set.

hasTimeWindow()

public boolean hasTimeWindow()

Time interval that the collection represents.

.google.type.Interval time_window = 8;

Returns
Type	Description
boolean	Whether the timeWindow field is set.

hashCode()

public int hashCode()

Returns
Type	Description
int

Overrides

AbstractMessage.hashCode()

internalGetFieldAccessorTable()

protected GeneratedMessage.FieldAccessorTable internalGetFieldAccessorTable()

Returns
Type	Description
FieldAccessorTable

Overrides

GeneratedMessage.internalGetFieldAccessorTable()

isInitialized()

public final boolean isInitialized()

Returns
Type	Description
boolean

Overrides

GeneratedMessage.isInitialized()

newBuilderForType()

public Collection.Builder newBuilderForType()

Returns
Type	Description
Collection.Builder

newBuilderForType(AbstractMessage.BuilderParent parent)

protected Collection.Builder newBuilderForType(AbstractMessage.BuilderParent parent)

Parameter
Name	Description
parent	BuilderParent

Returns
Type	Description
Collection.Builder

Overrides

AbstractMessage.newBuilderForType(AbstractMessage.BuilderParent parent)

toBuilder()

public Collection.Builder toBuilder()

Returns
Type	Description
Collection.Builder

writeTo(CodedOutputStream output)

public void writeTo(CodedOutputStream output)

Parameter
Name	Description
output	CodedOutputStream

Overrides

GeneratedMessage.writeTo(CodedOutputStream output)

Exceptions
Type	Description
IOException