Chronicle V1 API - Class Google::Backstory::Collection (v1.4.0)

Reference documentation and code samples for the Chronicle V1 API class Google::Backstory::Collection.

Collection represents a container of objects (such as events, entity context metadata, detection finding metadata) and state (such as investigation details).

An example use case for Collection is to model a detection and investigation from detection finding metadata to investigative state collected in the course of the investigation. For more complex investigation and response workflows a Collection could represent an incident consisting of multiple child findings or incidents. This can be expanded on to model remediation elements of a full detection and response workflow.

Inherits

  • Object

Extended By

  • Google::Protobuf::MessageExts::ClassMethods

Includes

  • Google::Protobuf::MessageExts

Methods

#case_name

def case_name() -> ::String
Returns
  • (::String) — The resource name of the Case that this collection belongs to. Example: projects/{project id}/locations/{region}/chronicle/cases/{internal_case_id}

#case_name=

def case_name=(value) -> ::String
Parameter
  • value (::String) — The resource name of the Case that this collection belongs to. Example: projects/{project id}/locations/{region}/chronicle/cases/{internal_case_id}
Returns
  • (::String) — The resource name of the Case that this collection belongs to. Example: projects/{project id}/locations/{region}/chronicle/cases/{internal_case_id}

#collection_elements

def collection_elements() -> ::Array<::Google::Backstory::Element>
Returns
  • (::Array<::Google::Backstory::Element>) — Constituent elements of the collection. Each element shares an association that groups it together and is a component of the overall collection. For example, a detection collection may have several constituent elements that each share a correlation association that together represent a particular pattern or behavior.

#collection_elements=

def collection_elements=(value) -> ::Array<::Google::Backstory::Element>
Parameter
  • value (::Array<::Google::Backstory::Element>) — Constituent elements of the collection. Each element shares an association that groups it together and is a component of the overall collection. For example, a detection collection may have several constituent elements that each share a correlation association that together represent a particular pattern or behavior.
Returns
  • (::Array<::Google::Backstory::Element>) — Constituent elements of the collection. Each element shares an association that groups it together and is a component of the overall collection. For example, a detection collection may have several constituent elements that each share a correlation association that together represent a particular pattern or behavior.

#created_time

def created_time() -> ::Google::Protobuf::Timestamp
Returns

#created_time=

def created_time=(value) -> ::Google::Protobuf::Timestamp
Parameter
Returns

#data_access_scope

def data_access_scope() -> ::String
Returns
  • (::String) — The resource name of the DataAccessScope of this collection.

#data_access_scope=

def data_access_scope=(value) -> ::String
Parameter
  • value (::String) — The resource name of the DataAccessScope of this collection.
Returns
  • (::String) — The resource name of the DataAccessScope of this collection.

#detection

def detection() -> ::Array<::Google::Backstory::SecurityResult>
Returns
  • (::Array<::Google::Backstory::SecurityResult>) — Detection metadata for findings that represent detections, can include rule details, machine learning model metadata, and indicators implicated in the detection (using the .about field).

#detection=

def detection=(value) -> ::Array<::Google::Backstory::SecurityResult>
Parameter
  • value (::Array<::Google::Backstory::SecurityResult>) — Detection metadata for findings that represent detections, can include rule details, machine learning model metadata, and indicators implicated in the detection (using the .about field).
Returns
  • (::Array<::Google::Backstory::SecurityResult>) — Detection metadata for findings that represent detections, can include rule details, machine learning model metadata, and indicators implicated in the detection (using the .about field).

#detection_time

def detection_time() -> ::Google::Protobuf::Timestamp
Returns
  • (::Google::Protobuf::Timestamp) — Timestamp within the time_window related to the time of the collection_elements. For Rule Detections, this timestamp is the end of the the time_window for multi-event rules or the time of the event for single event rules. For late-arriving events that trigger new alerts, the detection_time will be the event time of the event.

#detection_time=

def detection_time=(value) -> ::Google::Protobuf::Timestamp
Parameter
  • value (::Google::Protobuf::Timestamp) — Timestamp within the time_window related to the time of the collection_elements. For Rule Detections, this timestamp is the end of the the time_window for multi-event rules or the time of the event for single event rules. For late-arriving events that trigger new alerts, the detection_time will be the event time of the event.
Returns
  • (::Google::Protobuf::Timestamp) — Timestamp within the time_window related to the time of the collection_elements. For Rule Detections, this timestamp is the end of the the time_window for multi-event rules or the time of the event for single event rules. For late-arriving events that trigger new alerts, the detection_time will be the event time of the event.

#detection_timing_details

def detection_timing_details() -> ::Array<::Google::Backstory::Collection::DetectionTimingDetails>
Returns

#detection_timing_details=

def detection_timing_details=(value) -> ::Array<::Google::Backstory::Collection::DetectionTimingDetails>
Parameter
Returns

#id

def id() -> ::String
Returns
  • (::String) — Unique ID for the collection. The ID is specific to the type of collection. For example, with rule detections this is the detection ID.

#id=

def id=(value) -> ::String
Parameter
  • value (::String) — Unique ID for the collection. The ID is specific to the type of collection. For example, with rule detections this is the detection ID.
Returns
  • (::String) — Unique ID for the collection. The ID is specific to the type of collection. For example, with rule detections this is the detection ID.

#id_namespace

def id_namespace() -> ::Google::Backstory::Id::Namespace
Returns

#id_namespace=

def id_namespace=(value) -> ::Google::Backstory::Id::Namespace
Parameter
Returns

#investigation

def investigation() -> ::Google::Backstory::Investigation
Returns
  • (::Google::Backstory::Investigation) — Consolidated investigation details (categorization, status, etc) typically for collections that begin as detection findings and then evolve with analyst action and feedback into investigations around the detection output.

#investigation=

def investigation=(value) -> ::Google::Backstory::Investigation
Parameter
  • value (::Google::Backstory::Investigation) — Consolidated investigation details (categorization, status, etc) typically for collections that begin as detection findings and then evolve with analyst action and feedback into investigations around the detection output.
Returns
  • (::Google::Backstory::Investigation) — Consolidated investigation details (categorization, status, etc) typically for collections that begin as detection findings and then evolve with analyst action and feedback into investigations around the detection output.

#last_updated_time

def last_updated_time() -> ::Google::Protobuf::Timestamp
Returns

#last_updated_time=

def last_updated_time=(value) -> ::Google::Protobuf::Timestamp
Parameter
Returns

#latency_metrics

def latency_metrics() -> ::Google::Backstory::LatencyMetrics
Returns
  • (::Google::Backstory::LatencyMetrics) — The latency metrics for the specific detection. These metrics are calculated from ALL of the events that contribute to the detection, not just the sampled ones.

#latency_metrics=

def latency_metrics=(value) -> ::Google::Backstory::LatencyMetrics
Parameter
  • value (::Google::Backstory::LatencyMetrics) — The latency metrics for the specific detection. These metrics are calculated from ALL of the events that contribute to the detection, not just the sampled ones.
Returns
  • (::Google::Backstory::LatencyMetrics) — The latency metrics for the specific detection. These metrics are calculated from ALL of the events that contribute to the detection, not just the sampled ones.

#response_platform_info

def response_platform_info() -> ::Google::Backstory::ResponsePlatformInfo
Returns

#response_platform_info=

def response_platform_info=(value) -> ::Google::Backstory::ResponsePlatformInfo
Parameter
Returns

#rule_run_frequency

def rule_run_frequency() -> ::Google::Backstory::Collection::RunFrequency
Returns

#rule_run_frequency=

def rule_run_frequency=(value) -> ::Google::Backstory::Collection::RunFrequency
Parameter
Returns

#simulated_event_count

def simulated_event_count() -> ::Integer
Returns
  • (::Integer) — The total number of simulated events that contributed to this detection. Simulated events are realistic threat sequences (Raw Logs or UDM) programmatically delivered into the production ingestion pipeline to verify the entire detection lifecycle—from identification to action.

#simulated_event_count=

def simulated_event_count=(value) -> ::Integer
Parameter
  • value (::Integer) — The total number of simulated events that contributed to this detection. Simulated events are realistic threat sequences (Raw Logs or UDM) programmatically delivered into the production ingestion pipeline to verify the entire detection lifecycle—from identification to action.
Returns
  • (::Integer) — The total number of simulated events that contributed to this detection. Simulated events are realistic threat sequences (Raw Logs or UDM) programmatically delivered into the production ingestion pipeline to verify the entire detection lifecycle—from identification to action.

#simulated_event_names

def simulated_event_names() -> ::Array<::String>
Returns
  • (::Array<::String>) — The set of all values from event ingestion_labels where SIMULATED is set as the key, for all simulated events that participated in this detection.

#simulated_event_names=

def simulated_event_names=(value) -> ::Array<::String>
Parameter
  • value (::Array<::String>) — The set of all values from event ingestion_labels where SIMULATED is set as the key, for all simulated events that participated in this detection.
Returns
  • (::Array<::String>) — The set of all values from event ingestion_labels where SIMULATED is set as the key, for all simulated events that participated in this detection.

#soar_alert

def soar_alert() -> ::Boolean
Returns
  • (::Boolean) — A boolean field indicating that the alert is present in SOAR.

#soar_alert=

def soar_alert=(value) -> ::Boolean
Parameter
  • value (::Boolean) — A boolean field indicating that the alert is present in SOAR.
Returns
  • (::Boolean) — A boolean field indicating that the alert is present in SOAR.

#soar_alert_metadata

def soar_alert_metadata() -> ::Google::Backstory::SoarAlertMetadata
Returns

#soar_alert_metadata=

def soar_alert_metadata=(value) -> ::Google::Backstory::SoarAlertMetadata
Parameter
Returns

#tags

def tags() -> ::Array<::String>
Returns
  • (::Array<::String>) — Tags set by UC/DSML/RE for the Finding during creation.

#tags=

def tags=(value) -> ::Array<::String>
Parameter
  • value (::Array<::String>) — Tags set by UC/DSML/RE for the Finding during creation.
Returns
  • (::Array<::String>) — Tags set by UC/DSML/RE for the Finding during creation.

#time_window

def time_window() -> ::Google::Type::Interval
Returns

#time_window=

def time_window=(value) -> ::Google::Type::Interval
Parameter
Returns

#type

def type() -> ::Google::Backstory::Collection::CollectionType
Returns

#type=

def type=(value) -> ::Google::Backstory::Collection::CollectionType
Parameter
Returns