Class Collection.Builder (0.3.0)

0.3.0 (latest) 0.2.0 0.1.0

public static final class Collection.Builder extends GeneratedMessage.Builder<Collection.Builder> implements CollectionOrBuilder

Collection represents a container of objects (such as events, entity context metadata, detection finding metadata) and state (such as investigation details).

An example use case for Collection is to model a detection and investigation from detection finding metadata to investigative state collected in the course of the investigation. For more complex investigation and response workflows a Collection could represent an incident consisting of multiple child findings or incidents. This can be expanded on to model remediation elements of a full detection and response workflow.

Protobuf type google.backstory.Collection

Inheritance

java.lang.Object > AbstractMessageLite.Builder<MessageType,BuilderType> > AbstractMessage.Builder<BuilderType> > GeneratedMessage.Builder > Collection.Builder

Implements

CollectionOrBuilder

Inherited Members

AbstractMessage.Builder.findInitializationErrors()

AbstractMessage.Builder.getInitializationErrorString()

AbstractMessage.Builder.internalMergeFrom(AbstractMessageLite)

AbstractMessage.Builder.mergeFrom(byte[])

AbstractMessage.Builder.mergeFrom(byte[],ExtensionRegistryLite)

AbstractMessage.Builder.mergeFrom(byte[],int,int)

AbstractMessage.Builder.mergeFrom(byte[],int,int,ExtensionRegistryLite)

AbstractMessage.Builder.mergeFrom(ByteString)

AbstractMessage.Builder.mergeFrom(ByteString,ExtensionRegistryLite)

AbstractMessage.Builder.mergeFrom(CodedInputStream)

AbstractMessage.Builder.mergeFrom(CodedInputStream,ExtensionRegistryLite)

AbstractMessage.Builder.mergeFrom(Message)

AbstractMessage.Builder.mergeFrom(InputStream)

AbstractMessage.Builder.mergeFrom(InputStream,ExtensionRegistryLite)

AbstractMessage.Builder.newUninitializedMessageException(Message)

AbstractMessage.Builder.toString()

AbstractMessageLite.Builder.<T>addAll(Iterable<T>,Collection<? super T>)

AbstractMessageLite.Builder.<T>addAll(Iterable<T>,List<? super T>)

AbstractMessageLite.Builder.internalMergeFrom(MessageType)

AbstractMessageLite.Builder.mergeDelimitedFrom(InputStream)

AbstractMessageLite.Builder.mergeDelimitedFrom(InputStream,ExtensionRegistryLite)

AbstractMessageLite.Builder.mergeFrom(MessageLite)

AbstractMessageLite.Builder.newUninitializedMessageException(MessageLite)

GeneratedMessage.Builder.addRepeatedField(Descriptors.FieldDescriptor,Object)

GeneratedMessage.Builder.clear()

GeneratedMessage.Builder.clearField(Descriptors.FieldDescriptor)

GeneratedMessage.Builder.clearOneof(Descriptors.OneofDescriptor)

GeneratedMessage.Builder.clone()

GeneratedMessage.Builder.getAllFields()

GeneratedMessage.Builder.getDescriptorForType()

GeneratedMessage.Builder.getField(Descriptors.FieldDescriptor)

GeneratedMessage.Builder.getFieldBuilder(Descriptors.FieldDescriptor)

GeneratedMessage.Builder.getOneofFieldDescriptor(Descriptors.OneofDescriptor)

GeneratedMessage.Builder.getParentForChildren()

GeneratedMessage.Builder.getRepeatedField(Descriptors.FieldDescriptor,int)

GeneratedMessage.Builder.getRepeatedFieldBuilder(Descriptors.FieldDescriptor,int)

GeneratedMessage.Builder.getRepeatedFieldCount(Descriptors.FieldDescriptor)

com.google.protobuf.GeneratedMessage.Builder.getUnknownFieldSetBuilder()

GeneratedMessage.Builder.getUnknownFields()

GeneratedMessage.Builder.hasField(Descriptors.FieldDescriptor)

GeneratedMessage.Builder.hasOneof(Descriptors.OneofDescriptor)

GeneratedMessage.Builder.internalGetFieldAccessorTable()

GeneratedMessage.Builder.internalGetMapField(int)

com.google.protobuf.GeneratedMessage.Builder.internalGetMapFieldReflection(int)

GeneratedMessage.Builder.internalGetMutableMapField(int)

com.google.protobuf.GeneratedMessage.Builder.internalGetMutableMapFieldReflection(int)

GeneratedMessage.Builder.isClean()

GeneratedMessage.Builder.isInitialized()

GeneratedMessage.Builder.markClean()

GeneratedMessage.Builder.mergeUnknownFields(UnknownFieldSet)

com.google.protobuf.GeneratedMessage.Builder.mergeUnknownLengthDelimitedField(int,com.google.protobuf.ByteString)

com.google.protobuf.GeneratedMessage.Builder.mergeUnknownVarintField(int,int)

GeneratedMessage.Builder.newBuilderForField(Descriptors.FieldDescriptor)

GeneratedMessage.Builder.onBuilt()

GeneratedMessage.Builder.onChanged()

com.google.protobuf.GeneratedMessage.Builder.parseUnknownField(com.google.protobuf.CodedInputStream,com.google.protobuf.ExtensionRegistryLite,int)

GeneratedMessage.Builder.setField(Descriptors.FieldDescriptor,Object)

GeneratedMessage.Builder.setRepeatedField(Descriptors.FieldDescriptor,int,Object)

com.google.protobuf.GeneratedMessage.Builder.setUnknownFieldSetBuilder(com.google.protobuf.UnknownFieldSet.Builder)

GeneratedMessage.Builder.setUnknownFields(UnknownFieldSet)

com.google.protobuf.GeneratedMessage.Builder.setUnknownFieldsProto3(com.google.protobuf.UnknownFieldSet)

Object.equals(Object)

Object.finalize()

Object.getClass()

Object.hashCode()

Object.notify()

Object.notifyAll()

Object.wait()

Object.wait(long)

Object.wait(long,int)

Static Methods

getDescriptor()

public static final Descriptors.Descriptor getDescriptor()

Returns
Type	Description
Descriptor

Methods

addAllCollectionElements(Iterable<? extends Element> values)

public Collection.Builder addAllCollectionElements(Iterable<? extends Element> values)

Constituent elements of the collection. Each element shares an association that groups it together and is a component of the overall collection. For example, a detection collection may have several constituent elements that each share a correlation association that together represent a particular pattern or behavior.

repeated .google.backstory.Element collection_elements = 9;

Parameter
Name	Description
values	Iterable<? extends com.google.backstory.Element>

Returns
Type	Description
Collection.Builder

addAllDetection(Iterable<? extends SecurityResult> values)

public Collection.Builder addAllDetection(Iterable<? extends SecurityResult> values)

Detection metadata for findings that represent detections, can include rule details, machine learning model metadata, and indicators implicated in the detection (using the .about field).

repeated .google.backstory.SecurityResult detection = 3;

Parameter
Name	Description
values	Iterable<? extends com.google.backstory.SecurityResult>

Returns
Type	Description
Collection.Builder

addAllDetectionTimingDetails(Iterable<? extends Collection.DetectionTimingDetails> values)

public Collection.Builder addAllDetectionTimingDetails(Iterable<? extends Collection.DetectionTimingDetails> values)

Detection timing details for the collection. These details are used to determine prossible causes of latency for the detection. This field is only set for detections that are generated by rules.

repeated .google.backstory.Collection.DetectionTimingDetails detection_timing_details = 20;

Parameter
Name	Description
values	Iterable<? extends com.google.backstory.Collection.DetectionTimingDetails> The detectionTimingDetails to add.

Returns
Type	Description
Collection.Builder	This builder for chaining.

addAllDetectionTimingDetailsValue(Iterable<Integer> values)

public Collection.Builder addAllDetectionTimingDetailsValue(Iterable<Integer> values)

Detection timing details for the collection. These details are used to determine prossible causes of latency for the detection. This field is only set for detections that are generated by rules.

repeated .google.backstory.Collection.DetectionTimingDetails detection_timing_details = 20;

Parameter
Name	Description
values	Iterable<Integer> The enum numeric values on the wire for detectionTimingDetails to add.

Returns
Type	Description
Collection.Builder	This builder for chaining.

addAllSimulatedEventNames(Iterable<String> values)

public Collection.Builder addAllSimulatedEventNames(Iterable<String> values)

The set of all values from event ingestion_labels where SIMULATED is set as the key, for all simulated events that participated in this detection.

repeated string simulated_event_names = 24;

Parameter
Name	Description
values	Iterable<String> The simulatedEventNames to add.

Returns
Type	Description
Collection.Builder	This builder for chaining.

addAllTags(Iterable<String> values)

public Collection.Builder addAllTags(Iterable<String> values)

Tags set by UC/DSML/RE for the Finding during creation.

repeated string tags = 11;

Parameter
Name	Description
values	Iterable<String> The tags to add.

Returns
Type	Description
Collection.Builder	This builder for chaining.

addCollectionElements(Element value)

public Collection.Builder addCollectionElements(Element value)

Constituent elements of the collection. Each element shares an association that groups it together and is a component of the overall collection. For example, a detection collection may have several constituent elements that each share a correlation association that together represent a particular pattern or behavior.

repeated .google.backstory.Element collection_elements = 9;

Parameter
Name	Description
value	Element

Returns
Type	Description
Collection.Builder

addCollectionElements(Element.Builder builderForValue)

public Collection.Builder addCollectionElements(Element.Builder builderForValue)

Constituent elements of the collection. Each element shares an association that groups it together and is a component of the overall collection. For example, a detection collection may have several constituent elements that each share a correlation association that together represent a particular pattern or behavior.

repeated .google.backstory.Element collection_elements = 9;

Parameter
Name	Description
builderForValue	Element.Builder

Returns
Type	Description
Collection.Builder

addCollectionElements(int index, Element value)

public Collection.Builder addCollectionElements(int index, Element value)

Constituent elements of the collection. Each element shares an association that groups it together and is a component of the overall collection. For example, a detection collection may have several constituent elements that each share a correlation association that together represent a particular pattern or behavior.

repeated .google.backstory.Element collection_elements = 9;

Parameters
Name	Description
index	int
value	Element

Returns
Type	Description
Collection.Builder

addCollectionElements(int index, Element.Builder builderForValue)

public Collection.Builder addCollectionElements(int index, Element.Builder builderForValue)

Constituent elements of the collection. Each element shares an association that groups it together and is a component of the overall collection. For example, a detection collection may have several constituent elements that each share a correlation association that together represent a particular pattern or behavior.

repeated .google.backstory.Element collection_elements = 9;

Parameters
Name	Description
index	int
builderForValue	Element.Builder

Returns
Type	Description
Collection.Builder

addCollectionElementsBuilder()

public Element.Builder addCollectionElementsBuilder()

Constituent elements of the collection. Each element shares an association that groups it together and is a component of the overall collection. For example, a detection collection may have several constituent elements that each share a correlation association that together represent a particular pattern or behavior.

repeated .google.backstory.Element collection_elements = 9;

Returns
Type	Description
Element.Builder

addCollectionElementsBuilder(int index)

public Element.Builder addCollectionElementsBuilder(int index)

Constituent elements of the collection. Each element shares an association that groups it together and is a component of the overall collection. For example, a detection collection may have several constituent elements that each share a correlation association that together represent a particular pattern or behavior.

repeated .google.backstory.Element collection_elements = 9;

Parameter
Name	Description
index	int

Returns
Type	Description
Element.Builder

addDetection(SecurityResult value)

public Collection.Builder addDetection(SecurityResult value)

Detection metadata for findings that represent detections, can include rule details, machine learning model metadata, and indicators implicated in the detection (using the .about field).

repeated .google.backstory.SecurityResult detection = 3;

Parameter
Name	Description
value	SecurityResult

Returns
Type	Description
Collection.Builder

addDetection(SecurityResult.Builder builderForValue)

public Collection.Builder addDetection(SecurityResult.Builder builderForValue)

Detection metadata for findings that represent detections, can include rule details, machine learning model metadata, and indicators implicated in the detection (using the .about field).

repeated .google.backstory.SecurityResult detection = 3;

Parameter
Name	Description
builderForValue	SecurityResult.Builder

Returns
Type	Description
Collection.Builder

addDetection(int index, SecurityResult value)

public Collection.Builder addDetection(int index, SecurityResult value)

Detection metadata for findings that represent detections, can include rule details, machine learning model metadata, and indicators implicated in the detection (using the .about field).

repeated .google.backstory.SecurityResult detection = 3;

Parameters
Name	Description
index	int
value	SecurityResult

Returns
Type	Description
Collection.Builder

addDetection(int index, SecurityResult.Builder builderForValue)

public Collection.Builder addDetection(int index, SecurityResult.Builder builderForValue)

Detection metadata for findings that represent detections, can include rule details, machine learning model metadata, and indicators implicated in the detection (using the .about field).

repeated .google.backstory.SecurityResult detection = 3;

Parameters
Name	Description
index	int
builderForValue	SecurityResult.Builder

Returns
Type	Description
Collection.Builder

addDetectionBuilder()

public SecurityResult.Builder addDetectionBuilder()

Detection metadata for findings that represent detections, can include rule details, machine learning model metadata, and indicators implicated in the detection (using the .about field).

repeated .google.backstory.SecurityResult detection = 3;

Returns
Type	Description
SecurityResult.Builder

addDetectionBuilder(int index)

public SecurityResult.Builder addDetectionBuilder(int index)

Detection metadata for findings that represent detections, can include rule details, machine learning model metadata, and indicators implicated in the detection (using the .about field).

repeated .google.backstory.SecurityResult detection = 3;

Parameter
Name	Description
index	int

Returns
Type	Description
SecurityResult.Builder

addDetectionTimingDetails(Collection.DetectionTimingDetails value)

public Collection.Builder addDetectionTimingDetails(Collection.DetectionTimingDetails value)

Detection timing details for the collection. These details are used to determine prossible causes of latency for the detection. This field is only set for detections that are generated by rules.

repeated .google.backstory.Collection.DetectionTimingDetails detection_timing_details = 20;

Parameter
Name	Description
value	Collection.DetectionTimingDetails The detectionTimingDetails to add.

Returns
Type	Description
Collection.Builder	This builder for chaining.

addDetectionTimingDetailsValue(int value)

public Collection.Builder addDetectionTimingDetailsValue(int value)

Detection timing details for the collection. These details are used to determine prossible causes of latency for the detection. This field is only set for detections that are generated by rules.

repeated .google.backstory.Collection.DetectionTimingDetails detection_timing_details = 20;

Parameter
Name	Description
value	int The enum numeric value on the wire for detectionTimingDetails to add.

Returns
Type	Description
Collection.Builder	This builder for chaining.

addSimulatedEventNames(String value)

public Collection.Builder addSimulatedEventNames(String value)

The set of all values from event ingestion_labels where SIMULATED is set as the key, for all simulated events that participated in this detection.

repeated string simulated_event_names = 24;

Parameter
Name	Description
value	String The simulatedEventNames to add.

Returns
Type	Description
Collection.Builder	This builder for chaining.

addSimulatedEventNamesBytes(ByteString value)

public Collection.Builder addSimulatedEventNamesBytes(ByteString value)

The set of all values from event ingestion_labels where SIMULATED is set as the key, for all simulated events that participated in this detection.

repeated string simulated_event_names = 24;

Parameter
Name	Description
value	ByteString The bytes of the simulatedEventNames to add.

Returns
Type	Description
Collection.Builder	This builder for chaining.

addTags(String value)

public Collection.Builder addTags(String value)

Tags set by UC/DSML/RE for the Finding during creation.

repeated string tags = 11;

Parameter
Name	Description
value	String The tags to add.

Returns
Type	Description
Collection.Builder	This builder for chaining.

addTagsBytes(ByteString value)

public Collection.Builder addTagsBytes(ByteString value)

Tags set by UC/DSML/RE for the Finding during creation.

repeated string tags = 11;

Parameter
Name	Description
value	ByteString The bytes of the tags to add.

Returns
Type	Description
Collection.Builder	This builder for chaining.

build()

public Collection build()

Returns
Type	Description
Collection

buildPartial()

public Collection buildPartial()

Returns
Type	Description
Collection

clear()

public Collection.Builder clear()

Returns
Type	Description
Collection.Builder

Overrides

GeneratedMessage.Builder<BuilderType>.clear()

clearCaseName()

public Collection.Builder clearCaseName()

The resource name of the Case that this collection belongs to. Example: projects/{project id}/locations/{region}/chronicle/cases/{internal_case_id}

string case_name = 14;

Returns
Type	Description
Collection.Builder	This builder for chaining.

clearCollectionElements()

public Collection.Builder clearCollectionElements()

Constituent elements of the collection. Each element shares an association that groups it together and is a component of the overall collection. For example, a detection collection may have several constituent elements that each share a correlation association that together represent a particular pattern or behavior.

repeated .google.backstory.Element collection_elements = 9;

Returns
Type	Description
Collection.Builder

clearCreatedTime()

public Collection.Builder clearCreatedTime()

Time the collection was created.

.google.protobuf.Timestamp created_time = 5;

Returns
Type	Description
Collection.Builder

clearDataAccessScope()

public Collection.Builder clearDataAccessScope()

The resource name of the DataAccessScope of this collection.

string data_access_scope = 19;

Returns
Type	Description
Collection.Builder	This builder for chaining.

clearDetection()

public Collection.Builder clearDetection()

Detection metadata for findings that represent detections, can include rule details, machine learning model metadata, and indicators implicated in the detection (using the .about field).

repeated .google.backstory.SecurityResult detection = 3;

Returns
Type	Description
Collection.Builder

clearDetectionTime()

public Collection.Builder clearDetectionTime()

Timestamp within the time_window related to the time of the collection_elements. For Rule Detections, this timestamp is the end of the the time_window for multi-event rules or the time of the event for single event rules. For late-arriving events that trigger new alerts, the detection_time will be the event time of the event.

.google.protobuf.Timestamp detection_time = 10;

Returns
Type	Description
Collection.Builder

clearDetectionTimingDetails()

public Collection.Builder clearDetectionTimingDetails()

Detection timing details for the collection. These details are used to determine prossible causes of latency for the detection. This field is only set for detections that are generated by rules.

repeated .google.backstory.Collection.DetectionTimingDetails detection_timing_details = 20;

Returns
Type	Description
Collection.Builder	This builder for chaining.

clearId()

public Collection.Builder clearId()

Unique ID for the collection. The ID is specific to the type of collection. For example, with rule detections this is the detection ID.

string id = 7;

Returns
Type	Description
Collection.Builder	This builder for chaining.

clearIdNamespace()

public Collection.Builder clearIdNamespace()

The ID namespace used for the Collection.

.google.backstory.Id.Namespace id_namespace = 12;

Returns
Type	Description
Collection.Builder	This builder for chaining.

clearInvestigation()

public Collection.Builder clearInvestigation()

Consolidated investigation details (categorization, status, etc) typically for collections that begin as detection findings and then evolve with analyst action and feedback into investigations around the detection output.

.google.backstory.Investigation investigation = 4;

Returns
Type	Description
Collection.Builder

clearLastUpdatedTime()

public Collection.Builder clearLastUpdatedTime()

Time the collection was last updated.

.google.protobuf.Timestamp last_updated_time = 6;

Returns
Type	Description
Collection.Builder

clearLatencyMetrics()

public Collection.Builder clearLatencyMetrics()

The latency metrics for the specific detection. These metrics are calculated from ALL of the events that contribute to the detection, not just the sampled ones.

.google.backstory.LatencyMetrics latency_metrics = 21;

Returns
Type	Description
Collection.Builder

clearResponsePlatformInfo()

public Collection.Builder clearResponsePlatformInfo()

Alert related info of this same alert in customer's SOAR platform.

.google.backstory.ResponsePlatformInfo response_platform_info = 13;

Returns
Type	Description
Collection.Builder

clearRuleRunFrequency()

public Collection.Builder clearRuleRunFrequency()

The run frequency of the rule when it generated the detection.

.google.backstory.Collection.RunFrequency rule_run_frequency = 22;

Returns
Type	Description
Collection.Builder	This builder for chaining.

clearSimulatedEventCount()

public Collection.Builder clearSimulatedEventCount()

The total number of simulated events that contributed to this detection. Simulated events are realistic threat sequences (Raw Logs or UDM) programmatically delivered into the production ingestion pipeline to verify the entire detection lifecycle—from identification to action.

int64 simulated_event_count = 23;

Returns
Type	Description
Collection.Builder	This builder for chaining.

clearSimulatedEventNames()

public Collection.Builder clearSimulatedEventNames()

The set of all values from event ingestion_labels where SIMULATED is set as the key, for all simulated events that participated in this detection.

repeated string simulated_event_names = 24;

Returns
Type	Description
Collection.Builder	This builder for chaining.

clearSoarAlert()

public Collection.Builder clearSoarAlert()

A boolean field indicating that the alert is present in SOAR.

bool soar_alert = 17;

Returns
Type	Description
Collection.Builder	This builder for chaining.

clearSoarAlertMetadata()

public Collection.Builder clearSoarAlertMetadata()

Metadata fields of alerts coming from other SIEM systems via SOAR.

.google.backstory.SoarAlertMetadata soar_alert_metadata = 18;

Returns
Type	Description
Collection.Builder

clearTags()

public Collection.Builder clearTags()

Tags set by UC/DSML/RE for the Finding during creation.

repeated string tags = 11;

Returns
Type	Description
Collection.Builder	This builder for chaining.

clearTimeWindow()

public Collection.Builder clearTimeWindow()

Time interval that the collection represents.

.google.type.Interval time_window = 8;

Returns
Type	Description
Collection.Builder

clearType()

public Collection.Builder clearType()

What the collection represents.

.google.backstory.Collection.CollectionType type = 1;

Returns
Type	Description
Collection.Builder	This builder for chaining.

getCaseName()

public String getCaseName()

The resource name of the Case that this collection belongs to. Example: projects/{project id}/locations/{region}/chronicle/cases/{internal_case_id}

string case_name = 14;

Returns
Type	Description
String	The caseName.

getCaseNameBytes()

public ByteString getCaseNameBytes()

The resource name of the Case that this collection belongs to. Example: projects/{project id}/locations/{region}/chronicle/cases/{internal_case_id}

string case_name = 14;

Returns
Type	Description
ByteString	The bytes for caseName.

getCollectionElements(int index)

public Element getCollectionElements(int index)

Constituent elements of the collection. Each element shares an association that groups it together and is a component of the overall collection. For example, a detection collection may have several constituent elements that each share a correlation association that together represent a particular pattern or behavior.

repeated .google.backstory.Element collection_elements = 9;

Parameter
Name	Description
index	int

Returns
Type	Description
Element

getCollectionElementsBuilder(int index)

public Element.Builder getCollectionElementsBuilder(int index)

Constituent elements of the collection. Each element shares an association that groups it together and is a component of the overall collection. For example, a detection collection may have several constituent elements that each share a correlation association that together represent a particular pattern or behavior.

repeated .google.backstory.Element collection_elements = 9;

Parameter
Name	Description
index	int

Returns
Type	Description
Element.Builder

getCollectionElementsBuilderList()

public List<Element.Builder> getCollectionElementsBuilderList()

Constituent elements of the collection. Each element shares an association that groups it together and is a component of the overall collection. For example, a detection collection may have several constituent elements that each share a correlation association that together represent a particular pattern or behavior.

repeated .google.backstory.Element collection_elements = 9;

Returns
Type	Description
List<Builder>

getCollectionElementsCount()

public int getCollectionElementsCount()

Constituent elements of the collection. Each element shares an association that groups it together and is a component of the overall collection. For example, a detection collection may have several constituent elements that each share a correlation association that together represent a particular pattern or behavior.

repeated .google.backstory.Element collection_elements = 9;

Returns
Type	Description
int

getCollectionElementsList()

public List<Element> getCollectionElementsList()

Constituent elements of the collection. Each element shares an association that groups it together and is a component of the overall collection. For example, a detection collection may have several constituent elements that each share a correlation association that together represent a particular pattern or behavior.

repeated .google.backstory.Element collection_elements = 9;

Returns
Type	Description
List<Element>

getCollectionElementsOrBuilder(int index)

public ElementOrBuilder getCollectionElementsOrBuilder(int index)

Constituent elements of the collection. Each element shares an association that groups it together and is a component of the overall collection. For example, a detection collection may have several constituent elements that each share a correlation association that together represent a particular pattern or behavior.

repeated .google.backstory.Element collection_elements = 9;

Parameter
Name	Description
index	int

Returns
Type	Description
ElementOrBuilder

getCollectionElementsOrBuilderList()

public List<? extends ElementOrBuilder> getCollectionElementsOrBuilderList()

Constituent elements of the collection. Each element shares an association that groups it together and is a component of the overall collection. For example, a detection collection may have several constituent elements that each share a correlation association that together represent a particular pattern or behavior.

repeated .google.backstory.Element collection_elements = 9;

Returns
Type	Description
List<? extends com.google.backstory.ElementOrBuilder>

getCreatedTime()

public Timestamp getCreatedTime()

Time the collection was created.

.google.protobuf.Timestamp created_time = 5;

Returns
Type	Description
Timestamp	The createdTime.

getCreatedTimeBuilder()

public Timestamp.Builder getCreatedTimeBuilder()

Time the collection was created.

.google.protobuf.Timestamp created_time = 5;

Returns
Type	Description
Builder

getCreatedTimeOrBuilder()

public TimestampOrBuilder getCreatedTimeOrBuilder()

Time the collection was created.

.google.protobuf.Timestamp created_time = 5;

Returns
Type	Description
TimestampOrBuilder

getDataAccessScope()

public String getDataAccessScope()

The resource name of the DataAccessScope of this collection.

string data_access_scope = 19;

Returns
Type	Description
String	The dataAccessScope.

getDataAccessScopeBytes()

public ByteString getDataAccessScopeBytes()

The resource name of the DataAccessScope of this collection.

string data_access_scope = 19;

Returns
Type	Description
ByteString	The bytes for dataAccessScope.

getDefaultInstanceForType()

public Collection getDefaultInstanceForType()

Returns
Type	Description
Collection

getDescriptorForType()

public Descriptors.Descriptor getDescriptorForType()

Returns
Type	Description
Descriptor

Overrides

GeneratedMessage.Builder<BuilderType>.getDescriptorForType()

getDetection(int index)

public SecurityResult getDetection(int index)

Detection metadata for findings that represent detections, can include rule details, machine learning model metadata, and indicators implicated in the detection (using the .about field).

repeated .google.backstory.SecurityResult detection = 3;

Parameter
Name	Description
index	int

Returns
Type	Description
SecurityResult

getDetectionBuilder(int index)

public SecurityResult.Builder getDetectionBuilder(int index)

Detection metadata for findings that represent detections, can include rule details, machine learning model metadata, and indicators implicated in the detection (using the .about field).

repeated .google.backstory.SecurityResult detection = 3;

Parameter
Name	Description
index	int

Returns
Type	Description
SecurityResult.Builder

getDetectionBuilderList()

public List<SecurityResult.Builder> getDetectionBuilderList()

Detection metadata for findings that represent detections, can include rule details, machine learning model metadata, and indicators implicated in the detection (using the .about field).

repeated .google.backstory.SecurityResult detection = 3;

Returns
Type	Description
List<Builder>

getDetectionCount()

public int getDetectionCount()

Detection metadata for findings that represent detections, can include rule details, machine learning model metadata, and indicators implicated in the detection (using the .about field).

repeated .google.backstory.SecurityResult detection = 3;

Returns
Type	Description
int

getDetectionList()

public List<SecurityResult> getDetectionList()

Detection metadata for findings that represent detections, can include rule details, machine learning model metadata, and indicators implicated in the detection (using the .about field).

repeated .google.backstory.SecurityResult detection = 3;

Returns
Type	Description
List<SecurityResult>

getDetectionOrBuilder(int index)

public SecurityResultOrBuilder getDetectionOrBuilder(int index)

Detection metadata for findings that represent detections, can include rule details, machine learning model metadata, and indicators implicated in the detection (using the .about field).

repeated .google.backstory.SecurityResult detection = 3;

Parameter
Name	Description
index	int

Returns
Type	Description
SecurityResultOrBuilder

getDetectionOrBuilderList()

public List<? extends SecurityResultOrBuilder> getDetectionOrBuilderList()

Detection metadata for findings that represent detections, can include rule details, machine learning model metadata, and indicators implicated in the detection (using the .about field).

repeated .google.backstory.SecurityResult detection = 3;

Returns
Type	Description
List<? extends com.google.backstory.SecurityResultOrBuilder>

getDetectionTime()

public Timestamp getDetectionTime()

Timestamp within the time_window related to the time of the collection_elements. For Rule Detections, this timestamp is the end of the the time_window for multi-event rules or the time of the event for single event rules. For late-arriving events that trigger new alerts, the detection_time will be the event time of the event.

.google.protobuf.Timestamp detection_time = 10;

Returns
Type	Description
Timestamp	The detectionTime.

getDetectionTimeBuilder()

public Timestamp.Builder getDetectionTimeBuilder()

Timestamp within the time_window related to the time of the collection_elements. For Rule Detections, this timestamp is the end of the the time_window for multi-event rules or the time of the event for single event rules. For late-arriving events that trigger new alerts, the detection_time will be the event time of the event.

.google.protobuf.Timestamp detection_time = 10;

Returns
Type	Description
Builder

getDetectionTimeOrBuilder()

public TimestampOrBuilder getDetectionTimeOrBuilder()

Timestamp within the time_window related to the time of the collection_elements. For Rule Detections, this timestamp is the end of the the time_window for multi-event rules or the time of the event for single event rules. For late-arriving events that trigger new alerts, the detection_time will be the event time of the event.

.google.protobuf.Timestamp detection_time = 10;

Returns
Type	Description
TimestampOrBuilder

getDetectionTimingDetails(int index)

public Collection.DetectionTimingDetails getDetectionTimingDetails(int index)

Detection timing details for the collection. These details are used to determine prossible causes of latency for the detection. This field is only set for detections that are generated by rules.

repeated .google.backstory.Collection.DetectionTimingDetails detection_timing_details = 20;

Parameter
Name	Description
index	int The index of the element to return.

Returns
Type	Description
Collection.DetectionTimingDetails	The detectionTimingDetails at the given index.

getDetectionTimingDetailsCount()

public int getDetectionTimingDetailsCount()

Detection timing details for the collection. These details are used to determine prossible causes of latency for the detection. This field is only set for detections that are generated by rules.

repeated .google.backstory.Collection.DetectionTimingDetails detection_timing_details = 20;

Returns
Type	Description
int	The count of detectionTimingDetails.

getDetectionTimingDetailsList()

public List<Collection.DetectionTimingDetails> getDetectionTimingDetailsList()

Detection timing details for the collection. These details are used to determine prossible causes of latency for the detection. This field is only set for detections that are generated by rules.

repeated .google.backstory.Collection.DetectionTimingDetails detection_timing_details = 20;

Returns
Type	Description
List<DetectionTimingDetails>	A list containing the detectionTimingDetails.

getDetectionTimingDetailsValue(int index)

public int getDetectionTimingDetailsValue(int index)

Detection timing details for the collection. These details are used to determine prossible causes of latency for the detection. This field is only set for detections that are generated by rules.

repeated .google.backstory.Collection.DetectionTimingDetails detection_timing_details = 20;

Parameter
Name	Description
index	int The index of the value to return.

Returns
Type	Description
int	The enum numeric value on the wire of detectionTimingDetails at the given index.

getDetectionTimingDetailsValueList()

public List<Integer> getDetectionTimingDetailsValueList()

Detection timing details for the collection. These details are used to determine prossible causes of latency for the detection. This field is only set for detections that are generated by rules.

repeated .google.backstory.Collection.DetectionTimingDetails detection_timing_details = 20;

Returns
Type	Description
List<Integer>	A list containing the enum numeric values on the wire for detectionTimingDetails.

getId()

public String getId()

Unique ID for the collection. The ID is specific to the type of collection. For example, with rule detections this is the detection ID.

string id = 7;

Returns
Type	Description
String	The id.

getIdBytes()

public ByteString getIdBytes()

Unique ID for the collection. The ID is specific to the type of collection. For example, with rule detections this is the detection ID.

string id = 7;

Returns
Type	Description
ByteString	The bytes for id.

getIdNamespace()

public Id.Namespace getIdNamespace()

The ID namespace used for the Collection.

.google.backstory.Id.Namespace id_namespace = 12;

Returns
Type	Description
Id.Namespace	The idNamespace.

getIdNamespaceValue()

public int getIdNamespaceValue()

The ID namespace used for the Collection.

.google.backstory.Id.Namespace id_namespace = 12;

Returns
Type	Description
int	The enum numeric value on the wire for idNamespace.

getInvestigation()

public Investigation getInvestigation()

Consolidated investigation details (categorization, status, etc) typically for collections that begin as detection findings and then evolve with analyst action and feedback into investigations around the detection output.

.google.backstory.Investigation investigation = 4;

Returns
Type	Description
Investigation	The investigation.

getInvestigationBuilder()

public Investigation.Builder getInvestigationBuilder()

Consolidated investigation details (categorization, status, etc) typically for collections that begin as detection findings and then evolve with analyst action and feedback into investigations around the detection output.

.google.backstory.Investigation investigation = 4;

Returns
Type	Description
Investigation.Builder

getInvestigationOrBuilder()

public InvestigationOrBuilder getInvestigationOrBuilder()

Consolidated investigation details (categorization, status, etc) typically for collections that begin as detection findings and then evolve with analyst action and feedback into investigations around the detection output.

.google.backstory.Investigation investigation = 4;

Returns
Type	Description
InvestigationOrBuilder

getLastUpdatedTime()

public Timestamp getLastUpdatedTime()

Time the collection was last updated.

.google.protobuf.Timestamp last_updated_time = 6;

Returns
Type	Description
Timestamp	The lastUpdatedTime.

getLastUpdatedTimeBuilder()

public Timestamp.Builder getLastUpdatedTimeBuilder()

Time the collection was last updated.

.google.protobuf.Timestamp last_updated_time = 6;

Returns
Type	Description
Builder

getLastUpdatedTimeOrBuilder()

public TimestampOrBuilder getLastUpdatedTimeOrBuilder()

Time the collection was last updated.

.google.protobuf.Timestamp last_updated_time = 6;

Returns
Type	Description
TimestampOrBuilder

getLatencyMetrics()

public LatencyMetrics getLatencyMetrics()

The latency metrics for the specific detection. These metrics are calculated from ALL of the events that contribute to the detection, not just the sampled ones.

.google.backstory.LatencyMetrics latency_metrics = 21;

Returns
Type	Description
LatencyMetrics	The latencyMetrics.

getLatencyMetricsBuilder()

public LatencyMetrics.Builder getLatencyMetricsBuilder()

The latency metrics for the specific detection. These metrics are calculated from ALL of the events that contribute to the detection, not just the sampled ones.

.google.backstory.LatencyMetrics latency_metrics = 21;

Returns
Type	Description
LatencyMetrics.Builder

getLatencyMetricsOrBuilder()

public LatencyMetricsOrBuilder getLatencyMetricsOrBuilder()

The latency metrics for the specific detection. These metrics are calculated from ALL of the events that contribute to the detection, not just the sampled ones.

.google.backstory.LatencyMetrics latency_metrics = 21;

Returns
Type	Description
LatencyMetricsOrBuilder

getResponsePlatformInfo()

public ResponsePlatformInfo getResponsePlatformInfo()

Alert related info of this same alert in customer's SOAR platform.

.google.backstory.ResponsePlatformInfo response_platform_info = 13;

Returns
Type	Description
ResponsePlatformInfo	The responsePlatformInfo.

getResponsePlatformInfoBuilder()

public ResponsePlatformInfo.Builder getResponsePlatformInfoBuilder()

Alert related info of this same alert in customer's SOAR platform.

.google.backstory.ResponsePlatformInfo response_platform_info = 13;

Returns
Type	Description
ResponsePlatformInfo.Builder

getResponsePlatformInfoOrBuilder()

public ResponsePlatformInfoOrBuilder getResponsePlatformInfoOrBuilder()

Alert related info of this same alert in customer's SOAR platform.

.google.backstory.ResponsePlatformInfo response_platform_info = 13;

Returns
Type	Description
ResponsePlatformInfoOrBuilder

getRuleRunFrequency()

public Collection.RunFrequency getRuleRunFrequency()

The run frequency of the rule when it generated the detection.

.google.backstory.Collection.RunFrequency rule_run_frequency = 22;

Returns
Type	Description
Collection.RunFrequency	The ruleRunFrequency.

getRuleRunFrequencyValue()

public int getRuleRunFrequencyValue()

The run frequency of the rule when it generated the detection.

.google.backstory.Collection.RunFrequency rule_run_frequency = 22;

Returns
Type	Description
int	The enum numeric value on the wire for ruleRunFrequency.

getSimulatedEventCount()

public long getSimulatedEventCount()

The total number of simulated events that contributed to this detection. Simulated events are realistic threat sequences (Raw Logs or UDM) programmatically delivered into the production ingestion pipeline to verify the entire detection lifecycle—from identification to action.

int64 simulated_event_count = 23;

Returns
Type	Description
long	The simulatedEventCount.

getSimulatedEventNames(int index)

public String getSimulatedEventNames(int index)

The set of all values from event ingestion_labels where SIMULATED is set as the key, for all simulated events that participated in this detection.

repeated string simulated_event_names = 24;

Parameter
Name	Description
index	int The index of the element to return.

Returns
Type	Description
String	The simulatedEventNames at the given index.

getSimulatedEventNamesBytes(int index)

public ByteString getSimulatedEventNamesBytes(int index)

The set of all values from event ingestion_labels where SIMULATED is set as the key, for all simulated events that participated in this detection.

repeated string simulated_event_names = 24;

Parameter
Name	Description
index	int The index of the value to return.

Returns
Type	Description
ByteString	The bytes of the simulatedEventNames at the given index.

getSimulatedEventNamesCount()

public int getSimulatedEventNamesCount()

The set of all values from event ingestion_labels where SIMULATED is set as the key, for all simulated events that participated in this detection.

repeated string simulated_event_names = 24;

Returns
Type	Description
int	The count of simulatedEventNames.

getSimulatedEventNamesList()

public ProtocolStringList getSimulatedEventNamesList()

The set of all values from event ingestion_labels where SIMULATED is set as the key, for all simulated events that participated in this detection.

repeated string simulated_event_names = 24;

Returns
Type	Description
ProtocolStringList	A list containing the simulatedEventNames.

getSoarAlert()

public boolean getSoarAlert()

A boolean field indicating that the alert is present in SOAR.

bool soar_alert = 17;

Returns
Type	Description
boolean	The soarAlert.

getSoarAlertMetadata()

public SoarAlertMetadata getSoarAlertMetadata()

Metadata fields of alerts coming from other SIEM systems via SOAR.

.google.backstory.SoarAlertMetadata soar_alert_metadata = 18;

Returns
Type	Description
SoarAlertMetadata	The soarAlertMetadata.

getSoarAlertMetadataBuilder()

public SoarAlertMetadata.Builder getSoarAlertMetadataBuilder()

Metadata fields of alerts coming from other SIEM systems via SOAR.

.google.backstory.SoarAlertMetadata soar_alert_metadata = 18;

Returns
Type	Description
SoarAlertMetadata.Builder

getSoarAlertMetadataOrBuilder()

public SoarAlertMetadataOrBuilder getSoarAlertMetadataOrBuilder()

Metadata fields of alerts coming from other SIEM systems via SOAR.

.google.backstory.SoarAlertMetadata soar_alert_metadata = 18;

Returns
Type	Description
SoarAlertMetadataOrBuilder

getTags(int index)

public String getTags(int index)

Tags set by UC/DSML/RE for the Finding during creation.

repeated string tags = 11;

Parameter
Name	Description
index	int The index of the element to return.

Returns
Type	Description
String	The tags at the given index.

getTagsBytes(int index)

public ByteString getTagsBytes(int index)

Tags set by UC/DSML/RE for the Finding during creation.

repeated string tags = 11;

Parameter
Name	Description
index	int The index of the value to return.

Returns
Type	Description
ByteString	The bytes of the tags at the given index.

getTagsCount()

public int getTagsCount()

Tags set by UC/DSML/RE for the Finding during creation.

repeated string tags = 11;

Returns
Type	Description
int	The count of tags.

getTagsList()

public ProtocolStringList getTagsList()

Tags set by UC/DSML/RE for the Finding during creation.

repeated string tags = 11;

Returns
Type	Description
ProtocolStringList	A list containing the tags.

getTimeWindow()

public Interval getTimeWindow()

Time interval that the collection represents.

.google.type.Interval time_window = 8;

Returns
Type	Description
com.google.type.Interval	The timeWindow.

getTimeWindowBuilder()

public Interval.Builder getTimeWindowBuilder()

Time interval that the collection represents.

.google.type.Interval time_window = 8;

Returns
Type	Description
com.google.type.Interval.Builder

getTimeWindowOrBuilder()

public IntervalOrBuilder getTimeWindowOrBuilder()

Time interval that the collection represents.

.google.type.Interval time_window = 8;

Returns
Type	Description
com.google.type.IntervalOrBuilder

getType()

public Collection.CollectionType getType()

What the collection represents.

.google.backstory.Collection.CollectionType type = 1;

Returns
Type	Description
Collection.CollectionType	The type.

getTypeValue()

public int getTypeValue()

What the collection represents.

.google.backstory.Collection.CollectionType type = 1;

Returns
Type	Description
int	The enum numeric value on the wire for type.

hasCreatedTime()

public boolean hasCreatedTime()

Time the collection was created.

.google.protobuf.Timestamp created_time = 5;

Returns
Type	Description
boolean	Whether the createdTime field is set.

hasDetectionTime()

public boolean hasDetectionTime()

Timestamp within the time_window related to the time of the collection_elements. For Rule Detections, this timestamp is the end of the the time_window for multi-event rules or the time of the event for single event rules. For late-arriving events that trigger new alerts, the detection_time will be the event time of the event.

.google.protobuf.Timestamp detection_time = 10;

Returns
Type	Description
boolean	Whether the detectionTime field is set.

hasInvestigation()

public boolean hasInvestigation()

Consolidated investigation details (categorization, status, etc) typically for collections that begin as detection findings and then evolve with analyst action and feedback into investigations around the detection output.

.google.backstory.Investigation investigation = 4;

Returns
Type	Description
boolean	Whether the investigation field is set.

hasLastUpdatedTime()

public boolean hasLastUpdatedTime()

Time the collection was last updated.

.google.protobuf.Timestamp last_updated_time = 6;

Returns
Type	Description
boolean	Whether the lastUpdatedTime field is set.

hasLatencyMetrics()

public boolean hasLatencyMetrics()

The latency metrics for the specific detection. These metrics are calculated from ALL of the events that contribute to the detection, not just the sampled ones.

.google.backstory.LatencyMetrics latency_metrics = 21;

Returns
Type	Description
boolean	Whether the latencyMetrics field is set.

hasResponsePlatformInfo()

public boolean hasResponsePlatformInfo()

Alert related info of this same alert in customer's SOAR platform.

.google.backstory.ResponsePlatformInfo response_platform_info = 13;

Returns
Type	Description
boolean	Whether the responsePlatformInfo field is set.

hasSoarAlertMetadata()

public boolean hasSoarAlertMetadata()

Metadata fields of alerts coming from other SIEM systems via SOAR.

.google.backstory.SoarAlertMetadata soar_alert_metadata = 18;

Returns
Type	Description
boolean	Whether the soarAlertMetadata field is set.

hasTimeWindow()

public boolean hasTimeWindow()

Time interval that the collection represents.

.google.type.Interval time_window = 8;

Returns
Type	Description
boolean	Whether the timeWindow field is set.

internalGetFieldAccessorTable()

protected GeneratedMessage.FieldAccessorTable internalGetFieldAccessorTable()

Returns
Type	Description
FieldAccessorTable

Overrides

GeneratedMessage.Builder<BuilderType>.internalGetFieldAccessorTable()

isInitialized()

public final boolean isInitialized()

Returns
Type	Description
boolean

Overrides

GeneratedMessage.Builder<BuilderType>.isInitialized()

mergeCreatedTime(Timestamp value)

public Collection.Builder mergeCreatedTime(Timestamp value)

Time the collection was created.

.google.protobuf.Timestamp created_time = 5;

Parameter
Name	Description
value	Timestamp

Returns
Type	Description
Collection.Builder

mergeDetectionTime(Timestamp value)

public Collection.Builder mergeDetectionTime(Timestamp value)

Timestamp within the time_window related to the time of the collection_elements. For Rule Detections, this timestamp is the end of the the time_window for multi-event rules or the time of the event for single event rules. For late-arriving events that trigger new alerts, the detection_time will be the event time of the event.

.google.protobuf.Timestamp detection_time = 10;

Parameter
Name	Description
value	Timestamp

Returns
Type	Description
Collection.Builder

mergeFrom(Collection other)

public Collection.Builder mergeFrom(Collection other)

Parameter
Name	Description
other	Collection

Returns
Type	Description
Collection.Builder

mergeFrom(CodedInputStream input, ExtensionRegistryLite extensionRegistry)

public Collection.Builder mergeFrom(CodedInputStream input, ExtensionRegistryLite extensionRegistry)

Parameters
Name	Description
input	CodedInputStream
extensionRegistry	ExtensionRegistryLite

Returns
Type	Description
Collection.Builder

Overrides

AbstractMessage.Builder<BuilderType>.mergeFrom(CodedInputStream input, ExtensionRegistryLite extensionRegistry)

Exceptions
Type	Description
IOException

mergeFrom(Message other)

public Collection.Builder mergeFrom(Message other)

Parameter
Name	Description
other	Message

Returns
Type	Description
Collection.Builder

Overrides

AbstractMessage.Builder<BuilderType>.mergeFrom(Message other)

mergeInvestigation(Investigation value)

public Collection.Builder mergeInvestigation(Investigation value)

Consolidated investigation details (categorization, status, etc) typically for collections that begin as detection findings and then evolve with analyst action and feedback into investigations around the detection output.

.google.backstory.Investigation investigation = 4;

Parameter
Name	Description
value	Investigation

Returns
Type	Description
Collection.Builder

mergeLastUpdatedTime(Timestamp value)

public Collection.Builder mergeLastUpdatedTime(Timestamp value)

Time the collection was last updated.

.google.protobuf.Timestamp last_updated_time = 6;

Parameter
Name	Description
value	Timestamp

Returns
Type	Description
Collection.Builder

mergeLatencyMetrics(LatencyMetrics value)

public Collection.Builder mergeLatencyMetrics(LatencyMetrics value)

The latency metrics for the specific detection. These metrics are calculated from ALL of the events that contribute to the detection, not just the sampled ones.

.google.backstory.LatencyMetrics latency_metrics = 21;

Parameter
Name	Description
value	LatencyMetrics

Returns
Type	Description
Collection.Builder

mergeResponsePlatformInfo(ResponsePlatformInfo value)

public Collection.Builder mergeResponsePlatformInfo(ResponsePlatformInfo value)

Alert related info of this same alert in customer's SOAR platform.

.google.backstory.ResponsePlatformInfo response_platform_info = 13;

Parameter
Name	Description
value	ResponsePlatformInfo

Returns
Type	Description
Collection.Builder

mergeSoarAlertMetadata(SoarAlertMetadata value)

public Collection.Builder mergeSoarAlertMetadata(SoarAlertMetadata value)

Metadata fields of alerts coming from other SIEM systems via SOAR.

.google.backstory.SoarAlertMetadata soar_alert_metadata = 18;

Parameter
Name	Description
value	SoarAlertMetadata

Returns
Type	Description
Collection.Builder

mergeTimeWindow(Interval value)

public Collection.Builder mergeTimeWindow(Interval value)

Time interval that the collection represents.

.google.type.Interval time_window = 8;

Parameter
Name	Description
value	com.google.type.Interval

Returns
Type	Description
Collection.Builder

removeCollectionElements(int index)

public Collection.Builder removeCollectionElements(int index)

Constituent elements of the collection. Each element shares an association that groups it together and is a component of the overall collection. For example, a detection collection may have several constituent elements that each share a correlation association that together represent a particular pattern or behavior.

repeated .google.backstory.Element collection_elements = 9;

Parameter
Name	Description
index	int

Returns
Type	Description
Collection.Builder

removeDetection(int index)

public Collection.Builder removeDetection(int index)

Detection metadata for findings that represent detections, can include rule details, machine learning model metadata, and indicators implicated in the detection (using the .about field).

repeated .google.backstory.SecurityResult detection = 3;

Parameter
Name	Description
index	int

Returns
Type	Description
Collection.Builder

setCaseName(String value)

public Collection.Builder setCaseName(String value)

The resource name of the Case that this collection belongs to. Example: projects/{project id}/locations/{region}/chronicle/cases/{internal_case_id}

string case_name = 14;

Parameter
Name	Description
value	String The caseName to set.

Returns
Type	Description
Collection.Builder	This builder for chaining.

setCaseNameBytes(ByteString value)

public Collection.Builder setCaseNameBytes(ByteString value)

The resource name of the Case that this collection belongs to. Example: projects/{project id}/locations/{region}/chronicle/cases/{internal_case_id}

string case_name = 14;

Parameter
Name	Description
value	ByteString The bytes for caseName to set.

Returns
Type	Description
Collection.Builder	This builder for chaining.

setCollectionElements(int index, Element value)

public Collection.Builder setCollectionElements(int index, Element value)

Constituent elements of the collection. Each element shares an association that groups it together and is a component of the overall collection. For example, a detection collection may have several constituent elements that each share a correlation association that together represent a particular pattern or behavior.

repeated .google.backstory.Element collection_elements = 9;

Parameters
Name	Description
index	int
value	Element

Returns
Type	Description
Collection.Builder

setCollectionElements(int index, Element.Builder builderForValue)

public Collection.Builder setCollectionElements(int index, Element.Builder builderForValue)

Constituent elements of the collection. Each element shares an association that groups it together and is a component of the overall collection. For example, a detection collection may have several constituent elements that each share a correlation association that together represent a particular pattern or behavior.

repeated .google.backstory.Element collection_elements = 9;

Parameters
Name	Description
index	int
builderForValue	Element.Builder

Returns
Type	Description
Collection.Builder

setCreatedTime(Timestamp value)

public Collection.Builder setCreatedTime(Timestamp value)

Time the collection was created.

.google.protobuf.Timestamp created_time = 5;

Parameter
Name	Description
value	Timestamp

Returns
Type	Description
Collection.Builder

setCreatedTime(Timestamp.Builder builderForValue)

public Collection.Builder setCreatedTime(Timestamp.Builder builderForValue)

Time the collection was created.

.google.protobuf.Timestamp created_time = 5;

Parameter
Name	Description
builderForValue	Builder

Returns
Type	Description
Collection.Builder

setDataAccessScope(String value)

public Collection.Builder setDataAccessScope(String value)

The resource name of the DataAccessScope of this collection.

string data_access_scope = 19;

Parameter
Name	Description
value	String The dataAccessScope to set.

Returns
Type	Description
Collection.Builder	This builder for chaining.

setDataAccessScopeBytes(ByteString value)

public Collection.Builder setDataAccessScopeBytes(ByteString value)

The resource name of the DataAccessScope of this collection.

string data_access_scope = 19;

Parameter
Name	Description
value	ByteString The bytes for dataAccessScope to set.

Returns
Type	Description
Collection.Builder	This builder for chaining.

setDetection(int index, SecurityResult value)

public Collection.Builder setDetection(int index, SecurityResult value)

Detection metadata for findings that represent detections, can include rule details, machine learning model metadata, and indicators implicated in the detection (using the .about field).

repeated .google.backstory.SecurityResult detection = 3;

Parameters
Name	Description
index	int
value	SecurityResult

Returns
Type	Description
Collection.Builder

setDetection(int index, SecurityResult.Builder builderForValue)

public Collection.Builder setDetection(int index, SecurityResult.Builder builderForValue)

Detection metadata for findings that represent detections, can include rule details, machine learning model metadata, and indicators implicated in the detection (using the .about field).

repeated .google.backstory.SecurityResult detection = 3;

Parameters
Name	Description
index	int
builderForValue	SecurityResult.Builder

Returns
Type	Description
Collection.Builder

setDetectionTime(Timestamp value)

public Collection.Builder setDetectionTime(Timestamp value)

Timestamp within the time_window related to the time of the collection_elements. For Rule Detections, this timestamp is the end of the the time_window for multi-event rules or the time of the event for single event rules. For late-arriving events that trigger new alerts, the detection_time will be the event time of the event.

.google.protobuf.Timestamp detection_time = 10;

Parameter
Name	Description
value	Timestamp

Returns
Type	Description
Collection.Builder

setDetectionTime(Timestamp.Builder builderForValue)

public Collection.Builder setDetectionTime(Timestamp.Builder builderForValue)

Timestamp within the time_window related to the time of the collection_elements. For Rule Detections, this timestamp is the end of the the time_window for multi-event rules or the time of the event for single event rules. For late-arriving events that trigger new alerts, the detection_time will be the event time of the event.

.google.protobuf.Timestamp detection_time = 10;

Parameter
Name	Description
builderForValue	Builder

Returns
Type	Description
Collection.Builder

setDetectionTimingDetails(int index, Collection.DetectionTimingDetails value)

public Collection.Builder setDetectionTimingDetails(int index, Collection.DetectionTimingDetails value)

Detection timing details for the collection. These details are used to determine prossible causes of latency for the detection. This field is only set for detections that are generated by rules.

repeated .google.backstory.Collection.DetectionTimingDetails detection_timing_details = 20;

Parameters
Name	Description
index	int The index to set the value at.
value	Collection.DetectionTimingDetails The detectionTimingDetails to set.

Returns
Type	Description
Collection.Builder	This builder for chaining.

setDetectionTimingDetailsValue(int index, int value)

public Collection.Builder setDetectionTimingDetailsValue(int index, int value)

Detection timing details for the collection. These details are used to determine prossible causes of latency for the detection. This field is only set for detections that are generated by rules.

repeated .google.backstory.Collection.DetectionTimingDetails detection_timing_details = 20;

Parameters
Name	Description
index	int The index to set the value at.
value	int The enum numeric value on the wire for detectionTimingDetails to set.

Returns
Type	Description
Collection.Builder	This builder for chaining.

setId(String value)

public Collection.Builder setId(String value)

Unique ID for the collection. The ID is specific to the type of collection. For example, with rule detections this is the detection ID.

string id = 7;

Parameter
Name	Description
value	String The id to set.

Returns
Type	Description
Collection.Builder	This builder for chaining.

setIdBytes(ByteString value)

public Collection.Builder setIdBytes(ByteString value)

Unique ID for the collection. The ID is specific to the type of collection. For example, with rule detections this is the detection ID.

string id = 7;

Parameter
Name	Description
value	ByteString The bytes for id to set.

Returns
Type	Description
Collection.Builder	This builder for chaining.

setIdNamespace(Id.Namespace value)

public Collection.Builder setIdNamespace(Id.Namespace value)

The ID namespace used for the Collection.

.google.backstory.Id.Namespace id_namespace = 12;

Parameter
Name	Description
value	Id.Namespace The idNamespace to set.

Returns
Type	Description
Collection.Builder	This builder for chaining.

setIdNamespaceValue(int value)

public Collection.Builder setIdNamespaceValue(int value)

The ID namespace used for the Collection.

.google.backstory.Id.Namespace id_namespace = 12;

Parameter
Name	Description
value	int The enum numeric value on the wire for idNamespace to set.

Returns
Type	Description
Collection.Builder	This builder for chaining.

setInvestigation(Investigation value)

public Collection.Builder setInvestigation(Investigation value)

Consolidated investigation details (categorization, status, etc) typically for collections that begin as detection findings and then evolve with analyst action and feedback into investigations around the detection output.

.google.backstory.Investigation investigation = 4;

Parameter
Name	Description
value	Investigation

Returns
Type	Description
Collection.Builder

setInvestigation(Investigation.Builder builderForValue)

public Collection.Builder setInvestigation(Investigation.Builder builderForValue)

Consolidated investigation details (categorization, status, etc) typically for collections that begin as detection findings and then evolve with analyst action and feedback into investigations around the detection output.

.google.backstory.Investigation investigation = 4;

Parameter
Name	Description
builderForValue	Investigation.Builder

Returns
Type	Description
Collection.Builder

setLastUpdatedTime(Timestamp value)

public Collection.Builder setLastUpdatedTime(Timestamp value)

Time the collection was last updated.

.google.protobuf.Timestamp last_updated_time = 6;

Parameter
Name	Description
value	Timestamp

Returns
Type	Description
Collection.Builder

setLastUpdatedTime(Timestamp.Builder builderForValue)

public Collection.Builder setLastUpdatedTime(Timestamp.Builder builderForValue)

Time the collection was last updated.

.google.protobuf.Timestamp last_updated_time = 6;

Parameter
Name	Description
builderForValue	Builder

Returns
Type	Description
Collection.Builder

setLatencyMetrics(LatencyMetrics value)

public Collection.Builder setLatencyMetrics(LatencyMetrics value)

The latency metrics for the specific detection. These metrics are calculated from ALL of the events that contribute to the detection, not just the sampled ones.

.google.backstory.LatencyMetrics latency_metrics = 21;

Parameter
Name	Description
value	LatencyMetrics

Returns
Type	Description
Collection.Builder

setLatencyMetrics(LatencyMetrics.Builder builderForValue)

public Collection.Builder setLatencyMetrics(LatencyMetrics.Builder builderForValue)

The latency metrics for the specific detection. These metrics are calculated from ALL of the events that contribute to the detection, not just the sampled ones.

.google.backstory.LatencyMetrics latency_metrics = 21;

Parameter
Name	Description
builderForValue	LatencyMetrics.Builder

Returns
Type	Description
Collection.Builder

setResponsePlatformInfo(ResponsePlatformInfo value)

public Collection.Builder setResponsePlatformInfo(ResponsePlatformInfo value)

Alert related info of this same alert in customer's SOAR platform.

.google.backstory.ResponsePlatformInfo response_platform_info = 13;

Parameter
Name	Description
value	ResponsePlatformInfo

Returns
Type	Description
Collection.Builder

setResponsePlatformInfo(ResponsePlatformInfo.Builder builderForValue)

public Collection.Builder setResponsePlatformInfo(ResponsePlatformInfo.Builder builderForValue)

Alert related info of this same alert in customer's SOAR platform.

.google.backstory.ResponsePlatformInfo response_platform_info = 13;

Parameter
Name	Description
builderForValue	ResponsePlatformInfo.Builder

Returns
Type	Description
Collection.Builder

setRuleRunFrequency(Collection.RunFrequency value)

public Collection.Builder setRuleRunFrequency(Collection.RunFrequency value)

The run frequency of the rule when it generated the detection.

.google.backstory.Collection.RunFrequency rule_run_frequency = 22;

Parameter
Name	Description
value	Collection.RunFrequency The ruleRunFrequency to set.

Returns
Type	Description
Collection.Builder	This builder for chaining.

setRuleRunFrequencyValue(int value)

public Collection.Builder setRuleRunFrequencyValue(int value)

The run frequency of the rule when it generated the detection.

.google.backstory.Collection.RunFrequency rule_run_frequency = 22;

Parameter
Name	Description
value	int The enum numeric value on the wire for ruleRunFrequency to set.

Returns
Type	Description
Collection.Builder	This builder for chaining.

setSimulatedEventCount(long value)

public Collection.Builder setSimulatedEventCount(long value)

The total number of simulated events that contributed to this detection. Simulated events are realistic threat sequences (Raw Logs or UDM) programmatically delivered into the production ingestion pipeline to verify the entire detection lifecycle—from identification to action.

int64 simulated_event_count = 23;

Parameter
Name	Description
value	long The simulatedEventCount to set.

Returns
Type	Description
Collection.Builder	This builder for chaining.

setSimulatedEventNames(int index, String value)

public Collection.Builder setSimulatedEventNames(int index, String value)

The set of all values from event ingestion_labels where SIMULATED is set as the key, for all simulated events that participated in this detection.

repeated string simulated_event_names = 24;

Parameters
Name	Description
index	int The index to set the value at.
value	String The simulatedEventNames to set.

Returns
Type	Description
Collection.Builder	This builder for chaining.

setSoarAlert(boolean value)

public Collection.Builder setSoarAlert(boolean value)

A boolean field indicating that the alert is present in SOAR.

bool soar_alert = 17;

Parameter
Name	Description
value	boolean The soarAlert to set.

Returns
Type	Description
Collection.Builder	This builder for chaining.

setSoarAlertMetadata(SoarAlertMetadata value)

public Collection.Builder setSoarAlertMetadata(SoarAlertMetadata value)

Metadata fields of alerts coming from other SIEM systems via SOAR.

.google.backstory.SoarAlertMetadata soar_alert_metadata = 18;

Parameter
Name	Description
value	SoarAlertMetadata

Returns
Type	Description
Collection.Builder

setSoarAlertMetadata(SoarAlertMetadata.Builder builderForValue)

public Collection.Builder setSoarAlertMetadata(SoarAlertMetadata.Builder builderForValue)

Metadata fields of alerts coming from other SIEM systems via SOAR.

.google.backstory.SoarAlertMetadata soar_alert_metadata = 18;

Parameter
Name	Description
builderForValue	SoarAlertMetadata.Builder

Returns
Type	Description
Collection.Builder

setTags(int index, String value)

public Collection.Builder setTags(int index, String value)

Tags set by UC/DSML/RE for the Finding during creation.

repeated string tags = 11;

Parameters
Name	Description
index	int The index to set the value at.
value	String The tags to set.

Returns
Type	Description
Collection.Builder	This builder for chaining.

setTimeWindow(Interval value)

public Collection.Builder setTimeWindow(Interval value)

Time interval that the collection represents.

.google.type.Interval time_window = 8;

Parameter
Name	Description
value	com.google.type.Interval

Returns
Type	Description
Collection.Builder

setTimeWindow(Interval.Builder builderForValue)

public Collection.Builder setTimeWindow(Interval.Builder builderForValue)

Time interval that the collection represents.

.google.type.Interval time_window = 8;

Parameter
Name	Description
builderForValue	com.google.type.Interval.Builder

Returns
Type	Description
Collection.Builder

setType(Collection.CollectionType value)

public Collection.Builder setType(Collection.CollectionType value)

What the collection represents.

.google.backstory.Collection.CollectionType type = 1;

Parameter
Name	Description
value	Collection.CollectionType The type to set.

Returns
Type	Description
Collection.Builder	This builder for chaining.

setTypeValue(int value)

public Collection.Builder setTypeValue(int value)

What the collection represents.

.google.backstory.Collection.CollectionType type = 1;

Parameter
Name	Description
value	int The enum numeric value on the wire for type to set.

Returns
Type	Description
Collection.Builder	This builder for chaining.