Class UDM (0.3.0)

0.3.0 (latest) 0.2.0 0.1.0

public final class UDM extends GeneratedMessage implements UDMOrBuilder

A Unified Data Model event.

Protobuf type google.backstory.UDM

Inheritance

Object > AbstractMessageLite<MessageType,BuilderType> > AbstractMessage > GeneratedMessage > UDM

Implements

UDMOrBuilder

Inherited Members

AbstractMessage.equals(Object)

AbstractMessage.findInitializationErrors()

AbstractMessage.getInitializationErrorString()

AbstractMessage.hashCode()

AbstractMessage.hashFields(int,Map<Descriptors.FieldDescriptor,Object>)

AbstractMessage.newBuilderForType(AbstractMessage.BuilderParent)

AbstractMessage.toString()

AbstractMessageLite.<T>addAll(Iterable<T>,List<? super T>)

AbstractMessageLite.checkByteStringIsUtf8(ByteString)

AbstractMessageLite.toByteArray()

AbstractMessageLite.toByteString()

AbstractMessageLite.writeDelimitedTo(OutputStream)

AbstractMessageLite.writeTo(OutputStream)

com.google.protobuf.GeneratedMessage.<ContainingT,T>newFileScopedGeneratedExtension(java.lang.Class<?>,com.google.protobuf.Message)

com.google.protobuf.GeneratedMessage.<ContainingT,T>newMessageScopedGeneratedExtension(com.google.protobuf.Message,int,java.lang.Class<?>,com.google.protobuf.Message)

com.google.protobuf.GeneratedMessage.<ListT>makeMutableCopy(ListT)

com.google.protobuf.GeneratedMessage.<ListT>makeMutableCopy(ListT,int)

GeneratedMessage.<M>parseDelimitedWithIOException(Parser<M>,InputStream)

GeneratedMessage.<M>parseDelimitedWithIOException(Parser<M>,InputStream,ExtensionRegistryLite)

GeneratedMessage.<M>parseWithIOException(Parser<M>,CodedInputStream)

GeneratedMessage.<M>parseWithIOException(Parser<M>,CodedInputStream,ExtensionRegistryLite)

GeneratedMessage.<M>parseWithIOException(Parser<M>,InputStream)

GeneratedMessage.<M>parseWithIOException(Parser<M>,InputStream,ExtensionRegistryLite)

com.google.protobuf.GeneratedMessage.<T>emptyList(java.lang.Class<T>)

com.google.protobuf.GeneratedMessage.<V>serializeBooleanMapTo(com.google.protobuf.CodedOutputStream,com.google.protobuf.MapField<java.lang.Boolean,V>,com.google.protobuf.MapEntry<java.lang.Boolean,V>,int)

com.google.protobuf.GeneratedMessage.<V>serializeIntegerMapTo(com.google.protobuf.CodedOutputStream,com.google.protobuf.MapField<java.lang.Integer,V>,com.google.protobuf.MapEntry<java.lang.Integer,V>,int)

com.google.protobuf.GeneratedMessage.<V>serializeLongMapTo(com.google.protobuf.CodedOutputStream,com.google.protobuf.MapField<java.lang.Long,V>,com.google.protobuf.MapEntry<java.lang.Long,V>,int)

com.google.protobuf.GeneratedMessage.<V>serializeStringMapTo(com.google.protobuf.CodedOutputStream,com.google.protobuf.MapField<java.lang.String,V>,com.google.protobuf.MapEntry<java.lang.String,V>,int)

com.google.protobuf.GeneratedMessage.canUseUnsafe()

GeneratedMessage.computeStringSize(int,Object)

GeneratedMessage.computeStringSizeNoTag(Object)

com.google.protobuf.GeneratedMessage.emptyBooleanList()

com.google.protobuf.GeneratedMessage.emptyDoubleList()

com.google.protobuf.GeneratedMessage.emptyFloatList()

com.google.protobuf.GeneratedMessage.emptyIntList()

com.google.protobuf.GeneratedMessage.emptyLongList()

GeneratedMessage.getAllFields()

GeneratedMessage.getDescriptorForType()

GeneratedMessage.getField(Descriptors.FieldDescriptor)

GeneratedMessage.getOneofFieldDescriptor(Descriptors.OneofDescriptor)

GeneratedMessage.getParserForType()

GeneratedMessage.getRepeatedField(Descriptors.FieldDescriptor,int)

GeneratedMessage.getRepeatedFieldCount(Descriptors.FieldDescriptor)

GeneratedMessage.getSerializedSize()

GeneratedMessage.getUnknownFields()

GeneratedMessage.hasField(Descriptors.FieldDescriptor)

GeneratedMessage.hasOneof(Descriptors.OneofDescriptor)

GeneratedMessage.internalGetFieldAccessorTable()

GeneratedMessage.internalGetMapField(int)

com.google.protobuf.GeneratedMessage.internalGetMapFieldReflection(int)

GeneratedMessage.isInitialized()

com.google.protobuf.GeneratedMessage.isStringEmpty(java.lang.Object)

GeneratedMessage.makeExtensionsImmutable()

com.google.protobuf.GeneratedMessage.mergeFromAndMakeImmutableInternal(com.google.protobuf.CodedInputStream,com.google.protobuf.ExtensionRegistryLite)

com.google.protobuf.GeneratedMessage.newInstance(com.google.protobuf.GeneratedMessage.UnusedPrivateParameter)

GeneratedMessage.parseUnknownField(CodedInputStream,UnknownFieldSet.Builder,ExtensionRegistryLite,int)

com.google.protobuf.GeneratedMessage.parseUnknownFieldProto3(com.google.protobuf.CodedInputStream,com.google.protobuf.UnknownFieldSet.Builder,com.google.protobuf.ExtensionRegistryLite,int)

GeneratedMessage.writeReplace()

GeneratedMessage.writeString(CodedOutputStream,int,Object)

GeneratedMessage.writeStringNoTag(CodedOutputStream,Object)

GeneratedMessage.writeTo(CodedOutputStream)

Object.clone()

Object.finalize()

Object.getClass()

Object.notify()

Object.notifyAll()

Object.wait()

Object.wait(long)

Object.wait(long,int)

Static Fields

ABOUT_FIELD_NUMBER

public static final int ABOUT_FIELD_NUMBER

Field Value
Type	Description
int

ADDITIONAL_FIELD_NUMBER

public static final int ADDITIONAL_FIELD_NUMBER

Field Value
Type	Description
int

EXTENSIONS_FIELD_NUMBER

public static final int EXTENSIONS_FIELD_NUMBER

Field Value
Type	Description
int

EXTRACTED_FIELD_NUMBER

public static final int EXTRACTED_FIELD_NUMBER

Field Value
Type	Description
int

GROUPED_FIELD_NUMBER

public static final int GROUPED_FIELD_NUMBER

Field Value
Type	Description
int

INTERMEDIARY_FIELD_NUMBER

public static final int INTERMEDIARY_FIELD_NUMBER

Field Value
Type	Description
int

METADATA_FIELD_NUMBER

public static final int METADATA_FIELD_NUMBER

Field Value
Type	Description
int

NETWORK_FIELD_NUMBER

public static final int NETWORK_FIELD_NUMBER

Field Value
Type	Description
int

OBSERVER_FIELD_NUMBER

public static final int OBSERVER_FIELD_NUMBER

Field Value
Type	Description
int

PRINCIPAL_FIELD_NUMBER

public static final int PRINCIPAL_FIELD_NUMBER

Field Value
Type	Description
int

SECURITY_RESULT_FIELD_NUMBER

public static final int SECURITY_RESULT_FIELD_NUMBER

Field Value
Type	Description
int

SRC_FIELD_NUMBER

public static final int SRC_FIELD_NUMBER

Field Value
Type	Description
int

TARGET_FIELD_NUMBER

public static final int TARGET_FIELD_NUMBER

Field Value
Type	Description
int

Static Methods

getDefaultInstance()

public static UDM getDefaultInstance()

Returns
Type	Description
UDM

getDescriptor()

public static final Descriptors.Descriptor getDescriptor()

Returns
Type	Description
Descriptor

newBuilder()

public static UDM.Builder newBuilder()

Returns
Type	Description
UDM.Builder

newBuilder(UDM prototype)

public static UDM.Builder newBuilder(UDM prototype)

Parameter
Name	Description
prototype	UDM

Returns
Type	Description
UDM.Builder

parseDelimitedFrom(InputStream input)

public static UDM parseDelimitedFrom(InputStream input)

Parameter
Name	Description
input	InputStream

Returns
Type	Description
UDM

Exceptions
Type	Description
IOException

parseDelimitedFrom(InputStream input, ExtensionRegistryLite extensionRegistry)

public static UDM parseDelimitedFrom(InputStream input, ExtensionRegistryLite extensionRegistry)

Parameters
Name	Description
input	InputStream
extensionRegistry	ExtensionRegistryLite

Returns
Type	Description
UDM

Exceptions
Type	Description
IOException

parseFrom(byte[] data)

public static UDM parseFrom(byte[] data)

Parameter
Name	Description
data	byte[]

Returns
Type	Description
UDM

Exceptions
Type	Description
InvalidProtocolBufferException

parseFrom(byte[] data, ExtensionRegistryLite extensionRegistry)

public static UDM parseFrom(byte[] data, ExtensionRegistryLite extensionRegistry)

Parameters
Name	Description
data	byte[]
extensionRegistry	ExtensionRegistryLite

Returns
Type	Description
UDM

Exceptions
Type	Description
InvalidProtocolBufferException

parseFrom(ByteString data)

public static UDM parseFrom(ByteString data)

Parameter
Name	Description
data	ByteString

Returns
Type	Description
UDM

Exceptions
Type	Description
InvalidProtocolBufferException

parseFrom(ByteString data, ExtensionRegistryLite extensionRegistry)

public static UDM parseFrom(ByteString data, ExtensionRegistryLite extensionRegistry)

Parameters
Name	Description
data	ByteString
extensionRegistry	ExtensionRegistryLite

Returns
Type	Description
UDM

Exceptions
Type	Description
InvalidProtocolBufferException

parseFrom(CodedInputStream input)

public static UDM parseFrom(CodedInputStream input)

Parameter
Name	Description
input	CodedInputStream

Returns
Type	Description
UDM

Exceptions
Type	Description
IOException

parseFrom(CodedInputStream input, ExtensionRegistryLite extensionRegistry)

public static UDM parseFrom(CodedInputStream input, ExtensionRegistryLite extensionRegistry)

Parameters
Name	Description
input	CodedInputStream
extensionRegistry	ExtensionRegistryLite

Returns
Type	Description
UDM

Exceptions
Type	Description
IOException

parseFrom(InputStream input)

public static UDM parseFrom(InputStream input)

Parameter
Name	Description
input	InputStream

Returns
Type	Description
UDM

Exceptions
Type	Description
IOException

parseFrom(InputStream input, ExtensionRegistryLite extensionRegistry)

public static UDM parseFrom(InputStream input, ExtensionRegistryLite extensionRegistry)

Parameters
Name	Description
input	InputStream
extensionRegistry	ExtensionRegistryLite

Returns
Type	Description
UDM

Exceptions
Type	Description
IOException

parseFrom(ByteBuffer data)

public static UDM parseFrom(ByteBuffer data)

Parameter
Name	Description
data	ByteBuffer

Returns
Type	Description
UDM

Exceptions
Type	Description
InvalidProtocolBufferException

parseFrom(ByteBuffer data, ExtensionRegistryLite extensionRegistry)

public static UDM parseFrom(ByteBuffer data, ExtensionRegistryLite extensionRegistry)

Parameters
Name	Description
data	ByteBuffer
extensionRegistry	ExtensionRegistryLite

Returns
Type	Description
UDM

Exceptions
Type	Description
InvalidProtocolBufferException

parser()

public static Parser<UDM> parser()

Returns
Type	Description
Parser<UDM>

Methods

equals(Object obj)

public boolean equals(Object obj)

Parameter
Name	Description
obj	Object

Returns
Type	Description
boolean

Overrides

AbstractMessage.equals(Object other)

getAbout(int index)

public Noun getAbout(int index)

Represents entities referenced by the event that are not otherwise described in principal, src, target, intermediary or observer. For example, it could be used to track email file attachments, domains/URLs/IPs embedded within an email body, and DLLs that are loaded during a PROCESS_LAUNCH event.

repeated .google.backstory.Noun about = 8;

Parameter
Name	Description
index	int

Returns
Type	Description
Noun

getAboutCount()

public int getAboutCount()

Represents entities referenced by the event that are not otherwise described in principal, src, target, intermediary or observer. For example, it could be used to track email file attachments, domains/URLs/IPs embedded within an email body, and DLLs that are loaded during a PROCESS_LAUNCH event.

repeated .google.backstory.Noun about = 8;

Returns
Type	Description
int

getAboutList()

public List<Noun> getAboutList()

Represents entities referenced by the event that are not otherwise described in principal, src, target, intermediary or observer. For example, it could be used to track email file attachments, domains/URLs/IPs embedded within an email body, and DLLs that are loaded during a PROCESS_LAUNCH event.

repeated .google.backstory.Noun about = 8;

Returns
Type	Description
List<Noun>

getAboutOrBuilder(int index)

public NounOrBuilder getAboutOrBuilder(int index)

Represents entities referenced by the event that are not otherwise described in principal, src, target, intermediary or observer. For example, it could be used to track email file attachments, domains/URLs/IPs embedded within an email body, and DLLs that are loaded during a PROCESS_LAUNCH event.

repeated .google.backstory.Noun about = 8;

Parameter
Name	Description
index	int

Returns
Type	Description
NounOrBuilder

getAboutOrBuilderList()

public List<? extends NounOrBuilder> getAboutOrBuilderList()

Represents entities referenced by the event that are not otherwise described in principal, src, target, intermediary or observer. For example, it could be used to track email file attachments, domains/URLs/IPs embedded within an email body, and DLLs that are loaded during a PROCESS_LAUNCH event.

repeated .google.backstory.Noun about = 8;

Returns
Type	Description
List<? extends com.google.backstory.NounOrBuilder>

getAdditional()

public Struct getAdditional()

Any important vendor-specific event data that cannot be adequately represented within the formal sections of the UDM model.

.google.protobuf.Struct additional = 2;

Returns
Type	Description
Struct	The additional.

getAdditionalOrBuilder()

public StructOrBuilder getAdditionalOrBuilder()

Any important vendor-specific event data that cannot be adequately represented within the formal sections of the UDM model.

.google.protobuf.Struct additional = 2;

Returns
Type	Description
StructOrBuilder

getDefaultInstanceForType()

public UDM getDefaultInstanceForType()

Returns
Type	Description
UDM

getExtensions()

public Extensions getExtensions()

All other first-class, event-specific metadata goes in this message. Do not place protocol metadata in Extensions; put it in Network.

.google.backstory.Extensions extensions = 11;

Returns
Type	Description
Extensions	The extensions.

getExtensionsOrBuilder()

public ExtensionsOrBuilder getExtensionsOrBuilder()

All other first-class, event-specific metadata goes in this message. Do not place protocol metadata in Extensions; put it in Network.

.google.backstory.Extensions extensions = 11;

Returns
Type	Description
ExtensionsOrBuilder

getExtracted()

public Struct getExtracted()

Flattened fields extracted from the log.

.google.protobuf.Struct extracted = 12;

Returns
Type	Description
Struct	The extracted.

getExtractedOrBuilder()

public StructOrBuilder getExtractedOrBuilder()

Flattened fields extracted from the log.

.google.protobuf.Struct extracted = 12;

Returns
Type	Description
StructOrBuilder

getGrouped()

public GroupedFields getGrouped()

Related UDM fields that are grouped together.

optional .google.backstory.GroupedFields grouped = 13;

Returns
Type	Description
GroupedFields	The grouped.

getGroupedOrBuilder()

public GroupedFieldsOrBuilder getGroupedOrBuilder()

Related UDM fields that are grouped together.

optional .google.backstory.GroupedFields grouped = 13;

Returns
Type	Description
GroupedFieldsOrBuilder

getIntermediary(int index)

public Noun getIntermediary(int index)

Represents details on one or more intermediate entities processing activity described in the event. This includes device details about a proxy server or SMTP relay server. If an active event (that has a principal and possibly target) passes through any intermediaries, they're added here. Intermediaries can impact the overall action, for example blocking or modifying an ongoing request. A rule of thumb here is that 'principal', 'target', and description of the initial action should be the same regardless of the intermediary or its action. A successful network connection from A->B should look the same in principal/target/intermediary as one blocked by firewall C: principal: A, target: B (intermediary: C).

repeated .google.backstory.Noun intermediary = 6;

Parameter
Name	Description
index	int

Returns
Type	Description
Noun

getIntermediaryCount()

public int getIntermediaryCount()

Represents details on one or more intermediate entities processing activity described in the event. This includes device details about a proxy server or SMTP relay server. If an active event (that has a principal and possibly target) passes through any intermediaries, they're added here. Intermediaries can impact the overall action, for example blocking or modifying an ongoing request. A rule of thumb here is that 'principal', 'target', and description of the initial action should be the same regardless of the intermediary or its action. A successful network connection from A->B should look the same in principal/target/intermediary as one blocked by firewall C: principal: A, target: B (intermediary: C).

repeated .google.backstory.Noun intermediary = 6;

Returns
Type	Description
int

getIntermediaryList()

public List<Noun> getIntermediaryList()

Represents details on one or more intermediate entities processing activity described in the event. This includes device details about a proxy server or SMTP relay server. If an active event (that has a principal and possibly target) passes through any intermediaries, they're added here. Intermediaries can impact the overall action, for example blocking or modifying an ongoing request. A rule of thumb here is that 'principal', 'target', and description of the initial action should be the same regardless of the intermediary or its action. A successful network connection from A->B should look the same in principal/target/intermediary as one blocked by firewall C: principal: A, target: B (intermediary: C).

repeated .google.backstory.Noun intermediary = 6;

Returns
Type	Description
List<Noun>

getIntermediaryOrBuilder(int index)

public NounOrBuilder getIntermediaryOrBuilder(int index)

Represents details on one or more intermediate entities processing activity described in the event. This includes device details about a proxy server or SMTP relay server. If an active event (that has a principal and possibly target) passes through any intermediaries, they're added here. Intermediaries can impact the overall action, for example blocking or modifying an ongoing request. A rule of thumb here is that 'principal', 'target', and description of the initial action should be the same regardless of the intermediary or its action. A successful network connection from A->B should look the same in principal/target/intermediary as one blocked by firewall C: principal: A, target: B (intermediary: C).

repeated .google.backstory.Noun intermediary = 6;

Parameter
Name	Description
index	int

Returns
Type	Description
NounOrBuilder

getIntermediaryOrBuilderList()

public List<? extends NounOrBuilder> getIntermediaryOrBuilderList()

Represents details on one or more intermediate entities processing activity described in the event. This includes device details about a proxy server or SMTP relay server. If an active event (that has a principal and possibly target) passes through any intermediaries, they're added here. Intermediaries can impact the overall action, for example blocking or modifying an ongoing request. A rule of thumb here is that 'principal', 'target', and description of the initial action should be the same regardless of the intermediary or its action. A successful network connection from A->B should look the same in principal/target/intermediary as one blocked by firewall C: principal: A, target: B (intermediary: C).

repeated .google.backstory.Noun intermediary = 6;

Returns
Type	Description
List<? extends com.google.backstory.NounOrBuilder>

getMetadata()

public Metadata getMetadata()

Event metadata such as timestamp, source product, etc.

.google.backstory.Metadata metadata = 1;

Returns
Type	Description
Metadata	The metadata.

getMetadataOrBuilder()

public MetadataOrBuilder getMetadataOrBuilder()

Event metadata such as timestamp, source product, etc.

.google.backstory.Metadata metadata = 1;

Returns
Type	Description
MetadataOrBuilder

getNetwork()

public Network getNetwork()

All network details go here, including sub-messages with details on each protocol (for example, DHCP, DNS, or HTTP).

.google.backstory.Network network = 10;

Returns
Type	Description
Network	The network.

getNetworkOrBuilder()

public NetworkOrBuilder getNetworkOrBuilder()

All network details go here, including sub-messages with details on each protocol (for example, DHCP, DNS, or HTTP).

.google.backstory.Network network = 10;

Returns
Type	Description
NetworkOrBuilder

getObserver()

public Noun getObserver()

Represents an observer entity (for example, a packet sniffer or network-based vulnerability scanner), which is not a direct intermediary, but which observes and reports on the event in question.

.google.backstory.Noun observer = 7;

Returns
Type	Description
Noun	The observer.

getObserverOrBuilder()

public NounOrBuilder getObserverOrBuilder()

Represents an observer entity (for example, a packet sniffer or network-based vulnerability scanner), which is not a direct intermediary, but which observes and reports on the event in question.

.google.backstory.Noun observer = 7;

Returns
Type	Description
NounOrBuilder

getParserForType()

public Parser<UDM> getParserForType()

Returns
Type	Description
Parser<UDM>

Overrides

GeneratedMessage.getParserForType()

getPrincipal()

public Noun getPrincipal()

Represents the acting entity that originates the activity described in the event. The principal must include at least one machine detail (hostname, MACs, IPs, port, product-specific identifiers like an EDR asset ID) or user detail (for example, username), and optionally include process details. It must NOT include any of the following fields: email, files, registry keys or values.

.google.backstory.Noun principal = 3;

Returns
Type	Description
Noun	The principal.

getPrincipalOrBuilder()

public NounOrBuilder getPrincipalOrBuilder()

Represents the acting entity that originates the activity described in the event. The principal must include at least one machine detail (hostname, MACs, IPs, port, product-specific identifiers like an EDR asset ID) or user detail (for example, username), and optionally include process details. It must NOT include any of the following fields: email, files, registry keys or values.

.google.backstory.Noun principal = 3;

Returns
Type	Description
NounOrBuilder

getSecurityResult(int index)

public SecurityResult getSecurityResult(int index)

A list of security results.

repeated .google.backstory.SecurityResult security_result = 9;

Parameter
Name	Description
index	int

Returns
Type	Description
SecurityResult

getSecurityResultCount()

public int getSecurityResultCount()

A list of security results.

repeated .google.backstory.SecurityResult security_result = 9;

Returns
Type	Description
int

getSecurityResultList()

public List<SecurityResult> getSecurityResultList()

A list of security results.

repeated .google.backstory.SecurityResult security_result = 9;

Returns
Type	Description
List<SecurityResult>

getSecurityResultOrBuilder(int index)

public SecurityResultOrBuilder getSecurityResultOrBuilder(int index)

A list of security results.

repeated .google.backstory.SecurityResult security_result = 9;

Parameter
Name	Description
index	int

Returns
Type	Description
SecurityResultOrBuilder

getSecurityResultOrBuilderList()

public List<? extends SecurityResultOrBuilder> getSecurityResultOrBuilderList()

A list of security results.

repeated .google.backstory.SecurityResult security_result = 9;

Returns
Type	Description
List<? extends com.google.backstory.SecurityResultOrBuilder>

getSerializedSize()

public int getSerializedSize()

Returns
Type	Description
int

Overrides

GeneratedMessage.getSerializedSize()

getSrc()

public Noun getSrc()

Represents a source entity being acted upon by the participant along with the device or process context for the source object (the machine where the source object resides). For example, if user U copies file A on machine X to file B on machine Y, both file A and machine X would be specified in the src portion of the UDM event.

.google.backstory.Noun src = 4;

Returns
Type	Description
Noun	The src.

getSrcOrBuilder()

public NounOrBuilder getSrcOrBuilder()

Represents a source entity being acted upon by the participant along with the device or process context for the source object (the machine where the source object resides). For example, if user U copies file A on machine X to file B on machine Y, both file A and machine X would be specified in the src portion of the UDM event.

.google.backstory.Noun src = 4;

Returns
Type	Description
NounOrBuilder

getTarget()

public Noun getTarget()

Represents a target entity being referenced by the event or an object on the target entity. For example, in a firewall connection from device A to device B, A is described as the principal and B is described as the target. For a process injection by process C into target process D, process C is described as the principal and process D is described as the target.

.google.backstory.Noun target = 5;

Returns
Type	Description
Noun	The target.

getTargetOrBuilder()

public NounOrBuilder getTargetOrBuilder()

Represents a target entity being referenced by the event or an object on the target entity. For example, in a firewall connection from device A to device B, A is described as the principal and B is described as the target. For a process injection by process C into target process D, process C is described as the principal and process D is described as the target.

.google.backstory.Noun target = 5;

Returns
Type	Description
NounOrBuilder

hasAdditional()

public boolean hasAdditional()

Any important vendor-specific event data that cannot be adequately represented within the formal sections of the UDM model.

.google.protobuf.Struct additional = 2;

Returns
Type	Description
boolean	Whether the additional field is set.

hasExtensions()

public boolean hasExtensions()

All other first-class, event-specific metadata goes in this message. Do not place protocol metadata in Extensions; put it in Network.

.google.backstory.Extensions extensions = 11;

Returns
Type	Description
boolean	Whether the extensions field is set.

hasExtracted()

public boolean hasExtracted()

Flattened fields extracted from the log.

.google.protobuf.Struct extracted = 12;

Returns
Type	Description
boolean	Whether the extracted field is set.

hasGrouped()

public boolean hasGrouped()

Related UDM fields that are grouped together.

optional .google.backstory.GroupedFields grouped = 13;

Returns
Type	Description
boolean	Whether the grouped field is set.

hasMetadata()

public boolean hasMetadata()

Event metadata such as timestamp, source product, etc.

.google.backstory.Metadata metadata = 1;

Returns
Type	Description
boolean	Whether the metadata field is set.

hasNetwork()

public boolean hasNetwork()

All network details go here, including sub-messages with details on each protocol (for example, DHCP, DNS, or HTTP).

.google.backstory.Network network = 10;

Returns
Type	Description
boolean	Whether the network field is set.

hasObserver()

public boolean hasObserver()

Represents an observer entity (for example, a packet sniffer or network-based vulnerability scanner), which is not a direct intermediary, but which observes and reports on the event in question.

.google.backstory.Noun observer = 7;

Returns
Type	Description
boolean	Whether the observer field is set.

hasPrincipal()

public boolean hasPrincipal()

Represents the acting entity that originates the activity described in the event. The principal must include at least one machine detail (hostname, MACs, IPs, port, product-specific identifiers like an EDR asset ID) or user detail (for example, username), and optionally include process details. It must NOT include any of the following fields: email, files, registry keys or values.

.google.backstory.Noun principal = 3;

Returns
Type	Description
boolean	Whether the principal field is set.

hasSrc()

public boolean hasSrc()

Represents a source entity being acted upon by the participant along with the device or process context for the source object (the machine where the source object resides). For example, if user U copies file A on machine X to file B on machine Y, both file A and machine X would be specified in the src portion of the UDM event.

.google.backstory.Noun src = 4;

Returns
Type	Description
boolean	Whether the src field is set.

hasTarget()

public boolean hasTarget()

Represents a target entity being referenced by the event or an object on the target entity. For example, in a firewall connection from device A to device B, A is described as the principal and B is described as the target. For a process injection by process C into target process D, process C is described as the principal and process D is described as the target.

.google.backstory.Noun target = 5;

Returns
Type	Description
boolean	Whether the target field is set.

hashCode()

public int hashCode()

Returns
Type	Description
int

Overrides

AbstractMessage.hashCode()

internalGetFieldAccessorTable()

protected GeneratedMessage.FieldAccessorTable internalGetFieldAccessorTable()

Returns
Type	Description
FieldAccessorTable

Overrides

GeneratedMessage.internalGetFieldAccessorTable()

isInitialized()

public final boolean isInitialized()

Returns
Type	Description
boolean

Overrides

GeneratedMessage.isInitialized()

newBuilderForType()

public UDM.Builder newBuilderForType()

Returns
Type	Description
UDM.Builder

newBuilderForType(AbstractMessage.BuilderParent parent)

protected UDM.Builder newBuilderForType(AbstractMessage.BuilderParent parent)

Parameter
Name	Description
parent	BuilderParent

Returns
Type	Description
UDM.Builder

Overrides

AbstractMessage.newBuilderForType(AbstractMessage.BuilderParent parent)

toBuilder()

public UDM.Builder toBuilder()

Returns
Type	Description
UDM.Builder

writeTo(CodedOutputStream output)

public void writeTo(CodedOutputStream output)

Parameter
Name	Description
output	CodedOutputStream

Overrides

GeneratedMessage.writeTo(CodedOutputStream output)

Exceptions
Type	Description
IOException