Class Noun.Builder (0.3.0)

public static final class Noun.Builder extends GeneratedMessage.Builder<Noun.Builder> implements NounOrBuilder

The Noun type is used to represent the different entities in an event: principal, src, target, observer, intermediary, and about. It stores attributes known about the entity. For example, if the entity is a device with multiple IP or MAC addresses, it stores the IP and MAC addresses that are relevant to the event.

Protobuf type google.backstory.Noun

Implements

NounOrBuilder

Static Methods

getDescriptor()

public static final Descriptors.Descriptor getDescriptor()
Returns
Type Description
Descriptor

Methods

addAllIp(Iterable<String> values)

public Noun.Builder addAllIp(Iterable<String> values)

A list of IP addresses associated with a network connection. This field can be used as an entity indicator for asset entities.

repeated string ip = 6;

Parameter
Name Description
values Iterable<String>

The ip to add.

Returns
Type Description
Noun.Builder

This builder for chaining.

addAllIpGeoArtifact(Iterable<? extends Artifact> values)

public Noun.Builder addAllIpGeoArtifact(Iterable<? extends Artifact> values)

Enriched geographic information corresponding to an IP address. Specifically, location and network data.

repeated .google.backstory.Artifact ip_geo_artifact = 35;

Parameter
Name Description
values Iterable<? extends com.google.backstory.Artifact>
Returns
Type Description
Noun.Builder

addAllIpLocation(Iterable<? extends Location> values) (deprecated)

public Noun.Builder addAllIpLocation(Iterable<? extends Location> values)

Deprecated: use ip_geo_artifact.location instead.

repeated .google.backstory.Location ip_location = 34 [deprecated = true];

Parameter
Name Description
values Iterable<? extends com.google.backstory.Location>
Returns
Type Description
Noun.Builder

addAllLabels(Iterable<? extends Label> values) (deprecated)

public Noun.Builder addAllLabels(Iterable<? extends Label> values)

Labels are key-value pairs. For example: key = "env", value = "prod". Deprecated: labels should be populated in entity Attribute as generic metadata (e.g. user.attribute.labels).

repeated .google.backstory.Label labels = 23 [deprecated = true];

Parameter
Name Description
values Iterable<? extends com.google.backstory.Label>
Returns
Type Description
Noun.Builder

addAllMac(Iterable<String> values)

public Noun.Builder addAllMac(Iterable<String> values)

List of MAC addresses associated with a device. This field can be used as an entity indicator for asset entities.

repeated string mac = 8;

Parameter
Name Description
values Iterable<String>

The mac to add.

Returns
Type Description
Noun.Builder

This builder for chaining.

addAllNatIp(Iterable<String> values)

public Noun.Builder addAllNatIp(Iterable<String> values)

A list of NAT translated IP addresses associated with a network connection.

repeated string nat_ip = 21;

Parameter
Name Description
values Iterable<String>

The natIp to add.

Returns
Type Description
Noun.Builder

This builder for chaining.

addAllProcessAncestors(Iterable<? extends Process> values)

public Noun.Builder addAllProcessAncestors(Iterable<? extends Process> values)

Information about the process's ancestors ordered from immediate ancestor (parent process) to root. Note: process_ancestors is only populated when data is exported to BigQuery since recursive fields (e.g. process.parent_process) are not supported by BigQuery.

repeated .google.backstory.Process process_ancestors = 28;

Parameter
Name Description
values Iterable<? extends com.google.backstory.Process>
Returns
Type Description
Noun.Builder

addAllResourceAncestors(Iterable<? extends Resource> values)

public Noun.Builder addAllResourceAncestors(Iterable<? extends Resource> values)

Information about the resource's ancestors ordered from immediate ancestor (starting with parent resource).

repeated .google.backstory.Resource resource_ancestors = 31;

Parameter
Name Description
values Iterable<? extends com.google.backstory.Resource>
Returns
Type Description
Noun.Builder

addAllSecurityResult(Iterable<? extends SecurityResult> values)

public Noun.Builder addAllSecurityResult(Iterable<? extends SecurityResult> values)

A list of security results.

repeated .google.backstory.SecurityResult security_result = 36;

Parameter
Name Description
values Iterable<? extends com.google.backstory.SecurityResult>
Returns
Type Description
Noun.Builder

addAllUserManagementChain(Iterable<? extends User> values)

public Noun.Builder addAllUserManagementChain(Iterable<? extends User> values)

Information about the user's management chain (reporting hierarchy). Note: user_management_chain is only populated when data is exported to BigQuery since recursive fields (e.g. user.managers) are not supported by BigQuery.

repeated .google.backstory.User user_management_chain = 29;

Parameter
Name Description
values Iterable<? extends com.google.backstory.User>
Returns
Type Description
Noun.Builder

addIp(String value)

public Noun.Builder addIp(String value)

A list of IP addresses associated with a network connection. This field can be used as an entity indicator for asset entities.

repeated string ip = 6;

Parameter
Name Description
value String

The ip to add.

Returns
Type Description
Noun.Builder

This builder for chaining.

addIpBytes(ByteString value)

public Noun.Builder addIpBytes(ByteString value)

A list of IP addresses associated with a network connection. This field can be used as an entity indicator for asset entities.

repeated string ip = 6;

Parameter
Name Description
value ByteString

The bytes of the ip to add.

Returns
Type Description
Noun.Builder

This builder for chaining.

addIpGeoArtifact(Artifact value)

public Noun.Builder addIpGeoArtifact(Artifact value)

Enriched geographic information corresponding to an IP address. Specifically, location and network data.

repeated .google.backstory.Artifact ip_geo_artifact = 35;

Parameter
Name Description
value Artifact
Returns
Type Description
Noun.Builder

addIpGeoArtifact(Artifact.Builder builderForValue)

public Noun.Builder addIpGeoArtifact(Artifact.Builder builderForValue)

Enriched geographic information corresponding to an IP address. Specifically, location and network data.

repeated .google.backstory.Artifact ip_geo_artifact = 35;

Parameter
Name Description
builderForValue Artifact.Builder
Returns
Type Description
Noun.Builder

addIpGeoArtifact(int index, Artifact value)

public Noun.Builder addIpGeoArtifact(int index, Artifact value)

Enriched geographic information corresponding to an IP address. Specifically, location and network data.

repeated .google.backstory.Artifact ip_geo_artifact = 35;

Parameters
Name Description
index int
value Artifact
Returns
Type Description
Noun.Builder

addIpGeoArtifact(int index, Artifact.Builder builderForValue)

public Noun.Builder addIpGeoArtifact(int index, Artifact.Builder builderForValue)

Enriched geographic information corresponding to an IP address. Specifically, location and network data.

repeated .google.backstory.Artifact ip_geo_artifact = 35;

Parameters
Name Description
index int
builderForValue Artifact.Builder
Returns
Type Description
Noun.Builder

addIpGeoArtifactBuilder()

public Artifact.Builder addIpGeoArtifactBuilder()

Enriched geographic information corresponding to an IP address. Specifically, location and network data.

repeated .google.backstory.Artifact ip_geo_artifact = 35;

Returns
Type Description
Artifact.Builder

addIpGeoArtifactBuilder(int index)

public Artifact.Builder addIpGeoArtifactBuilder(int index)

Enriched geographic information corresponding to an IP address. Specifically, location and network data.

repeated .google.backstory.Artifact ip_geo_artifact = 35;

Parameter
Name Description
index int
Returns
Type Description
Artifact.Builder

addIpLocation(Location value) (deprecated)

public Noun.Builder addIpLocation(Location value)

Deprecated: use ip_geo_artifact.location instead.

repeated .google.backstory.Location ip_location = 34 [deprecated = true];

Parameter
Name Description
value Location
Returns
Type Description
Noun.Builder

addIpLocation(Location.Builder builderForValue) (deprecated)

public Noun.Builder addIpLocation(Location.Builder builderForValue)

Deprecated: use ip_geo_artifact.location instead.

repeated .google.backstory.Location ip_location = 34 [deprecated = true];

Parameter
Name Description
builderForValue Location.Builder
Returns
Type Description
Noun.Builder

addIpLocation(int index, Location value) (deprecated)

public Noun.Builder addIpLocation(int index, Location value)

Deprecated: use ip_geo_artifact.location instead.

repeated .google.backstory.Location ip_location = 34 [deprecated = true];

Parameters
Name Description
index int
value Location
Returns
Type Description
Noun.Builder

addIpLocation(int index, Location.Builder builderForValue) (deprecated)

public Noun.Builder addIpLocation(int index, Location.Builder builderForValue)

Deprecated: use ip_geo_artifact.location instead.

repeated .google.backstory.Location ip_location = 34 [deprecated = true];

Parameters
Name Description
index int
builderForValue Location.Builder
Returns
Type Description
Noun.Builder

addIpLocationBuilder() (deprecated)

public Location.Builder addIpLocationBuilder()

Deprecated: use ip_geo_artifact.location instead.

repeated .google.backstory.Location ip_location = 34 [deprecated = true];

Returns
Type Description
Location.Builder

addIpLocationBuilder(int index) (deprecated)

public Location.Builder addIpLocationBuilder(int index)

Deprecated: use ip_geo_artifact.location instead.

repeated .google.backstory.Location ip_location = 34 [deprecated = true];

Parameter
Name Description
index int
Returns
Type Description
Location.Builder

addLabels(Label value) (deprecated)

public Noun.Builder addLabels(Label value)

Labels are key-value pairs. For example: key = "env", value = "prod". Deprecated: labels should be populated in entity Attribute as generic metadata (e.g. user.attribute.labels).

repeated .google.backstory.Label labels = 23 [deprecated = true];

Parameter
Name Description
value Label
Returns
Type Description
Noun.Builder

addLabels(Label.Builder builderForValue) (deprecated)

public Noun.Builder addLabels(Label.Builder builderForValue)

Labels are key-value pairs. For example: key = "env", value = "prod". Deprecated: labels should be populated in entity Attribute as generic metadata (e.g. user.attribute.labels).

repeated .google.backstory.Label labels = 23 [deprecated = true];

Parameter
Name Description
builderForValue Label.Builder
Returns
Type Description
Noun.Builder

addLabels(int index, Label value) (deprecated)

public Noun.Builder addLabels(int index, Label value)

Labels are key-value pairs. For example: key = "env", value = "prod". Deprecated: labels should be populated in entity Attribute as generic metadata (e.g. user.attribute.labels).

repeated .google.backstory.Label labels = 23 [deprecated = true];

Parameters
Name Description
index int
value Label
Returns
Type Description
Noun.Builder

addLabels(int index, Label.Builder builderForValue) (deprecated)

public Noun.Builder addLabels(int index, Label.Builder builderForValue)

Labels are key-value pairs. For example: key = "env", value = "prod". Deprecated: labels should be populated in entity Attribute as generic metadata (e.g. user.attribute.labels).

repeated .google.backstory.Label labels = 23 [deprecated = true];

Parameters
Name Description
index int
builderForValue Label.Builder
Returns
Type Description
Noun.Builder

addLabelsBuilder() (deprecated)

public Label.Builder addLabelsBuilder()

Labels are key-value pairs. For example: key = "env", value = "prod". Deprecated: labels should be populated in entity Attribute as generic metadata (e.g. user.attribute.labels).

repeated .google.backstory.Label labels = 23 [deprecated = true];

Returns
Type Description
Label.Builder

addLabelsBuilder(int index) (deprecated)

public Label.Builder addLabelsBuilder(int index)

Labels are key-value pairs. For example: key = "env", value = "prod". Deprecated: labels should be populated in entity Attribute as generic metadata (e.g. user.attribute.labels).

repeated .google.backstory.Label labels = 23 [deprecated = true];

Parameter
Name Description
index int
Returns
Type Description
Label.Builder

addMac(String value)

public Noun.Builder addMac(String value)

List of MAC addresses associated with a device. This field can be used as an entity indicator for asset entities.

repeated string mac = 8;

Parameter
Name Description
value String

The mac to add.

Returns
Type Description
Noun.Builder

This builder for chaining.

addMacBytes(ByteString value)

public Noun.Builder addMacBytes(ByteString value)

List of MAC addresses associated with a device. This field can be used as an entity indicator for asset entities.

repeated string mac = 8;

Parameter
Name Description
value ByteString

The bytes of the mac to add.

Returns
Type Description
Noun.Builder

This builder for chaining.

addNatIp(String value)

public Noun.Builder addNatIp(String value)

A list of NAT translated IP addresses associated with a network connection.

repeated string nat_ip = 21;

Parameter
Name Description
value String

The natIp to add.

Returns
Type Description
Noun.Builder

This builder for chaining.

addNatIpBytes(ByteString value)

public Noun.Builder addNatIpBytes(ByteString value)

A list of NAT translated IP addresses associated with a network connection.

repeated string nat_ip = 21;

Parameter
Name Description
value ByteString

The bytes of the natIp to add.

Returns
Type Description
Noun.Builder

This builder for chaining.

addProcessAncestors(Process value)

public Noun.Builder addProcessAncestors(Process value)

Information about the process's ancestors ordered from immediate ancestor (parent process) to root. Note: process_ancestors is only populated when data is exported to BigQuery since recursive fields (e.g. process.parent_process) are not supported by BigQuery.

repeated .google.backstory.Process process_ancestors = 28;

Parameter
Name Description
value Process
Returns
Type Description
Noun.Builder

addProcessAncestors(Process.Builder builderForValue)

public Noun.Builder addProcessAncestors(Process.Builder builderForValue)

Information about the process's ancestors ordered from immediate ancestor (parent process) to root. Note: process_ancestors is only populated when data is exported to BigQuery since recursive fields (e.g. process.parent_process) are not supported by BigQuery.

repeated .google.backstory.Process process_ancestors = 28;

Parameter
Name Description
builderForValue Process.Builder
Returns
Type Description
Noun.Builder

addProcessAncestors(int index, Process value)

public Noun.Builder addProcessAncestors(int index, Process value)

Information about the process's ancestors ordered from immediate ancestor (parent process) to root. Note: process_ancestors is only populated when data is exported to BigQuery since recursive fields (e.g. process.parent_process) are not supported by BigQuery.

repeated .google.backstory.Process process_ancestors = 28;

Parameters
Name Description
index int
value Process
Returns
Type Description
Noun.Builder

addProcessAncestors(int index, Process.Builder builderForValue)

public Noun.Builder addProcessAncestors(int index, Process.Builder builderForValue)

Information about the process's ancestors ordered from immediate ancestor (parent process) to root. Note: process_ancestors is only populated when data is exported to BigQuery since recursive fields (e.g. process.parent_process) are not supported by BigQuery.

repeated .google.backstory.Process process_ancestors = 28;

Parameters
Name Description
index int
builderForValue Process.Builder
Returns
Type Description
Noun.Builder

addProcessAncestorsBuilder()

public Process.Builder addProcessAncestorsBuilder()

Information about the process's ancestors ordered from immediate ancestor (parent process) to root. Note: process_ancestors is only populated when data is exported to BigQuery since recursive fields (e.g. process.parent_process) are not supported by BigQuery.

repeated .google.backstory.Process process_ancestors = 28;

Returns
Type Description
Process.Builder

addProcessAncestorsBuilder(int index)

public Process.Builder addProcessAncestorsBuilder(int index)

Information about the process's ancestors ordered from immediate ancestor (parent process) to root. Note: process_ancestors is only populated when data is exported to BigQuery since recursive fields (e.g. process.parent_process) are not supported by BigQuery.

repeated .google.backstory.Process process_ancestors = 28;

Parameter
Name Description
index int
Returns
Type Description
Process.Builder

addResourceAncestors(Resource value)

public Noun.Builder addResourceAncestors(Resource value)

Information about the resource's ancestors ordered from immediate ancestor (starting with parent resource).

repeated .google.backstory.Resource resource_ancestors = 31;

Parameter
Name Description
value Resource
Returns
Type Description
Noun.Builder

addResourceAncestors(Resource.Builder builderForValue)

public Noun.Builder addResourceAncestors(Resource.Builder builderForValue)

Information about the resource's ancestors ordered from immediate ancestor (starting with parent resource).

repeated .google.backstory.Resource resource_ancestors = 31;

Parameter
Name Description
builderForValue Resource.Builder
Returns
Type Description
Noun.Builder

addResourceAncestors(int index, Resource value)

public Noun.Builder addResourceAncestors(int index, Resource value)

Information about the resource's ancestors ordered from immediate ancestor (starting with parent resource).

repeated .google.backstory.Resource resource_ancestors = 31;

Parameters
Name Description
index int
value Resource
Returns
Type Description
Noun.Builder

addResourceAncestors(int index, Resource.Builder builderForValue)

public Noun.Builder addResourceAncestors(int index, Resource.Builder builderForValue)

Information about the resource's ancestors ordered from immediate ancestor (starting with parent resource).

repeated .google.backstory.Resource resource_ancestors = 31;

Parameters
Name Description
index int
builderForValue Resource.Builder
Returns
Type Description
Noun.Builder

addResourceAncestorsBuilder()

public Resource.Builder addResourceAncestorsBuilder()

Information about the resource's ancestors ordered from immediate ancestor (starting with parent resource).

repeated .google.backstory.Resource resource_ancestors = 31;

Returns
Type Description
Resource.Builder

addResourceAncestorsBuilder(int index)

public Resource.Builder addResourceAncestorsBuilder(int index)

Information about the resource's ancestors ordered from immediate ancestor (starting with parent resource).

repeated .google.backstory.Resource resource_ancestors = 31;

Parameter
Name Description
index int
Returns
Type Description
Resource.Builder

addSecurityResult(SecurityResult value)

public Noun.Builder addSecurityResult(SecurityResult value)

A list of security results.

repeated .google.backstory.SecurityResult security_result = 36;

Parameter
Name Description
value SecurityResult
Returns
Type Description
Noun.Builder

addSecurityResult(SecurityResult.Builder builderForValue)

public Noun.Builder addSecurityResult(SecurityResult.Builder builderForValue)

A list of security results.

repeated .google.backstory.SecurityResult security_result = 36;

Parameter
Name Description
builderForValue SecurityResult.Builder
Returns
Type Description
Noun.Builder

addSecurityResult(int index, SecurityResult value)

public Noun.Builder addSecurityResult(int index, SecurityResult value)

A list of security results.

repeated .google.backstory.SecurityResult security_result = 36;

Parameters
Name Description
index int
value SecurityResult
Returns
Type Description
Noun.Builder

addSecurityResult(int index, SecurityResult.Builder builderForValue)

public Noun.Builder addSecurityResult(int index, SecurityResult.Builder builderForValue)

A list of security results.

repeated .google.backstory.SecurityResult security_result = 36;

Parameters
Name Description
index int
builderForValue SecurityResult.Builder
Returns
Type Description
Noun.Builder

addSecurityResultBuilder()

public SecurityResult.Builder addSecurityResultBuilder()

A list of security results.

repeated .google.backstory.SecurityResult security_result = 36;

Returns
Type Description
SecurityResult.Builder

addSecurityResultBuilder(int index)

public SecurityResult.Builder addSecurityResultBuilder(int index)

A list of security results.

repeated .google.backstory.SecurityResult security_result = 36;

Parameter
Name Description
index int
Returns
Type Description
SecurityResult.Builder

addUserManagementChain(User value)

public Noun.Builder addUserManagementChain(User value)

Information about the user's management chain (reporting hierarchy). Note: user_management_chain is only populated when data is exported to BigQuery since recursive fields (e.g. user.managers) are not supported by BigQuery.

repeated .google.backstory.User user_management_chain = 29;

Parameter
Name Description
value User
Returns
Type Description
Noun.Builder

addUserManagementChain(User.Builder builderForValue)

public Noun.Builder addUserManagementChain(User.Builder builderForValue)

Information about the user's management chain (reporting hierarchy). Note: user_management_chain is only populated when data is exported to BigQuery since recursive fields (e.g. user.managers) are not supported by BigQuery.

repeated .google.backstory.User user_management_chain = 29;

Parameter
Name Description
builderForValue User.Builder
Returns
Type Description
Noun.Builder

addUserManagementChain(int index, User value)

public Noun.Builder addUserManagementChain(int index, User value)

Information about the user's management chain (reporting hierarchy). Note: user_management_chain is only populated when data is exported to BigQuery since recursive fields (e.g. user.managers) are not supported by BigQuery.

repeated .google.backstory.User user_management_chain = 29;

Parameters
Name Description
index int
value User
Returns
Type Description
Noun.Builder

addUserManagementChain(int index, User.Builder builderForValue)

public Noun.Builder addUserManagementChain(int index, User.Builder builderForValue)

Information about the user's management chain (reporting hierarchy). Note: user_management_chain is only populated when data is exported to BigQuery since recursive fields (e.g. user.managers) are not supported by BigQuery.

repeated .google.backstory.User user_management_chain = 29;

Parameters
Name Description
index int
builderForValue User.Builder
Returns
Type Description
Noun.Builder

addUserManagementChainBuilder()

public User.Builder addUserManagementChainBuilder()

Information about the user's management chain (reporting hierarchy). Note: user_management_chain is only populated when data is exported to BigQuery since recursive fields (e.g. user.managers) are not supported by BigQuery.

repeated .google.backstory.User user_management_chain = 29;

Returns
Type Description
User.Builder

addUserManagementChainBuilder(int index)

public User.Builder addUserManagementChainBuilder(int index)

Information about the user's management chain (reporting hierarchy). Note: user_management_chain is only populated when data is exported to BigQuery since recursive fields (e.g. user.managers) are not supported by BigQuery.

repeated .google.backstory.User user_management_chain = 29;

Parameter
Name Description
index int
Returns
Type Description
User.Builder

build()

public Noun build()
Returns
Type Description
Noun

buildPartial()

public Noun buildPartial()
Returns
Type Description
Noun

clear()

public Noun.Builder clear()
Returns
Type Description
Noun.Builder
Overrides

clearAdministrativeDomain()

public Noun.Builder clearAdministrativeDomain()

Domain which the device belongs to (for example, the Microsoft Windows domain).

string administrative_domain = 9;

Returns
Type Description
Noun.Builder

This builder for chaining.

clearApplication()

public Noun.Builder clearApplication()

The name of an application or service. Some SSO solutions only capture the name of a target application such as "Atlassian" or "Chronicle".

string application = 14;

Returns
Type Description
Noun.Builder

This builder for chaining.

clearArtifact()

public Noun.Builder clearArtifact()

Information about an artifact.

.google.backstory.Artifact artifact = 32;

Returns
Type Description
Noun.Builder

clearAsset()

public Noun.Builder clearAsset()

Information about the asset.

.google.backstory.Asset asset = 27;

Returns
Type Description
Noun.Builder

clearAssetId()

public Noun.Builder clearAssetId()

The asset ID. This field can be used as an entity indicator for asset entities.

string asset_id = 2;

Returns
Type Description
Noun.Builder

This builder for chaining.

clearBrowser()

public Noun.Builder clearBrowser()

Information about an entry in the web browser's local history database.

.google.backstory.Browser browser = 38;

Returns
Type Description
Noun.Builder

clearCloud() (deprecated)

public Noun.Builder clearCloud()

Cloud metadata. Deprecated: cloud should be populated in entity Attribute as generic metadata (e.g. asset.attribute.cloud).

.google.backstory.Cloud cloud = 24 [deprecated = true];

Returns
Type Description
Noun.Builder

clearDomain()

public Noun.Builder clearDomain()

Information about the domain.

.google.backstory.Domain domain = 30;

Returns
Type Description
Noun.Builder

clearEmail()

public Noun.Builder clearEmail()

Email address. Only filled in for security_result.about

string email = 12;

Returns
Type Description
Noun.Builder

This builder for chaining.

clearFile()

public Noun.Builder clearFile()

Information about the file.

.google.backstory.File file = 11;

Returns
Type Description
Noun.Builder

clearGroup()

public Noun.Builder clearGroup()

Information about the group.

.google.backstory.Group group = 20;

Returns
Type Description
Noun.Builder

clearHostname()

public Noun.Builder clearHostname()

Client hostname or domain name field. Hostname also doubles as the domain for remote entities. This field can be used as an entity indicator for asset entities.

string hostname = 1;

Returns
Type Description
Noun.Builder

This builder for chaining.

clearInvestigation()

public Noun.Builder clearInvestigation()

Analyst feedback/investigation for alerts.

.google.backstory.Investigation investigation = 26;

Returns
Type Description
Noun.Builder

clearIp()

public Noun.Builder clearIp()

A list of IP addresses associated with a network connection. This field can be used as an entity indicator for asset entities.

repeated string ip = 6;

Returns
Type Description
Noun.Builder

This builder for chaining.

clearIpGeoArtifact()

public Noun.Builder clearIpGeoArtifact()

Enriched geographic information corresponding to an IP address. Specifically, location and network data.

repeated .google.backstory.Artifact ip_geo_artifact = 35;

Returns
Type Description
Noun.Builder

clearIpLocation() (deprecated)

public Noun.Builder clearIpLocation()

Deprecated: use ip_geo_artifact.location instead.

repeated .google.backstory.Location ip_location = 34 [deprecated = true];

Returns
Type Description
Noun.Builder

clearLabels() (deprecated)

public Noun.Builder clearLabels()

Labels are key-value pairs. For example: key = "env", value = "prod". Deprecated: labels should be populated in entity Attribute as generic metadata (e.g. user.attribute.labels).

repeated .google.backstory.Label labels = 23 [deprecated = true];

Returns
Type Description
Noun.Builder

clearLocation()

public Noun.Builder clearLocation()

Physical location. For cloud environments, set the region in location.name.

.google.backstory.Location location = 17;

Returns
Type Description
Noun.Builder

clearMac()

public Noun.Builder clearMac()

List of MAC addresses associated with a device. This field can be used as an entity indicator for asset entities.

repeated string mac = 8;

Returns
Type Description
Noun.Builder

This builder for chaining.

clearNamespace()

public Noun.Builder clearNamespace()

Namespace which the device belongs to, such as "AD forest". Uses for this field include Microsoft Windows AD forest, the name of subsidiary, or the name of acquisition. This field can be used along with an asset indicator to identify an asset.

string namespace = 19;

Returns
Type Description
Noun.Builder

This builder for chaining.

clearNatIp()

public Noun.Builder clearNatIp()

A list of NAT translated IP addresses associated with a network connection.

repeated string nat_ip = 21;

Returns
Type Description
Noun.Builder

This builder for chaining.

clearNatPort()

public Noun.Builder clearNatPort()

NAT external network port number when a specific network connection is described within an event.

int32 nat_port = 22;

Returns
Type Description
Noun.Builder

This builder for chaining.

clearNetwork()

public Noun.Builder clearNetwork()

Network details, including sub-messages with details on each protocol (for example, DHCP, DNS, or HTTP).

.google.backstory.Network network = 33;

Returns
Type Description
Noun.Builder

clearObjectReference()

public Noun.Builder clearObjectReference()

Finding to which the Analyst updated the feedback.

.google.backstory.Id object_reference = 25;

Returns
Type Description
Noun.Builder

clearPlatform()

public Noun.Builder clearPlatform()

Platform.

.google.backstory.Noun.Platform platform = 5;

Returns
Type Description
Noun.Builder

This builder for chaining.

clearPlatformPatchLevel()

public Noun.Builder clearPlatformPatchLevel()

Platform patch level. For example, "Build 17134.48"

string platform_patch_level = 16;

Returns
Type Description
Noun.Builder

This builder for chaining.

clearPlatformVersion()

public Noun.Builder clearPlatformVersion()

Platform version. For example, "Microsoft Windows 1803".

string platform_version = 15;

Returns
Type Description
Noun.Builder

This builder for chaining.

clearPort()

public Noun.Builder clearPort()

Source or destination network port number when a specific network connection is described within an event.

int32 port = 7;

Returns
Type Description
Noun.Builder

This builder for chaining.

clearProcess()

public Noun.Builder clearProcess()

Information about the process.

.google.backstory.Process process = 4;

Returns
Type Description
Noun.Builder

clearProcessAncestors()

public Noun.Builder clearProcessAncestors()

Information about the process's ancestors ordered from immediate ancestor (parent process) to root. Note: process_ancestors is only populated when data is exported to BigQuery since recursive fields (e.g. process.parent_process) are not supported by BigQuery.

repeated .google.backstory.Process process_ancestors = 28;

Returns
Type Description
Noun.Builder

clearRegistry()

public Noun.Builder clearRegistry()

Registry information.

.google.backstory.Registry registry = 13;

Returns
Type Description
Noun.Builder

clearResource()

public Noun.Builder clearResource()

Information about the resource (e.g. scheduled task, calendar entry). This field should not be used for files, registry, or processes because these objects are already part of Noun.

.google.backstory.Resource resource = 18;

Returns
Type Description
Noun.Builder

clearResourceAncestors()

public Noun.Builder clearResourceAncestors()

Information about the resource's ancestors ordered from immediate ancestor (starting with parent resource).

repeated .google.backstory.Resource resource_ancestors = 31;

Returns
Type Description
Noun.Builder

clearSecurityResult()

public Noun.Builder clearSecurityResult()

A list of security results.

repeated .google.backstory.SecurityResult security_result = 36;

Returns
Type Description
Noun.Builder

clearUrl()

public Noun.Builder clearUrl()

The URL.

string url = 10;

Returns
Type Description
Noun.Builder

This builder for chaining.

clearUrlMetadata()

public Noun.Builder clearUrlMetadata()

Information about the URL.

.google.backstory.Url url_metadata = 37;

Returns
Type Description
Noun.Builder

clearUser()

public Noun.Builder clearUser()

Information about the user.

.google.backstory.User user = 3;

Returns
Type Description
Noun.Builder

clearUserManagementChain()

public Noun.Builder clearUserManagementChain()

Information about the user's management chain (reporting hierarchy). Note: user_management_chain is only populated when data is exported to BigQuery since recursive fields (e.g. user.managers) are not supported by BigQuery.

repeated .google.backstory.User user_management_chain = 29;

Returns
Type Description
Noun.Builder

getAdministrativeDomain()

public String getAdministrativeDomain()

Domain which the device belongs to (for example, the Microsoft Windows domain).

string administrative_domain = 9;

Returns
Type Description
String

The administrativeDomain.

getAdministrativeDomainBytes()

public ByteString getAdministrativeDomainBytes()

Domain which the device belongs to (for example, the Microsoft Windows domain).

string administrative_domain = 9;

Returns
Type Description
ByteString

The bytes for administrativeDomain.

getApplication()

public String getApplication()

The name of an application or service. Some SSO solutions only capture the name of a target application such as "Atlassian" or "Chronicle".

string application = 14;

Returns
Type Description
String

The application.

getApplicationBytes()

public ByteString getApplicationBytes()

The name of an application or service. Some SSO solutions only capture the name of a target application such as "Atlassian" or "Chronicle".

string application = 14;

Returns
Type Description
ByteString

The bytes for application.

getArtifact()

public Artifact getArtifact()

Information about an artifact.

.google.backstory.Artifact artifact = 32;

Returns
Type Description
Artifact

The artifact.

getArtifactBuilder()

public Artifact.Builder getArtifactBuilder()

Information about an artifact.

.google.backstory.Artifact artifact = 32;

Returns
Type Description
Artifact.Builder

getArtifactOrBuilder()

public ArtifactOrBuilder getArtifactOrBuilder()

Information about an artifact.

.google.backstory.Artifact artifact = 32;

Returns
Type Description
ArtifactOrBuilder

getAsset()

public Asset getAsset()

Information about the asset.

.google.backstory.Asset asset = 27;

Returns
Type Description
Asset

The asset.

getAssetBuilder()

public Asset.Builder getAssetBuilder()

Information about the asset.

.google.backstory.Asset asset = 27;

Returns
Type Description
Asset.Builder

getAssetId()

public String getAssetId()

The asset ID. This field can be used as an entity indicator for asset entities.

string asset_id = 2;

Returns
Type Description
String

The assetId.

getAssetIdBytes()

public ByteString getAssetIdBytes()

The asset ID. This field can be used as an entity indicator for asset entities.

string asset_id = 2;

Returns
Type Description
ByteString

The bytes for assetId.

getAssetOrBuilder()

public AssetOrBuilder getAssetOrBuilder()

Information about the asset.

.google.backstory.Asset asset = 27;

Returns
Type Description
AssetOrBuilder

getBrowser()

public Browser getBrowser()

Information about an entry in the web browser's local history database.

.google.backstory.Browser browser = 38;

Returns
Type Description
Browser

The browser.

getBrowserBuilder()

public Browser.Builder getBrowserBuilder()

Information about an entry in the web browser's local history database.

.google.backstory.Browser browser = 38;

Returns
Type Description
Browser.Builder

getBrowserOrBuilder()

public BrowserOrBuilder getBrowserOrBuilder()

Information about an entry in the web browser's local history database.

.google.backstory.Browser browser = 38;

Returns
Type Description
BrowserOrBuilder

getCloud() (deprecated)

public Cloud getCloud()

Deprecated. google.backstory.Noun.cloud is deprecated. See backstory/udm.proto;l=6324

Cloud metadata. Deprecated: cloud should be populated in entity Attribute as generic metadata (e.g. asset.attribute.cloud).

.google.backstory.Cloud cloud = 24 [deprecated = true];

Returns
Type Description
Cloud

The cloud.

getCloudBuilder() (deprecated)

public Cloud.Builder getCloudBuilder()

Cloud metadata. Deprecated: cloud should be populated in entity Attribute as generic metadata (e.g. asset.attribute.cloud).

.google.backstory.Cloud cloud = 24 [deprecated = true];

Returns
Type Description
Cloud.Builder

getCloudOrBuilder() (deprecated)

public CloudOrBuilder getCloudOrBuilder()

Cloud metadata. Deprecated: cloud should be populated in entity Attribute as generic metadata (e.g. asset.attribute.cloud).

.google.backstory.Cloud cloud = 24 [deprecated = true];

Returns
Type Description
CloudOrBuilder

getDefaultInstanceForType()

public Noun getDefaultInstanceForType()
Returns
Type Description
Noun

getDescriptorForType()

public Descriptors.Descriptor getDescriptorForType()
Returns
Type Description
Descriptor
Overrides

getDomain()

public Domain getDomain()

Information about the domain.

.google.backstory.Domain domain = 30;

Returns
Type Description
Domain

The domain.

getDomainBuilder()

public Domain.Builder getDomainBuilder()

Information about the domain.

.google.backstory.Domain domain = 30;

Returns
Type Description
Domain.Builder

getDomainOrBuilder()

public DomainOrBuilder getDomainOrBuilder()

Information about the domain.

.google.backstory.Domain domain = 30;

Returns
Type Description
DomainOrBuilder

getEmail()

public String getEmail()

Email address. Only filled in for security_result.about

string email = 12;

Returns
Type Description
String

The email.

getEmailBytes()

public ByteString getEmailBytes()

Email address. Only filled in for security_result.about

string email = 12;

Returns
Type Description
ByteString

The bytes for email.

getFile()

public File getFile()

Information about the file.

.google.backstory.File file = 11;

Returns
Type Description
File

The file.

getFileBuilder()

public File.Builder getFileBuilder()

Information about the file.

.google.backstory.File file = 11;

Returns
Type Description
File.Builder

getFileOrBuilder()

public FileOrBuilder getFileOrBuilder()

Information about the file.

.google.backstory.File file = 11;

Returns
Type Description
FileOrBuilder

getGroup()

public Group getGroup()

Information about the group.

.google.backstory.Group group = 20;

Returns
Type Description
Group

The group.

getGroupBuilder()

public Group.Builder getGroupBuilder()

Information about the group.

.google.backstory.Group group = 20;

Returns
Type Description
Group.Builder

getGroupOrBuilder()

public GroupOrBuilder getGroupOrBuilder()

Information about the group.

.google.backstory.Group group = 20;

Returns
Type Description
GroupOrBuilder

getHostname()

public String getHostname()

Client hostname or domain name field. Hostname also doubles as the domain for remote entities. This field can be used as an entity indicator for asset entities.

string hostname = 1;

Returns
Type Description
String

The hostname.

getHostnameBytes()

public ByteString getHostnameBytes()

Client hostname or domain name field. Hostname also doubles as the domain for remote entities. This field can be used as an entity indicator for asset entities.

string hostname = 1;

Returns
Type Description
ByteString

The bytes for hostname.

getInvestigation()

public Investigation getInvestigation()

Analyst feedback/investigation for alerts.

.google.backstory.Investigation investigation = 26;

Returns
Type Description
Investigation

The investigation.

getInvestigationBuilder()

public Investigation.Builder getInvestigationBuilder()

Analyst feedback/investigation for alerts.

.google.backstory.Investigation investigation = 26;

Returns
Type Description
Investigation.Builder

getInvestigationOrBuilder()

public InvestigationOrBuilder getInvestigationOrBuilder()

Analyst feedback/investigation for alerts.

.google.backstory.Investigation investigation = 26;

Returns
Type Description
InvestigationOrBuilder

getIp(int index)

public String getIp(int index)

A list of IP addresses associated with a network connection. This field can be used as an entity indicator for asset entities.

repeated string ip = 6;

Parameter
Name Description
index int

The index of the element to return.

Returns
Type Description
String

The ip at the given index.

getIpBytes(int index)

public ByteString getIpBytes(int index)

A list of IP addresses associated with a network connection. This field can be used as an entity indicator for asset entities.

repeated string ip = 6;

Parameter
Name Description
index int

The index of the value to return.

Returns
Type Description
ByteString

The bytes of the ip at the given index.

getIpCount()

public int getIpCount()

A list of IP addresses associated with a network connection. This field can be used as an entity indicator for asset entities.

repeated string ip = 6;

Returns
Type Description
int

The count of ip.

getIpGeoArtifact(int index)

public Artifact getIpGeoArtifact(int index)

Enriched geographic information corresponding to an IP address. Specifically, location and network data.

repeated .google.backstory.Artifact ip_geo_artifact = 35;

Parameter
Name Description
index int
Returns
Type Description
Artifact

getIpGeoArtifactBuilder(int index)

public Artifact.Builder getIpGeoArtifactBuilder(int index)

Enriched geographic information corresponding to an IP address. Specifically, location and network data.

repeated .google.backstory.Artifact ip_geo_artifact = 35;

Parameter
Name Description
index int
Returns
Type Description
Artifact.Builder

getIpGeoArtifactBuilderList()

public List<Artifact.Builder> getIpGeoArtifactBuilderList()

Enriched geographic information corresponding to an IP address. Specifically, location and network data.

repeated .google.backstory.Artifact ip_geo_artifact = 35;

Returns
Type Description
List<Builder>

getIpGeoArtifactCount()

public int getIpGeoArtifactCount()

Enriched geographic information corresponding to an IP address. Specifically, location and network data.

repeated .google.backstory.Artifact ip_geo_artifact = 35;

Returns
Type Description
int

getIpGeoArtifactList()

public List<Artifact> getIpGeoArtifactList()

Enriched geographic information corresponding to an IP address. Specifically, location and network data.

repeated .google.backstory.Artifact ip_geo_artifact = 35;

Returns
Type Description
List<Artifact>

getIpGeoArtifactOrBuilder(int index)

public ArtifactOrBuilder getIpGeoArtifactOrBuilder(int index)

Enriched geographic information corresponding to an IP address. Specifically, location and network data.

repeated .google.backstory.Artifact ip_geo_artifact = 35;

Parameter
Name Description
index int
Returns
Type Description
ArtifactOrBuilder

getIpGeoArtifactOrBuilderList()

public List<? extends ArtifactOrBuilder> getIpGeoArtifactOrBuilderList()

Enriched geographic information corresponding to an IP address. Specifically, location and network data.

repeated .google.backstory.Artifact ip_geo_artifact = 35;

Returns
Type Description
List<? extends com.google.backstory.ArtifactOrBuilder>

getIpList()

public ProtocolStringList getIpList()

A list of IP addresses associated with a network connection. This field can be used as an entity indicator for asset entities.

repeated string ip = 6;

Returns
Type Description
ProtocolStringList

A list containing the ip.

getIpLocation(int index) (deprecated)

public Location getIpLocation(int index)

Deprecated: use ip_geo_artifact.location instead.

repeated .google.backstory.Location ip_location = 34 [deprecated = true];

Parameter
Name Description
index int
Returns
Type Description
Location

getIpLocationBuilder(int index) (deprecated)

public Location.Builder getIpLocationBuilder(int index)

Deprecated: use ip_geo_artifact.location instead.

repeated .google.backstory.Location ip_location = 34 [deprecated = true];

Parameter
Name Description
index int
Returns
Type Description
Location.Builder

getIpLocationBuilderList() (deprecated)

public List<Location.Builder> getIpLocationBuilderList()

Deprecated: use ip_geo_artifact.location instead.

repeated .google.backstory.Location ip_location = 34 [deprecated = true];

Returns
Type Description
List<Builder>

getIpLocationCount() (deprecated)

public int getIpLocationCount()

Deprecated: use ip_geo_artifact.location instead.

repeated .google.backstory.Location ip_location = 34 [deprecated = true];

Returns
Type Description
int

getIpLocationList() (deprecated)

public List<Location> getIpLocationList()

Deprecated: use ip_geo_artifact.location instead.

repeated .google.backstory.Location ip_location = 34 [deprecated = true];

Returns
Type Description
List<Location>

getIpLocationOrBuilder(int index) (deprecated)

public LocationOrBuilder getIpLocationOrBuilder(int index)

Deprecated: use ip_geo_artifact.location instead.

repeated .google.backstory.Location ip_location = 34 [deprecated = true];

Parameter
Name Description
index int
Returns
Type Description
LocationOrBuilder

getIpLocationOrBuilderList() (deprecated)

public List<? extends LocationOrBuilder> getIpLocationOrBuilderList()

Deprecated: use ip_geo_artifact.location instead.

repeated .google.backstory.Location ip_location = 34 [deprecated = true];

Returns
Type Description
List<? extends com.google.backstory.LocationOrBuilder>

getLabels(int index) (deprecated)

public Label getLabels(int index)

Labels are key-value pairs. For example: key = "env", value = "prod". Deprecated: labels should be populated in entity Attribute as generic metadata (e.g. user.attribute.labels).

repeated .google.backstory.Label labels = 23 [deprecated = true];

Parameter
Name Description
index int
Returns
Type Description
Label

getLabelsBuilder(int index) (deprecated)

public Label.Builder getLabelsBuilder(int index)

Labels are key-value pairs. For example: key = "env", value = "prod". Deprecated: labels should be populated in entity Attribute as generic metadata (e.g. user.attribute.labels).

repeated .google.backstory.Label labels = 23 [deprecated = true];

Parameter
Name Description
index int
Returns
Type Description
Label.Builder

getLabelsBuilderList() (deprecated)

public List<Label.Builder> getLabelsBuilderList()

Labels are key-value pairs. For example: key = "env", value = "prod". Deprecated: labels should be populated in entity Attribute as generic metadata (e.g. user.attribute.labels).

repeated .google.backstory.Label labels = 23 [deprecated = true];

Returns
Type Description
List<Builder>

getLabelsCount() (deprecated)

public int getLabelsCount()

Labels are key-value pairs. For example: key = "env", value = "prod". Deprecated: labels should be populated in entity Attribute as generic metadata (e.g. user.attribute.labels).

repeated .google.backstory.Label labels = 23 [deprecated = true];

Returns
Type Description
int

getLabelsList() (deprecated)

public List<Label> getLabelsList()

Labels are key-value pairs. For example: key = "env", value = "prod". Deprecated: labels should be populated in entity Attribute as generic metadata (e.g. user.attribute.labels).

repeated .google.backstory.Label labels = 23 [deprecated = true];

Returns
Type Description
List<Label>

getLabelsOrBuilder(int index) (deprecated)

public LabelOrBuilder getLabelsOrBuilder(int index)

Labels are key-value pairs. For example: key = "env", value = "prod". Deprecated: labels should be populated in entity Attribute as generic metadata (e.g. user.attribute.labels).

repeated .google.backstory.Label labels = 23 [deprecated = true];

Parameter
Name Description
index int
Returns
Type Description
LabelOrBuilder

getLabelsOrBuilderList() (deprecated)

public List<? extends LabelOrBuilder> getLabelsOrBuilderList()

Labels are key-value pairs. For example: key = "env", value = "prod". Deprecated: labels should be populated in entity Attribute as generic metadata (e.g. user.attribute.labels).

repeated .google.backstory.Label labels = 23 [deprecated = true];

Returns
Type Description
List<? extends com.google.backstory.LabelOrBuilder>

getLocation()

public Location getLocation()

Physical location. For cloud environments, set the region in location.name.

.google.backstory.Location location = 17;

Returns
Type Description
Location

The location.

getLocationBuilder()

public Location.Builder getLocationBuilder()

Physical location. For cloud environments, set the region in location.name.

.google.backstory.Location location = 17;

Returns
Type Description
Location.Builder

getLocationOrBuilder()

public LocationOrBuilder getLocationOrBuilder()

Physical location. For cloud environments, set the region in location.name.

.google.backstory.Location location = 17;

Returns
Type Description
LocationOrBuilder

getMac(int index)

public String getMac(int index)

List of MAC addresses associated with a device. This field can be used as an entity indicator for asset entities.

repeated string mac = 8;

Parameter
Name Description
index int

The index of the element to return.

Returns
Type Description
String

The mac at the given index.

getMacBytes(int index)

public ByteString getMacBytes(int index)

List of MAC addresses associated with a device. This field can be used as an entity indicator for asset entities.

repeated string mac = 8;

Parameter
Name Description
index int

The index of the value to return.

Returns
Type Description
ByteString

The bytes of the mac at the given index.

getMacCount()

public int getMacCount()

List of MAC addresses associated with a device. This field can be used as an entity indicator for asset entities.

repeated string mac = 8;

Returns
Type Description
int

The count of mac.

getMacList()

public ProtocolStringList getMacList()

List of MAC addresses associated with a device. This field can be used as an entity indicator for asset entities.

repeated string mac = 8;

Returns
Type Description
ProtocolStringList

A list containing the mac.

getNamespace()

public String getNamespace()

Namespace which the device belongs to, such as "AD forest". Uses for this field include Microsoft Windows AD forest, the name of subsidiary, or the name of acquisition. This field can be used along with an asset indicator to identify an asset.

string namespace = 19;

Returns
Type Description
String

The namespace.

getNamespaceBytes()

public ByteString getNamespaceBytes()

Namespace which the device belongs to, such as "AD forest". Uses for this field include Microsoft Windows AD forest, the name of subsidiary, or the name of acquisition. This field can be used along with an asset indicator to identify an asset.

string namespace = 19;

Returns
Type Description
ByteString

The bytes for namespace.

getNatIp(int index)

public String getNatIp(int index)

A list of NAT translated IP addresses associated with a network connection.

repeated string nat_ip = 21;

Parameter
Name Description
index int

The index of the element to return.

Returns
Type Description
String

The natIp at the given index.

getNatIpBytes(int index)

public ByteString getNatIpBytes(int index)

A list of NAT translated IP addresses associated with a network connection.

repeated string nat_ip = 21;

Parameter
Name Description
index int

The index of the value to return.

Returns
Type Description
ByteString

The bytes of the natIp at the given index.

getNatIpCount()

public int getNatIpCount()

A list of NAT translated IP addresses associated with a network connection.

repeated string nat_ip = 21;

Returns
Type Description
int

The count of natIp.

getNatIpList()

public ProtocolStringList getNatIpList()

A list of NAT translated IP addresses associated with a network connection.

repeated string nat_ip = 21;

Returns
Type Description
ProtocolStringList

A list containing the natIp.

getNatPort()

public int getNatPort()

NAT external network port number when a specific network connection is described within an event.

int32 nat_port = 22;

Returns
Type Description
int

The natPort.

getNetwork()

public Network getNetwork()

Network details, including sub-messages with details on each protocol (for example, DHCP, DNS, or HTTP).

.google.backstory.Network network = 33;

Returns
Type Description
Network

The network.

getNetworkBuilder()

public Network.Builder getNetworkBuilder()

Network details, including sub-messages with details on each protocol (for example, DHCP, DNS, or HTTP).

.google.backstory.Network network = 33;

Returns
Type Description
Network.Builder

getNetworkOrBuilder()

public NetworkOrBuilder getNetworkOrBuilder()

Network details, including sub-messages with details on each protocol (for example, DHCP, DNS, or HTTP).

.google.backstory.Network network = 33;

Returns
Type Description
NetworkOrBuilder

getObjectReference()

public Id getObjectReference()

Finding to which the Analyst updated the feedback.

.google.backstory.Id object_reference = 25;

Returns
Type Description
Id

The objectReference.

getObjectReferenceBuilder()

public Id.Builder getObjectReferenceBuilder()

Finding to which the Analyst updated the feedback.

.google.backstory.Id object_reference = 25;

Returns
Type Description
Id.Builder

getObjectReferenceOrBuilder()

public IdOrBuilder getObjectReferenceOrBuilder()

Finding to which the Analyst updated the feedback.

.google.backstory.Id object_reference = 25;

Returns
Type Description
IdOrBuilder

getPlatform()

public Noun.Platform getPlatform()

Platform.

.google.backstory.Noun.Platform platform = 5;

Returns
Type Description
Noun.Platform

The platform.

getPlatformPatchLevel()

public String getPlatformPatchLevel()

Platform patch level. For example, "Build 17134.48"

string platform_patch_level = 16;

Returns
Type Description
String

The platformPatchLevel.

getPlatformPatchLevelBytes()

public ByteString getPlatformPatchLevelBytes()

Platform patch level. For example, "Build 17134.48"

string platform_patch_level = 16;

Returns
Type Description
ByteString

The bytes for platformPatchLevel.

getPlatformValue()

public int getPlatformValue()

Platform.

.google.backstory.Noun.Platform platform = 5;

Returns
Type Description
int

The enum numeric value on the wire for platform.

getPlatformVersion()

public String getPlatformVersion()

Platform version. For example, "Microsoft Windows 1803".

string platform_version = 15;

Returns
Type Description
String

The platformVersion.

getPlatformVersionBytes()

public ByteString getPlatformVersionBytes()

Platform version. For example, "Microsoft Windows 1803".

string platform_version = 15;

Returns
Type Description
ByteString

The bytes for platformVersion.

getPort()

public int getPort()

Source or destination network port number when a specific network connection is described within an event.

int32 port = 7;

Returns
Type Description
int

The port.

getProcess()

public Process getProcess()

Information about the process.

.google.backstory.Process process = 4;

Returns
Type Description
Process

The process.

getProcessAncestors(int index)

public Process getProcessAncestors(int index)

Information about the process's ancestors ordered from immediate ancestor (parent process) to root. Note: process_ancestors is only populated when data is exported to BigQuery since recursive fields (e.g. process.parent_process) are not supported by BigQuery.

repeated .google.backstory.Process process_ancestors = 28;

Parameter
Name Description
index int
Returns
Type Description
Process

getProcessAncestorsBuilder(int index)

public Process.Builder getProcessAncestorsBuilder(int index)

Information about the process's ancestors ordered from immediate ancestor (parent process) to root. Note: process_ancestors is only populated when data is exported to BigQuery since recursive fields (e.g. process.parent_process) are not supported by BigQuery.

repeated .google.backstory.Process process_ancestors = 28;

Parameter
Name Description
index int
Returns
Type Description
Process.Builder

getProcessAncestorsBuilderList()

public List<Process.Builder> getProcessAncestorsBuilderList()

Information about the process's ancestors ordered from immediate ancestor (parent process) to root. Note: process_ancestors is only populated when data is exported to BigQuery since recursive fields (e.g. process.parent_process) are not supported by BigQuery.

repeated .google.backstory.Process process_ancestors = 28;

Returns
Type Description
List<Builder>

getProcessAncestorsCount()

public int getProcessAncestorsCount()

Information about the process's ancestors ordered from immediate ancestor (parent process) to root. Note: process_ancestors is only populated when data is exported to BigQuery since recursive fields (e.g. process.parent_process) are not supported by BigQuery.

repeated .google.backstory.Process process_ancestors = 28;

Returns
Type Description
int

getProcessAncestorsList()

public List<Process> getProcessAncestorsList()

Information about the process's ancestors ordered from immediate ancestor (parent process) to root. Note: process_ancestors is only populated when data is exported to BigQuery since recursive fields (e.g. process.parent_process) are not supported by BigQuery.

repeated .google.backstory.Process process_ancestors = 28;

Returns
Type Description
List<Process>

getProcessAncestorsOrBuilder(int index)

public ProcessOrBuilder getProcessAncestorsOrBuilder(int index)

Information about the process's ancestors ordered from immediate ancestor (parent process) to root. Note: process_ancestors is only populated when data is exported to BigQuery since recursive fields (e.g. process.parent_process) are not supported by BigQuery.

repeated .google.backstory.Process process_ancestors = 28;

Parameter
Name Description
index int
Returns
Type Description
ProcessOrBuilder

getProcessAncestorsOrBuilderList()

public List<? extends ProcessOrBuilder> getProcessAncestorsOrBuilderList()

Information about the process's ancestors ordered from immediate ancestor (parent process) to root. Note: process_ancestors is only populated when data is exported to BigQuery since recursive fields (e.g. process.parent_process) are not supported by BigQuery.

repeated .google.backstory.Process process_ancestors = 28;

Returns
Type Description
List<? extends com.google.backstory.ProcessOrBuilder>

getProcessBuilder()

public Process.Builder getProcessBuilder()

Information about the process.

.google.backstory.Process process = 4;

Returns
Type Description
Process.Builder

getProcessOrBuilder()

public ProcessOrBuilder getProcessOrBuilder()

Information about the process.

.google.backstory.Process process = 4;

Returns
Type Description
ProcessOrBuilder

getRegistry()

public Registry getRegistry()

Registry information.

.google.backstory.Registry registry = 13;

Returns
Type Description
Registry

The registry.

getRegistryBuilder()

public Registry.Builder getRegistryBuilder()

Registry information.

.google.backstory.Registry registry = 13;

Returns
Type Description
Registry.Builder

getRegistryOrBuilder()

public RegistryOrBuilder getRegistryOrBuilder()

Registry information.

.google.backstory.Registry registry = 13;

Returns
Type Description
RegistryOrBuilder

getResource()

public Resource getResource()

Information about the resource (e.g. scheduled task, calendar entry). This field should not be used for files, registry, or processes because these objects are already part of Noun.

.google.backstory.Resource resource = 18;

Returns
Type Description
Resource

The resource.

getResourceAncestors(int index)

public Resource getResourceAncestors(int index)

Information about the resource's ancestors ordered from immediate ancestor (starting with parent resource).

repeated .google.backstory.Resource resource_ancestors = 31;

Parameter
Name Description
index int
Returns
Type Description
Resource

getResourceAncestorsBuilder(int index)

public Resource.Builder getResourceAncestorsBuilder(int index)

Information about the resource's ancestors ordered from immediate ancestor (starting with parent resource).

repeated .google.backstory.Resource resource_ancestors = 31;

Parameter
Name Description
index int
Returns
Type Description
Resource.Builder

getResourceAncestorsBuilderList()

public List<Resource.Builder> getResourceAncestorsBuilderList()

Information about the resource's ancestors ordered from immediate ancestor (starting with parent resource).

repeated .google.backstory.Resource resource_ancestors = 31;

Returns
Type Description
List<Builder>

getResourceAncestorsCount()

public int getResourceAncestorsCount()

Information about the resource's ancestors ordered from immediate ancestor (starting with parent resource).

repeated .google.backstory.Resource resource_ancestors = 31;

Returns
Type Description
int

getResourceAncestorsList()

public List<Resource> getResourceAncestorsList()

Information about the resource's ancestors ordered from immediate ancestor (starting with parent resource).

repeated .google.backstory.Resource resource_ancestors = 31;

Returns
Type Description
List<Resource>

getResourceAncestorsOrBuilder(int index)

public ResourceOrBuilder getResourceAncestorsOrBuilder(int index)

Information about the resource's ancestors ordered from immediate ancestor (starting with parent resource).

repeated .google.backstory.Resource resource_ancestors = 31;

Parameter
Name Description
index int
Returns
Type Description
ResourceOrBuilder

getResourceAncestorsOrBuilderList()

public List<? extends ResourceOrBuilder> getResourceAncestorsOrBuilderList()

Information about the resource's ancestors ordered from immediate ancestor (starting with parent resource).

repeated .google.backstory.Resource resource_ancestors = 31;

Returns
Type Description
List<? extends com.google.backstory.ResourceOrBuilder>

getResourceBuilder()

public Resource.Builder getResourceBuilder()

Information about the resource (e.g. scheduled task, calendar entry). This field should not be used for files, registry, or processes because these objects are already part of Noun.

.google.backstory.Resource resource = 18;

Returns
Type Description
Resource.Builder

getResourceOrBuilder()

public ResourceOrBuilder getResourceOrBuilder()

Information about the resource (e.g. scheduled task, calendar entry). This field should not be used for files, registry, or processes because these objects are already part of Noun.

.google.backstory.Resource resource = 18;

Returns
Type Description
ResourceOrBuilder

getSecurityResult(int index)

public SecurityResult getSecurityResult(int index)

A list of security results.

repeated .google.backstory.SecurityResult security_result = 36;

Parameter
Name Description
index int
Returns
Type Description
SecurityResult

getSecurityResultBuilder(int index)

public SecurityResult.Builder getSecurityResultBuilder(int index)

A list of security results.

repeated .google.backstory.SecurityResult security_result = 36;

Parameter
Name Description
index int
Returns
Type Description
SecurityResult.Builder

getSecurityResultBuilderList()

public List<SecurityResult.Builder> getSecurityResultBuilderList()

A list of security results.

repeated .google.backstory.SecurityResult security_result = 36;

Returns
Type Description
List<Builder>

getSecurityResultCount()

public int getSecurityResultCount()

A list of security results.

repeated .google.backstory.SecurityResult security_result = 36;

Returns
Type Description
int

getSecurityResultList()

public List<SecurityResult> getSecurityResultList()

A list of security results.

repeated .google.backstory.SecurityResult security_result = 36;

Returns
Type Description
List<SecurityResult>

getSecurityResultOrBuilder(int index)

public SecurityResultOrBuilder getSecurityResultOrBuilder(int index)

A list of security results.

repeated .google.backstory.SecurityResult security_result = 36;

Parameter
Name Description
index int
Returns
Type Description
SecurityResultOrBuilder

getSecurityResultOrBuilderList()

public List<? extends SecurityResultOrBuilder> getSecurityResultOrBuilderList()

A list of security results.

repeated .google.backstory.SecurityResult security_result = 36;

Returns
Type Description
List<? extends com.google.backstory.SecurityResultOrBuilder>

getUrl()

public String getUrl()

The URL.

string url = 10;

Returns
Type Description
String

The url.

getUrlBytes()

public ByteString getUrlBytes()

The URL.

string url = 10;

Returns
Type Description
ByteString

The bytes for url.

getUrlMetadata()

public Url getUrlMetadata()

Information about the URL.

.google.backstory.Url url_metadata = 37;

Returns
Type Description
Url

The urlMetadata.

getUrlMetadataBuilder()

public Url.Builder getUrlMetadataBuilder()

Information about the URL.

.google.backstory.Url url_metadata = 37;

Returns
Type Description
Url.Builder

getUrlMetadataOrBuilder()

public UrlOrBuilder getUrlMetadataOrBuilder()

Information about the URL.

.google.backstory.Url url_metadata = 37;

Returns
Type Description
UrlOrBuilder

getUser()

public User getUser()

Information about the user.

.google.backstory.User user = 3;

Returns
Type Description
User

The user.

getUserBuilder()

public User.Builder getUserBuilder()

Information about the user.

.google.backstory.User user = 3;

Returns
Type Description
User.Builder

getUserManagementChain(int index)

public User getUserManagementChain(int index)

Information about the user's management chain (reporting hierarchy). Note: user_management_chain is only populated when data is exported to BigQuery since recursive fields (e.g. user.managers) are not supported by BigQuery.

repeated .google.backstory.User user_management_chain = 29;

Parameter
Name Description
index int
Returns
Type Description
User

getUserManagementChainBuilder(int index)

public User.Builder getUserManagementChainBuilder(int index)

Information about the user's management chain (reporting hierarchy). Note: user_management_chain is only populated when data is exported to BigQuery since recursive fields (e.g. user.managers) are not supported by BigQuery.

repeated .google.backstory.User user_management_chain = 29;

Parameter
Name Description
index int
Returns
Type Description
User.Builder

getUserManagementChainBuilderList()

public List<User.Builder> getUserManagementChainBuilderList()

Information about the user's management chain (reporting hierarchy). Note: user_management_chain is only populated when data is exported to BigQuery since recursive fields (e.g. user.managers) are not supported by BigQuery.

repeated .google.backstory.User user_management_chain = 29;

Returns
Type Description
List<Builder>

getUserManagementChainCount()

public int getUserManagementChainCount()

Information about the user's management chain (reporting hierarchy). Note: user_management_chain is only populated when data is exported to BigQuery since recursive fields (e.g. user.managers) are not supported by BigQuery.

repeated .google.backstory.User user_management_chain = 29;

Returns
Type Description
int

getUserManagementChainList()

public List<User> getUserManagementChainList()

Information about the user's management chain (reporting hierarchy). Note: user_management_chain is only populated when data is exported to BigQuery since recursive fields (e.g. user.managers) are not supported by BigQuery.

repeated .google.backstory.User user_management_chain = 29;

Returns
Type Description
List<User>

getUserManagementChainOrBuilder(int index)

public UserOrBuilder getUserManagementChainOrBuilder(int index)

Information about the user's management chain (reporting hierarchy). Note: user_management_chain is only populated when data is exported to BigQuery since recursive fields (e.g. user.managers) are not supported by BigQuery.

repeated .google.backstory.User user_management_chain = 29;

Parameter
Name Description
index int
Returns
Type Description
UserOrBuilder

getUserManagementChainOrBuilderList()

public List<? extends UserOrBuilder> getUserManagementChainOrBuilderList()

Information about the user's management chain (reporting hierarchy). Note: user_management_chain is only populated when data is exported to BigQuery since recursive fields (e.g. user.managers) are not supported by BigQuery.

repeated .google.backstory.User user_management_chain = 29;

Returns
Type Description
List<? extends com.google.backstory.UserOrBuilder>

getUserOrBuilder()

public UserOrBuilder getUserOrBuilder()

Information about the user.

.google.backstory.User user = 3;

Returns
Type Description
UserOrBuilder

hasArtifact()

public boolean hasArtifact()

Information about an artifact.

.google.backstory.Artifact artifact = 32;

Returns
Type Description
boolean

Whether the artifact field is set.

hasAsset()

public boolean hasAsset()

Information about the asset.

.google.backstory.Asset asset = 27;

Returns
Type Description
boolean

Whether the asset field is set.

hasBrowser()

public boolean hasBrowser()

Information about an entry in the web browser's local history database.

.google.backstory.Browser browser = 38;

Returns
Type Description
boolean

Whether the browser field is set.

hasCloud() (deprecated)

public boolean hasCloud()

Deprecated. google.backstory.Noun.cloud is deprecated. See backstory/udm.proto;l=6324

Cloud metadata. Deprecated: cloud should be populated in entity Attribute as generic metadata (e.g. asset.attribute.cloud).

.google.backstory.Cloud cloud = 24 [deprecated = true];

Returns
Type Description
boolean

Whether the cloud field is set.

hasDomain()

public boolean hasDomain()

Information about the domain.

.google.backstory.Domain domain = 30;

Returns
Type Description
boolean

Whether the domain field is set.

hasFile()

public boolean hasFile()

Information about the file.

.google.backstory.File file = 11;

Returns
Type Description
boolean

Whether the file field is set.

hasGroup()

public boolean hasGroup()

Information about the group.

.google.backstory.Group group = 20;

Returns
Type Description
boolean

Whether the group field is set.

hasInvestigation()

public boolean hasInvestigation()

Analyst feedback/investigation for alerts.

.google.backstory.Investigation investigation = 26;

Returns
Type Description
boolean

Whether the investigation field is set.

hasLocation()

public boolean hasLocation()

Physical location. For cloud environments, set the region in location.name.

.google.backstory.Location location = 17;

Returns
Type Description
boolean

Whether the location field is set.

hasNetwork()

public boolean hasNetwork()

Network details, including sub-messages with details on each protocol (for example, DHCP, DNS, or HTTP).

.google.backstory.Network network = 33;

Returns
Type Description
boolean

Whether the network field is set.

hasObjectReference()

public boolean hasObjectReference()

Finding to which the Analyst updated the feedback.

.google.backstory.Id object_reference = 25;

Returns
Type Description
boolean

Whether the objectReference field is set.

hasProcess()

public boolean hasProcess()

Information about the process.

.google.backstory.Process process = 4;

Returns
Type Description
boolean

Whether the process field is set.

hasRegistry()

public boolean hasRegistry()

Registry information.

.google.backstory.Registry registry = 13;

Returns
Type Description
boolean

Whether the registry field is set.

hasResource()

public boolean hasResource()

Information about the resource (e.g. scheduled task, calendar entry). This field should not be used for files, registry, or processes because these objects are already part of Noun.

.google.backstory.Resource resource = 18;

Returns
Type Description
boolean

Whether the resource field is set.

hasUrlMetadata()

public boolean hasUrlMetadata()

Information about the URL.

.google.backstory.Url url_metadata = 37;

Returns
Type Description
boolean

Whether the urlMetadata field is set.

hasUser()

public boolean hasUser()

Information about the user.

.google.backstory.User user = 3;

Returns
Type Description
boolean

Whether the user field is set.

internalGetFieldAccessorTable()

protected GeneratedMessage.FieldAccessorTable internalGetFieldAccessorTable()
Returns
Type Description
FieldAccessorTable
Overrides

isInitialized()

public final boolean isInitialized()
Returns
Type Description
boolean
Overrides

mergeArtifact(Artifact value)

public Noun.Builder mergeArtifact(Artifact value)

Information about an artifact.

.google.backstory.Artifact artifact = 32;

Parameter
Name Description
value Artifact
Returns
Type Description
Noun.Builder

mergeAsset(Asset value)

public Noun.Builder mergeAsset(Asset value)

Information about the asset.

.google.backstory.Asset asset = 27;

Parameter
Name Description
value Asset
Returns
Type Description
Noun.Builder

mergeBrowser(Browser value)

public Noun.Builder mergeBrowser(Browser value)

Information about an entry in the web browser's local history database.

.google.backstory.Browser browser = 38;

Parameter
Name Description
value Browser
Returns
Type Description
Noun.Builder

mergeCloud(Cloud value) (deprecated)

public Noun.Builder mergeCloud(Cloud value)

Cloud metadata. Deprecated: cloud should be populated in entity Attribute as generic metadata (e.g. asset.attribute.cloud).

.google.backstory.Cloud cloud = 24 [deprecated = true];

Parameter
Name Description
value Cloud
Returns
Type Description
Noun.Builder

mergeDomain(Domain value)

public Noun.Builder mergeDomain(Domain value)

Information about the domain.

.google.backstory.Domain domain = 30;

Parameter
Name Description
value Domain
Returns
Type Description
Noun.Builder

mergeFile(File value)

public Noun.Builder mergeFile(File value)

Information about the file.

.google.backstory.File file = 11;

Parameter
Name Description
value File
Returns
Type Description
Noun.Builder

mergeFrom(Noun other)

public Noun.Builder mergeFrom(Noun other)
Parameter
Name Description
other Noun
Returns
Type Description
Noun.Builder

mergeFrom(CodedInputStream input, ExtensionRegistryLite extensionRegistry)

public Noun.Builder mergeFrom(CodedInputStream input, ExtensionRegistryLite extensionRegistry)
Parameters
Name Description
input CodedInputStream
extensionRegistry ExtensionRegistryLite
Returns
Type Description
Noun.Builder
Overrides
Exceptions
Type Description
IOException

mergeFrom(Message other)

public Noun.Builder mergeFrom(Message other)
Parameter
Name Description
other Message
Returns
Type Description
Noun.Builder
Overrides

mergeGroup(Group value)

public Noun.Builder mergeGroup(Group value)

Information about the group.

.google.backstory.Group group = 20;

Parameter
Name Description
value Group
Returns
Type Description
Noun.Builder

mergeInvestigation(Investigation value)

public Noun.Builder mergeInvestigation(Investigation value)

Analyst feedback/investigation for alerts.

.google.backstory.Investigation investigation = 26;

Parameter
Name Description
value Investigation
Returns
Type Description
Noun.Builder

mergeLocation(Location value)

public Noun.Builder mergeLocation(Location value)

Physical location. For cloud environments, set the region in location.name.

.google.backstory.Location location = 17;

Parameter
Name Description
value Location
Returns
Type Description
Noun.Builder

mergeNetwork(Network value)

public Noun.Builder mergeNetwork(Network value)

Network details, including sub-messages with details on each protocol (for example, DHCP, DNS, or HTTP).

.google.backstory.Network network = 33;

Parameter
Name Description
value Network
Returns
Type Description
Noun.Builder

mergeObjectReference(Id value)

public Noun.Builder mergeObjectReference(Id value)

Finding to which the Analyst updated the feedback.

.google.backstory.Id object_reference = 25;

Parameter
Name Description
value Id
Returns
Type Description
Noun.Builder

mergeProcess(Process value)

public Noun.Builder mergeProcess(Process value)

Information about the process.

.google.backstory.Process process = 4;

Parameter
Name Description
value Process
Returns
Type Description
Noun.Builder

mergeRegistry(Registry value)

public Noun.Builder mergeRegistry(Registry value)

Registry information.

.google.backstory.Registry registry = 13;

Parameter
Name Description
value Registry
Returns
Type Description
Noun.Builder

mergeResource(Resource value)

public Noun.Builder mergeResource(Resource value)

Information about the resource (e.g. scheduled task, calendar entry). This field should not be used for files, registry, or processes because these objects are already part of Noun.

.google.backstory.Resource resource = 18;

Parameter
Name Description
value Resource
Returns
Type Description
Noun.Builder

mergeUrlMetadata(Url value)

public Noun.Builder mergeUrlMetadata(Url value)

Information about the URL.

.google.backstory.Url url_metadata = 37;

Parameter
Name Description
value Url
Returns
Type Description
Noun.Builder

mergeUser(User value)

public Noun.Builder mergeUser(User value)

Information about the user.

.google.backstory.User user = 3;

Parameter
Name Description
value User
Returns
Type Description
Noun.Builder

removeIpGeoArtifact(int index)

public Noun.Builder removeIpGeoArtifact(int index)

Enriched geographic information corresponding to an IP address. Specifically, location and network data.

repeated .google.backstory.Artifact ip_geo_artifact = 35;

Parameter
Name Description
index int
Returns
Type Description
Noun.Builder

removeIpLocation(int index) (deprecated)

public Noun.Builder removeIpLocation(int index)

Deprecated: use ip_geo_artifact.location instead.

repeated .google.backstory.Location ip_location = 34 [deprecated = true];

Parameter
Name Description
index int
Returns
Type Description
Noun.Builder

removeLabels(int index) (deprecated)

public Noun.Builder removeLabels(int index)

Labels are key-value pairs. For example: key = "env", value = "prod". Deprecated: labels should be populated in entity Attribute as generic metadata (e.g. user.attribute.labels).

repeated .google.backstory.Label labels = 23 [deprecated = true];

Parameter
Name Description
index int
Returns
Type Description
Noun.Builder

removeProcessAncestors(int index)

public Noun.Builder removeProcessAncestors(int index)

Information about the process's ancestors ordered from immediate ancestor (parent process) to root. Note: process_ancestors is only populated when data is exported to BigQuery since recursive fields (e.g. process.parent_process) are not supported by BigQuery.

repeated .google.backstory.Process process_ancestors = 28;

Parameter
Name Description
index int
Returns
Type Description
Noun.Builder

removeResourceAncestors(int index)

public Noun.Builder removeResourceAncestors(int index)

Information about the resource's ancestors ordered from immediate ancestor (starting with parent resource).

repeated .google.backstory.Resource resource_ancestors = 31;

Parameter
Name Description
index int
Returns
Type Description
Noun.Builder

removeSecurityResult(int index)

public Noun.Builder removeSecurityResult(int index)

A list of security results.

repeated .google.backstory.SecurityResult security_result = 36;

Parameter
Name Description
index int
Returns
Type Description
Noun.Builder

removeUserManagementChain(int index)

public Noun.Builder removeUserManagementChain(int index)

Information about the user's management chain (reporting hierarchy). Note: user_management_chain is only populated when data is exported to BigQuery since recursive fields (e.g. user.managers) are not supported by BigQuery.

repeated .google.backstory.User user_management_chain = 29;

Parameter
Name Description
index int
Returns
Type Description
Noun.Builder

setAdministrativeDomain(String value)

public Noun.Builder setAdministrativeDomain(String value)

Domain which the device belongs to (for example, the Microsoft Windows domain).

string administrative_domain = 9;

Parameter
Name Description
value String

The administrativeDomain to set.

Returns
Type Description
Noun.Builder

This builder for chaining.

setAdministrativeDomainBytes(ByteString value)

public Noun.Builder setAdministrativeDomainBytes(ByteString value)

Domain which the device belongs to (for example, the Microsoft Windows domain).

string administrative_domain = 9;

Parameter
Name Description
value ByteString

The bytes for administrativeDomain to set.

Returns
Type Description
Noun.Builder

This builder for chaining.

setApplication(String value)

public Noun.Builder setApplication(String value)

The name of an application or service. Some SSO solutions only capture the name of a target application such as "Atlassian" or "Chronicle".

string application = 14;

Parameter
Name Description
value String

The application to set.

Returns
Type Description
Noun.Builder

This builder for chaining.

setApplicationBytes(ByteString value)

public Noun.Builder setApplicationBytes(ByteString value)

The name of an application or service. Some SSO solutions only capture the name of a target application such as "Atlassian" or "Chronicle".

string application = 14;

Parameter
Name Description
value ByteString

The bytes for application to set.

Returns
Type Description
Noun.Builder

This builder for chaining.

setArtifact(Artifact value)

public Noun.Builder setArtifact(Artifact value)

Information about an artifact.

.google.backstory.Artifact artifact = 32;

Parameter
Name Description
value Artifact
Returns
Type Description
Noun.Builder

setArtifact(Artifact.Builder builderForValue)

public Noun.Builder setArtifact(Artifact.Builder builderForValue)

Information about an artifact.

.google.backstory.Artifact artifact = 32;

Parameter
Name Description
builderForValue Artifact.Builder
Returns
Type Description
Noun.Builder

setAsset(Asset value)

public Noun.Builder setAsset(Asset value)

Information about the asset.

.google.backstory.Asset asset = 27;

Parameter
Name Description
value Asset
Returns
Type Description
Noun.Builder

setAsset(Asset.Builder builderForValue)

public Noun.Builder setAsset(Asset.Builder builderForValue)

Information about the asset.

.google.backstory.Asset asset = 27;

Parameter
Name Description
builderForValue Asset.Builder
Returns
Type Description
Noun.Builder

setAssetId(String value)

public Noun.Builder setAssetId(String value)

The asset ID. This field can be used as an entity indicator for asset entities.

string asset_id = 2;

Parameter
Name Description
value String

The assetId to set.

Returns
Type Description
Noun.Builder

This builder for chaining.

setAssetIdBytes(ByteString value)

public Noun.Builder setAssetIdBytes(ByteString value)

The asset ID. This field can be used as an entity indicator for asset entities.

string asset_id = 2;

Parameter
Name Description
value ByteString

The bytes for assetId to set.

Returns
Type Description
Noun.Builder

This builder for chaining.

setBrowser(Browser value)

public Noun.Builder setBrowser(Browser value)

Information about an entry in the web browser's local history database.

.google.backstory.Browser browser = 38;

Parameter
Name Description
value Browser
Returns
Type Description
Noun.Builder

setBrowser(Browser.Builder builderForValue)

public Noun.Builder setBrowser(Browser.Builder builderForValue)

Information about an entry in the web browser's local history database.

.google.backstory.Browser browser = 38;

Parameter
Name Description
builderForValue Browser.Builder
Returns
Type Description
Noun.Builder

setCloud(Cloud value) (deprecated)

public Noun.Builder setCloud(Cloud value)

Cloud metadata. Deprecated: cloud should be populated in entity Attribute as generic metadata (e.g. asset.attribute.cloud).

.google.backstory.Cloud cloud = 24 [deprecated = true];

Parameter
Name Description
value Cloud
Returns
Type Description
Noun.Builder

setCloud(Cloud.Builder builderForValue) (deprecated)

public Noun.Builder setCloud(Cloud.Builder builderForValue)

Cloud metadata. Deprecated: cloud should be populated in entity Attribute as generic metadata (e.g. asset.attribute.cloud).

.google.backstory.Cloud cloud = 24 [deprecated = true];

Parameter
Name Description
builderForValue Cloud.Builder
Returns
Type Description
Noun.Builder

setDomain(Domain value)

public Noun.Builder setDomain(Domain value)

Information about the domain.

.google.backstory.Domain domain = 30;

Parameter
Name Description
value Domain
Returns
Type Description
Noun.Builder

setDomain(Domain.Builder builderForValue)

public Noun.Builder setDomain(Domain.Builder builderForValue)

Information about the domain.

.google.backstory.Domain domain = 30;

Parameter
Name Description
builderForValue Domain.Builder
Returns
Type Description
Noun.Builder

setEmail(String value)

public Noun.Builder setEmail(String value)

Email address. Only filled in for security_result.about

string email = 12;

Parameter
Name Description
value String

The email to set.

Returns
Type Description
Noun.Builder

This builder for chaining.

setEmailBytes(ByteString value)

public Noun.Builder setEmailBytes(ByteString value)

Email address. Only filled in for security_result.about

string email = 12;

Parameter
Name Description
value ByteString

The bytes for email to set.

Returns
Type Description
Noun.Builder

This builder for chaining.

setFile(File value)

public Noun.Builder setFile(File value)

Information about the file.

.google.backstory.File file = 11;

Parameter
Name Description
value File
Returns
Type Description
Noun.Builder

setFile(File.Builder builderForValue)

public Noun.Builder setFile(File.Builder builderForValue)

Information about the file.

.google.backstory.File file = 11;

Parameter
Name Description
builderForValue File.Builder
Returns
Type Description
Noun.Builder

setGroup(Group value)

public Noun.Builder setGroup(Group value)

Information about the group.

.google.backstory.Group group = 20;

Parameter
Name Description
value Group
Returns
Type Description
Noun.Builder

setGroup(Group.Builder builderForValue)

public Noun.Builder setGroup(Group.Builder builderForValue)

Information about the group.

.google.backstory.Group group = 20;

Parameter
Name Description
builderForValue Group.Builder
Returns
Type Description
Noun.Builder

setHostname(String value)

public Noun.Builder setHostname(String value)

Client hostname or domain name field. Hostname also doubles as the domain for remote entities. This field can be used as an entity indicator for asset entities.

string hostname = 1;

Parameter
Name Description
value String

The hostname to set.

Returns
Type Description
Noun.Builder

This builder for chaining.

setHostnameBytes(ByteString value)

public Noun.Builder setHostnameBytes(ByteString value)

Client hostname or domain name field. Hostname also doubles as the domain for remote entities. This field can be used as an entity indicator for asset entities.

string hostname = 1;

Parameter
Name Description
value ByteString

The bytes for hostname to set.

Returns
Type Description
Noun.Builder

This builder for chaining.

setInvestigation(Investigation value)

public Noun.Builder setInvestigation(Investigation value)

Analyst feedback/investigation for alerts.

.google.backstory.Investigation investigation = 26;

Parameter
Name Description
value Investigation
Returns
Type Description
Noun.Builder

setInvestigation(Investigation.Builder builderForValue)

public Noun.Builder setInvestigation(Investigation.Builder builderForValue)

Analyst feedback/investigation for alerts.

.google.backstory.Investigation investigation = 26;

Parameter
Name Description
builderForValue Investigation.Builder
Returns
Type Description
Noun.Builder

setIp(int index, String value)

public Noun.Builder setIp(int index, String value)

A list of IP addresses associated with a network connection. This field can be used as an entity indicator for asset entities.

repeated string ip = 6;

Parameters
Name Description
index int

The index to set the value at.

value String

The ip to set.

Returns
Type Description
Noun.Builder

This builder for chaining.

setIpGeoArtifact(int index, Artifact value)

public Noun.Builder setIpGeoArtifact(int index, Artifact value)

Enriched geographic information corresponding to an IP address. Specifically, location and network data.

repeated .google.backstory.Artifact ip_geo_artifact = 35;

Parameters
Name Description
index int
value Artifact
Returns
Type Description
Noun.Builder

setIpGeoArtifact(int index, Artifact.Builder builderForValue)

public Noun.Builder setIpGeoArtifact(int index, Artifact.Builder builderForValue)

Enriched geographic information corresponding to an IP address. Specifically, location and network data.

repeated .google.backstory.Artifact ip_geo_artifact = 35;

Parameters
Name Description
index int
builderForValue Artifact.Builder
Returns
Type Description
Noun.Builder

setIpLocation(int index, Location value) (deprecated)

public Noun.Builder setIpLocation(int index, Location value)

Deprecated: use ip_geo_artifact.location instead.

repeated .google.backstory.Location ip_location = 34 [deprecated = true];

Parameters
Name Description
index int
value Location
Returns
Type Description
Noun.Builder

setIpLocation(int index, Location.Builder builderForValue) (deprecated)

public Noun.Builder setIpLocation(int index, Location.Builder builderForValue)

Deprecated: use ip_geo_artifact.location instead.

repeated .google.backstory.Location ip_location = 34 [deprecated = true];

Parameters
Name Description
index int
builderForValue Location.Builder
Returns
Type Description
Noun.Builder

setLabels(int index, Label value) (deprecated)

public Noun.Builder setLabels(int index, Label value)

Labels are key-value pairs. For example: key = "env", value = "prod". Deprecated: labels should be populated in entity Attribute as generic metadata (e.g. user.attribute.labels).

repeated .google.backstory.Label labels = 23 [deprecated = true];

Parameters
Name Description
index int
value Label
Returns
Type Description
Noun.Builder

setLabels(int index, Label.Builder builderForValue) (deprecated)

public Noun.Builder setLabels(int index, Label.Builder builderForValue)

Labels are key-value pairs. For example: key = "env", value = "prod". Deprecated: labels should be populated in entity Attribute as generic metadata (e.g. user.attribute.labels).

repeated .google.backstory.Label labels = 23 [deprecated = true];

Parameters
Name Description
index int
builderForValue Label.Builder
Returns
Type Description
Noun.Builder

setLocation(Location value)

public Noun.Builder setLocation(Location value)

Physical location. For cloud environments, set the region in location.name.

.google.backstory.Location location = 17;

Parameter
Name Description
value Location
Returns
Type Description
Noun.Builder

setLocation(Location.Builder builderForValue)

public Noun.Builder setLocation(Location.Builder builderForValue)

Physical location. For cloud environments, set the region in location.name.

.google.backstory.Location location = 17;

Parameter
Name Description
builderForValue Location.Builder
Returns
Type Description
Noun.Builder

setMac(int index, String value)

public Noun.Builder setMac(int index, String value)

List of MAC addresses associated with a device. This field can be used as an entity indicator for asset entities.

repeated string mac = 8;

Parameters
Name Description
index int

The index to set the value at.

value String

The mac to set.

Returns
Type Description
Noun.Builder

This builder for chaining.

setNamespace(String value)

public Noun.Builder setNamespace(String value)

Namespace which the device belongs to, such as "AD forest". Uses for this field include Microsoft Windows AD forest, the name of subsidiary, or the name of acquisition. This field can be used along with an asset indicator to identify an asset.

string namespace = 19;

Parameter
Name Description
value String

The namespace to set.

Returns
Type Description
Noun.Builder

This builder for chaining.

setNamespaceBytes(ByteString value)

public Noun.Builder setNamespaceBytes(ByteString value)

Namespace which the device belongs to, such as "AD forest". Uses for this field include Microsoft Windows AD forest, the name of subsidiary, or the name of acquisition. This field can be used along with an asset indicator to identify an asset.

string namespace = 19;

Parameter
Name Description
value ByteString

The bytes for namespace to set.

Returns
Type Description
Noun.Builder

This builder for chaining.

setNatIp(int index, String value)

public Noun.Builder setNatIp(int index, String value)

A list of NAT translated IP addresses associated with a network connection.

repeated string nat_ip = 21;

Parameters
Name Description
index int

The index to set the value at.

value String

The natIp to set.

Returns
Type Description
Noun.Builder

This builder for chaining.

setNatPort(int value)

public Noun.Builder setNatPort(int value)

NAT external network port number when a specific network connection is described within an event.

int32 nat_port = 22;

Parameter
Name Description
value int

The natPort to set.

Returns
Type Description
Noun.Builder

This builder for chaining.

setNetwork(Network value)

public Noun.Builder setNetwork(Network value)

Network details, including sub-messages with details on each protocol (for example, DHCP, DNS, or HTTP).

.google.backstory.Network network = 33;

Parameter
Name Description
value Network
Returns
Type Description
Noun.Builder

setNetwork(Network.Builder builderForValue)

public Noun.Builder setNetwork(Network.Builder builderForValue)

Network details, including sub-messages with details on each protocol (for example, DHCP, DNS, or HTTP).

.google.backstory.Network network = 33;

Parameter
Name Description
builderForValue Network.Builder
Returns
Type Description
Noun.Builder

setObjectReference(Id value)

public Noun.Builder setObjectReference(Id value)

Finding to which the Analyst updated the feedback.

.google.backstory.Id object_reference = 25;

Parameter
Name Description
value Id
Returns
Type Description
Noun.Builder

setObjectReference(Id.Builder builderForValue)

public Noun.Builder setObjectReference(Id.Builder builderForValue)

Finding to which the Analyst updated the feedback.

.google.backstory.Id object_reference = 25;

Parameter
Name Description
builderForValue Id.Builder
Returns
Type Description
Noun.Builder

setPlatform(Noun.Platform value)

public Noun.Builder setPlatform(Noun.Platform value)

Platform.

.google.backstory.Noun.Platform platform = 5;

Parameter
Name Description
value Noun.Platform

The platform to set.

Returns
Type Description
Noun.Builder

This builder for chaining.

setPlatformPatchLevel(String value)

public Noun.Builder setPlatformPatchLevel(String value)

Platform patch level. For example, "Build 17134.48"

string platform_patch_level = 16;

Parameter
Name Description
value String

The platformPatchLevel to set.

Returns
Type Description
Noun.Builder

This builder for chaining.

setPlatformPatchLevelBytes(ByteString value)

public Noun.Builder setPlatformPatchLevelBytes(ByteString value)

Platform patch level. For example, "Build 17134.48"

string platform_patch_level = 16;

Parameter
Name Description
value ByteString

The bytes for platformPatchLevel to set.

Returns
Type Description
Noun.Builder

This builder for chaining.

setPlatformValue(int value)

public Noun.Builder setPlatformValue(int value)

Platform.

.google.backstory.Noun.Platform platform = 5;

Parameter
Name Description
value int

The enum numeric value on the wire for platform to set.

Returns
Type Description
Noun.Builder

This builder for chaining.

setPlatformVersion(String value)

public Noun.Builder setPlatformVersion(String value)

Platform version. For example, "Microsoft Windows 1803".

string platform_version = 15;

Parameter
Name Description
value String

The platformVersion to set.

Returns
Type Description
Noun.Builder

This builder for chaining.

setPlatformVersionBytes(ByteString value)

public Noun.Builder setPlatformVersionBytes(ByteString value)

Platform version. For example, "Microsoft Windows 1803".

string platform_version = 15;

Parameter
Name Description
value ByteString

The bytes for platformVersion to set.

Returns
Type Description
Noun.Builder

This builder for chaining.

setPort(int value)

public Noun.Builder setPort(int value)

Source or destination network port number when a specific network connection is described within an event.

int32 port = 7;

Parameter
Name Description
value int

The port to set.

Returns
Type Description
Noun.Builder

This builder for chaining.

setProcess(Process value)

public Noun.Builder setProcess(Process value)

Information about the process.

.google.backstory.Process process = 4;

Parameter
Name Description
value Process
Returns
Type Description
Noun.Builder

setProcess(Process.Builder builderForValue)

public Noun.Builder setProcess(Process.Builder builderForValue)

Information about the process.

.google.backstory.Process process = 4;

Parameter
Name Description
builderForValue Process.Builder
Returns
Type Description
Noun.Builder

setProcessAncestors(int index, Process value)

public Noun.Builder setProcessAncestors(int index, Process value)

Information about the process's ancestors ordered from immediate ancestor (parent process) to root. Note: process_ancestors is only populated when data is exported to BigQuery since recursive fields (e.g. process.parent_process) are not supported by BigQuery.

repeated .google.backstory.Process process_ancestors = 28;

Parameters
Name Description
index int
value Process
Returns
Type Description
Noun.Builder

setProcessAncestors(int index, Process.Builder builderForValue)

public Noun.Builder setProcessAncestors(int index, Process.Builder builderForValue)

Information about the process's ancestors ordered from immediate ancestor (parent process) to root. Note: process_ancestors is only populated when data is exported to BigQuery since recursive fields (e.g. process.parent_process) are not supported by BigQuery.

repeated .google.backstory.Process process_ancestors = 28;

Parameters
Name Description
index int
builderForValue Process.Builder
Returns
Type Description
Noun.Builder

setRegistry(Registry value)

public Noun.Builder setRegistry(Registry value)

Registry information.

.google.backstory.Registry registry = 13;

Parameter
Name Description
value Registry
Returns
Type Description
Noun.Builder

setRegistry(Registry.Builder builderForValue)

public Noun.Builder setRegistry(Registry.Builder builderForValue)

Registry information.

.google.backstory.Registry registry = 13;

Parameter
Name Description
builderForValue Registry.Builder
Returns
Type Description
Noun.Builder

setResource(Resource value)

public Noun.Builder setResource(Resource value)

Information about the resource (e.g. scheduled task, calendar entry). This field should not be used for files, registry, or processes because these objects are already part of Noun.

.google.backstory.Resource resource = 18;

Parameter
Name Description
value Resource
Returns
Type Description
Noun.Builder

setResource(Resource.Builder builderForValue)

public Noun.Builder setResource(Resource.Builder builderForValue)

Information about the resource (e.g. scheduled task, calendar entry). This field should not be used for files, registry, or processes because these objects are already part of Noun.

.google.backstory.Resource resource = 18;

Parameter
Name Description
builderForValue Resource.Builder
Returns
Type Description
Noun.Builder

setResourceAncestors(int index, Resource value)

public Noun.Builder setResourceAncestors(int index, Resource value)

Information about the resource's ancestors ordered from immediate ancestor (starting with parent resource).

repeated .google.backstory.Resource resource_ancestors = 31;

Parameters
Name Description
index int
value Resource
Returns
Type Description
Noun.Builder

setResourceAncestors(int index, Resource.Builder builderForValue)

public Noun.Builder setResourceAncestors(int index, Resource.Builder builderForValue)

Information about the resource's ancestors ordered from immediate ancestor (starting with parent resource).

repeated .google.backstory.Resource resource_ancestors = 31;

Parameters
Name Description
index int
builderForValue Resource.Builder
Returns
Type Description
Noun.Builder

setSecurityResult(int index, SecurityResult value)

public Noun.Builder setSecurityResult(int index, SecurityResult value)

A list of security results.

repeated .google.backstory.SecurityResult security_result = 36;

Parameters
Name Description
index int
value SecurityResult
Returns
Type Description
Noun.Builder

setSecurityResult(int index, SecurityResult.Builder builderForValue)

public Noun.Builder setSecurityResult(int index, SecurityResult.Builder builderForValue)

A list of security results.

repeated .google.backstory.SecurityResult security_result = 36;

Parameters
Name Description
index int
builderForValue SecurityResult.Builder
Returns
Type Description
Noun.Builder

setUrl(String value)

public Noun.Builder setUrl(String value)

The URL.

string url = 10;

Parameter
Name Description
value String

The url to set.

Returns
Type Description
Noun.Builder

This builder for chaining.

setUrlBytes(ByteString value)

public Noun.Builder setUrlBytes(ByteString value)

The URL.

string url = 10;

Parameter
Name Description
value ByteString

The bytes for url to set.

Returns
Type Description
Noun.Builder

This builder for chaining.

setUrlMetadata(Url value)

public Noun.Builder setUrlMetadata(Url value)

Information about the URL.

.google.backstory.Url url_metadata = 37;

Parameter
Name Description
value Url
Returns
Type Description
Noun.Builder

setUrlMetadata(Url.Builder builderForValue)

public Noun.Builder setUrlMetadata(Url.Builder builderForValue)

Information about the URL.

.google.backstory.Url url_metadata = 37;

Parameter
Name Description
builderForValue Url.Builder
Returns
Type Description
Noun.Builder

setUser(User value)

public Noun.Builder setUser(User value)

Information about the user.

.google.backstory.User user = 3;

Parameter
Name Description
value User
Returns
Type Description
Noun.Builder

setUser(User.Builder builderForValue)

public Noun.Builder setUser(User.Builder builderForValue)

Information about the user.

.google.backstory.User user = 3;

Parameter
Name Description
builderForValue User.Builder
Returns
Type Description
Noun.Builder

setUserManagementChain(int index, User value)

public Noun.Builder setUserManagementChain(int index, User value)

Information about the user's management chain (reporting hierarchy). Note: user_management_chain is only populated when data is exported to BigQuery since recursive fields (e.g. user.managers) are not supported by BigQuery.

repeated .google.backstory.User user_management_chain = 29;

Parameters
Name Description
index int
value User
Returns
Type Description
Noun.Builder

setUserManagementChain(int index, User.Builder builderForValue)

public Noun.Builder setUserManagementChain(int index, User.Builder builderForValue)

Information about the user's management chain (reporting hierarchy). Note: user_management_chain is only populated when data is exported to BigQuery since recursive fields (e.g. user.managers) are not supported by BigQuery.

repeated .google.backstory.User user_management_chain = 29;

Parameters
Name Description
index int
builderForValue User.Builder
Returns
Type Description
Noun.Builder