public final class SecurityResult extends GeneratedMessage implements SecurityResultOrBuilderSecurity related metadata for the event. A security result might be something like "virus detected and quarantined," "malicious connection blocked," or "sensitive data included in document foo.doc." Each security result, of which there may be more than one, may either pertain to the whole event, or to a specific object or device referenced in the event (e.g. a malicious file that was detected, or a sensitive document sent as an email attachment). For security results that apply to a particular object referenced in the event, the security_results message MUST contain details about the implicated object (such as process, user, IP, domain, URL, IP, or email address) in the about field. For security results that apply to the entire event (e.g. SPAM found in this email), the about field must remain empty.
Protobuf type google.backstory.SecurityResult
Inheritance
Object > AbstractMessageLite<MessageType,BuilderType> > AbstractMessage > GeneratedMessage > SecurityResultImplements
SecurityResultOrBuilderStatic Fields
ABOUT_FIELD_NUMBER
public static final int ABOUT_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
ACTION_DETAILS_FIELD_NUMBER
public static final int ACTION_DETAILS_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
ACTION_FIELD_NUMBER
public static final int ACTION_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
ALERT_STATE_FIELD_NUMBER
public static final int ALERT_STATE_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
ANALYTICS_METADATA_FIELD_NUMBER
public static final int ANALYTICS_METADATA_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
ASSOCIATIONS_FIELD_NUMBER
public static final int ASSOCIATIONS_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
ATTACK_DETAILS_FIELD_NUMBER
public static final int ATTACK_DETAILS_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
CAMPAIGNS_FIELD_NUMBER
public static final int CAMPAIGNS_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
CATEGORY_DETAILS_FIELD_NUMBER
public static final int CATEGORY_DETAILS_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
CATEGORY_FIELD_NUMBER
public static final int CATEGORY_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
CONFIDENCE_DETAILS_FIELD_NUMBER
public static final int CONFIDENCE_DETAILS_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
CONFIDENCE_FIELD_NUMBER
public static final int CONFIDENCE_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
CONFIDENCE_SCORE_FIELD_NUMBER
public static final int CONFIDENCE_SCORE_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
DESCRIPTION_FIELD_NUMBER
public static final int DESCRIPTION_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
DETECTION_DEPTH_FIELD_NUMBER
public static final int DETECTION_DEPTH_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
DETECTION_FIELDS_FIELD_NUMBER
public static final int DETECTION_FIELDS_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
DISPLAY_NAME_FIELD_NUMBER
public static final int DISPLAY_NAME_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
FIRST_DISCOVERED_TIME_FIELD_NUMBER
public static final int FIRST_DISCOVERED_TIME_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
LAST_DISCOVERED_TIME_FIELD_NUMBER
public static final int LAST_DISCOVERED_TIME_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
LAST_UPDATED_TIME_FIELD_NUMBER
public static final int LAST_UPDATED_TIME_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
OUTCOMES_FIELD_NUMBER
public static final int OUTCOMES_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
PRIORITY_DETAILS_FIELD_NUMBER
public static final int PRIORITY_DETAILS_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
PRIORITY_FIELD_NUMBER
public static final int PRIORITY_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
REPORTS_FIELD_NUMBER
public static final int REPORTS_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
RISK_SCORE_FIELD_NUMBER
public static final int RISK_SCORE_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
RULESET_CATEGORY_DISPLAY_NAME_FIELD_NUMBER
public static final int RULESET_CATEGORY_DISPLAY_NAME_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
RULE_AUTHOR_FIELD_NUMBER
public static final int RULE_AUTHOR_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
RULE_ID_FIELD_NUMBER
public static final int RULE_ID_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
RULE_LABELS_FIELD_NUMBER
public static final int RULE_LABELS_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
RULE_NAME_FIELD_NUMBER
public static final int RULE_NAME_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
RULE_SET_DISPLAY_NAME_FIELD_NUMBER
public static final int RULE_SET_DISPLAY_NAME_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
RULE_SET_FIELD_NUMBER
public static final int RULE_SET_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
RULE_TYPE_FIELD_NUMBER
public static final int RULE_TYPE_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
RULE_VERSION_FIELD_NUMBER
public static final int RULE_VERSION_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
SEVERITY_DETAILS_FIELD_NUMBER
public static final int SEVERITY_DETAILS_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
SEVERITY_FIELD_NUMBER
public static final int SEVERITY_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
SUMMARY_FIELD_NUMBER
public static final int SUMMARY_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
THREAT_COLLECTIONS_FIELD_NUMBER
public static final int THREAT_COLLECTIONS_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
THREAT_FEED_NAME_FIELD_NUMBER
public static final int THREAT_FEED_NAME_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
THREAT_ID_FIELD_NUMBER
public static final int THREAT_ID_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
THREAT_ID_NAMESPACE_FIELD_NUMBER
public static final int THREAT_ID_NAMESPACE_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
THREAT_NAME_FIELD_NUMBER
public static final int THREAT_NAME_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
THREAT_STATUS_FIELD_NUMBER
public static final int THREAT_STATUS_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
THREAT_VERDICT_FIELD_NUMBER
public static final int THREAT_VERDICT_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
URL_BACK_TO_PRODUCT_FIELD_NUMBER
public static final int URL_BACK_TO_PRODUCT_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
VARIABLES_FIELD_NUMBER
public static final int VARIABLES_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
VERDICT_FIELD_NUMBER
public static final int VERDICT_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
VERDICT_INFO_FIELD_NUMBER
public static final int VERDICT_INFO_FIELD_NUMBER| Field Value | |
|---|---|
| Type | Description |
int |
|
Static Methods
getDefaultInstance()
public static SecurityResult getDefaultInstance()| Returns | |
|---|---|
| Type | Description |
SecurityResult |
|
getDescriptor()
public static final Descriptors.Descriptor getDescriptor()| Returns | |
|---|---|
| Type | Description |
Descriptor |
|
newBuilder()
public static SecurityResult.Builder newBuilder()| Returns | |
|---|---|
| Type | Description |
SecurityResult.Builder |
|
newBuilder(SecurityResult prototype)
public static SecurityResult.Builder newBuilder(SecurityResult prototype)| Parameter | |
|---|---|
| Name | Description |
prototype |
SecurityResult |
| Returns | |
|---|---|
| Type | Description |
SecurityResult.Builder |
|
parseDelimitedFrom(InputStream input)
public static SecurityResult parseDelimitedFrom(InputStream input)| Parameter | |
|---|---|
| Name | Description |
input |
InputStream |
| Returns | |
|---|---|
| Type | Description |
SecurityResult |
|
| Exceptions | |
|---|---|
| Type | Description |
IOException |
|
parseDelimitedFrom(InputStream input, ExtensionRegistryLite extensionRegistry)
public static SecurityResult parseDelimitedFrom(InputStream input, ExtensionRegistryLite extensionRegistry)| Parameters | |
|---|---|
| Name | Description |
input |
InputStream |
extensionRegistry |
ExtensionRegistryLite |
| Returns | |
|---|---|
| Type | Description |
SecurityResult |
|
| Exceptions | |
|---|---|
| Type | Description |
IOException |
|
parseFrom(byte[] data)
public static SecurityResult parseFrom(byte[] data)| Parameter | |
|---|---|
| Name | Description |
data |
byte[] |
| Returns | |
|---|---|
| Type | Description |
SecurityResult |
|
| Exceptions | |
|---|---|
| Type | Description |
InvalidProtocolBufferException |
|
parseFrom(byte[] data, ExtensionRegistryLite extensionRegistry)
public static SecurityResult parseFrom(byte[] data, ExtensionRegistryLite extensionRegistry)| Parameters | |
|---|---|
| Name | Description |
data |
byte[] |
extensionRegistry |
ExtensionRegistryLite |
| Returns | |
|---|---|
| Type | Description |
SecurityResult |
|
| Exceptions | |
|---|---|
| Type | Description |
InvalidProtocolBufferException |
|
parseFrom(ByteString data)
public static SecurityResult parseFrom(ByteString data)| Parameter | |
|---|---|
| Name | Description |
data |
ByteString |
| Returns | |
|---|---|
| Type | Description |
SecurityResult |
|
| Exceptions | |
|---|---|
| Type | Description |
InvalidProtocolBufferException |
|
parseFrom(ByteString data, ExtensionRegistryLite extensionRegistry)
public static SecurityResult parseFrom(ByteString data, ExtensionRegistryLite extensionRegistry)| Parameters | |
|---|---|
| Name | Description |
data |
ByteString |
extensionRegistry |
ExtensionRegistryLite |
| Returns | |
|---|---|
| Type | Description |
SecurityResult |
|
| Exceptions | |
|---|---|
| Type | Description |
InvalidProtocolBufferException |
|
parseFrom(CodedInputStream input)
public static SecurityResult parseFrom(CodedInputStream input)| Parameter | |
|---|---|
| Name | Description |
input |
CodedInputStream |
| Returns | |
|---|---|
| Type | Description |
SecurityResult |
|
| Exceptions | |
|---|---|
| Type | Description |
IOException |
|
parseFrom(CodedInputStream input, ExtensionRegistryLite extensionRegistry)
public static SecurityResult parseFrom(CodedInputStream input, ExtensionRegistryLite extensionRegistry)| Parameters | |
|---|---|
| Name | Description |
input |
CodedInputStream |
extensionRegistry |
ExtensionRegistryLite |
| Returns | |
|---|---|
| Type | Description |
SecurityResult |
|
| Exceptions | |
|---|---|
| Type | Description |
IOException |
|
parseFrom(InputStream input)
public static SecurityResult parseFrom(InputStream input)| Parameter | |
|---|---|
| Name | Description |
input |
InputStream |
| Returns | |
|---|---|
| Type | Description |
SecurityResult |
|
| Exceptions | |
|---|---|
| Type | Description |
IOException |
|
parseFrom(InputStream input, ExtensionRegistryLite extensionRegistry)
public static SecurityResult parseFrom(InputStream input, ExtensionRegistryLite extensionRegistry)| Parameters | |
|---|---|
| Name | Description |
input |
InputStream |
extensionRegistry |
ExtensionRegistryLite |
| Returns | |
|---|---|
| Type | Description |
SecurityResult |
|
| Exceptions | |
|---|---|
| Type | Description |
IOException |
|
parseFrom(ByteBuffer data)
public static SecurityResult parseFrom(ByteBuffer data)| Parameter | |
|---|---|
| Name | Description |
data |
ByteBuffer |
| Returns | |
|---|---|
| Type | Description |
SecurityResult |
|
| Exceptions | |
|---|---|
| Type | Description |
InvalidProtocolBufferException |
|
parseFrom(ByteBuffer data, ExtensionRegistryLite extensionRegistry)
public static SecurityResult parseFrom(ByteBuffer data, ExtensionRegistryLite extensionRegistry)| Parameters | |
|---|---|
| Name | Description |
data |
ByteBuffer |
extensionRegistry |
ExtensionRegistryLite |
| Returns | |
|---|---|
| Type | Description |
SecurityResult |
|
| Exceptions | |
|---|---|
| Type | Description |
InvalidProtocolBufferException |
|
parser()
public static Parser<SecurityResult> parser()| Returns | |
|---|---|
| Type | Description |
Parser<SecurityResult> |
|
Methods
containsVariables(String key)
public boolean containsVariables(String key)A list of outcomes and match variables that represent the results of this security finding. This list represents a mapping of names of the requested outcomes or match variables, to their values.
This is only populated when the SecurityResult appears in a detection.
map<string, .google.backstory.FindingVariable> variables = 44;
| Parameter | |
|---|---|
| Name | Description |
key |
String |
| Returns | |
|---|---|
| Type | Description |
boolean |
|
equals(Object obj)
public boolean equals(Object obj)| Parameter | |
|---|---|
| Name | Description |
obj |
Object |
| Returns | |
|---|---|
| Type | Description |
boolean |
|
getAbout()
public Noun getAbout()If the security result is about a specific entity (Noun), add it here. This field is not populated when the SecurityResult appears in a detection.
.google.backstory.Noun about = 1;
| Returns | |
|---|---|
| Type | Description |
Noun |
The about. |
getAboutOrBuilder()
public NounOrBuilder getAboutOrBuilder()If the security result is about a specific entity (Noun), add it here. This field is not populated when the SecurityResult appears in a detection.
.google.backstory.Noun about = 1;
| Returns | |
|---|---|
| Type | Description |
NounOrBuilder |
|
getAction(int index)
public SecurityResult.Action getAction(int index)Actions taken for this event. This field is not populated when the SecurityResult appears in a detection.
repeated .google.backstory.SecurityResult.Action action = 8;
| Parameter | |
|---|---|
| Name | Description |
index |
intThe index of the element to return. |
| Returns | |
|---|---|
| Type | Description |
SecurityResult.Action |
The action at the given index. |
getActionCount()
public int getActionCount()Actions taken for this event. This field is not populated when the SecurityResult appears in a detection.
repeated .google.backstory.SecurityResult.Action action = 8;
| Returns | |
|---|---|
| Type | Description |
int |
The count of action. |
getActionDetails()
public String getActionDetails()The detail of the action taken as provided by the vendor. This field is not populated when the SecurityResult appears in a detection.
string action_details = 19;
| Returns | |
|---|---|
| Type | Description |
String |
The actionDetails. |
getActionDetailsBytes()
public ByteString getActionDetailsBytes()The detail of the action taken as provided by the vendor. This field is not populated when the SecurityResult appears in a detection.
string action_details = 19;
| Returns | |
|---|---|
| Type | Description |
ByteString |
The bytes for actionDetails. |
getActionList()
public List<SecurityResult.Action> getActionList()Actions taken for this event. This field is not populated when the SecurityResult appears in a detection.
repeated .google.backstory.SecurityResult.Action action = 8;
| Returns | |
|---|---|
| Type | Description |
List<Action> |
A list containing the action. |
getActionValue(int index)
public int getActionValue(int index)Actions taken for this event. This field is not populated when the SecurityResult appears in a detection.
repeated .google.backstory.SecurityResult.Action action = 8;
| Parameter | |
|---|---|
| Name | Description |
index |
intThe index of the value to return. |
| Returns | |
|---|---|
| Type | Description |
int |
The enum numeric value on the wire of action at the given index. |
getActionValueList()
public List<Integer> getActionValueList()Actions taken for this event. This field is not populated when the SecurityResult appears in a detection.
repeated .google.backstory.SecurityResult.Action action = 8;
| Returns | |
|---|---|
| Type | Description |
List<Integer> |
A list containing the enum numeric values on the wire for action. |
getAlertState()
public SecurityResult.AlertState getAlertState()The alerting types of this security result. This is primarily set for rule-generated detections and alerts.
.google.backstory.SecurityResult.AlertState alert_state = 21;
| Returns | |
|---|---|
| Type | Description |
SecurityResult.AlertState |
The alertState. |
getAlertStateValue()
public int getAlertStateValue()The alerting types of this security result. This is primarily set for rule-generated detections and alerts.
.google.backstory.SecurityResult.AlertState alert_state = 21;
| Returns | |
|---|---|
| Type | Description |
int |
The enum numeric value on the wire for alertState. |
getAnalyticsMetadata(int index)
public AnalyticsMetadata getAnalyticsMetadata(int index)Stores metadata about each risk analytic metric the rule uses. This field is not populated when the SecurityResult appears in a detection.
repeated .google.backstory.AnalyticsMetadata analytics_metadata = 43;
| Parameter | |
|---|---|
| Name | Description |
index |
int |
| Returns | |
|---|---|
| Type | Description |
AnalyticsMetadata |
|
getAnalyticsMetadataCount()
public int getAnalyticsMetadataCount()Stores metadata about each risk analytic metric the rule uses. This field is not populated when the SecurityResult appears in a detection.
repeated .google.backstory.AnalyticsMetadata analytics_metadata = 43;
| Returns | |
|---|---|
| Type | Description |
int |
|
getAnalyticsMetadataList()
public List<AnalyticsMetadata> getAnalyticsMetadataList()Stores metadata about each risk analytic metric the rule uses. This field is not populated when the SecurityResult appears in a detection.
repeated .google.backstory.AnalyticsMetadata analytics_metadata = 43;
| Returns | |
|---|---|
| Type | Description |
List<AnalyticsMetadata> |
|
getAnalyticsMetadataOrBuilder(int index)
public AnalyticsMetadataOrBuilder getAnalyticsMetadataOrBuilder(int index)Stores metadata about each risk analytic metric the rule uses. This field is not populated when the SecurityResult appears in a detection.
repeated .google.backstory.AnalyticsMetadata analytics_metadata = 43;
| Parameter | |
|---|---|
| Name | Description |
index |
int |
| Returns | |
|---|---|
| Type | Description |
AnalyticsMetadataOrBuilder |
|
getAnalyticsMetadataOrBuilderList()
public List<? extends AnalyticsMetadataOrBuilder> getAnalyticsMetadataOrBuilderList()Stores metadata about each risk analytic metric the rule uses. This field is not populated when the SecurityResult appears in a detection.
repeated .google.backstory.AnalyticsMetadata analytics_metadata = 43;
| Returns | |
|---|---|
| Type | Description |
List<? extends com.google.backstory.AnalyticsMetadataOrBuilder> |
|
getAssociations(int index)
public SecurityResult.Association getAssociations(int index)Associations related to the threat.
repeated .google.backstory.SecurityResult.Association associations = 34;
| Parameter | |
|---|---|
| Name | Description |
index |
int |
| Returns | |
|---|---|
| Type | Description |
SecurityResult.Association |
|
getAssociationsCount()
public int getAssociationsCount()Associations related to the threat.
repeated .google.backstory.SecurityResult.Association associations = 34;
| Returns | |
|---|---|
| Type | Description |
int |
|
getAssociationsList()
public List<SecurityResult.Association> getAssociationsList()Associations related to the threat.
repeated .google.backstory.SecurityResult.Association associations = 34;
| Returns | |
|---|---|
| Type | Description |
List<Association> |
|
getAssociationsOrBuilder(int index)
public SecurityResult.AssociationOrBuilder getAssociationsOrBuilder(int index)Associations related to the threat.
repeated .google.backstory.SecurityResult.Association associations = 34;
| Parameter | |
|---|---|
| Name | Description |
index |
int |
| Returns | |
|---|---|
| Type | Description |
SecurityResult.AssociationOrBuilder |
|
getAssociationsOrBuilderList()
public List<? extends SecurityResult.AssociationOrBuilder> getAssociationsOrBuilderList()Associations related to the threat.
repeated .google.backstory.SecurityResult.Association associations = 34;
| Returns | |
|---|---|
| Type | Description |
List<? extends com.google.backstory.SecurityResult.AssociationOrBuilder> |
|
getAttackDetails()
public AttackDetails getAttackDetails()MITRE ATT&CK details. This field is not populated when the SecurityResult appears in a detection.
.google.backstory.AttackDetails attack_details = 32;
| Returns | |
|---|---|
| Type | Description |
AttackDetails |
The attackDetails. |
getAttackDetailsOrBuilder()
public AttackDetailsOrBuilder getAttackDetailsOrBuilder()MITRE ATT&CK details. This field is not populated when the SecurityResult appears in a detection.
.google.backstory.AttackDetails attack_details = 32;
| Returns | |
|---|---|
| Type | Description |
AttackDetailsOrBuilder |
|
getCampaigns(int index) (deprecated)
public String getCampaigns(int index)Deprecated. google.backstory.SecurityResult.campaigns is deprecated. See backstory/udm.proto;l=2718
Campaigns using this IOC threat. This is deprecated. Use threat_collections instead.
repeated string campaigns = 35 [deprecated = true];
| Parameter | |
|---|---|
| Name | Description |
index |
intThe index of the element to return. |
| Returns | |
|---|---|
| Type | Description |
String |
The campaigns at the given index. |
getCampaignsBytes(int index) (deprecated)
public ByteString getCampaignsBytes(int index)Deprecated. google.backstory.SecurityResult.campaigns is deprecated. See backstory/udm.proto;l=2718
Campaigns using this IOC threat. This is deprecated. Use threat_collections instead.
repeated string campaigns = 35 [deprecated = true];
| Parameter | |
|---|---|
| Name | Description |
index |
intThe index of the value to return. |
| Returns | |
|---|---|
| Type | Description |
ByteString |
The bytes of the campaigns at the given index. |
getCampaignsCount() (deprecated)
public int getCampaignsCount()Deprecated. google.backstory.SecurityResult.campaigns is deprecated. See backstory/udm.proto;l=2718
Campaigns using this IOC threat. This is deprecated. Use threat_collections instead.
repeated string campaigns = 35 [deprecated = true];
| Returns | |
|---|---|
| Type | Description |
int |
The count of campaigns. |
getCampaignsList() (deprecated)
public ProtocolStringList getCampaignsList()Deprecated. google.backstory.SecurityResult.campaigns is deprecated. See backstory/udm.proto;l=2718
Campaigns using this IOC threat. This is deprecated. Use threat_collections instead.
repeated string campaigns = 35 [deprecated = true];
| Returns | |
|---|---|
| Type | Description |
ProtocolStringList |
A list containing the campaigns. |
getCategory(int index)
public SecurityResult.SecurityCategory getCategory(int index)The security category. This field is not populated when the SecurityResult appears in a detection.
repeated .google.backstory.SecurityResult.SecurityCategory category = 2;
| Parameter | |
|---|---|
| Name | Description |
index |
intThe index of the element to return. |
| Returns | |
|---|---|
| Type | Description |
SecurityResult.SecurityCategory |
The category at the given index. |
getCategoryCount()
public int getCategoryCount()The security category. This field is not populated when the SecurityResult appears in a detection.
repeated .google.backstory.SecurityResult.SecurityCategory category = 2;
| Returns | |
|---|---|
| Type | Description |
int |
The count of category. |
getCategoryDetails(int index)
public String getCategoryDetails(int index)For vendor-specific categories. For web categorization, put type in here such as "gambling" or "porn". This field is not populated when the SecurityResult appears in a detection.
repeated string category_details = 3;
| Parameter | |
|---|---|
| Name | Description |
index |
intThe index of the element to return. |
| Returns | |
|---|---|
| Type | Description |
String |
The categoryDetails at the given index. |
getCategoryDetailsBytes(int index)
public ByteString getCategoryDetailsBytes(int index)For vendor-specific categories. For web categorization, put type in here such as "gambling" or "porn". This field is not populated when the SecurityResult appears in a detection.
repeated string category_details = 3;
| Parameter | |
|---|---|
| Name | Description |
index |
intThe index of the value to return. |
| Returns | |
|---|---|
| Type | Description |
ByteString |
The bytes of the categoryDetails at the given index. |
getCategoryDetailsCount()
public int getCategoryDetailsCount()For vendor-specific categories. For web categorization, put type in here such as "gambling" or "porn". This field is not populated when the SecurityResult appears in a detection.
repeated string category_details = 3;
| Returns | |
|---|---|
| Type | Description |
int |
The count of categoryDetails. |
getCategoryDetailsList()
public ProtocolStringList getCategoryDetailsList()For vendor-specific categories. For web categorization, put type in here such as "gambling" or "porn". This field is not populated when the SecurityResult appears in a detection.
repeated string category_details = 3;
| Returns | |
|---|---|
| Type | Description |
ProtocolStringList |
A list containing the categoryDetails. |
getCategoryList()
public List<SecurityResult.SecurityCategory> getCategoryList()The security category. This field is not populated when the SecurityResult appears in a detection.
repeated .google.backstory.SecurityResult.SecurityCategory category = 2;
| Returns | |
|---|---|
| Type | Description |
List<SecurityCategory> |
A list containing the category. |
getCategoryValue(int index)
public int getCategoryValue(int index)The security category. This field is not populated when the SecurityResult appears in a detection.
repeated .google.backstory.SecurityResult.SecurityCategory category = 2;
| Parameter | |
|---|---|
| Name | Description |
index |
intThe index of the value to return. |
| Returns | |
|---|---|
| Type | Description |
int |
The enum numeric value on the wire of category at the given index. |
getCategoryValueList()
public List<Integer> getCategoryValueList()The security category. This field is not populated when the SecurityResult appears in a detection.
repeated .google.backstory.SecurityResult.SecurityCategory category = 2;
| Returns | |
|---|---|
| Type | Description |
List<Integer> |
A list containing the enum numeric values on the wire for category. |
getConfidence()
public SecurityResult.ProductConfidence getConfidence()The confidence level of the result as estimated by the product. This field is not populated when the SecurityResult appears in a detection.
.google.backstory.SecurityResult.ProductConfidence confidence = 10;
| Returns | |
|---|---|
| Type | Description |
SecurityResult.ProductConfidence |
The confidence. |
getConfidenceDetails()
public String getConfidenceDetails()Additional detail with regards to the confidence of a security event as estimated by the product vendor. This field is not populated when the SecurityResult appears in a detection.
string confidence_details = 13;
| Returns | |
|---|---|
| Type | Description |
String |
The confidenceDetails. |
getConfidenceDetailsBytes()
public ByteString getConfidenceDetailsBytes()Additional detail with regards to the confidence of a security event as estimated by the product vendor. This field is not populated when the SecurityResult appears in a detection.
string confidence_details = 13;
| Returns | |
|---|---|
| Type | Description |
ByteString |
The bytes for confidenceDetails. |
getConfidenceScore()
public float getConfidenceScore()The confidence score of the security result. This field is not populated when the SecurityResult appears in a detection.
float confidence_score = 42;
| Returns | |
|---|---|
| Type | Description |
float |
The confidenceScore. |
getConfidenceValue()
public int getConfidenceValue()The confidence level of the result as estimated by the product. This field is not populated when the SecurityResult appears in a detection.
.google.backstory.SecurityResult.ProductConfidence confidence = 10;
| Returns | |
|---|---|
| Type | Description |
int |
The enum numeric value on the wire for confidence. |
getDefaultInstanceForType()
public SecurityResult getDefaultInstanceForType()| Returns | |
|---|---|
| Type | Description |
SecurityResult |
|
getDescription()
public String getDescription()A human-readable description (e.g. "user password was wrong"). This can be more detailed than the summary.
string description = 7;
| Returns | |
|---|---|
| Type | Description |
String |
The description. |
getDescriptionBytes()
public ByteString getDescriptionBytes()A human-readable description (e.g. "user password was wrong"). This can be more detailed than the summary.
string description = 7;
| Returns | |
|---|---|
| Type | Description |
ByteString |
The bytes for description. |
getDetectionDepth()
public long getDetectionDepth()The depth of the detection chain. Applies only to composite detections.
int64 detection_depth = 47;
| Returns | |
|---|---|
| Type | Description |
long |
The detectionDepth. |
getDetectionFields(int index)
public Label getDetectionFields(int index)An ordered list of values, that represent fields in detections for a security finding. This list represents mapping of names of requested entities to their values (the security result matched variables).
For Collection SecurityResults, prefer variables instead.
repeated .google.backstory.Label detection_fields = 23;
| Parameter | |
|---|---|
| Name | Description |
index |
int |
| Returns | |
|---|---|
| Type | Description |
Label |
|
getDetectionFieldsCount()
public int getDetectionFieldsCount()An ordered list of values, that represent fields in detections for a security finding. This list represents mapping of names of requested entities to their values (the security result matched variables).
For Collection SecurityResults, prefer variables instead.
repeated .google.backstory.Label detection_fields = 23;
| Returns | |
|---|---|
| Type | Description |
int |
|
getDetectionFieldsList()
public List<Label> getDetectionFieldsList()An ordered list of values, that represent fields in detections for a security finding. This list represents mapping of names of requested entities to their values (the security result matched variables).
For Collection SecurityResults, prefer variables instead.
repeated .google.backstory.Label detection_fields = 23;
| Returns | |
|---|---|
| Type | Description |
List<Label> |
|
getDetectionFieldsOrBuilder(int index)
public LabelOrBuilder getDetectionFieldsOrBuilder(int index)An ordered list of values, that represent fields in detections for a security finding. This list represents mapping of names of requested entities to their values (the security result matched variables).
For Collection SecurityResults, prefer variables instead.
repeated .google.backstory.Label detection_fields = 23;
| Parameter | |
|---|---|
| Name | Description |
index |
int |
| Returns | |
|---|---|
| Type | Description |
LabelOrBuilder |
|
getDetectionFieldsOrBuilderList()
public List<? extends LabelOrBuilder> getDetectionFieldsOrBuilderList()An ordered list of values, that represent fields in detections for a security finding. This list represents mapping of names of requested entities to their values (the security result matched variables).
For Collection SecurityResults, prefer variables instead.
repeated .google.backstory.Label detection_fields = 23;
| Returns | |
|---|---|
| Type | Description |
List<? extends com.google.backstory.LabelOrBuilder> |
|
getDisplayName()
public String getDisplayName()The display name of the security result. This is populated from 'name_override' Outcome Variable, if present. Otherwise, this field is not set.
string display_name = 49;
| Returns | |
|---|---|
| Type | Description |
String |
The displayName. |
getDisplayNameBytes()
public ByteString getDisplayNameBytes()The display name of the security result. This is populated from 'name_override' Outcome Variable, if present. Otherwise, this field is not set.
string display_name = 49;
| Returns | |
|---|---|
| Type | Description |
ByteString |
The bytes for displayName. |
getFirstDiscoveredTime()
public Timestamp getFirstDiscoveredTime()First time the IoC threat was discovered in the provider. This field is not populated when the SecurityResult appears in a detection.
.google.protobuf.Timestamp first_discovered_time = 33;
| Returns | |
|---|---|
| Type | Description |
Timestamp |
The firstDiscoveredTime. |
getFirstDiscoveredTimeOrBuilder()
public TimestampOrBuilder getFirstDiscoveredTimeOrBuilder()First time the IoC threat was discovered in the provider. This field is not populated when the SecurityResult appears in a detection.
.google.protobuf.Timestamp first_discovered_time = 33;
| Returns | |
|---|---|
| Type | Description |
TimestampOrBuilder |
|
getLastDiscoveredTime()
public Timestamp getLastDiscoveredTime()Last time the IoC was seen in the provider data. This field is not populated when the SecurityResult appears in a detection.
.google.protobuf.Timestamp last_discovered_time = 40;
| Returns | |
|---|---|
| Type | Description |
Timestamp |
The lastDiscoveredTime. |
getLastDiscoveredTimeOrBuilder()
public TimestampOrBuilder getLastDiscoveredTimeOrBuilder()Last time the IoC was seen in the provider data. This field is not populated when the SecurityResult appears in a detection.
.google.protobuf.Timestamp last_discovered_time = 40;
| Returns | |
|---|---|
| Type | Description |
TimestampOrBuilder |
|
getLastUpdatedTime()
public Timestamp getLastUpdatedTime()Last time the IoC threat was updated in the provider. This field is not populated when the SecurityResult appears in a detection.
.google.protobuf.Timestamp last_updated_time = 37;
| Returns | |
|---|---|
| Type | Description |
Timestamp |
The lastUpdatedTime. |
getLastUpdatedTimeOrBuilder()
public TimestampOrBuilder getLastUpdatedTimeOrBuilder()Last time the IoC threat was updated in the provider. This field is not populated when the SecurityResult appears in a detection.
.google.protobuf.Timestamp last_updated_time = 37;
| Returns | |
|---|---|
| Type | Description |
TimestampOrBuilder |
|
getOutcomes(int index) (deprecated)
public Label getOutcomes(int index)A list of outcomes that represent the results of this security finding. This list represents a mapping of names of the requested outcomes, to a stringified version of their values.
This is only populated when the SecurityResult appears in a detection. This is deprecated. Use variables instead.
repeated .google.backstory.Label outcomes = 28 [deprecated = true];
| Parameter | |
|---|---|
| Name | Description |
index |
int |
| Returns | |
|---|---|
| Type | Description |
Label |
|
getOutcomesCount() (deprecated)
public int getOutcomesCount()A list of outcomes that represent the results of this security finding. This list represents a mapping of names of the requested outcomes, to a stringified version of their values.
This is only populated when the SecurityResult appears in a detection. This is deprecated. Use variables instead.
repeated .google.backstory.Label outcomes = 28 [deprecated = true];
| Returns | |
|---|---|
| Type | Description |
int |
|
getOutcomesList() (deprecated)
public List<Label> getOutcomesList()A list of outcomes that represent the results of this security finding. This list represents a mapping of names of the requested outcomes, to a stringified version of their values.
This is only populated when the SecurityResult appears in a detection. This is deprecated. Use variables instead.
repeated .google.backstory.Label outcomes = 28 [deprecated = true];
| Returns | |
|---|---|
| Type | Description |
List<Label> |
|
getOutcomesOrBuilder(int index) (deprecated)
public LabelOrBuilder getOutcomesOrBuilder(int index)A list of outcomes that represent the results of this security finding. This list represents a mapping of names of the requested outcomes, to a stringified version of their values.
This is only populated when the SecurityResult appears in a detection. This is deprecated. Use variables instead.
repeated .google.backstory.Label outcomes = 28 [deprecated = true];
| Parameter | |
|---|---|
| Name | Description |
index |
int |
| Returns | |
|---|---|
| Type | Description |
LabelOrBuilder |
|
getOutcomesOrBuilderList() (deprecated)
public List<? extends LabelOrBuilder> getOutcomesOrBuilderList()A list of outcomes that represent the results of this security finding. This list represents a mapping of names of the requested outcomes, to a stringified version of their values.
This is only populated when the SecurityResult appears in a detection. This is deprecated. Use variables instead.
repeated .google.backstory.Label outcomes = 28 [deprecated = true];
| Returns | |
|---|---|
| Type | Description |
List<? extends com.google.backstory.LabelOrBuilder> |
|
getParserForType()
public Parser<SecurityResult> getParserForType()| Returns | |
|---|---|
| Type | Description |
Parser<SecurityResult> |
|
getPriority()
public SecurityResult.ProductPriority getPriority()The priority of the result. This field is not populated when the SecurityResult appears in a detection.
.google.backstory.SecurityResult.ProductPriority priority = 11;
| Returns | |
|---|---|
| Type | Description |
SecurityResult.ProductPriority |
The priority. |
getPriorityDetails()
public String getPriorityDetails()Vendor-specific information about the security result priority. This field is not populated when the SecurityResult appears in a detection.
string priority_details = 14;
| Returns | |
|---|---|
| Type | Description |
String |
The priorityDetails. |
getPriorityDetailsBytes()
public ByteString getPriorityDetailsBytes()Vendor-specific information about the security result priority. This field is not populated when the SecurityResult appears in a detection.
string priority_details = 14;
| Returns | |
|---|---|
| Type | Description |
ByteString |
The bytes for priorityDetails. |
getPriorityValue()
public int getPriorityValue()The priority of the result. This field is not populated when the SecurityResult appears in a detection.
.google.backstory.SecurityResult.ProductPriority priority = 11;
| Returns | |
|---|---|
| Type | Description |
int |
The enum numeric value on the wire for priority. |
getReports(int index) (deprecated)
public String getReports(int index)Deprecated. google.backstory.SecurityResult.reports is deprecated. See backstory/udm.proto;l=2722
Reports that reference this IOC threat. These are the report IDs. This is deprecated. Use threat_collections instead.
repeated string reports = 46 [deprecated = true];
| Parameter | |
|---|---|
| Name | Description |
index |
intThe index of the element to return. |
| Returns | |
|---|---|
| Type | Description |
String |
The reports at the given index. |
getReportsBytes(int index) (deprecated)
public ByteString getReportsBytes(int index)Deprecated. google.backstory.SecurityResult.reports is deprecated. See backstory/udm.proto;l=2722
Reports that reference this IOC threat. These are the report IDs. This is deprecated. Use threat_collections instead.
repeated string reports = 46 [deprecated = true];
| Parameter | |
|---|---|
| Name | Description |
index |
intThe index of the value to return. |
| Returns | |
|---|---|
| Type | Description |
ByteString |
The bytes of the reports at the given index. |
getReportsCount() (deprecated)
public int getReportsCount()Deprecated. google.backstory.SecurityResult.reports is deprecated. See backstory/udm.proto;l=2722
Reports that reference this IOC threat. These are the report IDs. This is deprecated. Use threat_collections instead.
repeated string reports = 46 [deprecated = true];
| Returns | |
|---|---|
| Type | Description |
int |
The count of reports. |
getReportsList() (deprecated)
public ProtocolStringList getReportsList()Deprecated. google.backstory.SecurityResult.reports is deprecated. See backstory/udm.proto;l=2722
Reports that reference this IOC threat. These are the report IDs. This is deprecated. Use threat_collections instead.
repeated string reports = 46 [deprecated = true];
| Returns | |
|---|---|
| Type | Description |
ProtocolStringList |
A list containing the reports. |
getRiskScore()
public float getRiskScore()The risk score of the security result.
float risk_score = 31;
| Returns | |
|---|---|
| Type | Description |
float |
The riskScore. |
getRuleAuthor()
public String getRuleAuthor()Author of the security rule. This field is not populated when the SecurityResult appears in a detection.
string rule_author = 25;
| Returns | |
|---|---|
| Type | Description |
String |
The ruleAuthor. |
getRuleAuthorBytes()
public ByteString getRuleAuthorBytes()Author of the security rule. This field is not populated when the SecurityResult appears in a detection.
string rule_author = 25;
| Returns | |
|---|---|
| Type | Description |
ByteString |
The bytes for ruleAuthor. |
getRuleId()
public String getRuleId()A vendor-specific ID for a rule, varying by observer type (e.g. "08123", "5d2b44d0-5ef6-40f5-a704-47d61d3babbe").
string rule_id = 16;
| Returns | |
|---|---|
| Type | Description |
String |
The ruleId. |
getRuleIdBytes()
public ByteString getRuleIdBytes()A vendor-specific ID for a rule, varying by observer type (e.g. "08123", "5d2b44d0-5ef6-40f5-a704-47d61d3babbe").
string rule_id = 16;
| Returns | |
|---|---|
| Type | Description |
ByteString |
The bytes for ruleId. |
getRuleLabels(int index)
public Label getRuleLabels(int index)A list of rule labels that can't be captured by the other fields in security result (e.g. "reference : AnotherRule", "contributor : John"). This is primarily set in rule-generated detections and alerts.
repeated .google.backstory.Label rule_labels = 26;
| Parameter | |
|---|---|
| Name | Description |
index |
int |
| Returns | |
|---|---|
| Type | Description |
Label |
|
getRuleLabelsCount()
public int getRuleLabelsCount()A list of rule labels that can't be captured by the other fields in security result (e.g. "reference : AnotherRule", "contributor : John"). This is primarily set in rule-generated detections and alerts.
repeated .google.backstory.Label rule_labels = 26;
| Returns | |
|---|---|
| Type | Description |
int |
|
getRuleLabelsList()
public List<Label> getRuleLabelsList()A list of rule labels that can't be captured by the other fields in security result (e.g. "reference : AnotherRule", "contributor : John"). This is primarily set in rule-generated detections and alerts.
repeated .google.backstory.Label rule_labels = 26;
| Returns | |
|---|---|
| Type | Description |
List<Label> |
|
getRuleLabelsOrBuilder(int index)
public LabelOrBuilder getRuleLabelsOrBuilder(int index)A list of rule labels that can't be captured by the other fields in security result (e.g. "reference : AnotherRule", "contributor : John"). This is primarily set in rule-generated detections and alerts.
repeated .google.backstory.Label rule_labels = 26;
| Parameter | |
|---|---|
| Name | Description |
index |
int |
| Returns | |
|---|---|
| Type | Description |
LabelOrBuilder |
|
getRuleLabelsOrBuilderList()
public List<? extends LabelOrBuilder> getRuleLabelsOrBuilderList()A list of rule labels that can't be captured by the other fields in security result (e.g. "reference : AnotherRule", "contributor : John"). This is primarily set in rule-generated detections and alerts.
repeated .google.backstory.Label rule_labels = 26;
| Returns | |
|---|---|
| Type | Description |
List<? extends com.google.backstory.LabelOrBuilder> |
|
getRuleName()
public String getRuleName()Name of the security rule (e.g. "BlockInboundToOracle").
string rule_name = 5;
| Returns | |
|---|---|
| Type | Description |
String |
The ruleName. |
getRuleNameBytes()
public ByteString getRuleNameBytes()Name of the security rule (e.g. "BlockInboundToOracle").
string rule_name = 5;
| Returns | |
|---|---|
| Type | Description |
ByteString |
The bytes for ruleName. |
getRuleSet()
public String getRuleSet()The curated detection's rule set identifier. (for example, "windows-threats") This is primarily set in rule-generated detections and alerts.
string rule_set = 29;
| Returns | |
|---|---|
| Type | Description |
String |
The ruleSet. |
getRuleSetBytes()
public ByteString getRuleSetBytes()The curated detection's rule set identifier. (for example, "windows-threats") This is primarily set in rule-generated detections and alerts.
string rule_set = 29;
| Returns | |
|---|---|
| Type | Description |
ByteString |
The bytes for ruleSet. |
getRuleSetDisplayName()
public String getRuleSetDisplayName()The curated detections rule set display name. This is primarily set in rule-generated detections and alerts.
string rule_set_display_name = 30;
| Returns | |
|---|---|
| Type | Description |
String |
The ruleSetDisplayName. |
getRuleSetDisplayNameBytes()
public ByteString getRuleSetDisplayNameBytes()The curated detections rule set display name. This is primarily set in rule-generated detections and alerts.
string rule_set_display_name = 30;
| Returns | |
|---|---|
| Type | Description |
ByteString |
The bytes for ruleSetDisplayName. |
getRuleType()
public String getRuleType()The type of security rule.
string rule_type = 22;
| Returns | |
|---|---|
| Type | Description |
String |
The ruleType. |
getRuleTypeBytes()
public ByteString getRuleTypeBytes()The type of security rule.
string rule_type = 22;
| Returns | |
|---|---|
| Type | Description |
ByteString |
The bytes for ruleType. |
getRuleVersion()
public String getRuleVersion()Version of the security rule. (e.g. "v1.1", "00001", "1604709794", "2020-11-16T23:04:19+00:00"). Note that rule versions are source-dependant and lexical ordering should not be assumed.
string rule_version = 20;
| Returns | |
|---|---|
| Type | Description |
String |
The ruleVersion. |
getRuleVersionBytes()
public ByteString getRuleVersionBytes()Version of the security rule. (e.g. "v1.1", "00001", "1604709794", "2020-11-16T23:04:19+00:00"). Note that rule versions are source-dependant and lexical ordering should not be assumed.
string rule_version = 20;
| Returns | |
|---|---|
| Type | Description |
ByteString |
The bytes for ruleVersion. |
getRulesetCategoryDisplayName()
public String getRulesetCategoryDisplayName()The curated detection rule set category display name. (for example, if rule_set_display_name is "CDIR SCC Enhanced Exfiltration", the rule_set_category is "Cloud Threats"). This is primarily set in rule-generated detections and alerts.
string ruleset_category_display_name = 41;
| Returns | |
|---|---|
| Type | Description |
String |
The rulesetCategoryDisplayName. |
getRulesetCategoryDisplayNameBytes()
public ByteString getRulesetCategoryDisplayNameBytes()The curated detection rule set category display name. (for example, if rule_set_display_name is "CDIR SCC Enhanced Exfiltration", the rule_set_category is "Cloud Threats"). This is primarily set in rule-generated detections and alerts.
string ruleset_category_display_name = 41;
| Returns | |
|---|---|
| Type | Description |
ByteString |
The bytes for rulesetCategoryDisplayName. |
getSerializedSize()
public int getSerializedSize()| Returns | |
|---|---|
| Type | Description |
int |
|
getSeverity()
public SecurityResult.ProductSeverity getSeverity()The severity of the result.
.google.backstory.SecurityResult.ProductSeverity severity = 9;
| Returns | |
|---|---|
| Type | Description |
SecurityResult.ProductSeverity |
The severity. |
getSeverityDetails()
public String getSeverityDetails()Vendor-specific severity. This field is not populated when the SecurityResult appears in a detection.
string severity_details = 12;
| Returns | |
|---|---|
| Type | Description |
String |
The severityDetails. |
getSeverityDetailsBytes()
public ByteString getSeverityDetailsBytes()Vendor-specific severity. This field is not populated when the SecurityResult appears in a detection.
string severity_details = 12;
| Returns | |
|---|---|
| Type | Description |
ByteString |
The bytes for severityDetails. |
getSeverityValue()
public int getSeverityValue()The severity of the result.
.google.backstory.SecurityResult.ProductSeverity severity = 9;
| Returns | |
|---|---|
| Type | Description |
int |
The enum numeric value on the wire for severity. |
getSummary()
public String getSummary()A short human-readable summary (e.g. "failed login occurred")
string summary = 6;
| Returns | |
|---|---|
| Type | Description |
String |
The summary. |
getSummaryBytes()
public ByteString getSummaryBytes()A short human-readable summary (e.g. "failed login occurred")
string summary = 6;
| Returns | |
|---|---|
| Type | Description |
ByteString |
The bytes for summary. |
getThreatCollections(int index)
public SecurityResult.ThreatCollectionItem getThreatCollections(int index)GTI collections associated with the security result.
repeated .google.backstory.SecurityResult.ThreatCollectionItem threat_collections = 48;
| Parameter | |
|---|---|
| Name | Description |
index |
int |
| Returns | |
|---|---|
| Type | Description |
SecurityResult.ThreatCollectionItem |
|
getThreatCollectionsCount()
public int getThreatCollectionsCount()GTI collections associated with the security result.
repeated .google.backstory.SecurityResult.ThreatCollectionItem threat_collections = 48;
| Returns | |
|---|---|
| Type | Description |
int |
|
getThreatCollectionsList()
public List<SecurityResult.ThreatCollectionItem> getThreatCollectionsList()GTI collections associated with the security result.
repeated .google.backstory.SecurityResult.ThreatCollectionItem threat_collections = 48;
| Returns | |
|---|---|
| Type | Description |
List<ThreatCollectionItem> |
|
getThreatCollectionsOrBuilder(int index)
public SecurityResult.ThreatCollectionItemOrBuilder getThreatCollectionsOrBuilder(int index)GTI collections associated with the security result.
repeated .google.backstory.SecurityResult.ThreatCollectionItem threat_collections = 48;
| Parameter | |
|---|---|
| Name | Description |
index |
int |
| Returns | |
|---|---|
| Type | Description |
SecurityResult.ThreatCollectionItemOrBuilder |
|
getThreatCollectionsOrBuilderList()
public List<? extends SecurityResult.ThreatCollectionItemOrBuilder> getThreatCollectionsOrBuilderList()GTI collections associated with the security result.
repeated .google.backstory.SecurityResult.ThreatCollectionItem threat_collections = 48;
| Returns | |
|---|---|
| Type | Description |
List<? extends com.google.backstory.SecurityResult.ThreatCollectionItemOrBuilder> |
|
getThreatFeedName()
public String getThreatFeedName()Vendor feed name for a threat indicator feed. This field is not populated when the SecurityResult appears in a detection.
string threat_feed_name = 27;
| Returns | |
|---|---|
| Type | Description |
String |
The threatFeedName. |
getThreatFeedNameBytes()
public ByteString getThreatFeedNameBytes()Vendor feed name for a threat indicator feed. This field is not populated when the SecurityResult appears in a detection.
string threat_feed_name = 27;
| Returns | |
|---|---|
| Type | Description |
ByteString |
The bytes for threatFeedName. |
getThreatId()
public String getThreatId()Vendor-specific ID for a threat. This field is not populated when the SecurityResult appears in a detection.
string threat_id = 17;
| Returns | |
|---|---|
| Type | Description |
String |
The threatId. |
getThreatIdBytes()
public ByteString getThreatIdBytes()Vendor-specific ID for a threat. This field is not populated when the SecurityResult appears in a detection.
string threat_id = 17;
| Returns | |
|---|---|
| Type | Description |
ByteString |
The bytes for threatId. |
getThreatIdNamespace()
public Id.Namespace getThreatIdNamespace()The attribute threat_id_namespace qualifies threat_id with an id namespace to get an unique id. The attribute threat_id by itself is not unique across Chronicle as it is a vendor specific id. This field is not populated when the SecurityResult appears in a detection.
.google.backstory.Id.Namespace threat_id_namespace = 24;
| Returns | |
|---|---|
| Type | Description |
Id.Namespace |
The threatIdNamespace. |
getThreatIdNamespaceValue()
public int getThreatIdNamespaceValue()The attribute threat_id_namespace qualifies threat_id with an id namespace to get an unique id. The attribute threat_id by itself is not unique across Chronicle as it is a vendor specific id. This field is not populated when the SecurityResult appears in a detection.
.google.backstory.Id.Namespace threat_id_namespace = 24;
| Returns | |
|---|---|
| Type | Description |
int |
The enum numeric value on the wire for threatIdNamespace. |
getThreatName()
public String getThreatName()A vendor-assigned classification common across multiple customers (for example, "W32/File-A", "Slammer"). This field is not populated when the SecurityResult appears in a detection.
string threat_name = 4;
| Returns | |
|---|---|
| Type | Description |
String |
The threatName. |
getThreatNameBytes()
public ByteString getThreatNameBytes()A vendor-assigned classification common across multiple customers (for example, "W32/File-A", "Slammer"). This field is not populated when the SecurityResult appears in a detection.
string threat_name = 4;
| Returns | |
|---|---|
| Type | Description |
ByteString |
The bytes for threatName. |
getThreatStatus()
public SecurityResult.ThreatStatus getThreatStatus()Current status of the threat This field is not populated when the SecurityResult appears in a detection.
.google.backstory.SecurityResult.ThreatStatus threat_status = 18;
| Returns | |
|---|---|
| Type | Description |
SecurityResult.ThreatStatus |
The threatStatus. |
getThreatStatusValue()
public int getThreatStatusValue()Current status of the threat This field is not populated when the SecurityResult appears in a detection.
.google.backstory.SecurityResult.ThreatStatus threat_status = 18;
| Returns | |
|---|---|
| Type | Description |
int |
The enum numeric value on the wire for threatStatus. |
getThreatVerdict()
public ThreatVerdict getThreatVerdict()GCTI threat verdict on the security result entity. This field is not populated when the SecurityResult appears in a detection.
.google.backstory.ThreatVerdict threat_verdict = 39;
| Returns | |
|---|---|
| Type | Description |
ThreatVerdict |
The threatVerdict. |
getThreatVerdictValue()
public int getThreatVerdictValue()GCTI threat verdict on the security result entity. This field is not populated when the SecurityResult appears in a detection.
.google.backstory.ThreatVerdict threat_verdict = 39;
| Returns | |
|---|---|
| Type | Description |
int |
The enum numeric value on the wire for threatVerdict. |
getUrlBackToProduct()
public String getUrlBackToProduct()URL that takes the user to the source product console for this event. This field is not populated when the SecurityResult appears in a detection.
string url_back_to_product = 15;
| Returns | |
|---|---|
| Type | Description |
String |
The urlBackToProduct. |
getUrlBackToProductBytes()
public ByteString getUrlBackToProductBytes()URL that takes the user to the source product console for this event. This field is not populated when the SecurityResult appears in a detection.
string url_back_to_product = 15;
| Returns | |
|---|---|
| Type | Description |
ByteString |
The bytes for urlBackToProduct. |
getVariables() (deprecated)
public Map<String,FindingVariable> getVariables()Use #getVariablesMap() instead.
| Returns | |
|---|---|
| Type | Description |
Map<String,FindingVariable> |
|
getVariablesCount()
public int getVariablesCount()A list of outcomes and match variables that represent the results of this security finding. This list represents a mapping of names of the requested outcomes or match variables, to their values.
This is only populated when the SecurityResult appears in a detection.
map<string, .google.backstory.FindingVariable> variables = 44;
| Returns | |
|---|---|
| Type | Description |
int |
|
getVariablesMap()
public Map<String,FindingVariable> getVariablesMap()A list of outcomes and match variables that represent the results of this security finding. This list represents a mapping of names of the requested outcomes or match variables, to their values.
This is only populated when the SecurityResult appears in a detection.
map<string, .google.backstory.FindingVariable> variables = 44;
| Returns | |
|---|---|
| Type | Description |
Map<String,FindingVariable> |
|
getVariablesOrDefault(String key, FindingVariable defaultValue)
public FindingVariable getVariablesOrDefault(String key, FindingVariable defaultValue)A list of outcomes and match variables that represent the results of this security finding. This list represents a mapping of names of the requested outcomes or match variables, to their values.
This is only populated when the SecurityResult appears in a detection.
map<string, .google.backstory.FindingVariable> variables = 44;
| Parameters | |
|---|---|
| Name | Description |
key |
String |
defaultValue |
FindingVariable |
| Returns | |
|---|---|
| Type | Description |
FindingVariable |
|
getVariablesOrThrow(String key)
public FindingVariable getVariablesOrThrow(String key)A list of outcomes and match variables that represent the results of this security finding. This list represents a mapping of names of the requested outcomes or match variables, to their values.
This is only populated when the SecurityResult appears in a detection.
map<string, .google.backstory.FindingVariable> variables = 44;
| Parameter | |
|---|---|
| Name | Description |
key |
String |
| Returns | |
|---|---|
| Type | Description |
FindingVariable |
|
getVerdict() (deprecated)
public SecurityResult.Verdict getVerdict()Deprecated. google.backstory.SecurityResult.verdict is deprecated. See backstory/udm.proto;l=2726
Verdict about the IoC from the provider. This field is now deprecated. Use VerdictInfo instead.
.google.backstory.SecurityResult.Verdict verdict = 36 [deprecated = true];
| Returns | |
|---|---|
| Type | Description |
SecurityResult.Verdict |
The verdict. |
getVerdictInfo(int index)
public SecurityResult.VerdictInfo getVerdictInfo(int index)Verdict information about the IoC from the provider. This field is not populated when the SecurityResult appears in a detection.
repeated .google.backstory.SecurityResult.VerdictInfo verdict_info = 38;
| Parameter | |
|---|---|
| Name | Description |
index |
int |
| Returns | |
|---|---|
| Type | Description |
SecurityResult.VerdictInfo |
|
getVerdictInfoCount()
public int getVerdictInfoCount()Verdict information about the IoC from the provider. This field is not populated when the SecurityResult appears in a detection.
repeated .google.backstory.SecurityResult.VerdictInfo verdict_info = 38;
| Returns | |
|---|---|
| Type | Description |
int |
|
getVerdictInfoList()
public List<SecurityResult.VerdictInfo> getVerdictInfoList()Verdict information about the IoC from the provider. This field is not populated when the SecurityResult appears in a detection.
repeated .google.backstory.SecurityResult.VerdictInfo verdict_info = 38;
| Returns | |
|---|---|
| Type | Description |
List<VerdictInfo> |
|
getVerdictInfoOrBuilder(int index)
public SecurityResult.VerdictInfoOrBuilder getVerdictInfoOrBuilder(int index)Verdict information about the IoC from the provider. This field is not populated when the SecurityResult appears in a detection.
repeated .google.backstory.SecurityResult.VerdictInfo verdict_info = 38;
| Parameter | |
|---|---|
| Name | Description |
index |
int |
| Returns | |
|---|---|
| Type | Description |
SecurityResult.VerdictInfoOrBuilder |
|
getVerdictInfoOrBuilderList()
public List<? extends SecurityResult.VerdictInfoOrBuilder> getVerdictInfoOrBuilderList()Verdict information about the IoC from the provider. This field is not populated when the SecurityResult appears in a detection.
repeated .google.backstory.SecurityResult.VerdictInfo verdict_info = 38;
| Returns | |
|---|---|
| Type | Description |
List<? extends com.google.backstory.SecurityResult.VerdictInfoOrBuilder> |
|
getVerdictOrBuilder() (deprecated)
public SecurityResult.VerdictOrBuilder getVerdictOrBuilder()Verdict about the IoC from the provider. This field is now deprecated. Use VerdictInfo instead.
.google.backstory.SecurityResult.Verdict verdict = 36 [deprecated = true];
| Returns | |
|---|---|
| Type | Description |
SecurityResult.VerdictOrBuilder |
|
hasAbout()
public boolean hasAbout()If the security result is about a specific entity (Noun), add it here. This field is not populated when the SecurityResult appears in a detection.
.google.backstory.Noun about = 1;
| Returns | |
|---|---|
| Type | Description |
boolean |
Whether the about field is set. |
hasAttackDetails()
public boolean hasAttackDetails()MITRE ATT&CK details. This field is not populated when the SecurityResult appears in a detection.
.google.backstory.AttackDetails attack_details = 32;
| Returns | |
|---|---|
| Type | Description |
boolean |
Whether the attackDetails field is set. |
hasFirstDiscoveredTime()
public boolean hasFirstDiscoveredTime()First time the IoC threat was discovered in the provider. This field is not populated when the SecurityResult appears in a detection.
.google.protobuf.Timestamp first_discovered_time = 33;
| Returns | |
|---|---|
| Type | Description |
boolean |
Whether the firstDiscoveredTime field is set. |
hasLastDiscoveredTime()
public boolean hasLastDiscoveredTime()Last time the IoC was seen in the provider data. This field is not populated when the SecurityResult appears in a detection.
.google.protobuf.Timestamp last_discovered_time = 40;
| Returns | |
|---|---|
| Type | Description |
boolean |
Whether the lastDiscoveredTime field is set. |
hasLastUpdatedTime()
public boolean hasLastUpdatedTime()Last time the IoC threat was updated in the provider. This field is not populated when the SecurityResult appears in a detection.
.google.protobuf.Timestamp last_updated_time = 37;
| Returns | |
|---|---|
| Type | Description |
boolean |
Whether the lastUpdatedTime field is set. |
hasVerdict() (deprecated)
public boolean hasVerdict()Deprecated. google.backstory.SecurityResult.verdict is deprecated. See backstory/udm.proto;l=2726
Verdict about the IoC from the provider. This field is now deprecated. Use VerdictInfo instead.
.google.backstory.SecurityResult.Verdict verdict = 36 [deprecated = true];
| Returns | |
|---|---|
| Type | Description |
boolean |
Whether the verdict field is set. |
hashCode()
public int hashCode()| Returns | |
|---|---|
| Type | Description |
int |
|
internalGetFieldAccessorTable()
protected GeneratedMessage.FieldAccessorTable internalGetFieldAccessorTable()| Returns | |
|---|---|
| Type | Description |
FieldAccessorTable |
|
internalGetMapFieldReflection(int number)
protected MapFieldReflectionAccessor internalGetMapFieldReflection(int number)| Parameter | |
|---|---|
| Name | Description |
number |
int |
| Returns | |
|---|---|
| Type | Description |
com.google.protobuf.MapFieldReflectionAccessor |
|
isInitialized()
public final boolean isInitialized()| Returns | |
|---|---|
| Type | Description |
boolean |
|
newBuilderForType()
public SecurityResult.Builder newBuilderForType()| Returns | |
|---|---|
| Type | Description |
SecurityResult.Builder |
|
newBuilderForType(AbstractMessage.BuilderParent parent)
protected SecurityResult.Builder newBuilderForType(AbstractMessage.BuilderParent parent)| Parameter | |
|---|---|
| Name | Description |
parent |
BuilderParent |
| Returns | |
|---|---|
| Type | Description |
SecurityResult.Builder |
|
toBuilder()
public SecurityResult.Builder toBuilder()| Returns | |
|---|---|
| Type | Description |
SecurityResult.Builder |
|
writeTo(CodedOutputStream output)
public void writeTo(CodedOutputStream output)| Parameter | |
|---|---|
| Name | Description |
output |
CodedOutputStream |
| Exceptions | |
|---|---|
| Type | Description |
IOException |
|