public final class Noun extends GeneratedMessage implements NounOrBuilderThe Noun type is used to represent the different entities in an event: principal, src, target, observer, intermediary, and about. It stores attributes known about the entity. For example, if the entity is a device with multiple IP or MAC addresses, it stores the IP and MAC addresses that are relevant to the event.
Protobuf type google.backstory.Noun
Inheritance
Object > AbstractMessageLite<MessageType,BuilderType> > AbstractMessage > GeneratedMessage > NounImplements
NounOrBuilderStatic Fields
ADMINISTRATIVE_DOMAIN_FIELD_NUMBER
public static final int ADMINISTRATIVE_DOMAIN_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
APPLICATION_FIELD_NUMBER
public static final int APPLICATION_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
ARTIFACT_FIELD_NUMBER
public static final int ARTIFACT_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
ASSET_FIELD_NUMBER
public static final int ASSET_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
ASSET_ID_FIELD_NUMBER
public static final int ASSET_ID_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
BROWSER_FIELD_NUMBER
public static final int BROWSER_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
CLOUD_FIELD_NUMBER
public static final int CLOUD_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
DOMAIN_FIELD_NUMBER
public static final int DOMAIN_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
EMAIL_FIELD_NUMBER
public static final int EMAIL_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
FILE_FIELD_NUMBER
public static final int FILE_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
GROUP_FIELD_NUMBER
public static final int GROUP_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
HOSTNAME_FIELD_NUMBER
public static final int HOSTNAME_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
INVESTIGATION_FIELD_NUMBER
public static final int INVESTIGATION_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
IP_FIELD_NUMBER
public static final int IP_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
IP_GEO_ARTIFACT_FIELD_NUMBER
public static final int IP_GEO_ARTIFACT_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
IP_LOCATION_FIELD_NUMBER
public static final int IP_LOCATION_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
LABELS_FIELD_NUMBER
public static final int LABELS_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
LOCATION_FIELD_NUMBER
public static final int LOCATION_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
MAC_FIELD_NUMBER
public static final int MAC_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
NAMESPACE_FIELD_NUMBER
public static final int NAMESPACE_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
NAT_IP_FIELD_NUMBER
public static final int NAT_IP_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
NAT_PORT_FIELD_NUMBER
public static final int NAT_PORT_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
NETWORK_FIELD_NUMBER
public static final int NETWORK_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
OBJECT_REFERENCE_FIELD_NUMBER
public static final int OBJECT_REFERENCE_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
PLATFORM_FIELD_NUMBER
public static final int PLATFORM_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
PLATFORM_PATCH_LEVEL_FIELD_NUMBER
public static final int PLATFORM_PATCH_LEVEL_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
PLATFORM_VERSION_FIELD_NUMBER
public static final int PLATFORM_VERSION_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
PORT_FIELD_NUMBER
public static final int PORT_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
PROCESS_ANCESTORS_FIELD_NUMBER
public static final int PROCESS_ANCESTORS_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
PROCESS_FIELD_NUMBER
public static final int PROCESS_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
REGISTRY_FIELD_NUMBER
public static final int REGISTRY_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
RESOURCE_ANCESTORS_FIELD_NUMBER
public static final int RESOURCE_ANCESTORS_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
RESOURCE_FIELD_NUMBER
public static final int RESOURCE_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
SECURITY_RESULT_FIELD_NUMBER
public static final int SECURITY_RESULT_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
URL_FIELD_NUMBER
public static final int URL_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
URL_METADATA_FIELD_NUMBER
public static final int URL_METADATA_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
USER_FIELD_NUMBER
public static final int USER_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
USER_MANAGEMENT_CHAIN_FIELD_NUMBER
public static final int USER_MANAGEMENT_CHAIN_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
Static Methods
getDefaultInstance()
public static Noun getDefaultInstance()| Returns | |
|---|---|
| Type | Description |
Noun |
|
getDescriptor()
public static final Descriptors.Descriptor getDescriptor()| Returns | |
|---|---|
| Type | Description |
Descriptor |
|
newBuilder()
public static Noun.Builder newBuilder()| Returns | |
|---|---|
| Type | Description |
Noun.Builder |
|
newBuilder(Noun prototype)
public static Noun.Builder newBuilder(Noun prototype)| Parameter | |
|---|---|
| Name | Description |
prototype |
Noun |
| Returns | |
|---|---|
| Type | Description |
Noun.Builder |
|
parseDelimitedFrom(InputStream input)
public static Noun parseDelimitedFrom(InputStream input)| Parameter | |
|---|---|
| Name | Description |
input |
InputStream |
| Returns | |
|---|---|
| Type | Description |
Noun |
|
| Exceptions | |
|---|---|
| Type | Description |
IOException |
|
parseDelimitedFrom(InputStream input, ExtensionRegistryLite extensionRegistry)
public static Noun parseDelimitedFrom(InputStream input, ExtensionRegistryLite extensionRegistry)| Parameters | |
|---|---|
| Name | Description |
input |
InputStream |
extensionRegistry |
ExtensionRegistryLite |
| Returns | |
|---|---|
| Type | Description |
Noun |
|
| Exceptions | |
|---|---|
| Type | Description |
IOException |
|
parseFrom(byte[] data)
public static Noun parseFrom(byte[] data)| Parameter | |
|---|---|
| Name | Description |
data |
byte[] |
| Returns | |
|---|---|
| Type | Description |
Noun |
|
| Exceptions | |
|---|---|
| Type | Description |
InvalidProtocolBufferException |
|
parseFrom(byte[] data, ExtensionRegistryLite extensionRegistry)
public static Noun parseFrom(byte[] data, ExtensionRegistryLite extensionRegistry)| Parameters | |
|---|---|
| Name | Description |
data |
byte[] |
extensionRegistry |
ExtensionRegistryLite |
| Returns | |
|---|---|
| Type | Description |
Noun |
|
| Exceptions | |
|---|---|
| Type | Description |
InvalidProtocolBufferException |
|
parseFrom(ByteString data)
public static Noun parseFrom(ByteString data)| Parameter | |
|---|---|
| Name | Description |
data |
ByteString |
| Returns | |
|---|---|
| Type | Description |
Noun |
|
| Exceptions | |
|---|---|
| Type | Description |
InvalidProtocolBufferException |
|
parseFrom(ByteString data, ExtensionRegistryLite extensionRegistry)
public static Noun parseFrom(ByteString data, ExtensionRegistryLite extensionRegistry)| Parameters | |
|---|---|
| Name | Description |
data |
ByteString |
extensionRegistry |
ExtensionRegistryLite |
| Returns | |
|---|---|
| Type | Description |
Noun |
|
| Exceptions | |
|---|---|
| Type | Description |
InvalidProtocolBufferException |
|
parseFrom(CodedInputStream input)
public static Noun parseFrom(CodedInputStream input)| Parameter | |
|---|---|
| Name | Description |
input |
CodedInputStream |
| Returns | |
|---|---|
| Type | Description |
Noun |
|
| Exceptions | |
|---|---|
| Type | Description |
IOException |
|
parseFrom(CodedInputStream input, ExtensionRegistryLite extensionRegistry)
public static Noun parseFrom(CodedInputStream input, ExtensionRegistryLite extensionRegistry)| Parameters | |
|---|---|
| Name | Description |
input |
CodedInputStream |
extensionRegistry |
ExtensionRegistryLite |
| Returns | |
|---|---|
| Type | Description |
Noun |
|
| Exceptions | |
|---|---|
| Type | Description |
IOException |
|
parseFrom(InputStream input)
public static Noun parseFrom(InputStream input)| Parameter | |
|---|---|
| Name | Description |
input |
InputStream |
| Returns | |
|---|---|
| Type | Description |
Noun |
|
| Exceptions | |
|---|---|
| Type | Description |
IOException |
|
parseFrom(InputStream input, ExtensionRegistryLite extensionRegistry)
public static Noun parseFrom(InputStream input, ExtensionRegistryLite extensionRegistry)| Parameters | |
|---|---|
| Name | Description |
input |
InputStream |
extensionRegistry |
ExtensionRegistryLite |
| Returns | |
|---|---|
| Type | Description |
Noun |
|
| Exceptions | |
|---|---|
| Type | Description |
IOException |
|
parseFrom(ByteBuffer data)
public static Noun parseFrom(ByteBuffer data)| Parameter | |
|---|---|
| Name | Description |
data |
ByteBuffer |
| Returns | |
|---|---|
| Type | Description |
Noun |
|
| Exceptions | |
|---|---|
| Type | Description |
InvalidProtocolBufferException |
|
parseFrom(ByteBuffer data, ExtensionRegistryLite extensionRegistry)
public static Noun parseFrom(ByteBuffer data, ExtensionRegistryLite extensionRegistry)| Parameters | |
|---|---|
| Name | Description |
data |
ByteBuffer |
extensionRegistry |
ExtensionRegistryLite |
| Returns | |
|---|---|
| Type | Description |
Noun |
|
| Exceptions | |
|---|---|
| Type | Description |
InvalidProtocolBufferException |
|
parser()
public static Parser<Noun> parser()| Returns | |
|---|---|
| Type | Description |
Parser<Noun> |
|
Methods
equals(Object obj)
public boolean equals(Object obj)| Parameter | |
|---|---|
| Name | Description |
obj |
Object |
| Returns | |
|---|---|
| Type | Description |
boolean |
|
getAdministrativeDomain()
public String getAdministrativeDomain()Domain which the device belongs to (for example, the Microsoft Windows domain).
string administrative_domain = 9;
| Returns | |
|---|---|
| Type | Description |
String |
The administrativeDomain. |
getAdministrativeDomainBytes()
public ByteString getAdministrativeDomainBytes()Domain which the device belongs to (for example, the Microsoft Windows domain).
string administrative_domain = 9;
| Returns | |
|---|---|
| Type | Description |
ByteString |
The bytes for administrativeDomain. |
getApplication()
public String getApplication()The name of an application or service. Some SSO solutions only capture the name of a target application such as "Atlassian" or "Chronicle".
string application = 14;
| Returns | |
|---|---|
| Type | Description |
String |
The application. |
getApplicationBytes()
public ByteString getApplicationBytes()The name of an application or service. Some SSO solutions only capture the name of a target application such as "Atlassian" or "Chronicle".
string application = 14;
| Returns | |
|---|---|
| Type | Description |
ByteString |
The bytes for application. |
getArtifact()
public Artifact getArtifact()Information about an artifact.
.google.backstory.Artifact artifact = 32;
| Returns | |
|---|---|
| Type | Description |
Artifact |
The artifact. |
getArtifactOrBuilder()
public ArtifactOrBuilder getArtifactOrBuilder()Information about an artifact.
.google.backstory.Artifact artifact = 32;
| Returns | |
|---|---|
| Type | Description |
ArtifactOrBuilder |
|
getAsset()
public Asset getAsset()Information about the asset.
.google.backstory.Asset asset = 27;
| Returns | |
|---|---|
| Type | Description |
Asset |
The asset. |
getAssetId()
public String getAssetId()The asset ID. This field can be used as an entity indicator for asset entities.
string asset_id = 2;
| Returns | |
|---|---|
| Type | Description |
String |
The assetId. |
getAssetIdBytes()
public ByteString getAssetIdBytes()The asset ID. This field can be used as an entity indicator for asset entities.
string asset_id = 2;
| Returns | |
|---|---|
| Type | Description |
ByteString |
The bytes for assetId. |
getAssetOrBuilder()
public AssetOrBuilder getAssetOrBuilder()Information about the asset.
.google.backstory.Asset asset = 27;
| Returns | |
|---|---|
| Type | Description |
AssetOrBuilder |
|
getBrowser()
public Browser getBrowser()Information about an entry in the web browser's local history database.
.google.backstory.Browser browser = 38;
| Returns | |
|---|---|
| Type | Description |
Browser |
The browser. |
getBrowserOrBuilder()
public BrowserOrBuilder getBrowserOrBuilder()Information about an entry in the web browser's local history database.
.google.backstory.Browser browser = 38;
| Returns | |
|---|---|
| Type | Description |
BrowserOrBuilder |
|
getCloud() (deprecated)
public Cloud getCloud()Deprecated. google.backstory.Noun.cloud is deprecated. See backstory/udm.proto;l=6324
Cloud metadata. Deprecated: cloud should be populated in entity Attribute as generic metadata (e.g. asset.attribute.cloud).
.google.backstory.Cloud cloud = 24 [deprecated = true];
| Returns | |
|---|---|
| Type | Description |
Cloud |
The cloud. |
getCloudOrBuilder() (deprecated)
public CloudOrBuilder getCloudOrBuilder()Cloud metadata. Deprecated: cloud should be populated in entity Attribute as generic metadata (e.g. asset.attribute.cloud).
.google.backstory.Cloud cloud = 24 [deprecated = true];
| Returns | |
|---|---|
| Type | Description |
CloudOrBuilder |
|
getDefaultInstanceForType()
public Noun getDefaultInstanceForType()| Returns | |
|---|---|
| Type | Description |
Noun |
|
getDomain()
public Domain getDomain()Information about the domain.
.google.backstory.Domain domain = 30;
| Returns | |
|---|---|
| Type | Description |
Domain |
The domain. |
getDomainOrBuilder()
public DomainOrBuilder getDomainOrBuilder()Information about the domain.
.google.backstory.Domain domain = 30;
| Returns | |
|---|---|
| Type | Description |
DomainOrBuilder |
|
getEmail()
public String getEmail()Email address. Only filled in for security_result.about
string email = 12;
| Returns | |
|---|---|
| Type | Description |
String |
The email. |
getEmailBytes()
public ByteString getEmailBytes()Email address. Only filled in for security_result.about
string email = 12;
| Returns | |
|---|---|
| Type | Description |
ByteString |
The bytes for email. |
getFile()
public File getFile()Information about the file.
.google.backstory.File file = 11;
| Returns | |
|---|---|
| Type | Description |
File |
The file. |
getFileOrBuilder()
public FileOrBuilder getFileOrBuilder()Information about the file.
.google.backstory.File file = 11;
| Returns | |
|---|---|
| Type | Description |
FileOrBuilder |
|
getGroup()
public Group getGroup()Information about the group.
.google.backstory.Group group = 20;
| Returns | |
|---|---|
| Type | Description |
Group |
The group. |
getGroupOrBuilder()
public GroupOrBuilder getGroupOrBuilder()Information about the group.
.google.backstory.Group group = 20;
| Returns | |
|---|---|
| Type | Description |
GroupOrBuilder |
|
getHostname()
public String getHostname()Client hostname or domain name field. Hostname also doubles as the domain for remote entities. This field can be used as an entity indicator for asset entities.
string hostname = 1;
| Returns | |
|---|---|
| Type | Description |
String |
The hostname. |
getHostnameBytes()
public ByteString getHostnameBytes()Client hostname or domain name field. Hostname also doubles as the domain for remote entities. This field can be used as an entity indicator for asset entities.
string hostname = 1;
| Returns | |
|---|---|
| Type | Description |
ByteString |
The bytes for hostname. |
getInvestigation()
public Investigation getInvestigation()Analyst feedback/investigation for alerts.
.google.backstory.Investigation investigation = 26;
| Returns | |
|---|---|
| Type | Description |
Investigation |
The investigation. |
getInvestigationOrBuilder()
public InvestigationOrBuilder getInvestigationOrBuilder()Analyst feedback/investigation for alerts.
.google.backstory.Investigation investigation = 26;
| Returns | |
|---|---|
| Type | Description |
InvestigationOrBuilder |
|
getIp(int index)
public String getIp(int index)A list of IP addresses associated with a network connection. This field can be used as an entity indicator for asset entities.
repeated string ip = 6;
| Parameter | |
|---|---|
| Name | Description |
index |
intThe index of the element to return. |
| Returns | |
|---|---|
| Type | Description |
String |
The ip at the given index. |
getIpBytes(int index)
public ByteString getIpBytes(int index)A list of IP addresses associated with a network connection. This field can be used as an entity indicator for asset entities.
repeated string ip = 6;
| Parameter | |
|---|---|
| Name | Description |
index |
intThe index of the value to return. |
| Returns | |
|---|---|
| Type | Description |
ByteString |
The bytes of the ip at the given index. |
getIpCount()
public int getIpCount()A list of IP addresses associated with a network connection. This field can be used as an entity indicator for asset entities.
repeated string ip = 6;
| Returns | |
|---|---|
| Type | Description |
int |
The count of ip. |
getIpGeoArtifact(int index)
public Artifact getIpGeoArtifact(int index)Enriched geographic information corresponding to an IP address. Specifically, location and network data.
repeated .google.backstory.Artifact ip_geo_artifact = 35;
| Parameter | |
|---|---|
| Name | Description |
index |
int |
| Returns | |
|---|---|
| Type | Description |
Artifact |
|
getIpGeoArtifactCount()
public int getIpGeoArtifactCount()Enriched geographic information corresponding to an IP address. Specifically, location and network data.
repeated .google.backstory.Artifact ip_geo_artifact = 35;
| Returns | |
|---|---|
| Type | Description |
int |
|
getIpGeoArtifactList()
public List<Artifact> getIpGeoArtifactList()Enriched geographic information corresponding to an IP address. Specifically, location and network data.
repeated .google.backstory.Artifact ip_geo_artifact = 35;
| Returns | |
|---|---|
| Type | Description |
List<Artifact> |
|
getIpGeoArtifactOrBuilder(int index)
public ArtifactOrBuilder getIpGeoArtifactOrBuilder(int index)Enriched geographic information corresponding to an IP address. Specifically, location and network data.
repeated .google.backstory.Artifact ip_geo_artifact = 35;
| Parameter | |
|---|---|
| Name | Description |
index |
int |
| Returns | |
|---|---|
| Type | Description |
ArtifactOrBuilder |
|
getIpGeoArtifactOrBuilderList()
public List<? extends ArtifactOrBuilder> getIpGeoArtifactOrBuilderList()Enriched geographic information corresponding to an IP address. Specifically, location and network data.
repeated .google.backstory.Artifact ip_geo_artifact = 35;
| Returns | |
|---|---|
| Type | Description |
List<? extends com.google.backstory.ArtifactOrBuilder> |
|
getIpList()
public ProtocolStringList getIpList()A list of IP addresses associated with a network connection. This field can be used as an entity indicator for asset entities.
repeated string ip = 6;
| Returns | |
|---|---|
| Type | Description |
ProtocolStringList |
A list containing the ip. |
getIpLocation(int index) (deprecated)
public Location getIpLocation(int index)Deprecated: use ip_geo_artifact.location instead.
repeated .google.backstory.Location ip_location = 34 [deprecated = true];
| Parameter | |
|---|---|
| Name | Description |
index |
int |
| Returns | |
|---|---|
| Type | Description |
Location |
|
getIpLocationCount() (deprecated)
public int getIpLocationCount()Deprecated: use ip_geo_artifact.location instead.
repeated .google.backstory.Location ip_location = 34 [deprecated = true];
| Returns | |
|---|---|
| Type | Description |
int |
|
getIpLocationList() (deprecated)
public List<Location> getIpLocationList()Deprecated: use ip_geo_artifact.location instead.
repeated .google.backstory.Location ip_location = 34 [deprecated = true];
| Returns | |
|---|---|
| Type | Description |
List<Location> |
|
getIpLocationOrBuilder(int index) (deprecated)
public LocationOrBuilder getIpLocationOrBuilder(int index)Deprecated: use ip_geo_artifact.location instead.
repeated .google.backstory.Location ip_location = 34 [deprecated = true];
| Parameter | |
|---|---|
| Name | Description |
index |
int |
| Returns | |
|---|---|
| Type | Description |
LocationOrBuilder |
|
getIpLocationOrBuilderList() (deprecated)
public List<? extends LocationOrBuilder> getIpLocationOrBuilderList()Deprecated: use ip_geo_artifact.location instead.
repeated .google.backstory.Location ip_location = 34 [deprecated = true];
| Returns | |
|---|---|
| Type | Description |
List<? extends com.google.backstory.LocationOrBuilder> |
|
getLabels(int index) (deprecated)
public Label getLabels(int index)Labels are key-value pairs. For example: key = "env", value = "prod". Deprecated: labels should be populated in entity Attribute as generic metadata (e.g. user.attribute.labels).
repeated .google.backstory.Label labels = 23 [deprecated = true];
| Parameter | |
|---|---|
| Name | Description |
index |
int |
| Returns | |
|---|---|
| Type | Description |
Label |
|
getLabelsCount() (deprecated)
public int getLabelsCount()Labels are key-value pairs. For example: key = "env", value = "prod". Deprecated: labels should be populated in entity Attribute as generic metadata (e.g. user.attribute.labels).
repeated .google.backstory.Label labels = 23 [deprecated = true];
| Returns | |
|---|---|
| Type | Description |
int |
|
getLabelsList() (deprecated)
public List<Label> getLabelsList()Labels are key-value pairs. For example: key = "env", value = "prod". Deprecated: labels should be populated in entity Attribute as generic metadata (e.g. user.attribute.labels).
repeated .google.backstory.Label labels = 23 [deprecated = true];
| Returns | |
|---|---|
| Type | Description |
List<Label> |
|
getLabelsOrBuilder(int index) (deprecated)
public LabelOrBuilder getLabelsOrBuilder(int index)Labels are key-value pairs. For example: key = "env", value = "prod". Deprecated: labels should be populated in entity Attribute as generic metadata (e.g. user.attribute.labels).
repeated .google.backstory.Label labels = 23 [deprecated = true];
| Parameter | |
|---|---|
| Name | Description |
index |
int |
| Returns | |
|---|---|
| Type | Description |
LabelOrBuilder |
|
getLabelsOrBuilderList() (deprecated)
public List<? extends LabelOrBuilder> getLabelsOrBuilderList()Labels are key-value pairs. For example: key = "env", value = "prod". Deprecated: labels should be populated in entity Attribute as generic metadata (e.g. user.attribute.labels).
repeated .google.backstory.Label labels = 23 [deprecated = true];
| Returns | |
|---|---|
| Type | Description |
List<? extends com.google.backstory.LabelOrBuilder> |
|
getLocation()
public Location getLocation()Physical location. For cloud environments, set the region in location.name.
.google.backstory.Location location = 17;
| Returns | |
|---|---|
| Type | Description |
Location |
The location. |
getLocationOrBuilder()
public LocationOrBuilder getLocationOrBuilder()Physical location. For cloud environments, set the region in location.name.
.google.backstory.Location location = 17;
| Returns | |
|---|---|
| Type | Description |
LocationOrBuilder |
|
getMac(int index)
public String getMac(int index)List of MAC addresses associated with a device. This field can be used as an entity indicator for asset entities.
repeated string mac = 8;
| Parameter | |
|---|---|
| Name | Description |
index |
intThe index of the element to return. |
| Returns | |
|---|---|
| Type | Description |
String |
The mac at the given index. |
getMacBytes(int index)
public ByteString getMacBytes(int index)List of MAC addresses associated with a device. This field can be used as an entity indicator for asset entities.
repeated string mac = 8;
| Parameter | |
|---|---|
| Name | Description |
index |
intThe index of the value to return. |
| Returns | |
|---|---|
| Type | Description |
ByteString |
The bytes of the mac at the given index. |
getMacCount()
public int getMacCount()List of MAC addresses associated with a device. This field can be used as an entity indicator for asset entities.
repeated string mac = 8;
| Returns | |
|---|---|
| Type | Description |
int |
The count of mac. |
getMacList()
public ProtocolStringList getMacList()List of MAC addresses associated with a device. This field can be used as an entity indicator for asset entities.
repeated string mac = 8;
| Returns | |
|---|---|
| Type | Description |
ProtocolStringList |
A list containing the mac. |
getNamespace()
public String getNamespace()Namespace which the device belongs to, such as "AD forest". Uses for this field include Microsoft Windows AD forest, the name of subsidiary, or the name of acquisition. This field can be used along with an asset indicator to identify an asset.
string namespace = 19;
| Returns | |
|---|---|
| Type | Description |
String |
The namespace. |
getNamespaceBytes()
public ByteString getNamespaceBytes()Namespace which the device belongs to, such as "AD forest". Uses for this field include Microsoft Windows AD forest, the name of subsidiary, or the name of acquisition. This field can be used along with an asset indicator to identify an asset.
string namespace = 19;
| Returns | |
|---|---|
| Type | Description |
ByteString |
The bytes for namespace. |
getNatIp(int index)
public String getNatIp(int index)A list of NAT translated IP addresses associated with a network connection.
repeated string nat_ip = 21;
| Parameter | |
|---|---|
| Name | Description |
index |
intThe index of the element to return. |
| Returns | |
|---|---|
| Type | Description |
String |
The natIp at the given index. |
getNatIpBytes(int index)
public ByteString getNatIpBytes(int index)A list of NAT translated IP addresses associated with a network connection.
repeated string nat_ip = 21;
| Parameter | |
|---|---|
| Name | Description |
index |
intThe index of the value to return. |
| Returns | |
|---|---|
| Type | Description |
ByteString |
The bytes of the natIp at the given index. |
getNatIpCount()
public int getNatIpCount()A list of NAT translated IP addresses associated with a network connection.
repeated string nat_ip = 21;
| Returns | |
|---|---|
| Type | Description |
int |
The count of natIp. |
getNatIpList()
public ProtocolStringList getNatIpList()A list of NAT translated IP addresses associated with a network connection.
repeated string nat_ip = 21;
| Returns | |
|---|---|
| Type | Description |
ProtocolStringList |
A list containing the natIp. |
getNatPort()
public int getNatPort()NAT external network port number when a specific network connection is described within an event.
int32 nat_port = 22;
| Returns | |
|---|---|
| Type | Description |
int |
The natPort. |
getNetwork()
public Network getNetwork()Network details, including sub-messages with details on each protocol (for example, DHCP, DNS, or HTTP).
.google.backstory.Network network = 33;
| Returns | |
|---|---|
| Type | Description |
Network |
The network. |
getNetworkOrBuilder()
public NetworkOrBuilder getNetworkOrBuilder()Network details, including sub-messages with details on each protocol (for example, DHCP, DNS, or HTTP).
.google.backstory.Network network = 33;
| Returns | |
|---|---|
| Type | Description |
NetworkOrBuilder |
|
getObjectReference()
public Id getObjectReference()Finding to which the Analyst updated the feedback.
.google.backstory.Id object_reference = 25;
| Returns | |
|---|---|
| Type | Description |
Id |
The objectReference. |
getObjectReferenceOrBuilder()
public IdOrBuilder getObjectReferenceOrBuilder()Finding to which the Analyst updated the feedback.
.google.backstory.Id object_reference = 25;
| Returns | |
|---|---|
| Type | Description |
IdOrBuilder |
|
getParserForType()
public Parser<Noun> getParserForType()| Returns | |
|---|---|
| Type | Description |
Parser<Noun> |
|
getPlatform()
public Noun.Platform getPlatform()Platform.
.google.backstory.Noun.Platform platform = 5;
| Returns | |
|---|---|
| Type | Description |
Noun.Platform |
The platform. |
getPlatformPatchLevel()
public String getPlatformPatchLevel()Platform patch level. For example, "Build 17134.48"
string platform_patch_level = 16;
| Returns | |
|---|---|
| Type | Description |
String |
The platformPatchLevel. |
getPlatformPatchLevelBytes()
public ByteString getPlatformPatchLevelBytes()Platform patch level. For example, "Build 17134.48"
string platform_patch_level = 16;
| Returns | |
|---|---|
| Type | Description |
ByteString |
The bytes for platformPatchLevel. |
getPlatformValue()
public int getPlatformValue()Platform.
.google.backstory.Noun.Platform platform = 5;
| Returns | |
|---|---|
| Type | Description |
int |
The enum numeric value on the wire for platform. |
getPlatformVersion()
public String getPlatformVersion()Platform version. For example, "Microsoft Windows 1803".
string platform_version = 15;
| Returns | |
|---|---|
| Type | Description |
String |
The platformVersion. |
getPlatformVersionBytes()
public ByteString getPlatformVersionBytes()Platform version. For example, "Microsoft Windows 1803".
string platform_version = 15;
| Returns | |
|---|---|
| Type | Description |
ByteString |
The bytes for platformVersion. |
getPort()
public int getPort()Source or destination network port number when a specific network connection is described within an event.
int32 port = 7;
| Returns | |
|---|---|
| Type | Description |
int |
The port. |
getProcess()
public Process getProcess()Information about the process.
.google.backstory.Process process = 4;
| Returns | |
|---|---|
| Type | Description |
Process |
The process. |
getProcessAncestors(int index)
public Process getProcessAncestors(int index)Information about the process's ancestors ordered from immediate ancestor (parent process) to root. Note: process_ancestors is only populated when data is exported to BigQuery since recursive fields (e.g. process.parent_process) are not supported by BigQuery.
repeated .google.backstory.Process process_ancestors = 28;
| Parameter | |
|---|---|
| Name | Description |
index |
int |
| Returns | |
|---|---|
| Type | Description |
Process |
|
getProcessAncestorsCount()
public int getProcessAncestorsCount()Information about the process's ancestors ordered from immediate ancestor (parent process) to root. Note: process_ancestors is only populated when data is exported to BigQuery since recursive fields (e.g. process.parent_process) are not supported by BigQuery.
repeated .google.backstory.Process process_ancestors = 28;
| Returns | |
|---|---|
| Type | Description |
int |
|
getProcessAncestorsList()
public List<Process> getProcessAncestorsList()Information about the process's ancestors ordered from immediate ancestor (parent process) to root. Note: process_ancestors is only populated when data is exported to BigQuery since recursive fields (e.g. process.parent_process) are not supported by BigQuery.
repeated .google.backstory.Process process_ancestors = 28;
| Returns | |
|---|---|
| Type | Description |
List<Process> |
|
getProcessAncestorsOrBuilder(int index)
public ProcessOrBuilder getProcessAncestorsOrBuilder(int index)Information about the process's ancestors ordered from immediate ancestor (parent process) to root. Note: process_ancestors is only populated when data is exported to BigQuery since recursive fields (e.g. process.parent_process) are not supported by BigQuery.
repeated .google.backstory.Process process_ancestors = 28;
| Parameter | |
|---|---|
| Name | Description |
index |
int |
| Returns | |
|---|---|
| Type | Description |
ProcessOrBuilder |
|
getProcessAncestorsOrBuilderList()
public List<? extends ProcessOrBuilder> getProcessAncestorsOrBuilderList()Information about the process's ancestors ordered from immediate ancestor (parent process) to root. Note: process_ancestors is only populated when data is exported to BigQuery since recursive fields (e.g. process.parent_process) are not supported by BigQuery.
repeated .google.backstory.Process process_ancestors = 28;
| Returns | |
|---|---|
| Type | Description |
List<? extends com.google.backstory.ProcessOrBuilder> |
|
getProcessOrBuilder()
public ProcessOrBuilder getProcessOrBuilder()Information about the process.
.google.backstory.Process process = 4;
| Returns | |
|---|---|
| Type | Description |
ProcessOrBuilder |
|
getRegistry()
public Registry getRegistry()Registry information.
.google.backstory.Registry registry = 13;
| Returns | |
|---|---|
| Type | Description |
Registry |
The registry. |
getRegistryOrBuilder()
public RegistryOrBuilder getRegistryOrBuilder()Registry information.
.google.backstory.Registry registry = 13;
| Returns | |
|---|---|
| Type | Description |
RegistryOrBuilder |
|
getResource()
public Resource getResource()Information about the resource (e.g. scheduled task, calendar entry). This field should not be used for files, registry, or processes because these objects are already part of Noun.
.google.backstory.Resource resource = 18;
| Returns | |
|---|---|
| Type | Description |
Resource |
The resource. |
getResourceAncestors(int index)
public Resource getResourceAncestors(int index)Information about the resource's ancestors ordered from immediate ancestor (starting with parent resource).
repeated .google.backstory.Resource resource_ancestors = 31;
| Parameter | |
|---|---|
| Name | Description |
index |
int |
| Returns | |
|---|---|
| Type | Description |
Resource |
|
getResourceAncestorsCount()
public int getResourceAncestorsCount()Information about the resource's ancestors ordered from immediate ancestor (starting with parent resource).
repeated .google.backstory.Resource resource_ancestors = 31;
| Returns | |
|---|---|
| Type | Description |
int |
|
getResourceAncestorsList()
public List<Resource> getResourceAncestorsList()Information about the resource's ancestors ordered from immediate ancestor (starting with parent resource).
repeated .google.backstory.Resource resource_ancestors = 31;
| Returns | |
|---|---|
| Type | Description |
List<Resource> |
|
getResourceAncestorsOrBuilder(int index)
public ResourceOrBuilder getResourceAncestorsOrBuilder(int index)Information about the resource's ancestors ordered from immediate ancestor (starting with parent resource).
repeated .google.backstory.Resource resource_ancestors = 31;
| Parameter | |
|---|---|
| Name | Description |
index |
int |
| Returns | |
|---|---|
| Type | Description |
ResourceOrBuilder |
|
getResourceAncestorsOrBuilderList()
public List<? extends ResourceOrBuilder> getResourceAncestorsOrBuilderList()Information about the resource's ancestors ordered from immediate ancestor (starting with parent resource).
repeated .google.backstory.Resource resource_ancestors = 31;
| Returns | |
|---|---|
| Type | Description |
List<? extends com.google.backstory.ResourceOrBuilder> |
|
getResourceOrBuilder()
public ResourceOrBuilder getResourceOrBuilder()Information about the resource (e.g. scheduled task, calendar entry). This field should not be used for files, registry, or processes because these objects are already part of Noun.
.google.backstory.Resource resource = 18;
| Returns | |
|---|---|
| Type | Description |
ResourceOrBuilder |
|
getSecurityResult(int index)
public SecurityResult getSecurityResult(int index)A list of security results.
repeated .google.backstory.SecurityResult security_result = 36;
| Parameter | |
|---|---|
| Name | Description |
index |
int |
| Returns | |
|---|---|
| Type | Description |
SecurityResult |
|
getSecurityResultCount()
public int getSecurityResultCount()A list of security results.
repeated .google.backstory.SecurityResult security_result = 36;
| Returns | |
|---|---|
| Type | Description |
int |
|
getSecurityResultList()
public List<SecurityResult> getSecurityResultList()A list of security results.
repeated .google.backstory.SecurityResult security_result = 36;
| Returns | |
|---|---|
| Type | Description |
List<SecurityResult> |
|
getSecurityResultOrBuilder(int index)
public SecurityResultOrBuilder getSecurityResultOrBuilder(int index)A list of security results.
repeated .google.backstory.SecurityResult security_result = 36;
| Parameter | |
|---|---|
| Name | Description |
index |
int |
| Returns | |
|---|---|
| Type | Description |
SecurityResultOrBuilder |
|
getSecurityResultOrBuilderList()
public List<? extends SecurityResultOrBuilder> getSecurityResultOrBuilderList()A list of security results.
repeated .google.backstory.SecurityResult security_result = 36;
| Returns | |
|---|---|
| Type | Description |
List<? extends com.google.backstory.SecurityResultOrBuilder> |
|
getSerializedSize()
public int getSerializedSize()| Returns | |
|---|---|
| Type | Description |
int |
|
getUrl()
public String getUrl()The URL.
string url = 10;
| Returns | |
|---|---|
| Type | Description |
String |
The url. |
getUrlBytes()
public ByteString getUrlBytes()The URL.
string url = 10;
| Returns | |
|---|---|
| Type | Description |
ByteString |
The bytes for url. |
getUrlMetadata()
public Url getUrlMetadata()Information about the URL.
.google.backstory.Url url_metadata = 37;
| Returns | |
|---|---|
| Type | Description |
Url |
The urlMetadata. |
getUrlMetadataOrBuilder()
public UrlOrBuilder getUrlMetadataOrBuilder()Information about the URL.
.google.backstory.Url url_metadata = 37;
| Returns | |
|---|---|
| Type | Description |
UrlOrBuilder |
|
getUser()
public User getUser()Information about the user.
.google.backstory.User user = 3;
| Returns | |
|---|---|
| Type | Description |
User |
The user. |
getUserManagementChain(int index)
public User getUserManagementChain(int index)Information about the user's management chain (reporting hierarchy). Note: user_management_chain is only populated when data is exported to BigQuery since recursive fields (e.g. user.managers) are not supported by BigQuery.
repeated .google.backstory.User user_management_chain = 29;
| Parameter | |
|---|---|
| Name | Description |
index |
int |
| Returns | |
|---|---|
| Type | Description |
User |
|
getUserManagementChainCount()
public int getUserManagementChainCount()Information about the user's management chain (reporting hierarchy). Note: user_management_chain is only populated when data is exported to BigQuery since recursive fields (e.g. user.managers) are not supported by BigQuery.
repeated .google.backstory.User user_management_chain = 29;
| Returns | |
|---|---|
| Type | Description |
int |
|
getUserManagementChainList()
public List<User> getUserManagementChainList()Information about the user's management chain (reporting hierarchy). Note: user_management_chain is only populated when data is exported to BigQuery since recursive fields (e.g. user.managers) are not supported by BigQuery.
repeated .google.backstory.User user_management_chain = 29;
| Returns | |
|---|---|
| Type | Description |
List<User> |
|
getUserManagementChainOrBuilder(int index)
public UserOrBuilder getUserManagementChainOrBuilder(int index)Information about the user's management chain (reporting hierarchy). Note: user_management_chain is only populated when data is exported to BigQuery since recursive fields (e.g. user.managers) are not supported by BigQuery.
repeated .google.backstory.User user_management_chain = 29;
| Parameter | |
|---|---|
| Name | Description |
index |
int |
| Returns | |
|---|---|
| Type | Description |
UserOrBuilder |
|
getUserManagementChainOrBuilderList()
public List<? extends UserOrBuilder> getUserManagementChainOrBuilderList()Information about the user's management chain (reporting hierarchy). Note: user_management_chain is only populated when data is exported to BigQuery since recursive fields (e.g. user.managers) are not supported by BigQuery.
repeated .google.backstory.User user_management_chain = 29;
| Returns | |
|---|---|
| Type | Description |
List<? extends com.google.backstory.UserOrBuilder> |
|
getUserOrBuilder()
public UserOrBuilder getUserOrBuilder()Information about the user.
.google.backstory.User user = 3;
| Returns | |
|---|---|
| Type | Description |
UserOrBuilder |
|
hasArtifact()
public boolean hasArtifact()Information about an artifact.
.google.backstory.Artifact artifact = 32;
| Returns | |
|---|---|
| Type | Description |
boolean |
Whether the artifact field is set. |
hasAsset()
public boolean hasAsset()Information about the asset.
.google.backstory.Asset asset = 27;
| Returns | |
|---|---|
| Type | Description |
boolean |
Whether the asset field is set. |
hasBrowser()
public boolean hasBrowser()Information about an entry in the web browser's local history database.
.google.backstory.Browser browser = 38;
| Returns | |
|---|---|
| Type | Description |
boolean |
Whether the browser field is set. |
hasCloud() (deprecated)
public boolean hasCloud()Deprecated. google.backstory.Noun.cloud is deprecated. See backstory/udm.proto;l=6324
Cloud metadata. Deprecated: cloud should be populated in entity Attribute as generic metadata (e.g. asset.attribute.cloud).
.google.backstory.Cloud cloud = 24 [deprecated = true];
| Returns | |
|---|---|
| Type | Description |
boolean |
Whether the cloud field is set. |
hasDomain()
public boolean hasDomain()Information about the domain.
.google.backstory.Domain domain = 30;
| Returns | |
|---|---|
| Type | Description |
boolean |
Whether the domain field is set. |
hasFile()
public boolean hasFile()Information about the file.
.google.backstory.File file = 11;
| Returns | |
|---|---|
| Type | Description |
boolean |
Whether the file field is set. |
hasGroup()
public boolean hasGroup()Information about the group.
.google.backstory.Group group = 20;
| Returns | |
|---|---|
| Type | Description |
boolean |
Whether the group field is set. |
hasInvestigation()
public boolean hasInvestigation()Analyst feedback/investigation for alerts.
.google.backstory.Investigation investigation = 26;
| Returns | |
|---|---|
| Type | Description |
boolean |
Whether the investigation field is set. |
hasLocation()
public boolean hasLocation()Physical location. For cloud environments, set the region in location.name.
.google.backstory.Location location = 17;
| Returns | |
|---|---|
| Type | Description |
boolean |
Whether the location field is set. |
hasNetwork()
public boolean hasNetwork()Network details, including sub-messages with details on each protocol (for example, DHCP, DNS, or HTTP).
.google.backstory.Network network = 33;
| Returns | |
|---|---|
| Type | Description |
boolean |
Whether the network field is set. |
hasObjectReference()
public boolean hasObjectReference()Finding to which the Analyst updated the feedback.
.google.backstory.Id object_reference = 25;
| Returns | |
|---|---|
| Type | Description |
boolean |
Whether the objectReference field is set. |
hasProcess()
public boolean hasProcess()Information about the process.
.google.backstory.Process process = 4;
| Returns | |
|---|---|
| Type | Description |
boolean |
Whether the process field is set. |
hasRegistry()
public boolean hasRegistry()Registry information.
.google.backstory.Registry registry = 13;
| Returns | |
|---|---|
| Type | Description |
boolean |
Whether the registry field is set. |
hasResource()
public boolean hasResource()Information about the resource (e.g. scheduled task, calendar entry). This field should not be used for files, registry, or processes because these objects are already part of Noun.
.google.backstory.Resource resource = 18;
| Returns | |
|---|---|
| Type | Description |
boolean |
Whether the resource field is set. |
hasUrlMetadata()
public boolean hasUrlMetadata()Information about the URL.
.google.backstory.Url url_metadata = 37;
| Returns | |
|---|---|
| Type | Description |
boolean |
Whether the urlMetadata field is set. |
hasUser()
public boolean hasUser()Information about the user.
.google.backstory.User user = 3;
| Returns | |
|---|---|
| Type | Description |
boolean |
Whether the user field is set. |
hashCode()
public int hashCode()| Returns | |
|---|---|
| Type | Description |
int |
|
internalGetFieldAccessorTable()
protected GeneratedMessage.FieldAccessorTable internalGetFieldAccessorTable()| Returns | |
|---|---|
| Type | Description |
FieldAccessorTable |
|
isInitialized()
public final boolean isInitialized()| Returns | |
|---|---|
| Type | Description |
boolean |
|
newBuilderForType()
public Noun.Builder newBuilderForType()| Returns | |
|---|---|
| Type | Description |
Noun.Builder |
|
newBuilderForType(AbstractMessage.BuilderParent parent)
protected Noun.Builder newBuilderForType(AbstractMessage.BuilderParent parent)| Parameter | |
|---|---|
| Name | Description |
parent |
BuilderParent |
| Returns | |
|---|---|
| Type | Description |
Noun.Builder |
|
toBuilder()
public Noun.Builder toBuilder()| Returns | |
|---|---|
| Type | Description |
Noun.Builder |
|
writeTo(CodedOutputStream output)
public void writeTo(CodedOutputStream output)| Parameter | |
|---|---|
| Name | Description |
output |
CodedOutputStream |
| Exceptions | |
|---|---|
| Type | Description |
IOException |
|