Interface CollectionOrBuilder (0.3.0) 

public interface CollectionOrBuilder extends MessageOrBuilder

Implements

MessageOrBuilder

Methods

getCaseName()

public abstract String getCaseName()

The resource name of the Case that this collection belongs to. Example: projects/{project id}/locations/{region}/chronicle/cases/{internal_case_id}

string case_name = 14;

Returns
Type Description
String

The caseName.

getCaseNameBytes()

public abstract ByteString getCaseNameBytes()

The resource name of the Case that this collection belongs to. Example: projects/{project id}/locations/{region}/chronicle/cases/{internal_case_id}

string case_name = 14;

Returns
Type Description
ByteString

The bytes for caseName.

getCollectionElements(int index)

public abstract Element getCollectionElements(int index)

Constituent elements of the collection. Each element shares an association that groups it together and is a component of the overall collection. For example, a detection collection may have several constituent elements that each share a correlation association that together represent a particular pattern or behavior.

repeated .google.backstory.Element collection_elements = 9;

Parameter
Name Description
index int
Returns
Type Description
Element

getCollectionElementsCount()

public abstract int getCollectionElementsCount()

Constituent elements of the collection. Each element shares an association that groups it together and is a component of the overall collection. For example, a detection collection may have several constituent elements that each share a correlation association that together represent a particular pattern or behavior.

repeated .google.backstory.Element collection_elements = 9;

Returns
Type Description
int

getCollectionElementsList()

public abstract List<Element> getCollectionElementsList()

Constituent elements of the collection. Each element shares an association that groups it together and is a component of the overall collection. For example, a detection collection may have several constituent elements that each share a correlation association that together represent a particular pattern or behavior.

repeated .google.backstory.Element collection_elements = 9;

Returns
Type Description
List<Element>

getCollectionElementsOrBuilder(int index)

public abstract ElementOrBuilder getCollectionElementsOrBuilder(int index)

Constituent elements of the collection. Each element shares an association that groups it together and is a component of the overall collection. For example, a detection collection may have several constituent elements that each share a correlation association that together represent a particular pattern or behavior.

repeated .google.backstory.Element collection_elements = 9;

Parameter
Name Description
index int
Returns
Type Description
ElementOrBuilder

getCollectionElementsOrBuilderList()

public abstract List<? extends ElementOrBuilder> getCollectionElementsOrBuilderList()

Constituent elements of the collection. Each element shares an association that groups it together and is a component of the overall collection. For example, a detection collection may have several constituent elements that each share a correlation association that together represent a particular pattern or behavior.

repeated .google.backstory.Element collection_elements = 9;

Returns
Type Description
List<? extends com.google.backstory.ElementOrBuilder>

getCreatedTime()

public abstract Timestamp getCreatedTime()

Time the collection was created.

.google.protobuf.Timestamp created_time = 5;

Returns
Type Description
Timestamp

The createdTime.

getCreatedTimeOrBuilder()

public abstract TimestampOrBuilder getCreatedTimeOrBuilder()

Time the collection was created.

.google.protobuf.Timestamp created_time = 5;

Returns
Type Description
TimestampOrBuilder

getDataAccessScope()

public abstract String getDataAccessScope()

The resource name of the DataAccessScope of this collection.

string data_access_scope = 19;

Returns
Type Description
String

The dataAccessScope.

getDataAccessScopeBytes()

public abstract ByteString getDataAccessScopeBytes()

The resource name of the DataAccessScope of this collection.

string data_access_scope = 19;

Returns
Type Description
ByteString

The bytes for dataAccessScope.

getDetection(int index)

public abstract SecurityResult getDetection(int index)

Detection metadata for findings that represent detections, can include rule details, machine learning model metadata, and indicators implicated in the detection (using the .about field).

repeated .google.backstory.SecurityResult detection = 3;

Parameter
Name Description
index int
Returns
Type Description
SecurityResult

getDetectionCount()

public abstract int getDetectionCount()

Detection metadata for findings that represent detections, can include rule details, machine learning model metadata, and indicators implicated in the detection (using the .about field).

repeated .google.backstory.SecurityResult detection = 3;

Returns
Type Description
int

getDetectionList()

public abstract List<SecurityResult> getDetectionList()

Detection metadata for findings that represent detections, can include rule details, machine learning model metadata, and indicators implicated in the detection (using the .about field).

repeated .google.backstory.SecurityResult detection = 3;

Returns
Type Description
List<SecurityResult>

getDetectionOrBuilder(int index)

public abstract SecurityResultOrBuilder getDetectionOrBuilder(int index)

Detection metadata for findings that represent detections, can include rule details, machine learning model metadata, and indicators implicated in the detection (using the .about field).

repeated .google.backstory.SecurityResult detection = 3;

Parameter
Name Description
index int
Returns
Type Description
SecurityResultOrBuilder

getDetectionOrBuilderList()

public abstract List<? extends SecurityResultOrBuilder> getDetectionOrBuilderList()

Detection metadata for findings that represent detections, can include rule details, machine learning model metadata, and indicators implicated in the detection (using the .about field).

repeated .google.backstory.SecurityResult detection = 3;

Returns
Type Description
List<? extends com.google.backstory.SecurityResultOrBuilder>

getDetectionTime()

public abstract Timestamp getDetectionTime()

Timestamp within the time_window related to the time of the collection_elements. For Rule Detections, this timestamp is the end of the the time_window for multi-event rules or the time of the event for single event rules. For late-arriving events that trigger new alerts, the detection_time will be the event time of the event.

.google.protobuf.Timestamp detection_time = 10;

Returns
Type Description
Timestamp

The detectionTime.

getDetectionTimeOrBuilder()

public abstract TimestampOrBuilder getDetectionTimeOrBuilder()

Timestamp within the time_window related to the time of the collection_elements. For Rule Detections, this timestamp is the end of the the time_window for multi-event rules or the time of the event for single event rules. For late-arriving events that trigger new alerts, the detection_time will be the event time of the event.

.google.protobuf.Timestamp detection_time = 10;

Returns
Type Description
TimestampOrBuilder

getDetectionTimingDetails(int index)

public abstract Collection.DetectionTimingDetails getDetectionTimingDetails(int index)

Detection timing details for the collection. These details are used to determine prossible causes of latency for the detection. This field is only set for detections that are generated by rules.

repeated .google.backstory.Collection.DetectionTimingDetails detection_timing_details = 20;

Parameter
Name Description
index int

The index of the element to return.
Returns
Type Description
Collection.DetectionTimingDetails

The detectionTimingDetails at the given index.

getDetectionTimingDetailsCount()

public abstract int getDetectionTimingDetailsCount()

Detection timing details for the collection. These details are used to determine prossible causes of latency for the detection. This field is only set for detections that are generated by rules.

repeated .google.backstory.Collection.DetectionTimingDetails detection_timing_details = 20;

Returns
Type Description
int

The count of detectionTimingDetails.

getDetectionTimingDetailsList()

public abstract List<Collection.DetectionTimingDetails> getDetectionTimingDetailsList()

Detection timing details for the collection. These details are used to determine prossible causes of latency for the detection. This field is only set for detections that are generated by rules.

repeated .google.backstory.Collection.DetectionTimingDetails detection_timing_details = 20;

Returns
Type Description
List<DetectionTimingDetails>

A list containing the detectionTimingDetails.

getDetectionTimingDetailsValue(int index)

public abstract int getDetectionTimingDetailsValue(int index)

Detection timing details for the collection. These details are used to determine prossible causes of latency for the detection. This field is only set for detections that are generated by rules.

repeated .google.backstory.Collection.DetectionTimingDetails detection_timing_details = 20;

Parameter
Name Description
index int

The index of the value to return.
Returns
Type Description
int

The enum numeric value on the wire of detectionTimingDetails at the given index.

getDetectionTimingDetailsValueList()

public abstract List<Integer> getDetectionTimingDetailsValueList()

Detection timing details for the collection. These details are used to determine prossible causes of latency for the detection. This field is only set for detections that are generated by rules.

repeated .google.backstory.Collection.DetectionTimingDetails detection_timing_details = 20;

Returns
Type Description
List<Integer>

A list containing the enum numeric values on the wire for detectionTimingDetails.

getId()

public abstract String getId()

Unique ID for the collection. The ID is specific to the type of collection. For example, with rule detections this is the detection ID.

string id = 7;

Returns
Type Description
String

The id.

getIdBytes()

public abstract ByteString getIdBytes()

Unique ID for the collection. The ID is specific to the type of collection. For example, with rule detections this is the detection ID.

string id = 7;

Returns
Type Description
ByteString

The bytes for id.

getIdNamespace()

public abstract Id.Namespace getIdNamespace()

The ID namespace used for the Collection.

.google.backstory.Id.Namespace id_namespace = 12;

Returns
Type Description
Id.Namespace

The idNamespace.

getIdNamespaceValue()

public abstract int getIdNamespaceValue()

The ID namespace used for the Collection.

.google.backstory.Id.Namespace id_namespace = 12;

Returns
Type Description
int

The enum numeric value on the wire for idNamespace.

getInvestigation()

public abstract Investigation getInvestigation()

Consolidated investigation details (categorization, status, etc) typically for collections that begin as detection findings and then evolve with analyst action and feedback into investigations around the detection output.

.google.backstory.Investigation investigation = 4;

Returns
Type Description
Investigation

The investigation.

getInvestigationOrBuilder()

public abstract InvestigationOrBuilder getInvestigationOrBuilder()

Consolidated investigation details (categorization, status, etc) typically for collections that begin as detection findings and then evolve with analyst action and feedback into investigations around the detection output.

.google.backstory.Investigation investigation = 4;

Returns
Type Description
InvestigationOrBuilder

getLastUpdatedTime()

public abstract Timestamp getLastUpdatedTime()

Time the collection was last updated.

.google.protobuf.Timestamp last_updated_time = 6;

Returns
Type Description
Timestamp

The lastUpdatedTime.

getLastUpdatedTimeOrBuilder()

public abstract TimestampOrBuilder getLastUpdatedTimeOrBuilder()

Time the collection was last updated.

.google.protobuf.Timestamp last_updated_time = 6;

Returns
Type Description
TimestampOrBuilder

getLatencyMetrics()

public abstract LatencyMetrics getLatencyMetrics()

The latency metrics for the specific detection. These metrics are calculated from ALL of the events that contribute to the detection, not just the sampled ones.

.google.backstory.LatencyMetrics latency_metrics = 21;

Returns
Type Description
LatencyMetrics

The latencyMetrics.

getLatencyMetricsOrBuilder()

public abstract LatencyMetricsOrBuilder getLatencyMetricsOrBuilder()

The latency metrics for the specific detection. These metrics are calculated from ALL of the events that contribute to the detection, not just the sampled ones.

.google.backstory.LatencyMetrics latency_metrics = 21;

Returns
Type Description
LatencyMetricsOrBuilder

getResponsePlatformInfo()

public abstract ResponsePlatformInfo getResponsePlatformInfo()

Alert related info of this same alert in customer's SOAR platform.

.google.backstory.ResponsePlatformInfo response_platform_info = 13;

Returns
Type Description
ResponsePlatformInfo

The responsePlatformInfo.

getResponsePlatformInfoOrBuilder()

public abstract ResponsePlatformInfoOrBuilder getResponsePlatformInfoOrBuilder()

Alert related info of this same alert in customer's SOAR platform.

.google.backstory.ResponsePlatformInfo response_platform_info = 13;

Returns
Type Description
ResponsePlatformInfoOrBuilder

getRuleRunFrequency()

public abstract Collection.RunFrequency getRuleRunFrequency()

The run frequency of the rule when it generated the detection.

.google.backstory.Collection.RunFrequency rule_run_frequency = 22;

Returns
Type Description
Collection.RunFrequency

The ruleRunFrequency.

getRuleRunFrequencyValue()

public abstract int getRuleRunFrequencyValue()

The run frequency of the rule when it generated the detection.

.google.backstory.Collection.RunFrequency rule_run_frequency = 22;

Returns
Type Description
int

The enum numeric value on the wire for ruleRunFrequency.

getSimulatedEventCount()

public abstract long getSimulatedEventCount()

The total number of simulated events that contributed to this detection. Simulated events are realistic threat sequences (Raw Logs or UDM) programmatically delivered into the production ingestion pipeline to verify the entire detection lifecycle—from identification to action.

int64 simulated_event_count = 23;

Returns
Type Description
long

The simulatedEventCount.

getSimulatedEventNames(int index)

public abstract String getSimulatedEventNames(int index)

The set of all values from event ingestion_labels where SIMULATED is set as the key, for all simulated events that participated in this detection.

repeated string simulated_event_names = 24;

Parameter
Name Description
index int

The index of the element to return.
Returns
Type Description
String

The simulatedEventNames at the given index.

getSimulatedEventNamesBytes(int index)

public abstract ByteString getSimulatedEventNamesBytes(int index)

The set of all values from event ingestion_labels where SIMULATED is set as the key, for all simulated events that participated in this detection.

repeated string simulated_event_names = 24;

Parameter
Name Description
index int

The index of the value to return.
Returns
Type Description
ByteString

The bytes of the simulatedEventNames at the given index.

getSimulatedEventNamesCount()

public abstract int getSimulatedEventNamesCount()

The set of all values from event ingestion_labels where SIMULATED is set as the key, for all simulated events that participated in this detection.

repeated string simulated_event_names = 24;

Returns
Type Description
int

The count of simulatedEventNames.

getSimulatedEventNamesList()

public abstract List<String> getSimulatedEventNamesList()

The set of all values from event ingestion_labels where SIMULATED is set as the key, for all simulated events that participated in this detection.

repeated string simulated_event_names = 24;

Returns
Type Description
List<String>

A list containing the simulatedEventNames.

getSoarAlert()

public abstract boolean getSoarAlert()

A boolean field indicating that the alert is present in SOAR.

bool soar_alert = 17;

Returns
Type Description
boolean

The soarAlert.

getSoarAlertMetadata()

public abstract SoarAlertMetadata getSoarAlertMetadata()

Metadata fields of alerts coming from other SIEM systems via SOAR.

.google.backstory.SoarAlertMetadata soar_alert_metadata = 18;

Returns
Type Description
SoarAlertMetadata

The soarAlertMetadata.

getSoarAlertMetadataOrBuilder()

public abstract SoarAlertMetadataOrBuilder getSoarAlertMetadataOrBuilder()

Metadata fields of alerts coming from other SIEM systems via SOAR.

.google.backstory.SoarAlertMetadata soar_alert_metadata = 18;

Returns
Type Description
SoarAlertMetadataOrBuilder

getTags(int index)

public abstract String getTags(int index)

Tags set by UC/DSML/RE for the Finding during creation.

repeated string tags = 11;

Parameter
Name Description
index int

The index of the element to return.
Returns
Type Description
String

The tags at the given index.

getTagsBytes(int index)

public abstract ByteString getTagsBytes(int index)

Tags set by UC/DSML/RE for the Finding during creation.

repeated string tags = 11;

Parameter
Name Description
index int

The index of the value to return.
Returns
Type Description
ByteString

The bytes of the tags at the given index.

getTagsCount()

public abstract int getTagsCount()

Tags set by UC/DSML/RE for the Finding during creation.

repeated string tags = 11;

Returns
Type Description
int

The count of tags.

getTagsList()

public abstract List<String> getTagsList()

Tags set by UC/DSML/RE for the Finding during creation.

repeated string tags = 11;

Returns
Type Description
List<String>

A list containing the tags.

getTimeWindow()

public abstract Interval getTimeWindow()

Time interval that the collection represents.

.google.type.Interval time_window = 8;

Returns
Type Description
com.google.type.Interval

The timeWindow.

getTimeWindowOrBuilder()

public abstract IntervalOrBuilder getTimeWindowOrBuilder()

Time interval that the collection represents.

.google.type.Interval time_window = 8;

Returns
Type Description
com.google.type.IntervalOrBuilder

getType()

public abstract Collection.CollectionType getType()

What the collection represents.

.google.backstory.Collection.CollectionType type = 1;

Returns
Type Description
Collection.CollectionType

The type.

getTypeValue()

public abstract int getTypeValue()

What the collection represents.

.google.backstory.Collection.CollectionType type = 1;

Returns
Type Description
int

The enum numeric value on the wire for type.

hasCreatedTime()

public abstract boolean hasCreatedTime()

Time the collection was created.

.google.protobuf.Timestamp created_time = 5;

Returns
Type Description
boolean

Whether the createdTime field is set.

hasDetectionTime()

public abstract boolean hasDetectionTime()

Timestamp within the time_window related to the time of the collection_elements. For Rule Detections, this timestamp is the end of the the time_window for multi-event rules or the time of the event for single event rules. For late-arriving events that trigger new alerts, the detection_time will be the event time of the event.

.google.protobuf.Timestamp detection_time = 10;

Returns
Type Description
boolean

Whether the detectionTime field is set.

hasInvestigation()

public abstract boolean hasInvestigation()

Consolidated investigation details (categorization, status, etc) typically for collections that begin as detection findings and then evolve with analyst action and feedback into investigations around the detection output.

.google.backstory.Investigation investigation = 4;

Returns
Type Description
boolean

Whether the investigation field is set.

hasLastUpdatedTime()

public abstract boolean hasLastUpdatedTime()

Time the collection was last updated.

.google.protobuf.Timestamp last_updated_time = 6;

Returns
Type Description
boolean

Whether the lastUpdatedTime field is set.

hasLatencyMetrics()

public abstract boolean hasLatencyMetrics()

The latency metrics for the specific detection. These metrics are calculated from ALL of the events that contribute to the detection, not just the sampled ones.

.google.backstory.LatencyMetrics latency_metrics = 21;

Returns
Type Description
boolean

Whether the latencyMetrics field is set.

hasResponsePlatformInfo()

public abstract boolean hasResponsePlatformInfo()

Alert related info of this same alert in customer's SOAR platform.

.google.backstory.ResponsePlatformInfo response_platform_info = 13;

Returns
Type Description
boolean

Whether the responsePlatformInfo field is set.

hasSoarAlertMetadata()

public abstract boolean hasSoarAlertMetadata()

Metadata fields of alerts coming from other SIEM systems via SOAR.

.google.backstory.SoarAlertMetadata soar_alert_metadata = 18;

Returns
Type Description
boolean

Whether the soarAlertMetadata field is set.

hasTimeWindow()

public abstract boolean hasTimeWindow()

Time interval that the collection represents.

.google.type.Interval time_window = 8;

Returns
Type Description
boolean

Whether the timeWindow field is set.