Reference documentation and code samples for the Chronicle V1 API class Google::Backstory::Element.
Inherits
- Object
Extended By
- Google::Protobuf::MessageExts::ClassMethods
Includes
- Google::Protobuf::MessageExts
Methods
#association
def association() -> ::Google::Backstory::SecurityResult
Returns
- (::Google::Backstory::SecurityResult) — Metadata that provides the relevant association for the references in the element. For a detection, this can be the correlated aspect of the references that contributed to the overall detection. For example, may include sub-rule condition, machine learning model metadata, and/or indicators implicated in this component of the detection (using the .about field).
#association=
def association=(value) -> ::Google::Backstory::SecurityResult
Parameter
- value (::Google::Backstory::SecurityResult) — Metadata that provides the relevant association for the references in the element. For a detection, this can be the correlated aspect of the references that contributed to the overall detection. For example, may include sub-rule condition, machine learning model metadata, and/or indicators implicated in this component of the detection (using the .about field).
Returns
- (::Google::Backstory::SecurityResult) — Metadata that provides the relevant association for the references in the element. For a detection, this can be the correlated aspect of the references that contributed to the overall detection. For example, may include sub-rule condition, machine learning model metadata, and/or indicators implicated in this component of the detection (using the .about field).
#label
def label() -> ::String
Returns
- (::String) — A name that labels the entire references group.
#label=
def label=(value) -> ::String
Parameter
- value (::String) — A name that labels the entire references group.
Returns
- (::String) — A name that labels the entire references group.
#latency_metrics
def latency_metrics() -> ::Google::Backstory::LatencyMetrics
Returns
- (::Google::Backstory::LatencyMetrics) — Latency metrics for the specific element. These are calculated from all the contributing events or entities for a single event variable, not just the sampled ones included in references. This is currently only populated for UDM events.
#latency_metrics=
def latency_metrics=(value) -> ::Google::Backstory::LatencyMetrics
Parameter
- value (::Google::Backstory::LatencyMetrics) — Latency metrics for the specific element. These are calculated from all the contributing events or entities for a single event variable, not just the sampled ones included in references. This is currently only populated for UDM events.
Returns
- (::Google::Backstory::LatencyMetrics) — Latency metrics for the specific element. These are calculated from all the contributing events or entities for a single event variable, not just the sampled ones included in references. This is currently only populated for UDM events.
#references
def references() -> ::Array<::Google::Backstory::Reference>
Returns
- (::Array<::Google::Backstory::Reference>) — References to model primatives including events and entities that share a common association. Even though a reference can have both UDM and entity, a collection of references (of a single element) will only have one type of message in it (either UDM / Entity).
#references=
def references=(value) -> ::Array<::Google::Backstory::Reference>
Parameter
- value (::Array<::Google::Backstory::Reference>) — References to model primatives including events and entities that share a common association. Even though a reference can have both UDM and entity, a collection of references (of a single element) will only have one type of message in it (either UDM / Entity).
Returns
- (::Array<::Google::Backstory::Reference>) — References to model primatives including events and entities that share a common association. Even though a reference can have both UDM and entity, a collection of references (of a single element) will only have one type of message in it (either UDM / Entity).
#references_sampled
def references_sampled() -> ::Boolean
Returns
- (::Boolean) — Copied from the detection event_sample.too_many_event_samples field. If true, the number of references will be capped at the sample limit (set at rule service). This is applicable to both UDM references and Entity references.
#references_sampled=
def references_sampled=(value) -> ::Boolean
Parameter
- value (::Boolean) — Copied from the detection event_sample.too_many_event_samples field. If true, the number of references will be capped at the sample limit (set at rule service). This is applicable to both UDM references and Entity references.
Returns
- (::Boolean) — Copied from the detection event_sample.too_many_event_samples field. If true, the number of references will be capped at the sample limit (set at rule service). This is applicable to both UDM references and Entity references.