Interface SecurityResultOrBuilder (0.3.0)

public interface SecurityResultOrBuilder extends MessageOrBuilder

Implements

MessageOrBuilder

Methods

containsVariables(String key)

public abstract boolean containsVariables(String key)

A list of outcomes and match variables that represent the results of this security finding. This list represents a mapping of names of the requested outcomes or match variables, to their values.

This is only populated when the SecurityResult appears in a detection.

map<string, .google.backstory.FindingVariable> variables = 44;

Parameter
Name	Description
`key`	`String`

Returns
Type	Description
`boolean`

getAbout()

public abstract Noun getAbout()

If the security result is about a specific entity (Noun), add it here. This field is not populated when the SecurityResult appears in a detection.

.google.backstory.Noun about = 1;

Returns
Type	Description
`Noun`	The about.

getAboutOrBuilder()

public abstract NounOrBuilder getAboutOrBuilder()

If the security result is about a specific entity (Noun), add it here. This field is not populated when the SecurityResult appears in a detection.

.google.backstory.Noun about = 1;

Returns
Type	Description
`NounOrBuilder`

getAction(int index)

public abstract SecurityResult.Action getAction(int index)

Actions taken for this event. This field is not populated when the SecurityResult appears in a detection.

repeated .google.backstory.SecurityResult.Action action = 8;

Parameter
Name	Description
`index`	`int` The index of the element to return.

Returns
Type	Description
`SecurityResult.Action`	The action at the given index.

getActionCount()

public abstract int getActionCount()

Actions taken for this event. This field is not populated when the SecurityResult appears in a detection.

repeated .google.backstory.SecurityResult.Action action = 8;

Returns
Type	Description
`int`	The count of action.

getActionDetails()

public abstract String getActionDetails()

The detail of the action taken as provided by the vendor. This field is not populated when the SecurityResult appears in a detection.

string action_details = 19;

Returns
Type	Description
`String`	The actionDetails.

getActionDetailsBytes()

public abstract ByteString getActionDetailsBytes()

The detail of the action taken as provided by the vendor. This field is not populated when the SecurityResult appears in a detection.

string action_details = 19;

Returns
Type	Description
`ByteString`	The bytes for actionDetails.

getActionList()

public abstract List<SecurityResult.Action> getActionList()

Actions taken for this event. This field is not populated when the SecurityResult appears in a detection.

repeated .google.backstory.SecurityResult.Action action = 8;

Returns
Type	Description
`List<Action>`	A list containing the action.

getActionValue(int index)

public abstract int getActionValue(int index)

Actions taken for this event. This field is not populated when the SecurityResult appears in a detection.

repeated .google.backstory.SecurityResult.Action action = 8;

Parameter
Name	Description
`index`	`int` The index of the value to return.

Returns
Type	Description
`int`	The enum numeric value on the wire of action at the given index.

getActionValueList()

public abstract List<Integer> getActionValueList()

Actions taken for this event. This field is not populated when the SecurityResult appears in a detection.

repeated .google.backstory.SecurityResult.Action action = 8;

Returns
Type	Description
`List<Integer>`	A list containing the enum numeric values on the wire for action.

getAlertState()

public abstract SecurityResult.AlertState getAlertState()

The alerting types of this security result. This is primarily set for rule-generated detections and alerts.

.google.backstory.SecurityResult.AlertState alert_state = 21;

Returns
Type	Description
`SecurityResult.AlertState`	The alertState.

getAlertStateValue()

public abstract int getAlertStateValue()

The alerting types of this security result. This is primarily set for rule-generated detections and alerts.

.google.backstory.SecurityResult.AlertState alert_state = 21;

Returns
Type	Description
`int`	The enum numeric value on the wire for alertState.

getAnalyticsMetadata(int index)

public abstract AnalyticsMetadata getAnalyticsMetadata(int index)

Stores metadata about each risk analytic metric the rule uses. This field is not populated when the SecurityResult appears in a detection.

repeated .google.backstory.AnalyticsMetadata analytics_metadata = 43;

Parameter
Name	Description
`index`	`int`

Returns
Type	Description
`AnalyticsMetadata`

getAnalyticsMetadataCount()

public abstract int getAnalyticsMetadataCount()

Stores metadata about each risk analytic metric the rule uses. This field is not populated when the SecurityResult appears in a detection.

repeated .google.backstory.AnalyticsMetadata analytics_metadata = 43;

Returns
Type	Description
`int`

getAnalyticsMetadataList()

public abstract List<AnalyticsMetadata> getAnalyticsMetadataList()

Stores metadata about each risk analytic metric the rule uses. This field is not populated when the SecurityResult appears in a detection.

repeated .google.backstory.AnalyticsMetadata analytics_metadata = 43;

Returns
Type	Description
`List<AnalyticsMetadata>`

getAnalyticsMetadataOrBuilder(int index)

public abstract AnalyticsMetadataOrBuilder getAnalyticsMetadataOrBuilder(int index)

Stores metadata about each risk analytic metric the rule uses. This field is not populated when the SecurityResult appears in a detection.

repeated .google.backstory.AnalyticsMetadata analytics_metadata = 43;

Parameter
Name	Description
`index`	`int`

Returns
Type	Description
`AnalyticsMetadataOrBuilder`

getAnalyticsMetadataOrBuilderList()

public abstract List<? extends AnalyticsMetadataOrBuilder> getAnalyticsMetadataOrBuilderList()

Stores metadata about each risk analytic metric the rule uses. This field is not populated when the SecurityResult appears in a detection.

repeated .google.backstory.AnalyticsMetadata analytics_metadata = 43;

Returns
Type	Description
`List<? extends com.google.backstory.AnalyticsMetadataOrBuilder>`

getAssociations(int index)

public abstract SecurityResult.Association getAssociations(int index)

Associations related to the threat.

repeated .google.backstory.SecurityResult.Association associations = 34;

Parameter
Name	Description
`index`	`int`

Returns
Type	Description
`SecurityResult.Association`

getAssociationsCount()

public abstract int getAssociationsCount()

Associations related to the threat.

repeated .google.backstory.SecurityResult.Association associations = 34;

Returns
Type	Description
`int`

getAssociationsList()

public abstract List<SecurityResult.Association> getAssociationsList()

Associations related to the threat.

repeated .google.backstory.SecurityResult.Association associations = 34;

Returns
Type	Description
`List<Association>`

getAssociationsOrBuilder(int index)

public abstract SecurityResult.AssociationOrBuilder getAssociationsOrBuilder(int index)

Associations related to the threat.

repeated .google.backstory.SecurityResult.Association associations = 34;

Parameter
Name	Description
`index`	`int`

Returns
Type	Description
`SecurityResult.AssociationOrBuilder`

getAssociationsOrBuilderList()

public abstract List<? extends SecurityResult.AssociationOrBuilder> getAssociationsOrBuilderList()

Associations related to the threat.

repeated .google.backstory.SecurityResult.Association associations = 34;

Returns
Type	Description
`List<? extends com.google.backstory.SecurityResult.AssociationOrBuilder>`

getAttackDetails()

public abstract AttackDetails getAttackDetails()

MITRE ATT&CK details. This field is not populated when the SecurityResult appears in a detection.

.google.backstory.AttackDetails attack_details = 32;

Returns
Type	Description
`AttackDetails`	The attackDetails.

getAttackDetailsOrBuilder()

public abstract AttackDetailsOrBuilder getAttackDetailsOrBuilder()

MITRE ATT&CK details. This field is not populated when the SecurityResult appears in a detection.

.google.backstory.AttackDetails attack_details = 32;

Returns
Type	Description
`AttackDetailsOrBuilder`

getCampaigns(int index) (deprecated)

public abstract String getCampaigns(int index)

Deprecated. google.backstory.SecurityResult.campaigns is deprecated. See backstory/udm.proto;l=2718

Campaigns using this IOC threat. This is deprecated. Use threat_collections instead.

repeated string campaigns = 35 [deprecated = true];

Parameter
Name	Description
`index`	`int` The index of the element to return.

Returns
Type	Description
`String`	The campaigns at the given index.

getCampaignsBytes(int index) (deprecated)

public abstract ByteString getCampaignsBytes(int index)

Deprecated. google.backstory.SecurityResult.campaigns is deprecated. See backstory/udm.proto;l=2718

Campaigns using this IOC threat. This is deprecated. Use threat_collections instead.

repeated string campaigns = 35 [deprecated = true];

Parameter
Name	Description
`index`	`int` The index of the value to return.

Returns
Type	Description
`ByteString`	The bytes of the campaigns at the given index.

getCampaignsCount() (deprecated)

public abstract int getCampaignsCount()

Deprecated. google.backstory.SecurityResult.campaigns is deprecated. See backstory/udm.proto;l=2718

Campaigns using this IOC threat. This is deprecated. Use threat_collections instead.

repeated string campaigns = 35 [deprecated = true];

Returns
Type	Description
`int`	The count of campaigns.

getCampaignsList() (deprecated)

public abstract List<String> getCampaignsList()

Deprecated. google.backstory.SecurityResult.campaigns is deprecated. See backstory/udm.proto;l=2718

Campaigns using this IOC threat. This is deprecated. Use threat_collections instead.

repeated string campaigns = 35 [deprecated = true];

Returns
Type	Description
`List<String>`	A list containing the campaigns.

getCategory(int index)

public abstract SecurityResult.SecurityCategory getCategory(int index)

The security category. This field is not populated when the SecurityResult appears in a detection.

repeated .google.backstory.SecurityResult.SecurityCategory category = 2;

Parameter
Name	Description
`index`	`int` The index of the element to return.

Returns
Type	Description
`SecurityResult.SecurityCategory`	The category at the given index.

getCategoryCount()

public abstract int getCategoryCount()

The security category. This field is not populated when the SecurityResult appears in a detection.

repeated .google.backstory.SecurityResult.SecurityCategory category = 2;

Returns
Type	Description
`int`	The count of category.

getCategoryDetails(int index)

public abstract String getCategoryDetails(int index)

For vendor-specific categories. For web categorization, put type in here such as "gambling" or "porn". This field is not populated when the SecurityResult appears in a detection.

repeated string category_details = 3;

Parameter
Name	Description
`index`	`int` The index of the element to return.

Returns
Type	Description
`String`	The categoryDetails at the given index.

getCategoryDetailsBytes(int index)

public abstract ByteString getCategoryDetailsBytes(int index)

For vendor-specific categories. For web categorization, put type in here such as "gambling" or "porn". This field is not populated when the SecurityResult appears in a detection.

repeated string category_details = 3;

Parameter
Name	Description
`index`	`int` The index of the value to return.

Returns
Type	Description
`ByteString`	The bytes of the categoryDetails at the given index.

getCategoryDetailsCount()

public abstract int getCategoryDetailsCount()

For vendor-specific categories. For web categorization, put type in here such as "gambling" or "porn". This field is not populated when the SecurityResult appears in a detection.

repeated string category_details = 3;

Returns
Type	Description
`int`	The count of categoryDetails.

getCategoryDetailsList()

public abstract List<String> getCategoryDetailsList()

For vendor-specific categories. For web categorization, put type in here such as "gambling" or "porn". This field is not populated when the SecurityResult appears in a detection.

repeated string category_details = 3;

Returns
Type	Description
`List<String>`	A list containing the categoryDetails.

getCategoryList()

public abstract List<SecurityResult.SecurityCategory> getCategoryList()

The security category. This field is not populated when the SecurityResult appears in a detection.

repeated .google.backstory.SecurityResult.SecurityCategory category = 2;

Returns
Type	Description
`List<SecurityCategory>`	A list containing the category.

getCategoryValue(int index)

public abstract int getCategoryValue(int index)

The security category. This field is not populated when the SecurityResult appears in a detection.

repeated .google.backstory.SecurityResult.SecurityCategory category = 2;

Parameter
Name	Description
`index`	`int` The index of the value to return.

Returns
Type	Description
`int`	The enum numeric value on the wire of category at the given index.

getCategoryValueList()

public abstract List<Integer> getCategoryValueList()

The security category. This field is not populated when the SecurityResult appears in a detection.

repeated .google.backstory.SecurityResult.SecurityCategory category = 2;

Returns
Type	Description
`List<Integer>`	A list containing the enum numeric values on the wire for category.

getConfidence()

public abstract SecurityResult.ProductConfidence getConfidence()

The confidence level of the result as estimated by the product. This field is not populated when the SecurityResult appears in a detection.

.google.backstory.SecurityResult.ProductConfidence confidence = 10;

Returns
Type	Description
`SecurityResult.ProductConfidence`	The confidence.

getConfidenceDetails()

public abstract String getConfidenceDetails()

Additional detail with regards to the confidence of a security event as estimated by the product vendor. This field is not populated when the SecurityResult appears in a detection.

string confidence_details = 13;

Returns
Type	Description
`String`	The confidenceDetails.

getConfidenceDetailsBytes()

public abstract ByteString getConfidenceDetailsBytes()

Additional detail with regards to the confidence of a security event as estimated by the product vendor. This field is not populated when the SecurityResult appears in a detection.

string confidence_details = 13;

Returns
Type	Description
`ByteString`	The bytes for confidenceDetails.

getConfidenceScore()

public abstract float getConfidenceScore()

The confidence score of the security result. This field is not populated when the SecurityResult appears in a detection.

float confidence_score = 42;

Returns
Type	Description
`float`	The confidenceScore.

getConfidenceValue()

public abstract int getConfidenceValue()

The confidence level of the result as estimated by the product. This field is not populated when the SecurityResult appears in a detection.

.google.backstory.SecurityResult.ProductConfidence confidence = 10;

Returns
Type	Description
`int`	The enum numeric value on the wire for confidence.

getDescription()

public abstract String getDescription()

A human-readable description (e.g. "user password was wrong"). This can be more detailed than the summary.

string description = 7;

Returns
Type	Description
`String`	The description.

getDescriptionBytes()

public abstract ByteString getDescriptionBytes()

A human-readable description (e.g. "user password was wrong"). This can be more detailed than the summary.

string description = 7;

Returns
Type	Description
`ByteString`	The bytes for description.

getDetectionDepth()

public abstract long getDetectionDepth()

The depth of the detection chain. Applies only to composite detections.

int64 detection_depth = 47;

Returns
Type	Description
`long`	The detectionDepth.

getDetectionFields(int index)

public abstract Label getDetectionFields(int index)

An ordered list of values, that represent fields in detections for a security finding. This list represents mapping of names of requested entities to their values (the security result matched variables).

For Collection SecurityResults, prefer variables instead.

repeated .google.backstory.Label detection_fields = 23;

Parameter
Name	Description
`index`	`int`

Returns
Type	Description
`Label`

getDetectionFieldsCount()

public abstract int getDetectionFieldsCount()

For Collection SecurityResults, prefer variables instead.

repeated .google.backstory.Label detection_fields = 23;

Returns
Type	Description
`int`

getDetectionFieldsList()

public abstract List<Label> getDetectionFieldsList()

For Collection SecurityResults, prefer variables instead.

repeated .google.backstory.Label detection_fields = 23;

Returns
Type	Description
`List<Label>`

getDetectionFieldsOrBuilder(int index)

public abstract LabelOrBuilder getDetectionFieldsOrBuilder(int index)

For Collection SecurityResults, prefer variables instead.

repeated .google.backstory.Label detection_fields = 23;

Parameter
Name	Description
`index`	`int`

Returns
Type	Description
`LabelOrBuilder`

getDetectionFieldsOrBuilderList()

public abstract List<? extends LabelOrBuilder> getDetectionFieldsOrBuilderList()

For Collection SecurityResults, prefer variables instead.

repeated .google.backstory.Label detection_fields = 23;

Returns
Type	Description
`List<? extends com.google.backstory.LabelOrBuilder>`

getDisplayName()

public abstract String getDisplayName()

The display name of the security result. This is populated from 'name_override' Outcome Variable, if present. Otherwise, this field is not set.

string display_name = 49;

Returns
Type	Description
`String`	The displayName.

getDisplayNameBytes()

public abstract ByteString getDisplayNameBytes()

The display name of the security result. This is populated from 'name_override' Outcome Variable, if present. Otherwise, this field is not set.

string display_name = 49;

Returns
Type	Description
`ByteString`	The bytes for displayName.

getFirstDiscoveredTime()

public abstract Timestamp getFirstDiscoveredTime()

First time the IoC threat was discovered in the provider. This field is not populated when the SecurityResult appears in a detection.

.google.protobuf.Timestamp first_discovered_time = 33;

Returns
Type	Description
`Timestamp`	The firstDiscoveredTime.

getFirstDiscoveredTimeOrBuilder()

public abstract TimestampOrBuilder getFirstDiscoveredTimeOrBuilder()

First time the IoC threat was discovered in the provider. This field is not populated when the SecurityResult appears in a detection.

.google.protobuf.Timestamp first_discovered_time = 33;

Returns
Type	Description
`TimestampOrBuilder`

getLastDiscoveredTime()

public abstract Timestamp getLastDiscoveredTime()

Last time the IoC was seen in the provider data. This field is not populated when the SecurityResult appears in a detection.

.google.protobuf.Timestamp last_discovered_time = 40;

Returns
Type	Description
`Timestamp`	The lastDiscoveredTime.

getLastDiscoveredTimeOrBuilder()

public abstract TimestampOrBuilder getLastDiscoveredTimeOrBuilder()

Last time the IoC was seen in the provider data. This field is not populated when the SecurityResult appears in a detection.

.google.protobuf.Timestamp last_discovered_time = 40;

Returns
Type	Description
`TimestampOrBuilder`

getLastUpdatedTime()

public abstract Timestamp getLastUpdatedTime()

Last time the IoC threat was updated in the provider. This field is not populated when the SecurityResult appears in a detection.

.google.protobuf.Timestamp last_updated_time = 37;

Returns
Type	Description
`Timestamp`	The lastUpdatedTime.

getLastUpdatedTimeOrBuilder()

public abstract TimestampOrBuilder getLastUpdatedTimeOrBuilder()

Last time the IoC threat was updated in the provider. This field is not populated when the SecurityResult appears in a detection.

.google.protobuf.Timestamp last_updated_time = 37;

Returns
Type	Description
`TimestampOrBuilder`

getOutcomes(int index) (deprecated)

public abstract Label getOutcomes(int index)

A list of outcomes that represent the results of this security finding. This list represents a mapping of names of the requested outcomes, to a stringified version of their values.

This is only populated when the SecurityResult appears in a detection. This is deprecated. Use variables instead.

repeated .google.backstory.Label outcomes = 28 [deprecated = true];

Parameter
Name	Description
`index`	`int`

Returns
Type	Description
`Label`

getOutcomesCount() (deprecated)

public abstract int getOutcomesCount()

A list of outcomes that represent the results of this security finding. This list represents a mapping of names of the requested outcomes, to a stringified version of their values.

This is only populated when the SecurityResult appears in a detection. This is deprecated. Use variables instead.

repeated .google.backstory.Label outcomes = 28 [deprecated = true];

Returns
Type	Description
`int`

getOutcomesList() (deprecated)

public abstract List<Label> getOutcomesList()

A list of outcomes that represent the results of this security finding. This list represents a mapping of names of the requested outcomes, to a stringified version of their values.

This is only populated when the SecurityResult appears in a detection. This is deprecated. Use variables instead.

repeated .google.backstory.Label outcomes = 28 [deprecated = true];

Returns
Type	Description
`List<Label>`

getOutcomesOrBuilder(int index) (deprecated)

public abstract LabelOrBuilder getOutcomesOrBuilder(int index)

A list of outcomes that represent the results of this security finding. This list represents a mapping of names of the requested outcomes, to a stringified version of their values.

This is only populated when the SecurityResult appears in a detection. This is deprecated. Use variables instead.

repeated .google.backstory.Label outcomes = 28 [deprecated = true];

Parameter
Name	Description
`index`	`int`

Returns
Type	Description
`LabelOrBuilder`

getOutcomesOrBuilderList() (deprecated)

public abstract List<? extends LabelOrBuilder> getOutcomesOrBuilderList()

A list of outcomes that represent the results of this security finding. This list represents a mapping of names of the requested outcomes, to a stringified version of their values.

This is only populated when the SecurityResult appears in a detection. This is deprecated. Use variables instead.

repeated .google.backstory.Label outcomes = 28 [deprecated = true];

Returns
Type	Description
`List<? extends com.google.backstory.LabelOrBuilder>`

getPriority()

public abstract SecurityResult.ProductPriority getPriority()

The priority of the result. This field is not populated when the SecurityResult appears in a detection.

.google.backstory.SecurityResult.ProductPriority priority = 11;

Returns
Type	Description
`SecurityResult.ProductPriority`	The priority.

getPriorityDetails()

public abstract String getPriorityDetails()

Vendor-specific information about the security result priority. This field is not populated when the SecurityResult appears in a detection.

string priority_details = 14;

Returns
Type	Description
`String`	The priorityDetails.

getPriorityDetailsBytes()

public abstract ByteString getPriorityDetailsBytes()

Vendor-specific information about the security result priority. This field is not populated when the SecurityResult appears in a detection.

string priority_details = 14;

Returns
Type	Description
`ByteString`	The bytes for priorityDetails.

getPriorityValue()

public abstract int getPriorityValue()

The priority of the result. This field is not populated when the SecurityResult appears in a detection.

.google.backstory.SecurityResult.ProductPriority priority = 11;

Returns
Type	Description
`int`	The enum numeric value on the wire for priority.

getReports(int index) (deprecated)

public abstract String getReports(int index)

Deprecated. google.backstory.SecurityResult.reports is deprecated. See backstory/udm.proto;l=2722

Reports that reference this IOC threat. These are the report IDs. This is deprecated. Use threat_collections instead.

repeated string reports = 46 [deprecated = true];

Parameter
Name	Description
`index`	`int` The index of the element to return.

Returns
Type	Description
`String`	The reports at the given index.

getReportsBytes(int index) (deprecated)

public abstract ByteString getReportsBytes(int index)

Deprecated. google.backstory.SecurityResult.reports is deprecated. See backstory/udm.proto;l=2722

Reports that reference this IOC threat. These are the report IDs. This is deprecated. Use threat_collections instead.

repeated string reports = 46 [deprecated = true];

Parameter
Name	Description
`index`	`int` The index of the value to return.

Returns
Type	Description
`ByteString`	The bytes of the reports at the given index.

getReportsCount() (deprecated)

public abstract int getReportsCount()

Deprecated. google.backstory.SecurityResult.reports is deprecated. See backstory/udm.proto;l=2722

Reports that reference this IOC threat. These are the report IDs. This is deprecated. Use threat_collections instead.

repeated string reports = 46 [deprecated = true];

Returns
Type	Description
`int`	The count of reports.

getReportsList() (deprecated)

public abstract List<String> getReportsList()

Deprecated. google.backstory.SecurityResult.reports is deprecated. See backstory/udm.proto;l=2722

Reports that reference this IOC threat. These are the report IDs. This is deprecated. Use threat_collections instead.

repeated string reports = 46 [deprecated = true];

Returns
Type	Description
`List<String>`	A list containing the reports.

getRiskScore()

public abstract float getRiskScore()

The risk score of the security result.

float risk_score = 31;

Returns
Type	Description
`float`	The riskScore.

getRuleAuthor()

public abstract String getRuleAuthor()

Author of the security rule. This field is not populated when the SecurityResult appears in a detection.

string rule_author = 25;

Returns
Type	Description
`String`	The ruleAuthor.

getRuleAuthorBytes()

public abstract ByteString getRuleAuthorBytes()

Author of the security rule. This field is not populated when the SecurityResult appears in a detection.

string rule_author = 25;

Returns
Type	Description
`ByteString`	The bytes for ruleAuthor.

getRuleId()

public abstract String getRuleId()

A vendor-specific ID for a rule, varying by observer type (e.g. "08123", "5d2b44d0-5ef6-40f5-a704-47d61d3babbe").

string rule_id = 16;

Returns
Type	Description
`String`	The ruleId.

getRuleIdBytes()

public abstract ByteString getRuleIdBytes()

A vendor-specific ID for a rule, varying by observer type (e.g. "08123", "5d2b44d0-5ef6-40f5-a704-47d61d3babbe").

string rule_id = 16;

Returns
Type	Description
`ByteString`	The bytes for ruleId.

getRuleLabels(int index)

public abstract Label getRuleLabels(int index)

A list of rule labels that can't be captured by the other fields in security result (e.g. "reference : AnotherRule", "contributor : John"). This is primarily set in rule-generated detections and alerts.

repeated .google.backstory.Label rule_labels = 26;

Parameter
Name	Description
`index`	`int`

Returns
Type	Description
`Label`

getRuleLabelsCount()

public abstract int getRuleLabelsCount()

repeated .google.backstory.Label rule_labels = 26;

Returns
Type	Description
`int`

getRuleLabelsList()

public abstract List<Label> getRuleLabelsList()

repeated .google.backstory.Label rule_labels = 26;

Returns
Type	Description
`List<Label>`

getRuleLabelsOrBuilder(int index)

public abstract LabelOrBuilder getRuleLabelsOrBuilder(int index)

repeated .google.backstory.Label rule_labels = 26;

Parameter
Name	Description
`index`	`int`

Returns
Type	Description
`LabelOrBuilder`

getRuleLabelsOrBuilderList()

public abstract List<? extends LabelOrBuilder> getRuleLabelsOrBuilderList()

repeated .google.backstory.Label rule_labels = 26;

Returns
Type	Description
`List<? extends com.google.backstory.LabelOrBuilder>`

getRuleName()

public abstract String getRuleName()

Name of the security rule (e.g. "BlockInboundToOracle").

string rule_name = 5;

Returns
Type	Description
`String`	The ruleName.

getRuleNameBytes()

public abstract ByteString getRuleNameBytes()

Name of the security rule (e.g. "BlockInboundToOracle").

string rule_name = 5;

Returns
Type	Description
`ByteString`	The bytes for ruleName.

getRuleSet()

public abstract String getRuleSet()

The curated detection's rule set identifier. (for example, "windows-threats") This is primarily set in rule-generated detections and alerts.

string rule_set = 29;

Returns
Type	Description
`String`	The ruleSet.

getRuleSetBytes()

public abstract ByteString getRuleSetBytes()

The curated detection's rule set identifier. (for example, "windows-threats") This is primarily set in rule-generated detections and alerts.

string rule_set = 29;

Returns
Type	Description
`ByteString`	The bytes for ruleSet.

getRuleSetDisplayName()

public abstract String getRuleSetDisplayName()

The curated detections rule set display name. This is primarily set in rule-generated detections and alerts.

string rule_set_display_name = 30;

Returns
Type	Description
`String`	The ruleSetDisplayName.

getRuleSetDisplayNameBytes()

public abstract ByteString getRuleSetDisplayNameBytes()

The curated detections rule set display name. This is primarily set in rule-generated detections and alerts.

string rule_set_display_name = 30;

Returns
Type	Description
`ByteString`	The bytes for ruleSetDisplayName.

getRuleType()

public abstract String getRuleType()

The type of security rule.

string rule_type = 22;

Returns
Type	Description
`String`	The ruleType.

getRuleTypeBytes()

public abstract ByteString getRuleTypeBytes()

The type of security rule.

string rule_type = 22;

Returns
Type	Description
`ByteString`	The bytes for ruleType.

getRuleVersion()

public abstract String getRuleVersion()

Version of the security rule. (e.g. "v1.1", "00001", "1604709794", "2020-11-16T23:04:19+00:00"). Note that rule versions are source-dependant and lexical ordering should not be assumed.

string rule_version = 20;

Returns
Type	Description
`String`	The ruleVersion.

getRuleVersionBytes()

public abstract ByteString getRuleVersionBytes()

Version of the security rule. (e.g. "v1.1", "00001", "1604709794", "2020-11-16T23:04:19+00:00"). Note that rule versions are source-dependant and lexical ordering should not be assumed.

string rule_version = 20;

Returns
Type	Description
`ByteString`	The bytes for ruleVersion.

getRulesetCategoryDisplayName()

public abstract String getRulesetCategoryDisplayName()

The curated detection rule set category display name. (for example, if rule_set_display_name is "CDIR SCC Enhanced Exfiltration", the rule_set_category is "Cloud Threats"). This is primarily set in rule-generated detections and alerts.

string ruleset_category_display_name = 41;

Returns
Type	Description
`String`	The rulesetCategoryDisplayName.

getRulesetCategoryDisplayNameBytes()

public abstract ByteString getRulesetCategoryDisplayNameBytes()

string ruleset_category_display_name = 41;

Returns
Type	Description
`ByteString`	The bytes for rulesetCategoryDisplayName.

getSeverity()

public abstract SecurityResult.ProductSeverity getSeverity()

The severity of the result.

.google.backstory.SecurityResult.ProductSeverity severity = 9;

Returns
Type	Description
`SecurityResult.ProductSeverity`	The severity.

getSeverityDetails()

public abstract String getSeverityDetails()

Vendor-specific severity. This field is not populated when the SecurityResult appears in a detection.

string severity_details = 12;

Returns
Type	Description
`String`	The severityDetails.

getSeverityDetailsBytes()

public abstract ByteString getSeverityDetailsBytes()

Vendor-specific severity. This field is not populated when the SecurityResult appears in a detection.

string severity_details = 12;

Returns
Type	Description
`ByteString`	The bytes for severityDetails.

getSeverityValue()

public abstract int getSeverityValue()

The severity of the result.

.google.backstory.SecurityResult.ProductSeverity severity = 9;

Returns
Type	Description
`int`	The enum numeric value on the wire for severity.

getSummary()

public abstract String getSummary()

A short human-readable summary (e.g. "failed login occurred")

string summary = 6;

Returns
Type	Description
`String`	The summary.

getSummaryBytes()

public abstract ByteString getSummaryBytes()

A short human-readable summary (e.g. "failed login occurred")

string summary = 6;

Returns
Type	Description
`ByteString`	The bytes for summary.

getThreatCollections(int index)

public abstract SecurityResult.ThreatCollectionItem getThreatCollections(int index)

GTI collections associated with the security result.

repeated .google.backstory.SecurityResult.ThreatCollectionItem threat_collections = 48;

Parameter
Name	Description
`index`	`int`

Returns
Type	Description
`SecurityResult.ThreatCollectionItem`

getThreatCollectionsCount()

public abstract int getThreatCollectionsCount()

GTI collections associated with the security result.

repeated .google.backstory.SecurityResult.ThreatCollectionItem threat_collections = 48;

Returns
Type	Description
`int`

getThreatCollectionsList()

public abstract List<SecurityResult.ThreatCollectionItem> getThreatCollectionsList()

GTI collections associated with the security result.

repeated .google.backstory.SecurityResult.ThreatCollectionItem threat_collections = 48;

Returns
Type	Description
`List<ThreatCollectionItem>`

getThreatCollectionsOrBuilder(int index)

public abstract SecurityResult.ThreatCollectionItemOrBuilder getThreatCollectionsOrBuilder(int index)

GTI collections associated with the security result.

repeated .google.backstory.SecurityResult.ThreatCollectionItem threat_collections = 48;

Parameter
Name	Description
`index`	`int`

Returns
Type	Description
`SecurityResult.ThreatCollectionItemOrBuilder`

getThreatCollectionsOrBuilderList()

public abstract List<? extends SecurityResult.ThreatCollectionItemOrBuilder> getThreatCollectionsOrBuilderList()

GTI collections associated with the security result.

repeated .google.backstory.SecurityResult.ThreatCollectionItem threat_collections = 48;

Returns
Type	Description
`List<? extends com.google.backstory.SecurityResult.ThreatCollectionItemOrBuilder>`

getThreatFeedName()

public abstract String getThreatFeedName()

Vendor feed name for a threat indicator feed. This field is not populated when the SecurityResult appears in a detection.

string threat_feed_name = 27;

Returns
Type	Description
`String`	The threatFeedName.

getThreatFeedNameBytes()

public abstract ByteString getThreatFeedNameBytes()

Vendor feed name for a threat indicator feed. This field is not populated when the SecurityResult appears in a detection.

string threat_feed_name = 27;

Returns
Type	Description
`ByteString`	The bytes for threatFeedName.

getThreatId()

public abstract String getThreatId()

Vendor-specific ID for a threat. This field is not populated when the SecurityResult appears in a detection.

string threat_id = 17;

Returns
Type	Description
`String`	The threatId.

getThreatIdBytes()

public abstract ByteString getThreatIdBytes()

Vendor-specific ID for a threat. This field is not populated when the SecurityResult appears in a detection.

string threat_id = 17;

Returns
Type	Description
`ByteString`	The bytes for threatId.

getThreatIdNamespace()

public abstract Id.Namespace getThreatIdNamespace()

The attribute threat_id_namespace qualifies threat_id with an id namespace to get an unique id. The attribute threat_id by itself is not unique across Chronicle as it is a vendor specific id. This field is not populated when the SecurityResult appears in a detection.

.google.backstory.Id.Namespace threat_id_namespace = 24;

Returns
Type	Description
`Id.Namespace`	The threatIdNamespace.

getThreatIdNamespaceValue()

public abstract int getThreatIdNamespaceValue()

.google.backstory.Id.Namespace threat_id_namespace = 24;

Returns
Type	Description
`int`	The enum numeric value on the wire for threatIdNamespace.

getThreatName()

public abstract String getThreatName()

A vendor-assigned classification common across multiple customers (for example, "W32/File-A", "Slammer"). This field is not populated when the SecurityResult appears in a detection.

string threat_name = 4;

Returns
Type	Description
`String`	The threatName.

getThreatNameBytes()

public abstract ByteString getThreatNameBytes()

A vendor-assigned classification common across multiple customers (for example, "W32/File-A", "Slammer"). This field is not populated when the SecurityResult appears in a detection.

string threat_name = 4;

Returns
Type	Description
`ByteString`	The bytes for threatName.

getThreatStatus()

public abstract SecurityResult.ThreatStatus getThreatStatus()

Current status of the threat This field is not populated when the SecurityResult appears in a detection.

.google.backstory.SecurityResult.ThreatStatus threat_status = 18;

Returns
Type	Description
`SecurityResult.ThreatStatus`	The threatStatus.

getThreatStatusValue()

public abstract int getThreatStatusValue()

Current status of the threat This field is not populated when the SecurityResult appears in a detection.

.google.backstory.SecurityResult.ThreatStatus threat_status = 18;

Returns
Type	Description
`int`	The enum numeric value on the wire for threatStatus.

getThreatVerdict()

public abstract ThreatVerdict getThreatVerdict()

GCTI threat verdict on the security result entity. This field is not populated when the SecurityResult appears in a detection.

.google.backstory.ThreatVerdict threat_verdict = 39;

Returns
Type	Description
`ThreatVerdict`	The threatVerdict.

getThreatVerdictValue()

public abstract int getThreatVerdictValue()

GCTI threat verdict on the security result entity. This field is not populated when the SecurityResult appears in a detection.

.google.backstory.ThreatVerdict threat_verdict = 39;

Returns
Type	Description
`int`	The enum numeric value on the wire for threatVerdict.

getUrlBackToProduct()

public abstract String getUrlBackToProduct()

URL that takes the user to the source product console for this event. This field is not populated when the SecurityResult appears in a detection.

string url_back_to_product = 15;

Returns
Type	Description
`String`	The urlBackToProduct.

getUrlBackToProductBytes()

public abstract ByteString getUrlBackToProductBytes()

URL that takes the user to the source product console for this event. This field is not populated when the SecurityResult appears in a detection.

string url_back_to_product = 15;

Returns
Type	Description
`ByteString`	The bytes for urlBackToProduct.

getVariables() (deprecated)

public abstract Map<String,FindingVariable> getVariables()

Use #getVariablesMap() instead.

Returns
Type	Description
`Map<String,FindingVariable>`

getVariablesCount()

public abstract int getVariablesCount()

A list of outcomes and match variables that represent the results of this security finding. This list represents a mapping of names of the requested outcomes or match variables, to their values.

This is only populated when the SecurityResult appears in a detection.

map<string, .google.backstory.FindingVariable> variables = 44;

Returns
Type	Description
`int`

getVariablesMap()

public abstract Map<String,FindingVariable> getVariablesMap()

A list of outcomes and match variables that represent the results of this security finding. This list represents a mapping of names of the requested outcomes or match variables, to their values.

This is only populated when the SecurityResult appears in a detection.

map<string, .google.backstory.FindingVariable> variables = 44;

Returns
Type	Description
`Map<String,FindingVariable>`

getVariablesOrDefault(String key, FindingVariable defaultValue)

public abstract FindingVariable getVariablesOrDefault(String key, FindingVariable defaultValue)

A list of outcomes and match variables that represent the results of this security finding. This list represents a mapping of names of the requested outcomes or match variables, to their values.

This is only populated when the SecurityResult appears in a detection.

map<string, .google.backstory.FindingVariable> variables = 44;

Parameters
Name	Description
`key`	`String`
`defaultValue`	`FindingVariable`

Returns
Type	Description
`FindingVariable`

getVariablesOrThrow(String key)

public abstract FindingVariable getVariablesOrThrow(String key)

A list of outcomes and match variables that represent the results of this security finding. This list represents a mapping of names of the requested outcomes or match variables, to their values.

This is only populated when the SecurityResult appears in a detection.

map<string, .google.backstory.FindingVariable> variables = 44;

Parameter
Name	Description
`key`	`String`

Returns
Type	Description
`FindingVariable`

getVerdict() (deprecated)

public abstract SecurityResult.Verdict getVerdict()

Deprecated. google.backstory.SecurityResult.verdict is deprecated. See backstory/udm.proto;l=2726

Verdict about the IoC from the provider. This field is now deprecated. Use VerdictInfo instead.

.google.backstory.SecurityResult.Verdict verdict = 36 [deprecated = true];

Returns
Type	Description
`SecurityResult.Verdict`	The verdict.