public interface UDMOrBuilder extends MessageOrBuilderImplements
MessageOrBuilderMethods
getAbout(int index)
public abstract Noun getAbout(int index)Represents entities referenced by the event that are not otherwise described in principal, src, target, intermediary or observer. For example, it could be used to track email file attachments, domains/URLs/IPs embedded within an email body, and DLLs that are loaded during a PROCESS_LAUNCH event.
repeated .google.backstory.Noun about = 8;
| Parameter | |
|---|---|
| Name | Description |
index |
int |
| Returns | |
|---|---|
| Type | Description |
Noun |
|
getAboutCount()
public abstract int getAboutCount()Represents entities referenced by the event that are not otherwise described in principal, src, target, intermediary or observer. For example, it could be used to track email file attachments, domains/URLs/IPs embedded within an email body, and DLLs that are loaded during a PROCESS_LAUNCH event.
repeated .google.backstory.Noun about = 8;
| Returns | |
|---|---|
| Type | Description |
int |
|
getAboutList()
public abstract List<Noun> getAboutList()Represents entities referenced by the event that are not otherwise described in principal, src, target, intermediary or observer. For example, it could be used to track email file attachments, domains/URLs/IPs embedded within an email body, and DLLs that are loaded during a PROCESS_LAUNCH event.
repeated .google.backstory.Noun about = 8;
| Returns | |
|---|---|
| Type | Description |
List<Noun> |
|
getAboutOrBuilder(int index)
public abstract NounOrBuilder getAboutOrBuilder(int index)Represents entities referenced by the event that are not otherwise described in principal, src, target, intermediary or observer. For example, it could be used to track email file attachments, domains/URLs/IPs embedded within an email body, and DLLs that are loaded during a PROCESS_LAUNCH event.
repeated .google.backstory.Noun about = 8;
| Parameter | |
|---|---|
| Name | Description |
index |
int |
| Returns | |
|---|---|
| Type | Description |
NounOrBuilder |
|
getAboutOrBuilderList()
public abstract List<? extends NounOrBuilder> getAboutOrBuilderList()Represents entities referenced by the event that are not otherwise described in principal, src, target, intermediary or observer. For example, it could be used to track email file attachments, domains/URLs/IPs embedded within an email body, and DLLs that are loaded during a PROCESS_LAUNCH event.
repeated .google.backstory.Noun about = 8;
| Returns | |
|---|---|
| Type | Description |
List<? extends com.google.backstory.NounOrBuilder> |
|
getAdditional()
public abstract Struct getAdditional()Any important vendor-specific event data that cannot be adequately represented within the formal sections of the UDM model.
.google.protobuf.Struct additional = 2;
| Returns | |
|---|---|
| Type | Description |
Struct |
The additional. |
getAdditionalOrBuilder()
public abstract StructOrBuilder getAdditionalOrBuilder()Any important vendor-specific event data that cannot be adequately represented within the formal sections of the UDM model.
.google.protobuf.Struct additional = 2;
| Returns | |
|---|---|
| Type | Description |
StructOrBuilder |
|
getExtensions()
public abstract Extensions getExtensions()All other first-class, event-specific metadata goes in this message. Do not place protocol metadata in Extensions; put it in Network.
.google.backstory.Extensions extensions = 11;
| Returns | |
|---|---|
| Type | Description |
Extensions |
The extensions. |
getExtensionsOrBuilder()
public abstract ExtensionsOrBuilder getExtensionsOrBuilder()All other first-class, event-specific metadata goes in this message. Do not place protocol metadata in Extensions; put it in Network.
.google.backstory.Extensions extensions = 11;
| Returns | |
|---|---|
| Type | Description |
ExtensionsOrBuilder |
|
getExtracted()
public abstract Struct getExtracted()Flattened fields extracted from the log.
.google.protobuf.Struct extracted = 12;
| Returns | |
|---|---|
| Type | Description |
Struct |
The extracted. |
getExtractedOrBuilder()
public abstract StructOrBuilder getExtractedOrBuilder()Flattened fields extracted from the log.
.google.protobuf.Struct extracted = 12;
| Returns | |
|---|---|
| Type | Description |
StructOrBuilder |
|
getGrouped()
public abstract GroupedFields getGrouped()Related UDM fields that are grouped together.
optional .google.backstory.GroupedFields grouped = 13;
| Returns | |
|---|---|
| Type | Description |
GroupedFields |
The grouped. |
getGroupedOrBuilder()
public abstract GroupedFieldsOrBuilder getGroupedOrBuilder()Related UDM fields that are grouped together.
optional .google.backstory.GroupedFields grouped = 13;
| Returns | |
|---|---|
| Type | Description |
GroupedFieldsOrBuilder |
|
getIntermediary(int index)
public abstract Noun getIntermediary(int index)Represents details on one or more intermediate entities processing activity described in the event. This includes device details about a proxy server or SMTP relay server. If an active event (that has a principal and possibly target) passes through any intermediaries, they're added here. Intermediaries can impact the overall action, for example blocking or modifying an ongoing request. A rule of thumb here is that 'principal', 'target', and description of the initial action should be the same regardless of the intermediary or its action. A successful network connection from A->B should look the same in principal/target/intermediary as one blocked by firewall C: principal: A, target: B (intermediary: C).
repeated .google.backstory.Noun intermediary = 6;
| Parameter | |
|---|---|
| Name | Description |
index |
int |
| Returns | |
|---|---|
| Type | Description |
Noun |
|
getIntermediaryCount()
public abstract int getIntermediaryCount()Represents details on one or more intermediate entities processing activity described in the event. This includes device details about a proxy server or SMTP relay server. If an active event (that has a principal and possibly target) passes through any intermediaries, they're added here. Intermediaries can impact the overall action, for example blocking or modifying an ongoing request. A rule of thumb here is that 'principal', 'target', and description of the initial action should be the same regardless of the intermediary or its action. A successful network connection from A->B should look the same in principal/target/intermediary as one blocked by firewall C: principal: A, target: B (intermediary: C).
repeated .google.backstory.Noun intermediary = 6;
| Returns | |
|---|---|
| Type | Description |
int |
|
getIntermediaryList()
public abstract List<Noun> getIntermediaryList()Represents details on one or more intermediate entities processing activity described in the event. This includes device details about a proxy server or SMTP relay server. If an active event (that has a principal and possibly target) passes through any intermediaries, they're added here. Intermediaries can impact the overall action, for example blocking or modifying an ongoing request. A rule of thumb here is that 'principal', 'target', and description of the initial action should be the same regardless of the intermediary or its action. A successful network connection from A->B should look the same in principal/target/intermediary as one blocked by firewall C: principal: A, target: B (intermediary: C).
repeated .google.backstory.Noun intermediary = 6;
| Returns | |
|---|---|
| Type | Description |
List<Noun> |
|
getIntermediaryOrBuilder(int index)
public abstract NounOrBuilder getIntermediaryOrBuilder(int index)Represents details on one or more intermediate entities processing activity described in the event. This includes device details about a proxy server or SMTP relay server. If an active event (that has a principal and possibly target) passes through any intermediaries, they're added here. Intermediaries can impact the overall action, for example blocking or modifying an ongoing request. A rule of thumb here is that 'principal', 'target', and description of the initial action should be the same regardless of the intermediary or its action. A successful network connection from A->B should look the same in principal/target/intermediary as one blocked by firewall C: principal: A, target: B (intermediary: C).
repeated .google.backstory.Noun intermediary = 6;
| Parameter | |
|---|---|
| Name | Description |
index |
int |
| Returns | |
|---|---|
| Type | Description |
NounOrBuilder |
|
getIntermediaryOrBuilderList()
public abstract List<? extends NounOrBuilder> getIntermediaryOrBuilderList()Represents details on one or more intermediate entities processing activity described in the event. This includes device details about a proxy server or SMTP relay server. If an active event (that has a principal and possibly target) passes through any intermediaries, they're added here. Intermediaries can impact the overall action, for example blocking or modifying an ongoing request. A rule of thumb here is that 'principal', 'target', and description of the initial action should be the same regardless of the intermediary or its action. A successful network connection from A->B should look the same in principal/target/intermediary as one blocked by firewall C: principal: A, target: B (intermediary: C).
repeated .google.backstory.Noun intermediary = 6;
| Returns | |
|---|---|
| Type | Description |
List<? extends com.google.backstory.NounOrBuilder> |
|
getMetadata()
public abstract Metadata getMetadata()Event metadata such as timestamp, source product, etc.
.google.backstory.Metadata metadata = 1;
| Returns | |
|---|---|
| Type | Description |
Metadata |
The metadata. |
getMetadataOrBuilder()
public abstract MetadataOrBuilder getMetadataOrBuilder()Event metadata such as timestamp, source product, etc.
.google.backstory.Metadata metadata = 1;
| Returns | |
|---|---|
| Type | Description |
MetadataOrBuilder |
|
getNetwork()
public abstract Network getNetwork()All network details go here, including sub-messages with details on each protocol (for example, DHCP, DNS, or HTTP).
.google.backstory.Network network = 10;
| Returns | |
|---|---|
| Type | Description |
Network |
The network. |
getNetworkOrBuilder()
public abstract NetworkOrBuilder getNetworkOrBuilder()All network details go here, including sub-messages with details on each protocol (for example, DHCP, DNS, or HTTP).
.google.backstory.Network network = 10;
| Returns | |
|---|---|
| Type | Description |
NetworkOrBuilder |
|
getObserver()
public abstract Noun getObserver()Represents an observer entity (for example, a packet sniffer or network-based vulnerability scanner), which is not a direct intermediary, but which observes and reports on the event in question.
.google.backstory.Noun observer = 7;
| Returns | |
|---|---|
| Type | Description |
Noun |
The observer. |
getObserverOrBuilder()
public abstract NounOrBuilder getObserverOrBuilder()Represents an observer entity (for example, a packet sniffer or network-based vulnerability scanner), which is not a direct intermediary, but which observes and reports on the event in question.
.google.backstory.Noun observer = 7;
| Returns | |
|---|---|
| Type | Description |
NounOrBuilder |
|
getPrincipal()
public abstract Noun getPrincipal()Represents the acting entity that originates the activity described in the event. The principal must include at least one machine detail (hostname, MACs, IPs, port, product-specific identifiers like an EDR asset ID) or user detail (for example, username), and optionally include process details. It must NOT include any of the following fields: email, files, registry keys or values.
.google.backstory.Noun principal = 3;
| Returns | |
|---|---|
| Type | Description |
Noun |
The principal. |
getPrincipalOrBuilder()
public abstract NounOrBuilder getPrincipalOrBuilder()Represents the acting entity that originates the activity described in the event. The principal must include at least one machine detail (hostname, MACs, IPs, port, product-specific identifiers like an EDR asset ID) or user detail (for example, username), and optionally include process details. It must NOT include any of the following fields: email, files, registry keys or values.
.google.backstory.Noun principal = 3;
| Returns | |
|---|---|
| Type | Description |
NounOrBuilder |
|
getSecurityResult(int index)
public abstract SecurityResult getSecurityResult(int index)A list of security results.
repeated .google.backstory.SecurityResult security_result = 9;
| Parameter | |
|---|---|
| Name | Description |
index |
int |
| Returns | |
|---|---|
| Type | Description |
SecurityResult |
|
getSecurityResultCount()
public abstract int getSecurityResultCount()A list of security results.
repeated .google.backstory.SecurityResult security_result = 9;
| Returns | |
|---|---|
| Type | Description |
int |
|
getSecurityResultList()
public abstract List<SecurityResult> getSecurityResultList()A list of security results.
repeated .google.backstory.SecurityResult security_result = 9;
| Returns | |
|---|---|
| Type | Description |
List<SecurityResult> |
|
getSecurityResultOrBuilder(int index)
public abstract SecurityResultOrBuilder getSecurityResultOrBuilder(int index)A list of security results.
repeated .google.backstory.SecurityResult security_result = 9;
| Parameter | |
|---|---|
| Name | Description |
index |
int |
| Returns | |
|---|---|
| Type | Description |
SecurityResultOrBuilder |
|
getSecurityResultOrBuilderList()
public abstract List<? extends SecurityResultOrBuilder> getSecurityResultOrBuilderList()A list of security results.
repeated .google.backstory.SecurityResult security_result = 9;
| Returns | |
|---|---|
| Type | Description |
List<? extends com.google.backstory.SecurityResultOrBuilder> |
|
getSrc()
public abstract Noun getSrc()Represents a source entity being acted upon by the participant along with the device or process context for the source object (the machine where the source object resides). For example, if user U copies file A on machine X to file B on machine Y, both file A and machine X would be specified in the src portion of the UDM event.
.google.backstory.Noun src = 4;
| Returns | |
|---|---|
| Type | Description |
Noun |
The src. |
getSrcOrBuilder()
public abstract NounOrBuilder getSrcOrBuilder()Represents a source entity being acted upon by the participant along with the device or process context for the source object (the machine where the source object resides). For example, if user U copies file A on machine X to file B on machine Y, both file A and machine X would be specified in the src portion of the UDM event.
.google.backstory.Noun src = 4;
| Returns | |
|---|---|
| Type | Description |
NounOrBuilder |
|
getTarget()
public abstract Noun getTarget()Represents a target entity being referenced by the event or an object on the target entity. For example, in a firewall connection from device A to device B, A is described as the principal and B is described as the target. For a process injection by process C into target process D, process C is described as the principal and process D is described as the target.
.google.backstory.Noun target = 5;
| Returns | |
|---|---|
| Type | Description |
Noun |
The target. |
getTargetOrBuilder()
public abstract NounOrBuilder getTargetOrBuilder()Represents a target entity being referenced by the event or an object on the target entity. For example, in a firewall connection from device A to device B, A is described as the principal and B is described as the target. For a process injection by process C into target process D, process C is described as the principal and process D is described as the target.
.google.backstory.Noun target = 5;
| Returns | |
|---|---|
| Type | Description |
NounOrBuilder |
|
hasAdditional()
public abstract boolean hasAdditional()Any important vendor-specific event data that cannot be adequately represented within the formal sections of the UDM model.
.google.protobuf.Struct additional = 2;
| Returns | |
|---|---|
| Type | Description |
boolean |
Whether the additional field is set. |
hasExtensions()
public abstract boolean hasExtensions()All other first-class, event-specific metadata goes in this message. Do not place protocol metadata in Extensions; put it in Network.
.google.backstory.Extensions extensions = 11;
| Returns | |
|---|---|
| Type | Description |
boolean |
Whether the extensions field is set. |
hasExtracted()
public abstract boolean hasExtracted()Flattened fields extracted from the log.
.google.protobuf.Struct extracted = 12;
| Returns | |
|---|---|
| Type | Description |
boolean |
Whether the extracted field is set. |
hasGrouped()
public abstract boolean hasGrouped()Related UDM fields that are grouped together.
optional .google.backstory.GroupedFields grouped = 13;
| Returns | |
|---|---|
| Type | Description |
boolean |
Whether the grouped field is set. |
hasMetadata()
public abstract boolean hasMetadata()Event metadata such as timestamp, source product, etc.
.google.backstory.Metadata metadata = 1;
| Returns | |
|---|---|
| Type | Description |
boolean |
Whether the metadata field is set. |
hasNetwork()
public abstract boolean hasNetwork()All network details go here, including sub-messages with details on each protocol (for example, DHCP, DNS, or HTTP).
.google.backstory.Network network = 10;
| Returns | |
|---|---|
| Type | Description |
boolean |
Whether the network field is set. |
hasObserver()
public abstract boolean hasObserver()Represents an observer entity (for example, a packet sniffer or network-based vulnerability scanner), which is not a direct intermediary, but which observes and reports on the event in question.
.google.backstory.Noun observer = 7;
| Returns | |
|---|---|
| Type | Description |
boolean |
Whether the observer field is set. |
hasPrincipal()
public abstract boolean hasPrincipal()Represents the acting entity that originates the activity described in the event. The principal must include at least one machine detail (hostname, MACs, IPs, port, product-specific identifiers like an EDR asset ID) or user detail (for example, username), and optionally include process details. It must NOT include any of the following fields: email, files, registry keys or values.
.google.backstory.Noun principal = 3;
| Returns | |
|---|---|
| Type | Description |
boolean |
Whether the principal field is set. |
hasSrc()
public abstract boolean hasSrc()Represents a source entity being acted upon by the participant along with the device or process context for the source object (the machine where the source object resides). For example, if user U copies file A on machine X to file B on machine Y, both file A and machine X would be specified in the src portion of the UDM event.
.google.backstory.Noun src = 4;
| Returns | |
|---|---|
| Type | Description |
boolean |
Whether the src field is set. |
hasTarget()
public abstract boolean hasTarget()Represents a target entity being referenced by the event or an object on the target entity. For example, in a firewall connection from device A to device B, A is described as the principal and B is described as the target. For a process injection by process C into target process D, process C is described as the principal and process D is described as the target.
.google.backstory.Noun target = 5;
| Returns | |
|---|---|
| Type | Description |
boolean |
Whether the target field is set. |