public static final class UDM.Builder extends GeneratedMessage.Builder<UDM.Builder> implements UDMOrBuilderA Unified Data Model event.
Protobuf type google.backstory.UDM
Inheritance
java.lang.Object > AbstractMessageLite.Builder<MessageType,BuilderType> > AbstractMessage.Builder<BuilderType> > GeneratedMessage.Builder > UDM.BuilderImplements
UDMOrBuilderStatic Methods
getDescriptor()
public static final Descriptors.Descriptor getDescriptor()| Returns | |
|---|---|
| Type | Description |
Descriptor |
|
Methods
addAbout(Noun value)
public UDM.Builder addAbout(Noun value)Represents entities referenced by the event that are not otherwise described in principal, src, target, intermediary or observer. For example, it could be used to track email file attachments, domains/URLs/IPs embedded within an email body, and DLLs that are loaded during a PROCESS_LAUNCH event.
repeated .google.backstory.Noun about = 8;
| Parameter | |
|---|---|
| Name | Description |
value |
Noun |
| Returns | |
|---|---|
| Type | Description |
UDM.Builder |
|
addAbout(Noun.Builder builderForValue)
public UDM.Builder addAbout(Noun.Builder builderForValue)Represents entities referenced by the event that are not otherwise described in principal, src, target, intermediary or observer. For example, it could be used to track email file attachments, domains/URLs/IPs embedded within an email body, and DLLs that are loaded during a PROCESS_LAUNCH event.
repeated .google.backstory.Noun about = 8;
| Parameter | |
|---|---|
| Name | Description |
builderForValue |
Noun.Builder |
| Returns | |
|---|---|
| Type | Description |
UDM.Builder |
|
addAbout(int index, Noun value)
public UDM.Builder addAbout(int index, Noun value)Represents entities referenced by the event that are not otherwise described in principal, src, target, intermediary or observer. For example, it could be used to track email file attachments, domains/URLs/IPs embedded within an email body, and DLLs that are loaded during a PROCESS_LAUNCH event.
repeated .google.backstory.Noun about = 8;
| Parameters | |
|---|---|
| Name | Description |
index |
int |
value |
Noun |
| Returns | |
|---|---|
| Type | Description |
UDM.Builder |
|
addAbout(int index, Noun.Builder builderForValue)
public UDM.Builder addAbout(int index, Noun.Builder builderForValue)Represents entities referenced by the event that are not otherwise described in principal, src, target, intermediary or observer. For example, it could be used to track email file attachments, domains/URLs/IPs embedded within an email body, and DLLs that are loaded during a PROCESS_LAUNCH event.
repeated .google.backstory.Noun about = 8;
| Parameters | |
|---|---|
| Name | Description |
index |
int |
builderForValue |
Noun.Builder |
| Returns | |
|---|---|
| Type | Description |
UDM.Builder |
|
addAboutBuilder()
public Noun.Builder addAboutBuilder()Represents entities referenced by the event that are not otherwise described in principal, src, target, intermediary or observer. For example, it could be used to track email file attachments, domains/URLs/IPs embedded within an email body, and DLLs that are loaded during a PROCESS_LAUNCH event.
repeated .google.backstory.Noun about = 8;
| Returns | |
|---|---|
| Type | Description |
Noun.Builder |
|
addAboutBuilder(int index)
public Noun.Builder addAboutBuilder(int index)Represents entities referenced by the event that are not otherwise described in principal, src, target, intermediary or observer. For example, it could be used to track email file attachments, domains/URLs/IPs embedded within an email body, and DLLs that are loaded during a PROCESS_LAUNCH event.
repeated .google.backstory.Noun about = 8;
| Parameter | |
|---|---|
| Name | Description |
index |
int |
| Returns | |
|---|---|
| Type | Description |
Noun.Builder |
|
addAllAbout(Iterable<? extends Noun> values)
public UDM.Builder addAllAbout(Iterable<? extends Noun> values)Represents entities referenced by the event that are not otherwise described in principal, src, target, intermediary or observer. For example, it could be used to track email file attachments, domains/URLs/IPs embedded within an email body, and DLLs that are loaded during a PROCESS_LAUNCH event.
repeated .google.backstory.Noun about = 8;
| Parameter | |
|---|---|
| Name | Description |
values |
Iterable<? extends com.google.backstory.Noun> |
| Returns | |
|---|---|
| Type | Description |
UDM.Builder |
|
addAllIntermediary(Iterable<? extends Noun> values)
public UDM.Builder addAllIntermediary(Iterable<? extends Noun> values)Represents details on one or more intermediate entities processing activity described in the event. This includes device details about a proxy server or SMTP relay server. If an active event (that has a principal and possibly target) passes through any intermediaries, they're added here. Intermediaries can impact the overall action, for example blocking or modifying an ongoing request. A rule of thumb here is that 'principal', 'target', and description of the initial action should be the same regardless of the intermediary or its action. A successful network connection from A->B should look the same in principal/target/intermediary as one blocked by firewall C: principal: A, target: B (intermediary: C).
repeated .google.backstory.Noun intermediary = 6;
| Parameter | |
|---|---|
| Name | Description |
values |
Iterable<? extends com.google.backstory.Noun> |
| Returns | |
|---|---|
| Type | Description |
UDM.Builder |
|
addAllSecurityResult(Iterable<? extends SecurityResult> values)
public UDM.Builder addAllSecurityResult(Iterable<? extends SecurityResult> values)A list of security results.
repeated .google.backstory.SecurityResult security_result = 9;
| Parameter | |
|---|---|
| Name | Description |
values |
Iterable<? extends com.google.backstory.SecurityResult> |
| Returns | |
|---|---|
| Type | Description |
UDM.Builder |
|
addIntermediary(Noun value)
public UDM.Builder addIntermediary(Noun value)Represents details on one or more intermediate entities processing activity described in the event. This includes device details about a proxy server or SMTP relay server. If an active event (that has a principal and possibly target) passes through any intermediaries, they're added here. Intermediaries can impact the overall action, for example blocking or modifying an ongoing request. A rule of thumb here is that 'principal', 'target', and description of the initial action should be the same regardless of the intermediary or its action. A successful network connection from A->B should look the same in principal/target/intermediary as one blocked by firewall C: principal: A, target: B (intermediary: C).
repeated .google.backstory.Noun intermediary = 6;
| Parameter | |
|---|---|
| Name | Description |
value |
Noun |
| Returns | |
|---|---|
| Type | Description |
UDM.Builder |
|
addIntermediary(Noun.Builder builderForValue)
public UDM.Builder addIntermediary(Noun.Builder builderForValue)Represents details on one or more intermediate entities processing activity described in the event. This includes device details about a proxy server or SMTP relay server. If an active event (that has a principal and possibly target) passes through any intermediaries, they're added here. Intermediaries can impact the overall action, for example blocking or modifying an ongoing request. A rule of thumb here is that 'principal', 'target', and description of the initial action should be the same regardless of the intermediary or its action. A successful network connection from A->B should look the same in principal/target/intermediary as one blocked by firewall C: principal: A, target: B (intermediary: C).
repeated .google.backstory.Noun intermediary = 6;
| Parameter | |
|---|---|
| Name | Description |
builderForValue |
Noun.Builder |
| Returns | |
|---|---|
| Type | Description |
UDM.Builder |
|
addIntermediary(int index, Noun value)
public UDM.Builder addIntermediary(int index, Noun value)Represents details on one or more intermediate entities processing activity described in the event. This includes device details about a proxy server or SMTP relay server. If an active event (that has a principal and possibly target) passes through any intermediaries, they're added here. Intermediaries can impact the overall action, for example blocking or modifying an ongoing request. A rule of thumb here is that 'principal', 'target', and description of the initial action should be the same regardless of the intermediary or its action. A successful network connection from A->B should look the same in principal/target/intermediary as one blocked by firewall C: principal: A, target: B (intermediary: C).
repeated .google.backstory.Noun intermediary = 6;
| Parameters | |
|---|---|
| Name | Description |
index |
int |
value |
Noun |
| Returns | |
|---|---|
| Type | Description |
UDM.Builder |
|
addIntermediary(int index, Noun.Builder builderForValue)
public UDM.Builder addIntermediary(int index, Noun.Builder builderForValue)Represents details on one or more intermediate entities processing activity described in the event. This includes device details about a proxy server or SMTP relay server. If an active event (that has a principal and possibly target) passes through any intermediaries, they're added here. Intermediaries can impact the overall action, for example blocking or modifying an ongoing request. A rule of thumb here is that 'principal', 'target', and description of the initial action should be the same regardless of the intermediary or its action. A successful network connection from A->B should look the same in principal/target/intermediary as one blocked by firewall C: principal: A, target: B (intermediary: C).
repeated .google.backstory.Noun intermediary = 6;
| Parameters | |
|---|---|
| Name | Description |
index |
int |
builderForValue |
Noun.Builder |
| Returns | |
|---|---|
| Type | Description |
UDM.Builder |
|
addIntermediaryBuilder()
public Noun.Builder addIntermediaryBuilder()Represents details on one or more intermediate entities processing activity described in the event. This includes device details about a proxy server or SMTP relay server. If an active event (that has a principal and possibly target) passes through any intermediaries, they're added here. Intermediaries can impact the overall action, for example blocking or modifying an ongoing request. A rule of thumb here is that 'principal', 'target', and description of the initial action should be the same regardless of the intermediary or its action. A successful network connection from A->B should look the same in principal/target/intermediary as one blocked by firewall C: principal: A, target: B (intermediary: C).
repeated .google.backstory.Noun intermediary = 6;
| Returns | |
|---|---|
| Type | Description |
Noun.Builder |
|
addIntermediaryBuilder(int index)
public Noun.Builder addIntermediaryBuilder(int index)Represents details on one or more intermediate entities processing activity described in the event. This includes device details about a proxy server or SMTP relay server. If an active event (that has a principal and possibly target) passes through any intermediaries, they're added here. Intermediaries can impact the overall action, for example blocking or modifying an ongoing request. A rule of thumb here is that 'principal', 'target', and description of the initial action should be the same regardless of the intermediary or its action. A successful network connection from A->B should look the same in principal/target/intermediary as one blocked by firewall C: principal: A, target: B (intermediary: C).
repeated .google.backstory.Noun intermediary = 6;
| Parameter | |
|---|---|
| Name | Description |
index |
int |
| Returns | |
|---|---|
| Type | Description |
Noun.Builder |
|
addSecurityResult(SecurityResult value)
public UDM.Builder addSecurityResult(SecurityResult value)A list of security results.
repeated .google.backstory.SecurityResult security_result = 9;
| Parameter | |
|---|---|
| Name | Description |
value |
SecurityResult |
| Returns | |
|---|---|
| Type | Description |
UDM.Builder |
|
addSecurityResult(SecurityResult.Builder builderForValue)
public UDM.Builder addSecurityResult(SecurityResult.Builder builderForValue)A list of security results.
repeated .google.backstory.SecurityResult security_result = 9;
| Parameter | |
|---|---|
| Name | Description |
builderForValue |
SecurityResult.Builder |
| Returns | |
|---|---|
| Type | Description |
UDM.Builder |
|
addSecurityResult(int index, SecurityResult value)
public UDM.Builder addSecurityResult(int index, SecurityResult value)A list of security results.
repeated .google.backstory.SecurityResult security_result = 9;
| Parameters | |
|---|---|
| Name | Description |
index |
int |
value |
SecurityResult |
| Returns | |
|---|---|
| Type | Description |
UDM.Builder |
|
addSecurityResult(int index, SecurityResult.Builder builderForValue)
public UDM.Builder addSecurityResult(int index, SecurityResult.Builder builderForValue)A list of security results.
repeated .google.backstory.SecurityResult security_result = 9;
| Parameters | |
|---|---|
| Name | Description |
index |
int |
builderForValue |
SecurityResult.Builder |
| Returns | |
|---|---|
| Type | Description |
UDM.Builder |
|
addSecurityResultBuilder()
public SecurityResult.Builder addSecurityResultBuilder()A list of security results.
repeated .google.backstory.SecurityResult security_result = 9;
| Returns | |
|---|---|
| Type | Description |
SecurityResult.Builder |
|
addSecurityResultBuilder(int index)
public SecurityResult.Builder addSecurityResultBuilder(int index)A list of security results.
repeated .google.backstory.SecurityResult security_result = 9;
| Parameter | |
|---|---|
| Name | Description |
index |
int |
| Returns | |
|---|---|
| Type | Description |
SecurityResult.Builder |
|
build()
public UDM build()| Returns | |
|---|---|
| Type | Description |
UDM |
|
buildPartial()
public UDM buildPartial()| Returns | |
|---|---|
| Type | Description |
UDM |
|
clear()
public UDM.Builder clear()| Returns | |
|---|---|
| Type | Description |
UDM.Builder |
|
clearAbout()
public UDM.Builder clearAbout()Represents entities referenced by the event that are not otherwise described in principal, src, target, intermediary or observer. For example, it could be used to track email file attachments, domains/URLs/IPs embedded within an email body, and DLLs that are loaded during a PROCESS_LAUNCH event.
repeated .google.backstory.Noun about = 8;
| Returns | |
|---|---|
| Type | Description |
UDM.Builder |
|
clearAdditional()
public UDM.Builder clearAdditional()Any important vendor-specific event data that cannot be adequately represented within the formal sections of the UDM model.
.google.protobuf.Struct additional = 2;
| Returns | |
|---|---|
| Type | Description |
UDM.Builder |
|
clearExtensions()
public UDM.Builder clearExtensions()All other first-class, event-specific metadata goes in this message. Do not place protocol metadata in Extensions; put it in Network.
.google.backstory.Extensions extensions = 11;
| Returns | |
|---|---|
| Type | Description |
UDM.Builder |
|
clearExtracted()
public UDM.Builder clearExtracted()Flattened fields extracted from the log.
.google.protobuf.Struct extracted = 12;
| Returns | |
|---|---|
| Type | Description |
UDM.Builder |
|
clearGrouped()
public UDM.Builder clearGrouped()Related UDM fields that are grouped together.
optional .google.backstory.GroupedFields grouped = 13;
| Returns | |
|---|---|
| Type | Description |
UDM.Builder |
|
clearIntermediary()
public UDM.Builder clearIntermediary()Represents details on one or more intermediate entities processing activity described in the event. This includes device details about a proxy server or SMTP relay server. If an active event (that has a principal and possibly target) passes through any intermediaries, they're added here. Intermediaries can impact the overall action, for example blocking or modifying an ongoing request. A rule of thumb here is that 'principal', 'target', and description of the initial action should be the same regardless of the intermediary or its action. A successful network connection from A->B should look the same in principal/target/intermediary as one blocked by firewall C: principal: A, target: B (intermediary: C).
repeated .google.backstory.Noun intermediary = 6;
| Returns | |
|---|---|
| Type | Description |
UDM.Builder |
|
clearMetadata()
public UDM.Builder clearMetadata()Event metadata such as timestamp, source product, etc.
.google.backstory.Metadata metadata = 1;
| Returns | |
|---|---|
| Type | Description |
UDM.Builder |
|
clearNetwork()
public UDM.Builder clearNetwork()All network details go here, including sub-messages with details on each protocol (for example, DHCP, DNS, or HTTP).
.google.backstory.Network network = 10;
| Returns | |
|---|---|
| Type | Description |
UDM.Builder |
|
clearObserver()
public UDM.Builder clearObserver()Represents an observer entity (for example, a packet sniffer or network-based vulnerability scanner), which is not a direct intermediary, but which observes and reports on the event in question.
.google.backstory.Noun observer = 7;
| Returns | |
|---|---|
| Type | Description |
UDM.Builder |
|
clearPrincipal()
public UDM.Builder clearPrincipal()Represents the acting entity that originates the activity described in the event. The principal must include at least one machine detail (hostname, MACs, IPs, port, product-specific identifiers like an EDR asset ID) or user detail (for example, username), and optionally include process details. It must NOT include any of the following fields: email, files, registry keys or values.
.google.backstory.Noun principal = 3;
| Returns | |
|---|---|
| Type | Description |
UDM.Builder |
|
clearSecurityResult()
public UDM.Builder clearSecurityResult()A list of security results.
repeated .google.backstory.SecurityResult security_result = 9;
| Returns | |
|---|---|
| Type | Description |
UDM.Builder |
|
clearSrc()
public UDM.Builder clearSrc()Represents a source entity being acted upon by the participant along with the device or process context for the source object (the machine where the source object resides). For example, if user U copies file A on machine X to file B on machine Y, both file A and machine X would be specified in the src portion of the UDM event.
.google.backstory.Noun src = 4;
| Returns | |
|---|---|
| Type | Description |
UDM.Builder |
|
clearTarget()
public UDM.Builder clearTarget()Represents a target entity being referenced by the event or an object on the target entity. For example, in a firewall connection from device A to device B, A is described as the principal and B is described as the target. For a process injection by process C into target process D, process C is described as the principal and process D is described as the target.
.google.backstory.Noun target = 5;
| Returns | |
|---|---|
| Type | Description |
UDM.Builder |
|
getAbout(int index)
public Noun getAbout(int index)Represents entities referenced by the event that are not otherwise described in principal, src, target, intermediary or observer. For example, it could be used to track email file attachments, domains/URLs/IPs embedded within an email body, and DLLs that are loaded during a PROCESS_LAUNCH event.
repeated .google.backstory.Noun about = 8;
| Parameter | |
|---|---|
| Name | Description |
index |
int |
| Returns | |
|---|---|
| Type | Description |
Noun |
|
getAboutBuilder(int index)
public Noun.Builder getAboutBuilder(int index)Represents entities referenced by the event that are not otherwise described in principal, src, target, intermediary or observer. For example, it could be used to track email file attachments, domains/URLs/IPs embedded within an email body, and DLLs that are loaded during a PROCESS_LAUNCH event.
repeated .google.backstory.Noun about = 8;
| Parameter | |
|---|---|
| Name | Description |
index |
int |
| Returns | |
|---|---|
| Type | Description |
Noun.Builder |
|
getAboutBuilderList()
public List<Noun.Builder> getAboutBuilderList()Represents entities referenced by the event that are not otherwise described in principal, src, target, intermediary or observer. For example, it could be used to track email file attachments, domains/URLs/IPs embedded within an email body, and DLLs that are loaded during a PROCESS_LAUNCH event.
repeated .google.backstory.Noun about = 8;
| Returns | |
|---|---|
| Type | Description |
List<Builder> |
|
getAboutCount()
public int getAboutCount()Represents entities referenced by the event that are not otherwise described in principal, src, target, intermediary or observer. For example, it could be used to track email file attachments, domains/URLs/IPs embedded within an email body, and DLLs that are loaded during a PROCESS_LAUNCH event.
repeated .google.backstory.Noun about = 8;
| Returns | |
|---|---|
| Type | Description |
int |
|
getAboutList()
public List<Noun> getAboutList()Represents entities referenced by the event that are not otherwise described in principal, src, target, intermediary or observer. For example, it could be used to track email file attachments, domains/URLs/IPs embedded within an email body, and DLLs that are loaded during a PROCESS_LAUNCH event.
repeated .google.backstory.Noun about = 8;
| Returns | |
|---|---|
| Type | Description |
List<Noun> |
|
getAboutOrBuilder(int index)
public NounOrBuilder getAboutOrBuilder(int index)Represents entities referenced by the event that are not otherwise described in principal, src, target, intermediary or observer. For example, it could be used to track email file attachments, domains/URLs/IPs embedded within an email body, and DLLs that are loaded during a PROCESS_LAUNCH event.
repeated .google.backstory.Noun about = 8;
| Parameter | |
|---|---|
| Name | Description |
index |
int |
| Returns | |
|---|---|
| Type | Description |
NounOrBuilder |
|
getAboutOrBuilderList()
public List<? extends NounOrBuilder> getAboutOrBuilderList()Represents entities referenced by the event that are not otherwise described in principal, src, target, intermediary or observer. For example, it could be used to track email file attachments, domains/URLs/IPs embedded within an email body, and DLLs that are loaded during a PROCESS_LAUNCH event.
repeated .google.backstory.Noun about = 8;
| Returns | |
|---|---|
| Type | Description |
List<? extends com.google.backstory.NounOrBuilder> |
|
getAdditional()
public Struct getAdditional()Any important vendor-specific event data that cannot be adequately represented within the formal sections of the UDM model.
.google.protobuf.Struct additional = 2;
| Returns | |
|---|---|
| Type | Description |
Struct |
The additional. |
getAdditionalBuilder()
public Struct.Builder getAdditionalBuilder()Any important vendor-specific event data that cannot be adequately represented within the formal sections of the UDM model.
.google.protobuf.Struct additional = 2;
| Returns | |
|---|---|
| Type | Description |
Builder |
|
getAdditionalOrBuilder()
public StructOrBuilder getAdditionalOrBuilder()Any important vendor-specific event data that cannot be adequately represented within the formal sections of the UDM model.
.google.protobuf.Struct additional = 2;
| Returns | |
|---|---|
| Type | Description |
StructOrBuilder |
|
getDefaultInstanceForType()
public UDM getDefaultInstanceForType()| Returns | |
|---|---|
| Type | Description |
UDM |
|
getDescriptorForType()
public Descriptors.Descriptor getDescriptorForType()| Returns | |
|---|---|
| Type | Description |
Descriptor |
|
getExtensions()
public Extensions getExtensions()All other first-class, event-specific metadata goes in this message. Do not place protocol metadata in Extensions; put it in Network.
.google.backstory.Extensions extensions = 11;
| Returns | |
|---|---|
| Type | Description |
Extensions |
The extensions. |
getExtensionsBuilder()
public Extensions.Builder getExtensionsBuilder()All other first-class, event-specific metadata goes in this message. Do not place protocol metadata in Extensions; put it in Network.
.google.backstory.Extensions extensions = 11;
| Returns | |
|---|---|
| Type | Description |
Extensions.Builder |
|
getExtensionsOrBuilder()
public ExtensionsOrBuilder getExtensionsOrBuilder()All other first-class, event-specific metadata goes in this message. Do not place protocol metadata in Extensions; put it in Network.
.google.backstory.Extensions extensions = 11;
| Returns | |
|---|---|
| Type | Description |
ExtensionsOrBuilder |
|
getExtracted()
public Struct getExtracted()Flattened fields extracted from the log.
.google.protobuf.Struct extracted = 12;
| Returns | |
|---|---|
| Type | Description |
Struct |
The extracted. |
getExtractedBuilder()
public Struct.Builder getExtractedBuilder()Flattened fields extracted from the log.
.google.protobuf.Struct extracted = 12;
| Returns | |
|---|---|
| Type | Description |
Builder |
|
getExtractedOrBuilder()
public StructOrBuilder getExtractedOrBuilder()Flattened fields extracted from the log.
.google.protobuf.Struct extracted = 12;
| Returns | |
|---|---|
| Type | Description |
StructOrBuilder |
|
getGrouped()
public GroupedFields getGrouped()Related UDM fields that are grouped together.
optional .google.backstory.GroupedFields grouped = 13;
| Returns | |
|---|---|
| Type | Description |
GroupedFields |
The grouped. |
getGroupedBuilder()
public GroupedFields.Builder getGroupedBuilder()Related UDM fields that are grouped together.
optional .google.backstory.GroupedFields grouped = 13;
| Returns | |
|---|---|
| Type | Description |
GroupedFields.Builder |
|
getGroupedOrBuilder()
public GroupedFieldsOrBuilder getGroupedOrBuilder()Related UDM fields that are grouped together.
optional .google.backstory.GroupedFields grouped = 13;
| Returns | |
|---|---|
| Type | Description |
GroupedFieldsOrBuilder |
|
getIntermediary(int index)
public Noun getIntermediary(int index)Represents details on one or more intermediate entities processing activity described in the event. This includes device details about a proxy server or SMTP relay server. If an active event (that has a principal and possibly target) passes through any intermediaries, they're added here. Intermediaries can impact the overall action, for example blocking or modifying an ongoing request. A rule of thumb here is that 'principal', 'target', and description of the initial action should be the same regardless of the intermediary or its action. A successful network connection from A->B should look the same in principal/target/intermediary as one blocked by firewall C: principal: A, target: B (intermediary: C).
repeated .google.backstory.Noun intermediary = 6;
| Parameter | |
|---|---|
| Name | Description |
index |
int |
| Returns | |
|---|---|
| Type | Description |
Noun |
|
getIntermediaryBuilder(int index)
public Noun.Builder getIntermediaryBuilder(int index)Represents details on one or more intermediate entities processing activity described in the event. This includes device details about a proxy server or SMTP relay server. If an active event (that has a principal and possibly target) passes through any intermediaries, they're added here. Intermediaries can impact the overall action, for example blocking or modifying an ongoing request. A rule of thumb here is that 'principal', 'target', and description of the initial action should be the same regardless of the intermediary or its action. A successful network connection from A->B should look the same in principal/target/intermediary as one blocked by firewall C: principal: A, target: B (intermediary: C).
repeated .google.backstory.Noun intermediary = 6;
| Parameter | |
|---|---|
| Name | Description |
index |
int |
| Returns | |
|---|---|
| Type | Description |
Noun.Builder |
|
getIntermediaryBuilderList()
public List<Noun.Builder> getIntermediaryBuilderList()Represents details on one or more intermediate entities processing activity described in the event. This includes device details about a proxy server or SMTP relay server. If an active event (that has a principal and possibly target) passes through any intermediaries, they're added here. Intermediaries can impact the overall action, for example blocking or modifying an ongoing request. A rule of thumb here is that 'principal', 'target', and description of the initial action should be the same regardless of the intermediary or its action. A successful network connection from A->B should look the same in principal/target/intermediary as one blocked by firewall C: principal: A, target: B (intermediary: C).
repeated .google.backstory.Noun intermediary = 6;
| Returns | |
|---|---|
| Type | Description |
List<Builder> |
|
getIntermediaryCount()
public int getIntermediaryCount()Represents details on one or more intermediate entities processing activity described in the event. This includes device details about a proxy server or SMTP relay server. If an active event (that has a principal and possibly target) passes through any intermediaries, they're added here. Intermediaries can impact the overall action, for example blocking or modifying an ongoing request. A rule of thumb here is that 'principal', 'target', and description of the initial action should be the same regardless of the intermediary or its action. A successful network connection from A->B should look the same in principal/target/intermediary as one blocked by firewall C: principal: A, target: B (intermediary: C).
repeated .google.backstory.Noun intermediary = 6;
| Returns | |
|---|---|
| Type | Description |
int |
|
getIntermediaryList()
public List<Noun> getIntermediaryList()Represents details on one or more intermediate entities processing activity described in the event. This includes device details about a proxy server or SMTP relay server. If an active event (that has a principal and possibly target) passes through any intermediaries, they're added here. Intermediaries can impact the overall action, for example blocking or modifying an ongoing request. A rule of thumb here is that 'principal', 'target', and description of the initial action should be the same regardless of the intermediary or its action. A successful network connection from A->B should look the same in principal/target/intermediary as one blocked by firewall C: principal: A, target: B (intermediary: C).
repeated .google.backstory.Noun intermediary = 6;
| Returns | |
|---|---|
| Type | Description |
List<Noun> |
|
getIntermediaryOrBuilder(int index)
public NounOrBuilder getIntermediaryOrBuilder(int index)Represents details on one or more intermediate entities processing activity described in the event. This includes device details about a proxy server or SMTP relay server. If an active event (that has a principal and possibly target) passes through any intermediaries, they're added here. Intermediaries can impact the overall action, for example blocking or modifying an ongoing request. A rule of thumb here is that 'principal', 'target', and description of the initial action should be the same regardless of the intermediary or its action. A successful network connection from A->B should look the same in principal/target/intermediary as one blocked by firewall C: principal: A, target: B (intermediary: C).
repeated .google.backstory.Noun intermediary = 6;
| Parameter | |
|---|---|
| Name | Description |
index |
int |
| Returns | |
|---|---|
| Type | Description |
NounOrBuilder |
|
getIntermediaryOrBuilderList()
public List<? extends NounOrBuilder> getIntermediaryOrBuilderList()Represents details on one or more intermediate entities processing activity described in the event. This includes device details about a proxy server or SMTP relay server. If an active event (that has a principal and possibly target) passes through any intermediaries, they're added here. Intermediaries can impact the overall action, for example blocking or modifying an ongoing request. A rule of thumb here is that 'principal', 'target', and description of the initial action should be the same regardless of the intermediary or its action. A successful network connection from A->B should look the same in principal/target/intermediary as one blocked by firewall C: principal: A, target: B (intermediary: C).
repeated .google.backstory.Noun intermediary = 6;
| Returns | |
|---|---|
| Type | Description |
List<? extends com.google.backstory.NounOrBuilder> |
|
getMetadata()
public Metadata getMetadata()Event metadata such as timestamp, source product, etc.
.google.backstory.Metadata metadata = 1;
| Returns | |
|---|---|
| Type | Description |
Metadata |
The metadata. |
getMetadataBuilder()
public Metadata.Builder getMetadataBuilder()Event metadata such as timestamp, source product, etc.
.google.backstory.Metadata metadata = 1;
| Returns | |
|---|---|
| Type | Description |
Metadata.Builder |
|
getMetadataOrBuilder()
public MetadataOrBuilder getMetadataOrBuilder()Event metadata such as timestamp, source product, etc.
.google.backstory.Metadata metadata = 1;
| Returns | |
|---|---|
| Type | Description |
MetadataOrBuilder |
|
getNetwork()
public Network getNetwork()All network details go here, including sub-messages with details on each protocol (for example, DHCP, DNS, or HTTP).
.google.backstory.Network network = 10;
| Returns | |
|---|---|
| Type | Description |
Network |
The network. |
getNetworkBuilder()
public Network.Builder getNetworkBuilder()All network details go here, including sub-messages with details on each protocol (for example, DHCP, DNS, or HTTP).
.google.backstory.Network network = 10;
| Returns | |
|---|---|
| Type | Description |
Network.Builder |
|
getNetworkOrBuilder()
public NetworkOrBuilder getNetworkOrBuilder()All network details go here, including sub-messages with details on each protocol (for example, DHCP, DNS, or HTTP).
.google.backstory.Network network = 10;
| Returns | |
|---|---|
| Type | Description |
NetworkOrBuilder |
|
getObserver()
public Noun getObserver()Represents an observer entity (for example, a packet sniffer or network-based vulnerability scanner), which is not a direct intermediary, but which observes and reports on the event in question.
.google.backstory.Noun observer = 7;
| Returns | |
|---|---|
| Type | Description |
Noun |
The observer. |
getObserverBuilder()
public Noun.Builder getObserverBuilder()Represents an observer entity (for example, a packet sniffer or network-based vulnerability scanner), which is not a direct intermediary, but which observes and reports on the event in question.
.google.backstory.Noun observer = 7;
| Returns | |
|---|---|
| Type | Description |
Noun.Builder |
|
getObserverOrBuilder()
public NounOrBuilder getObserverOrBuilder()Represents an observer entity (for example, a packet sniffer or network-based vulnerability scanner), which is not a direct intermediary, but which observes and reports on the event in question.
.google.backstory.Noun observer = 7;
| Returns | |
|---|---|
| Type | Description |
NounOrBuilder |
|
getPrincipal()
public Noun getPrincipal()Represents the acting entity that originates the activity described in the event. The principal must include at least one machine detail (hostname, MACs, IPs, port, product-specific identifiers like an EDR asset ID) or user detail (for example, username), and optionally include process details. It must NOT include any of the following fields: email, files, registry keys or values.
.google.backstory.Noun principal = 3;
| Returns | |
|---|---|
| Type | Description |
Noun |
The principal. |
getPrincipalBuilder()
public Noun.Builder getPrincipalBuilder()Represents the acting entity that originates the activity described in the event. The principal must include at least one machine detail (hostname, MACs, IPs, port, product-specific identifiers like an EDR asset ID) or user detail (for example, username), and optionally include process details. It must NOT include any of the following fields: email, files, registry keys or values.
.google.backstory.Noun principal = 3;
| Returns | |
|---|---|
| Type | Description |
Noun.Builder |
|
getPrincipalOrBuilder()
public NounOrBuilder getPrincipalOrBuilder()Represents the acting entity that originates the activity described in the event. The principal must include at least one machine detail (hostname, MACs, IPs, port, product-specific identifiers like an EDR asset ID) or user detail (for example, username), and optionally include process details. It must NOT include any of the following fields: email, files, registry keys or values.
.google.backstory.Noun principal = 3;
| Returns | |
|---|---|
| Type | Description |
NounOrBuilder |
|
getSecurityResult(int index)
public SecurityResult getSecurityResult(int index)A list of security results.
repeated .google.backstory.SecurityResult security_result = 9;
| Parameter | |
|---|---|
| Name | Description |
index |
int |
| Returns | |
|---|---|
| Type | Description |
SecurityResult |
|
getSecurityResultBuilder(int index)
public SecurityResult.Builder getSecurityResultBuilder(int index)A list of security results.
repeated .google.backstory.SecurityResult security_result = 9;
| Parameter | |
|---|---|
| Name | Description |
index |
int |
| Returns | |
|---|---|
| Type | Description |
SecurityResult.Builder |
|
getSecurityResultBuilderList()
public List<SecurityResult.Builder> getSecurityResultBuilderList()A list of security results.
repeated .google.backstory.SecurityResult security_result = 9;
| Returns | |
|---|---|
| Type | Description |
List<Builder> |
|
getSecurityResultCount()
public int getSecurityResultCount()A list of security results.
repeated .google.backstory.SecurityResult security_result = 9;
| Returns | |
|---|---|
| Type | Description |
int |
|
getSecurityResultList()
public List<SecurityResult> getSecurityResultList()A list of security results.
repeated .google.backstory.SecurityResult security_result = 9;
| Returns | |
|---|---|
| Type | Description |
List<SecurityResult> |
|
getSecurityResultOrBuilder(int index)
public SecurityResultOrBuilder getSecurityResultOrBuilder(int index)A list of security results.
repeated .google.backstory.SecurityResult security_result = 9;
| Parameter | |
|---|---|
| Name | Description |
index |
int |
| Returns | |
|---|---|
| Type | Description |
SecurityResultOrBuilder |
|
getSecurityResultOrBuilderList()
public List<? extends SecurityResultOrBuilder> getSecurityResultOrBuilderList()A list of security results.
repeated .google.backstory.SecurityResult security_result = 9;
| Returns | |
|---|---|
| Type | Description |
List<? extends com.google.backstory.SecurityResultOrBuilder> |
|
getSrc()
public Noun getSrc()Represents a source entity being acted upon by the participant along with the device or process context for the source object (the machine where the source object resides). For example, if user U copies file A on machine X to file B on machine Y, both file A and machine X would be specified in the src portion of the UDM event.
.google.backstory.Noun src = 4;
| Returns | |
|---|---|
| Type | Description |
Noun |
The src. |
getSrcBuilder()
public Noun.Builder getSrcBuilder()Represents a source entity being acted upon by the participant along with the device or process context for the source object (the machine where the source object resides). For example, if user U copies file A on machine X to file B on machine Y, both file A and machine X would be specified in the src portion of the UDM event.
.google.backstory.Noun src = 4;
| Returns | |
|---|---|
| Type | Description |
Noun.Builder |
|
getSrcOrBuilder()
public NounOrBuilder getSrcOrBuilder()Represents a source entity being acted upon by the participant along with the device or process context for the source object (the machine where the source object resides). For example, if user U copies file A on machine X to file B on machine Y, both file A and machine X would be specified in the src portion of the UDM event.
.google.backstory.Noun src = 4;
| Returns | |
|---|---|
| Type | Description |
NounOrBuilder |
|
getTarget()
public Noun getTarget()Represents a target entity being referenced by the event or an object on the target entity. For example, in a firewall connection from device A to device B, A is described as the principal and B is described as the target. For a process injection by process C into target process D, process C is described as the principal and process D is described as the target.
.google.backstory.Noun target = 5;
| Returns | |
|---|---|
| Type | Description |
Noun |
The target. |
getTargetBuilder()
public Noun.Builder getTargetBuilder()Represents a target entity being referenced by the event or an object on the target entity. For example, in a firewall connection from device A to device B, A is described as the principal and B is described as the target. For a process injection by process C into target process D, process C is described as the principal and process D is described as the target.
.google.backstory.Noun target = 5;
| Returns | |
|---|---|
| Type | Description |
Noun.Builder |
|
getTargetOrBuilder()
public NounOrBuilder getTargetOrBuilder()Represents a target entity being referenced by the event or an object on the target entity. For example, in a firewall connection from device A to device B, A is described as the principal and B is described as the target. For a process injection by process C into target process D, process C is described as the principal and process D is described as the target.
.google.backstory.Noun target = 5;
| Returns | |
|---|---|
| Type | Description |
NounOrBuilder |
|
hasAdditional()
public boolean hasAdditional()Any important vendor-specific event data that cannot be adequately represented within the formal sections of the UDM model.
.google.protobuf.Struct additional = 2;
| Returns | |
|---|---|
| Type | Description |
boolean |
Whether the additional field is set. |
hasExtensions()
public boolean hasExtensions()All other first-class, event-specific metadata goes in this message. Do not place protocol metadata in Extensions; put it in Network.
.google.backstory.Extensions extensions = 11;
| Returns | |
|---|---|
| Type | Description |
boolean |
Whether the extensions field is set. |
hasExtracted()
public boolean hasExtracted()Flattened fields extracted from the log.
.google.protobuf.Struct extracted = 12;
| Returns | |
|---|---|
| Type | Description |
boolean |
Whether the extracted field is set. |
hasGrouped()
public boolean hasGrouped()Related UDM fields that are grouped together.
optional .google.backstory.GroupedFields grouped = 13;
| Returns | |
|---|---|
| Type | Description |
boolean |
Whether the grouped field is set. |
hasMetadata()
public boolean hasMetadata()Event metadata such as timestamp, source product, etc.
.google.backstory.Metadata metadata = 1;
| Returns | |
|---|---|
| Type | Description |
boolean |
Whether the metadata field is set. |
hasNetwork()
public boolean hasNetwork()All network details go here, including sub-messages with details on each protocol (for example, DHCP, DNS, or HTTP).
.google.backstory.Network network = 10;
| Returns | |
|---|---|
| Type | Description |
boolean |
Whether the network field is set. |
hasObserver()
public boolean hasObserver()Represents an observer entity (for example, a packet sniffer or network-based vulnerability scanner), which is not a direct intermediary, but which observes and reports on the event in question.
.google.backstory.Noun observer = 7;
| Returns | |
|---|---|
| Type | Description |
boolean |
Whether the observer field is set. |
hasPrincipal()
public boolean hasPrincipal()Represents the acting entity that originates the activity described in the event. The principal must include at least one machine detail (hostname, MACs, IPs, port, product-specific identifiers like an EDR asset ID) or user detail (for example, username), and optionally include process details. It must NOT include any of the following fields: email, files, registry keys or values.
.google.backstory.Noun principal = 3;
| Returns | |
|---|---|
| Type | Description |
boolean |
Whether the principal field is set. |
hasSrc()
public boolean hasSrc()Represents a source entity being acted upon by the participant along with the device or process context for the source object (the machine where the source object resides). For example, if user U copies file A on machine X to file B on machine Y, both file A and machine X would be specified in the src portion of the UDM event.
.google.backstory.Noun src = 4;
| Returns | |
|---|---|
| Type | Description |
boolean |
Whether the src field is set. |
hasTarget()
public boolean hasTarget()Represents a target entity being referenced by the event or an object on the target entity. For example, in a firewall connection from device A to device B, A is described as the principal and B is described as the target. For a process injection by process C into target process D, process C is described as the principal and process D is described as the target.
.google.backstory.Noun target = 5;
| Returns | |
|---|---|
| Type | Description |
boolean |
Whether the target field is set. |
internalGetFieldAccessorTable()
protected GeneratedMessage.FieldAccessorTable internalGetFieldAccessorTable()| Returns | |
|---|---|
| Type | Description |
FieldAccessorTable |
|
isInitialized()
public final boolean isInitialized()| Returns | |
|---|---|
| Type | Description |
boolean |
|
mergeAdditional(Struct value)
public UDM.Builder mergeAdditional(Struct value)Any important vendor-specific event data that cannot be adequately represented within the formal sections of the UDM model.
.google.protobuf.Struct additional = 2;
| Parameter | |
|---|---|
| Name | Description |
value |
Struct |
| Returns | |
|---|---|
| Type | Description |
UDM.Builder |
|
mergeExtensions(Extensions value)
public UDM.Builder mergeExtensions(Extensions value)All other first-class, event-specific metadata goes in this message. Do not place protocol metadata in Extensions; put it in Network.
.google.backstory.Extensions extensions = 11;
| Parameter | |
|---|---|
| Name | Description |
value |
Extensions |
| Returns | |
|---|---|
| Type | Description |
UDM.Builder |
|
mergeExtracted(Struct value)
public UDM.Builder mergeExtracted(Struct value)Flattened fields extracted from the log.
.google.protobuf.Struct extracted = 12;
| Parameter | |
|---|---|
| Name | Description |
value |
Struct |
| Returns | |
|---|---|
| Type | Description |
UDM.Builder |
|
mergeFrom(UDM other)
public UDM.Builder mergeFrom(UDM other)| Parameter | |
|---|---|
| Name | Description |
other |
UDM |
| Returns | |
|---|---|
| Type | Description |
UDM.Builder |
|
mergeFrom(CodedInputStream input, ExtensionRegistryLite extensionRegistry)
public UDM.Builder mergeFrom(CodedInputStream input, ExtensionRegistryLite extensionRegistry)| Parameters | |
|---|---|
| Name | Description |
input |
CodedInputStream |
extensionRegistry |
ExtensionRegistryLite |
| Returns | |
|---|---|
| Type | Description |
UDM.Builder |
|
| Exceptions | |
|---|---|
| Type | Description |
IOException |
|
mergeFrom(Message other)
public UDM.Builder mergeFrom(Message other)| Parameter | |
|---|---|
| Name | Description |
other |
Message |
| Returns | |
|---|---|
| Type | Description |
UDM.Builder |
|
mergeGrouped(GroupedFields value)
public UDM.Builder mergeGrouped(GroupedFields value)Related UDM fields that are grouped together.
optional .google.backstory.GroupedFields grouped = 13;
| Parameter | |
|---|---|
| Name | Description |
value |
GroupedFields |
| Returns | |
|---|---|
| Type | Description |
UDM.Builder |
|
mergeMetadata(Metadata value)
public UDM.Builder mergeMetadata(Metadata value)Event metadata such as timestamp, source product, etc.
.google.backstory.Metadata metadata = 1;
| Parameter | |
|---|---|
| Name | Description |
value |
Metadata |
| Returns | |
|---|---|
| Type | Description |
UDM.Builder |
|
mergeNetwork(Network value)
public UDM.Builder mergeNetwork(Network value)All network details go here, including sub-messages with details on each protocol (for example, DHCP, DNS, or HTTP).
.google.backstory.Network network = 10;
| Parameter | |
|---|---|
| Name | Description |
value |
Network |
| Returns | |
|---|---|
| Type | Description |
UDM.Builder |
|
mergeObserver(Noun value)
public UDM.Builder mergeObserver(Noun value)Represents an observer entity (for example, a packet sniffer or network-based vulnerability scanner), which is not a direct intermediary, but which observes and reports on the event in question.
.google.backstory.Noun observer = 7;
| Parameter | |
|---|---|
| Name | Description |
value |
Noun |
| Returns | |
|---|---|
| Type | Description |
UDM.Builder |
|
mergePrincipal(Noun value)
public UDM.Builder mergePrincipal(Noun value)Represents the acting entity that originates the activity described in the event. The principal must include at least one machine detail (hostname, MACs, IPs, port, product-specific identifiers like an EDR asset ID) or user detail (for example, username), and optionally include process details. It must NOT include any of the following fields: email, files, registry keys or values.
.google.backstory.Noun principal = 3;
| Parameter | |
|---|---|
| Name | Description |
value |
Noun |
| Returns | |
|---|---|
| Type | Description |
UDM.Builder |
|
mergeSrc(Noun value)
public UDM.Builder mergeSrc(Noun value)Represents a source entity being acted upon by the participant along with the device or process context for the source object (the machine where the source object resides). For example, if user U copies file A on machine X to file B on machine Y, both file A and machine X would be specified in the src portion of the UDM event.
.google.backstory.Noun src = 4;
| Parameter | |
|---|---|
| Name | Description |
value |
Noun |
| Returns | |
|---|---|
| Type | Description |
UDM.Builder |
|
mergeTarget(Noun value)
public UDM.Builder mergeTarget(Noun value)Represents a target entity being referenced by the event or an object on the target entity. For example, in a firewall connection from device A to device B, A is described as the principal and B is described as the target. For a process injection by process C into target process D, process C is described as the principal and process D is described as the target.
.google.backstory.Noun target = 5;
| Parameter | |
|---|---|
| Name | Description |
value |
Noun |
| Returns | |
|---|---|
| Type | Description |
UDM.Builder |
|
removeAbout(int index)
public UDM.Builder removeAbout(int index)Represents entities referenced by the event that are not otherwise described in principal, src, target, intermediary or observer. For example, it could be used to track email file attachments, domains/URLs/IPs embedded within an email body, and DLLs that are loaded during a PROCESS_LAUNCH event.
repeated .google.backstory.Noun about = 8;
| Parameter | |
|---|---|
| Name | Description |
index |
int |
| Returns | |
|---|---|
| Type | Description |
UDM.Builder |
|
removeIntermediary(int index)
public UDM.Builder removeIntermediary(int index)Represents details on one or more intermediate entities processing activity described in the event. This includes device details about a proxy server or SMTP relay server. If an active event (that has a principal and possibly target) passes through any intermediaries, they're added here. Intermediaries can impact the overall action, for example blocking or modifying an ongoing request. A rule of thumb here is that 'principal', 'target', and description of the initial action should be the same regardless of the intermediary or its action. A successful network connection from A->B should look the same in principal/target/intermediary as one blocked by firewall C: principal: A, target: B (intermediary: C).
repeated .google.backstory.Noun intermediary = 6;
| Parameter | |
|---|---|
| Name | Description |
index |
int |
| Returns | |
|---|---|
| Type | Description |
UDM.Builder |
|
removeSecurityResult(int index)
public UDM.Builder removeSecurityResult(int index)A list of security results.
repeated .google.backstory.SecurityResult security_result = 9;
| Parameter | |
|---|---|
| Name | Description |
index |
int |
| Returns | |
|---|---|
| Type | Description |
UDM.Builder |
|
setAbout(int index, Noun value)
public UDM.Builder setAbout(int index, Noun value)Represents entities referenced by the event that are not otherwise described in principal, src, target, intermediary or observer. For example, it could be used to track email file attachments, domains/URLs/IPs embedded within an email body, and DLLs that are loaded during a PROCESS_LAUNCH event.
repeated .google.backstory.Noun about = 8;
| Parameters | |
|---|---|
| Name | Description |
index |
int |
value |
Noun |
| Returns | |
|---|---|
| Type | Description |
UDM.Builder |
|
setAbout(int index, Noun.Builder builderForValue)
public UDM.Builder setAbout(int index, Noun.Builder builderForValue)Represents entities referenced by the event that are not otherwise described in principal, src, target, intermediary or observer. For example, it could be used to track email file attachments, domains/URLs/IPs embedded within an email body, and DLLs that are loaded during a PROCESS_LAUNCH event.
repeated .google.backstory.Noun about = 8;
| Parameters | |
|---|---|
| Name | Description |
index |
int |
builderForValue |
Noun.Builder |
| Returns | |
|---|---|
| Type | Description |
UDM.Builder |
|
setAdditional(Struct value)
public UDM.Builder setAdditional(Struct value)Any important vendor-specific event data that cannot be adequately represented within the formal sections of the UDM model.
.google.protobuf.Struct additional = 2;
| Parameter | |
|---|---|
| Name | Description |
value |
Struct |
| Returns | |
|---|---|
| Type | Description |
UDM.Builder |
|
setAdditional(Struct.Builder builderForValue)
public UDM.Builder setAdditional(Struct.Builder builderForValue)Any important vendor-specific event data that cannot be adequately represented within the formal sections of the UDM model.
.google.protobuf.Struct additional = 2;
| Parameter | |
|---|---|
| Name | Description |
builderForValue |
Builder |
| Returns | |
|---|---|
| Type | Description |
UDM.Builder |
|
setExtensions(Extensions value)
public UDM.Builder setExtensions(Extensions value)All other first-class, event-specific metadata goes in this message. Do not place protocol metadata in Extensions; put it in Network.
.google.backstory.Extensions extensions = 11;
| Parameter | |
|---|---|
| Name | Description |
value |
Extensions |
| Returns | |
|---|---|
| Type | Description |
UDM.Builder |
|
setExtensions(Extensions.Builder builderForValue)
public UDM.Builder setExtensions(Extensions.Builder builderForValue)All other first-class, event-specific metadata goes in this message. Do not place protocol metadata in Extensions; put it in Network.
.google.backstory.Extensions extensions = 11;
| Parameter | |
|---|---|
| Name | Description |
builderForValue |
Extensions.Builder |
| Returns | |
|---|---|
| Type | Description |
UDM.Builder |
|
setExtracted(Struct value)
public UDM.Builder setExtracted(Struct value)Flattened fields extracted from the log.
.google.protobuf.Struct extracted = 12;
| Parameter | |
|---|---|
| Name | Description |
value |
Struct |
| Returns | |
|---|---|
| Type | Description |
UDM.Builder |
|
setExtracted(Struct.Builder builderForValue)
public UDM.Builder setExtracted(Struct.Builder builderForValue)Flattened fields extracted from the log.
.google.protobuf.Struct extracted = 12;
| Parameter | |
|---|---|
| Name | Description |
builderForValue |
Builder |
| Returns | |
|---|---|
| Type | Description |
UDM.Builder |
|
setGrouped(GroupedFields value)
public UDM.Builder setGrouped(GroupedFields value)Related UDM fields that are grouped together.
optional .google.backstory.GroupedFields grouped = 13;
| Parameter | |
|---|---|
| Name | Description |
value |
GroupedFields |
| Returns | |
|---|---|
| Type | Description |
UDM.Builder |
|
setGrouped(GroupedFields.Builder builderForValue)
public UDM.Builder setGrouped(GroupedFields.Builder builderForValue)Related UDM fields that are grouped together.
optional .google.backstory.GroupedFields grouped = 13;
| Parameter | |
|---|---|
| Name | Description |
builderForValue |
GroupedFields.Builder |
| Returns | |
|---|---|
| Type | Description |
UDM.Builder |
|
setIntermediary(int index, Noun value)
public UDM.Builder setIntermediary(int index, Noun value)Represents details on one or more intermediate entities processing activity described in the event. This includes device details about a proxy server or SMTP relay server. If an active event (that has a principal and possibly target) passes through any intermediaries, they're added here. Intermediaries can impact the overall action, for example blocking or modifying an ongoing request. A rule of thumb here is that 'principal', 'target', and description of the initial action should be the same regardless of the intermediary or its action. A successful network connection from A->B should look the same in principal/target/intermediary as one blocked by firewall C: principal: A, target: B (intermediary: C).
repeated .google.backstory.Noun intermediary = 6;
| Parameters | |
|---|---|
| Name | Description |
index |
int |
value |
Noun |
| Returns | |
|---|---|
| Type | Description |
UDM.Builder |
|
setIntermediary(int index, Noun.Builder builderForValue)
public UDM.Builder setIntermediary(int index, Noun.Builder builderForValue)Represents details on one or more intermediate entities processing activity described in the event. This includes device details about a proxy server or SMTP relay server. If an active event (that has a principal and possibly target) passes through any intermediaries, they're added here. Intermediaries can impact the overall action, for example blocking or modifying an ongoing request. A rule of thumb here is that 'principal', 'target', and description of the initial action should be the same regardless of the intermediary or its action. A successful network connection from A->B should look the same in principal/target/intermediary as one blocked by firewall C: principal: A, target: B (intermediary: C).
repeated .google.backstory.Noun intermediary = 6;
| Parameters | |
|---|---|
| Name | Description |
index |
int |
builderForValue |
Noun.Builder |
| Returns | |
|---|---|
| Type | Description |
UDM.Builder |
|
setMetadata(Metadata value)
public UDM.Builder setMetadata(Metadata value)Event metadata such as timestamp, source product, etc.
.google.backstory.Metadata metadata = 1;
| Parameter | |
|---|---|
| Name | Description |
value |
Metadata |
| Returns | |
|---|---|
| Type | Description |
UDM.Builder |
|
setMetadata(Metadata.Builder builderForValue)
public UDM.Builder setMetadata(Metadata.Builder builderForValue)Event metadata such as timestamp, source product, etc.
.google.backstory.Metadata metadata = 1;
| Parameter | |
|---|---|
| Name | Description |
builderForValue |
Metadata.Builder |
| Returns | |
|---|---|
| Type | Description |
UDM.Builder |
|
setNetwork(Network value)
public UDM.Builder setNetwork(Network value)All network details go here, including sub-messages with details on each protocol (for example, DHCP, DNS, or HTTP).
.google.backstory.Network network = 10;
| Parameter | |
|---|---|
| Name | Description |
value |
Network |
| Returns | |
|---|---|
| Type | Description |
UDM.Builder |
|
setNetwork(Network.Builder builderForValue)
public UDM.Builder setNetwork(Network.Builder builderForValue)All network details go here, including sub-messages with details on each protocol (for example, DHCP, DNS, or HTTP).
.google.backstory.Network network = 10;
| Parameter | |
|---|---|
| Name | Description |
builderForValue |
Network.Builder |
| Returns | |
|---|---|
| Type | Description |
UDM.Builder |
|
setObserver(Noun value)
public UDM.Builder setObserver(Noun value)Represents an observer entity (for example, a packet sniffer or network-based vulnerability scanner), which is not a direct intermediary, but which observes and reports on the event in question.
.google.backstory.Noun observer = 7;
| Parameter | |
|---|---|
| Name | Description |
value |
Noun |
| Returns | |
|---|---|
| Type | Description |
UDM.Builder |
|
setObserver(Noun.Builder builderForValue)
public UDM.Builder setObserver(Noun.Builder builderForValue)Represents an observer entity (for example, a packet sniffer or network-based vulnerability scanner), which is not a direct intermediary, but which observes and reports on the event in question.
.google.backstory.Noun observer = 7;
| Parameter | |
|---|---|
| Name | Description |
builderForValue |
Noun.Builder |
| Returns | |
|---|---|
| Type | Description |
UDM.Builder |
|
setPrincipal(Noun value)
public UDM.Builder setPrincipal(Noun value)Represents the acting entity that originates the activity described in the event. The principal must include at least one machine detail (hostname, MACs, IPs, port, product-specific identifiers like an EDR asset ID) or user detail (for example, username), and optionally include process details. It must NOT include any of the following fields: email, files, registry keys or values.
.google.backstory.Noun principal = 3;
| Parameter | |
|---|---|
| Name | Description |
value |
Noun |
| Returns | |
|---|---|
| Type | Description |
UDM.Builder |
|
setPrincipal(Noun.Builder builderForValue)
public UDM.Builder setPrincipal(Noun.Builder builderForValue)Represents the acting entity that originates the activity described in the event. The principal must include at least one machine detail (hostname, MACs, IPs, port, product-specific identifiers like an EDR asset ID) or user detail (for example, username), and optionally include process details. It must NOT include any of the following fields: email, files, registry keys or values.
.google.backstory.Noun principal = 3;
| Parameter | |
|---|---|
| Name | Description |
builderForValue |
Noun.Builder |
| Returns | |
|---|---|
| Type | Description |
UDM.Builder |
|
setSecurityResult(int index, SecurityResult value)
public UDM.Builder setSecurityResult(int index, SecurityResult value)A list of security results.
repeated .google.backstory.SecurityResult security_result = 9;
| Parameters | |
|---|---|
| Name | Description |
index |
int |
value |
SecurityResult |
| Returns | |
|---|---|
| Type | Description |
UDM.Builder |
|
setSecurityResult(int index, SecurityResult.Builder builderForValue)
public UDM.Builder setSecurityResult(int index, SecurityResult.Builder builderForValue)A list of security results.
repeated .google.backstory.SecurityResult security_result = 9;
| Parameters | |
|---|---|
| Name | Description |
index |
int |
builderForValue |
SecurityResult.Builder |
| Returns | |
|---|---|
| Type | Description |
UDM.Builder |
|
setSrc(Noun value)
public UDM.Builder setSrc(Noun value)Represents a source entity being acted upon by the participant along with the device or process context for the source object (the machine where the source object resides). For example, if user U copies file A on machine X to file B on machine Y, both file A and machine X would be specified in the src portion of the UDM event.
.google.backstory.Noun src = 4;
| Parameter | |
|---|---|
| Name | Description |
value |
Noun |
| Returns | |
|---|---|
| Type | Description |
UDM.Builder |
|
setSrc(Noun.Builder builderForValue)
public UDM.Builder setSrc(Noun.Builder builderForValue)Represents a source entity being acted upon by the participant along with the device or process context for the source object (the machine where the source object resides). For example, if user U copies file A on machine X to file B on machine Y, both file A and machine X would be specified in the src portion of the UDM event.
.google.backstory.Noun src = 4;
| Parameter | |
|---|---|
| Name | Description |
builderForValue |
Noun.Builder |
| Returns | |
|---|---|
| Type | Description |
UDM.Builder |
|
setTarget(Noun value)
public UDM.Builder setTarget(Noun value)Represents a target entity being referenced by the event or an object on the target entity. For example, in a firewall connection from device A to device B, A is described as the principal and B is described as the target. For a process injection by process C into target process D, process C is described as the principal and process D is described as the target.
.google.backstory.Noun target = 5;
| Parameter | |
|---|---|
| Name | Description |
value |
Noun |
| Returns | |
|---|---|
| Type | Description |
UDM.Builder |
|
setTarget(Noun.Builder builderForValue)
public UDM.Builder setTarget(Noun.Builder builderForValue)Represents a target entity being referenced by the event or an object on the target entity. For example, in a firewall connection from device A to device B, A is described as the principal and B is described as the target. For a process injection by process C into target process D, process C is described as the principal and process D is described as the target.
.google.backstory.Noun target = 5;
| Parameter | |
|---|---|
| Name | Description |
builderForValue |
Noun.Builder |
| Returns | |
|---|---|
| Type | Description |
UDM.Builder |
|