Interface EntityRiskOrBuilder (0.3.0)

0.3.0 (latest) 0.2.0 0.1.0

public interface EntityRiskOrBuilder extends MessageOrBuilder

Implements

MessageOrBuilder

Methods

getDEPRECATEDRiskScore() (deprecated)

public abstract int getDEPRECATEDRiskScore()

Deprecated. google.backstory.EntityRisk.DEPRECATED_risk_score is deprecated. See backstory/entity_risk.proto;l=45

Deprecated risk score.

int32 DEPRECATED_risk_score = 3 [json_name = "DEPRECATEDRiskScore", deprecated = true];

Returns
Type	Description
int	The dEPRECATEDRiskScore.

getDetailUri()

public abstract String getDetailUri()

Link to the Google Security Operations UI with information about the entity risk score. If the SecOps instance has multiple frontend paths configured, this will be a relative path that can be used to construct the full URL.

string detail_uri = 13;

Returns
Type	Description
String	The detailUri.

getDetailUriBytes()

public abstract ByteString getDetailUriBytes()

Link to the Google Security Operations UI with information about the entity risk score. If the SecOps instance has multiple frontend paths configured, this will be a relative path that can be used to construct the full URL.

string detail_uri = 13;

Returns
Type	Description
ByteString	The bytes for detailUri.

getDetectionsCount()

public abstract int getDetectionsCount()

Number of detections that make up the risk score within the time window.

int32 detections_count = 5;

Returns
Type	Description
int	The detectionsCount.

getFirstDetectionTime()

public abstract Timestamp getFirstDetectionTime()

Timestamp of the first detection within the specified time window. This field is empty when there are no detections.

.google.protobuf.Timestamp first_detection_time = 6;

Returns
Type	Description
Timestamp	The firstDetectionTime.

getFirstDetectionTimeOrBuilder()

public abstract TimestampOrBuilder getFirstDetectionTimeOrBuilder()

Timestamp of the first detection within the specified time window. This field is empty when there are no detections.

.google.protobuf.Timestamp first_detection_time = 6;

Returns
Type	Description
TimestampOrBuilder

getLastDetectionTime()

public abstract Timestamp getLastDetectionTime()

Timestamp of the last detection within the specified time window. This field is empty when there are no detections.

.google.protobuf.Timestamp last_detection_time = 7;

Returns
Type	Description
Timestamp	The lastDetectionTime.

getLastDetectionTimeOrBuilder()

public abstract TimestampOrBuilder getLastDetectionTimeOrBuilder()

Timestamp of the last detection within the specified time window. This field is empty when there are no detections.

.google.protobuf.Timestamp last_detection_time = 7;

Returns
Type	Description
TimestampOrBuilder

getLastResetTime()

public abstract Timestamp getLastResetTime()

Timestamp for UEBA risk score reset based deduplication. Used specifically for risk based meta rules.

.google.protobuf.Timestamp last_reset_time = 12;

Returns
Type	Description
Timestamp	The lastResetTime.

getLastResetTimeOrBuilder()

public abstract TimestampOrBuilder getLastResetTimeOrBuilder()

Timestamp for UEBA risk score reset based deduplication. Used specifically for risk based meta rules.

.google.protobuf.Timestamp last_reset_time = 12;

Returns
Type	Description
TimestampOrBuilder

getNormalizedRiskScore()

public abstract int getNormalizedRiskScore()

Normalized risk score for the entity. This value is between 0-1000.

int32 normalized_risk_score = 9;

Returns
Type	Description
int	The normalizedRiskScore.

getRawRiskDelta()

public abstract RiskDelta getRawRiskDelta()

Represents the change in raw risk score for an entity between the end of the previous time window and the end of the current time window.

optional .google.backstory.RiskDelta raw_risk_delta = 11;

Returns
Type	Description
RiskDelta	The rawRiskDelta.

getRawRiskDeltaOrBuilder()

public abstract RiskDeltaOrBuilder getRawRiskDeltaOrBuilder()

Represents the change in raw risk score for an entity between the end of the previous time window and the end of the current time window.

optional .google.backstory.RiskDelta raw_risk_delta = 11;

Returns
Type	Description
RiskDeltaOrBuilder

getRiskDelta()

public abstract RiskDelta getRiskDelta()

Represents the change in risk score for an entity between the end of the previous time window and the end of the current time window.

optional .google.backstory.RiskDelta risk_delta = 4;

Returns
Type	Description
RiskDelta	The riskDelta.

getRiskDeltaOrBuilder()

public abstract RiskDeltaOrBuilder getRiskDeltaOrBuilder()

Represents the change in risk score for an entity between the end of the previous time window and the end of the current time window.

optional .google.backstory.RiskDelta risk_delta = 4;

Returns
Type	Description
RiskDeltaOrBuilder

getRiskScore()

public abstract float getRiskScore()

Raw risk score for the entity.

float risk_score = 8;

Returns
Type	Description
float	The riskScore.

getRiskVersion()

public abstract String getRiskVersion()

Version of the risk score calculation algorithm.

string risk_version = 1;

Returns
Type	Description
String	The riskVersion.

getRiskVersionBytes()

public abstract ByteString getRiskVersionBytes()

Version of the risk score calculation algorithm.

string risk_version = 1;

Returns
Type	Description
ByteString	The bytes for riskVersion.

getRiskWindow()

public abstract Interval getRiskWindow()

Time window used when computing the risk score for an entity, for example 24 hours or 7 days.

.google.type.Interval risk_window = 2;

Returns
Type	Description
com.google.type.Interval	The riskWindow.

getRiskWindowHasNewDetections()

public abstract boolean getRiskWindowHasNewDetections()

Whether there are new detections for the risk window.

bool risk_window_has_new_detections = 14;

Returns
Type	Description
boolean	The riskWindowHasNewDetections.

getRiskWindowOrBuilder()

public abstract IntervalOrBuilder getRiskWindowOrBuilder()

Time window used when computing the risk score for an entity, for example 24 hours or 7 days.

.google.type.Interval risk_window = 2;

Returns
Type	Description
com.google.type.IntervalOrBuilder

getRiskWindowSize()

public abstract Duration getRiskWindowSize()

Risk window duration for the entity.

.google.protobuf.Duration risk_window_size = 10;

Returns
Type	Description
Duration	The riskWindowSize.

getRiskWindowSizeOrBuilder()

public abstract DurationOrBuilder getRiskWindowSizeOrBuilder()

Risk window duration for the entity.

.google.protobuf.Duration risk_window_size = 10;

Returns
Type	Description
DurationOrBuilder

hasFirstDetectionTime()

public abstract boolean hasFirstDetectionTime()

Timestamp of the first detection within the specified time window. This field is empty when there are no detections.

.google.protobuf.Timestamp first_detection_time = 6;

Returns
Type	Description
boolean	Whether the firstDetectionTime field is set.

hasLastDetectionTime()

public abstract boolean hasLastDetectionTime()

Timestamp of the last detection within the specified time window. This field is empty when there are no detections.

.google.protobuf.Timestamp last_detection_time = 7;

Returns
Type	Description
boolean	Whether the lastDetectionTime field is set.

hasLastResetTime()

public abstract boolean hasLastResetTime()

Timestamp for UEBA risk score reset based deduplication. Used specifically for risk based meta rules.

.google.protobuf.Timestamp last_reset_time = 12;

Returns
Type	Description
boolean	Whether the lastResetTime field is set.

hasRawRiskDelta()

public abstract boolean hasRawRiskDelta()

Represents the change in raw risk score for an entity between the end of the previous time window and the end of the current time window.

optional .google.backstory.RiskDelta raw_risk_delta = 11;

Returns
Type	Description
boolean	Whether the rawRiskDelta field is set.

hasRiskDelta()

public abstract boolean hasRiskDelta()

Represents the change in risk score for an entity between the end of the previous time window and the end of the current time window.

optional .google.backstory.RiskDelta risk_delta = 4;

Returns
Type	Description
boolean	Whether the riskDelta field is set.

hasRiskWindow()

public abstract boolean hasRiskWindow()

Time window used when computing the risk score for an entity, for example 24 hours or 7 days.

.google.type.Interval risk_window = 2;

Returns
Type	Description
boolean	Whether the riskWindow field is set.

hasRiskWindowSize()

public abstract boolean hasRiskWindowSize()

Risk window duration for the entity.

.google.protobuf.Duration risk_window_size = 10;

Returns
Type	Description
boolean	Whether the riskWindowSize field is set.