Chronicle V1 API - Class Google::Backstory::Noun (v1.4.0)

1.4.0 (latest) 1.3.0 1.2.0 1.1.0 1.0.1 0.9.0 0.8.0 0.7.0 0.6.0 0.5.0 0.4.0 0.3.1 0.2.0 0.1.0

Reference documentation and code samples for the Chronicle V1 API class Google::Backstory::Noun.

The Noun type is used to represent the different entities in an event: principal, src, target, observer, intermediary, and about. It stores attributes known about the entity. For example, if the entity is a device with multiple IP or MAC addresses, it stores the IP and MAC addresses that are relevant to the event.

Inherits

• Object

Extended By

• Google::Protobuf::MessageExts::ClassMethods

Includes

• Google::Protobuf::MessageExts

Methods

#administrative_domain

def administrative_domain() -> ::String

Returns

• (::String) — Domain which the device belongs to (for example, the Microsoft Windows domain).

#administrative_domain=

def administrative_domain=(value) -> ::String

Parameter

• value (::String) — Domain which the device belongs to (for example, the Microsoft Windows domain).

Returns

• (::String) — Domain which the device belongs to (for example, the Microsoft Windows domain).

#application

def application() -> ::String

Returns

• (::String) — The name of an application or service. Some SSO solutions only capture the name of a target application such as "Atlassian" or "Chronicle".

#application=

def application=(value) -> ::String

Parameter

• value (::String) — The name of an application or service. Some SSO solutions only capture the name of a target application such as "Atlassian" or "Chronicle".

Returns

• (::String) — The name of an application or service. Some SSO solutions only capture the name of a target application such as "Atlassian" or "Chronicle".

#artifact

def artifact() -> ::Google::Backstory::Artifact

Returns

• (::Google::Backstory::Artifact) — Information about an artifact.

#artifact=

def artifact=(value) -> ::Google::Backstory::Artifact

Parameter

• value (::Google::Backstory::Artifact) — Information about an artifact.

Returns

• (::Google::Backstory::Artifact) — Information about an artifact.

#asset

def asset() -> ::Google::Backstory::Asset

Returns

• (::Google::Backstory::Asset) — Information about the asset.

#asset=

def asset=(value) -> ::Google::Backstory::Asset

Parameter

• value (::Google::Backstory::Asset) — Information about the asset.

Returns

• (::Google::Backstory::Asset) — Information about the asset.

#asset_id

def asset_id() -> ::String

Returns

• (::String) — The asset ID. This field can be used as an entity indicator for asset entities.

#asset_id=

def asset_id=(value) -> ::String

Parameter

• value (::String) — The asset ID. This field can be used as an entity indicator for asset entities.

Returns

• (::String) — The asset ID. This field can be used as an entity indicator for asset entities.

#browser

def browser() -> ::Google::Backstory::Browser

Returns

• (::Google::Backstory::Browser) — Information about an entry in the web browser's local history database.

#browser=

def browser=(value) -> ::Google::Backstory::Browser

Parameter

• value (::Google::Backstory::Browser) — Information about an entry in the web browser's local history database.

Returns

• (::Google::Backstory::Browser) — Information about an entry in the web browser's local history database.

#cloud

def cloud() -> ::Google::Backstory::Cloud

Returns

• (::Google::Backstory::Cloud) — Cloud metadata. Deprecated: cloud should be populated in entity Attribute as generic metadata (e.g. asset.attribute.cloud).

#cloud=

def cloud=(value) -> ::Google::Backstory::Cloud

Parameter

• value (::Google::Backstory::Cloud) — Cloud metadata. Deprecated: cloud should be populated in entity Attribute as generic metadata (e.g. asset.attribute.cloud).

Returns

• (::Google::Backstory::Cloud) — Cloud metadata. Deprecated: cloud should be populated in entity Attribute as generic metadata (e.g. asset.attribute.cloud).

#domain

def domain() -> ::Google::Backstory::Domain

Returns

• (::Google::Backstory::Domain) — Information about the domain.

#domain=

def domain=(value) -> ::Google::Backstory::Domain

Parameter

• value (::Google::Backstory::Domain) — Information about the domain.

Returns

• (::Google::Backstory::Domain) — Information about the domain.

#email

def email() -> ::String

Returns

• (::String) — Email address. Only filled in for security_result.about

#email=

def email=(value) -> ::String

Parameter

• value (::String) — Email address. Only filled in for security_result.about

Returns

• (::String) — Email address. Only filled in for security_result.about

#file

def file() -> ::Google::Backstory::File

Returns

• (::Google::Backstory::File) — Information about the file.

#file=

def file=(value) -> ::Google::Backstory::File

Parameter

• value (::Google::Backstory::File) — Information about the file.

Returns

• (::Google::Backstory::File) — Information about the file.

#group

def group() -> ::Google::Backstory::Group

Returns

• (::Google::Backstory::Group) — Information about the group.

#group=

def group=(value) -> ::Google::Backstory::Group

Parameter

• value (::Google::Backstory::Group) — Information about the group.

Returns

• (::Google::Backstory::Group) — Information about the group.

#hostname

def hostname() -> ::String

Returns

• (::String) — Client hostname or domain name field. Hostname also doubles as the domain for remote entities. This field can be used as an entity indicator for asset entities.

#hostname=

def hostname=(value) -> ::String

Parameter

• value (::String) — Client hostname or domain name field. Hostname also doubles as the domain for remote entities. This field can be used as an entity indicator for asset entities.

Returns

• (::String) — Client hostname or domain name field. Hostname also doubles as the domain for remote entities. This field can be used as an entity indicator for asset entities.

#investigation

def investigation() -> ::Google::Backstory::Investigation

Returns

• (::Google::Backstory::Investigation) — Analyst feedback/investigation for alerts.

#investigation=

def investigation=(value) -> ::Google::Backstory::Investigation

Parameter

• value (::Google::Backstory::Investigation) — Analyst feedback/investigation for alerts.

Returns

• (::Google::Backstory::Investigation) — Analyst feedback/investigation for alerts.

#ip

def ip() -> ::Array<::String>

Returns

• (::Array<::String>) — A list of IP addresses associated with a network connection. This field can be used as an entity indicator for asset entities.

#ip=

def ip=(value) -> ::Array<::String>

Parameter

• value (::Array<::String>) — A list of IP addresses associated with a network connection. This field can be used as an entity indicator for asset entities.

Returns

• (::Array<::String>) — A list of IP addresses associated with a network connection. This field can be used as an entity indicator for asset entities.

#ip_geo_artifact

def ip_geo_artifact() -> ::Array<::Google::Backstory::Artifact>

Returns

• (::Array<::Google::Backstory::Artifact>) — Enriched geographic information corresponding to an IP address. Specifically, location and network data.

#ip_geo_artifact=

def ip_geo_artifact=(value) -> ::Array<::Google::Backstory::Artifact>

Parameter

• value (::Array<::Google::Backstory::Artifact>) — Enriched geographic information corresponding to an IP address. Specifically, location and network data.

Returns

• (::Array<::Google::Backstory::Artifact>) — Enriched geographic information corresponding to an IP address. Specifically, location and network data.

#ip_location

def ip_location() -> ::Array<::Google::Backstory::Location>

Returns

• (::Array<::Google::Backstory::Location>) — Deprecated: use ip_geo_artifact.location instead.

#ip_location=

def ip_location=(value) -> ::Array<::Google::Backstory::Location>

Parameter

• value (::Array<::Google::Backstory::Location>) — Deprecated: use ip_geo_artifact.location instead.

Returns

• (::Array<::Google::Backstory::Location>) — Deprecated: use ip_geo_artifact.location instead.

#labels

def labels() -> ::Array<::Google::Backstory::Label>

Returns

• (::Array<::Google::Backstory::Label>) — Labels are key-value pairs. For example: key = "env", value = "prod". Deprecated: labels should be populated in entity Attribute as generic metadata (e.g. user.attribute.labels).

#labels=

def labels=(value) -> ::Array<::Google::Backstory::Label>

Parameter

• value (::Array<::Google::Backstory::Label>) — Labels are key-value pairs. For example: key = "env", value = "prod". Deprecated: labels should be populated in entity Attribute as generic metadata (e.g. user.attribute.labels).

Returns

• (::Array<::Google::Backstory::Label>) — Labels are key-value pairs. For example: key = "env", value = "prod". Deprecated: labels should be populated in entity Attribute as generic metadata (e.g. user.attribute.labels).

#location

def location() -> ::Google::Backstory::Location

Returns

• (::Google::Backstory::Location) — Physical location. For cloud environments, set the region in location.name.

#location=

def location=(value) -> ::Google::Backstory::Location

Parameter

• value (::Google::Backstory::Location) — Physical location. For cloud environments, set the region in location.name.

Returns

• (::Google::Backstory::Location) — Physical location. For cloud environments, set the region in location.name.

#mac

def mac() -> ::Array<::String>

Returns

• (::Array<::String>) — List of MAC addresses associated with a device. This field can be used as an entity indicator for asset entities.

#mac=

def mac=(value) -> ::Array<::String>

Parameter

• value (::Array<::String>) — List of MAC addresses associated with a device. This field can be used as an entity indicator for asset entities.

Returns

• (::Array<::String>) — List of MAC addresses associated with a device. This field can be used as an entity indicator for asset entities.

#namespace

def namespace() -> ::String

Returns

• (::String) — Namespace which the device belongs to, such as "AD forest". Uses for this field include Microsoft Windows AD forest, the name of subsidiary, or the name of acquisition. This field can be used along with an asset indicator to identify an asset.

#namespace=

def namespace=(value) -> ::String

Parameter

• value (::String) — Namespace which the device belongs to, such as "AD forest". Uses for this field include Microsoft Windows AD forest, the name of subsidiary, or the name of acquisition. This field can be used along with an asset indicator to identify an asset.

Returns

• (::String) — Namespace which the device belongs to, such as "AD forest". Uses for this field include Microsoft Windows AD forest, the name of subsidiary, or the name of acquisition. This field can be used along with an asset indicator to identify an asset.

#nat_ip

def nat_ip() -> ::Array<::String>

Returns

• (::Array<::String>) — A list of NAT translated IP addresses associated with a network connection.

#nat_ip=

def nat_ip=(value) -> ::Array<::String>

Parameter

• value (::Array<::String>) — A list of NAT translated IP addresses associated with a network connection.

Returns

• (::Array<::String>) — A list of NAT translated IP addresses associated with a network connection.

#nat_port

def nat_port() -> ::Integer

Returns

• (::Integer) — NAT external network port number when a specific network connection is described within an event.

#nat_port=

def nat_port=(value) -> ::Integer

Parameter

• value (::Integer) — NAT external network port number when a specific network connection is described within an event.

Returns

• (::Integer) — NAT external network port number when a specific network connection is described within an event.

#network

def network() -> ::Google::Backstory::Network

Returns

• (::Google::Backstory::Network) — Network details, including sub-messages with details on each protocol (for example, DHCP, DNS, or HTTP).

#network=

def network=(value) -> ::Google::Backstory::Network

Parameter

• value (::Google::Backstory::Network) — Network details, including sub-messages with details on each protocol (for example, DHCP, DNS, or HTTP).

Returns

• (::Google::Backstory::Network) — Network details, including sub-messages with details on each protocol (for example, DHCP, DNS, or HTTP).

#object_reference

def object_reference() -> ::Google::Backstory::Id

Returns

• (::Google::Backstory::Id) — Finding to which the Analyst updated the feedback.

#object_reference=

def object_reference=(value) -> ::Google::Backstory::Id

Parameter

• value (::Google::Backstory::Id) — Finding to which the Analyst updated the feedback.

Returns

• (::Google::Backstory::Id) — Finding to which the Analyst updated the feedback.

#platform

def platform() -> ::Google::Backstory::Noun::Platform

Returns

• (::Google::Backstory::Noun::Platform) — Platform.

#platform=

def platform=(value) -> ::Google::Backstory::Noun::Platform

Parameter

• value (::Google::Backstory::Noun::Platform) — Platform.

Returns

• (::Google::Backstory::Noun::Platform) — Platform.

#platform_patch_level

def platform_patch_level() -> ::String

Returns

• (::String) — Platform patch level. For example, "Build 17134.48"

#platform_patch_level=

def platform_patch_level=(value) -> ::String

Parameter

• value (::String) — Platform patch level. For example, "Build 17134.48"

Returns

• (::String) — Platform patch level. For example, "Build 17134.48"

#platform_version

def platform_version() -> ::String

Returns

• (::String) — Platform version. For example, "Microsoft Windows 1803".

#platform_version=

def platform_version=(value) -> ::String

Parameter

• value (::String) — Platform version. For example, "Microsoft Windows 1803".

Returns

• (::String) — Platform version. For example, "Microsoft Windows 1803".

#port

def port() -> ::Integer

Returns

• (::Integer) — Source or destination network port number when a specific network connection is described within an event.

#port=

def port=(value) -> ::Integer

Parameter

• value (::Integer) — Source or destination network port number when a specific network connection is described within an event.

Returns

• (::Integer) — Source or destination network port number when a specific network connection is described within an event.

#process

def process() -> ::Google::Backstory::Process

Returns

• (::Google::Backstory::Process) — Information about the process.

#process=

def process=(value) -> ::Google::Backstory::Process

Parameter

• value (::Google::Backstory::Process) — Information about the process.

Returns

• (::Google::Backstory::Process) — Information about the process.

#process_ancestors

def process_ancestors() -> ::Array<::Google::Backstory::Process>

Returns

• (::Array<::Google::Backstory::Process>) — Information about the process's ancestors ordered from immediate ancestor (parent process) to root. Note: process_ancestors is only populated when data is exported to BigQuery since recursive fields (e.g. process.parent_process) are not supported by BigQuery.

#process_ancestors=

def process_ancestors=(value) -> ::Array<::Google::Backstory::Process>

Parameter

• value (::Array<::Google::Backstory::Process>) — Information about the process's ancestors ordered from immediate ancestor (parent process) to root. Note: process_ancestors is only populated when data is exported to BigQuery since recursive fields (e.g. process.parent_process) are not supported by BigQuery.

Returns

• (::Array<::Google::Backstory::Process>) — Information about the process's ancestors ordered from immediate ancestor (parent process) to root. Note: process_ancestors is only populated when data is exported to BigQuery since recursive fields (e.g. process.parent_process) are not supported by BigQuery.

#registry

def registry() -> ::Google::Backstory::Registry

Returns

• (::Google::Backstory::Registry) — Registry information.

#registry=

def registry=(value) -> ::Google::Backstory::Registry

Parameter

• value (::Google::Backstory::Registry) — Registry information.

Returns

• (::Google::Backstory::Registry) — Registry information.

#resource

def resource() -> ::Google::Backstory::Resource

Returns

• (::Google::Backstory::Resource) — Information about the resource (e.g. scheduled task, calendar entry). This field should not be used for files, registry, or processes because these objects are already part of Noun.

#resource=

def resource=(value) -> ::Google::Backstory::Resource

Parameter

• value (::Google::Backstory::Resource) — Information about the resource (e.g. scheduled task, calendar entry). This field should not be used for files, registry, or processes because these objects are already part of Noun.

Returns

• (::Google::Backstory::Resource) — Information about the resource (e.g. scheduled task, calendar entry). This field should not be used for files, registry, or processes because these objects are already part of Noun.

#resource_ancestors

def resource_ancestors() -> ::Array<::Google::Backstory::Resource>

Returns

• (::Array<::Google::Backstory::Resource>) — Information about the resource's ancestors ordered from immediate ancestor (starting with parent resource).

#resource_ancestors=

def resource_ancestors=(value) -> ::Array<::Google::Backstory::Resource>

Parameter

• value (::Array<::Google::Backstory::Resource>) — Information about the resource's ancestors ordered from immediate ancestor (starting with parent resource).

Returns

• (::Array<::Google::Backstory::Resource>) — Information about the resource's ancestors ordered from immediate ancestor (starting with parent resource).

#security_result

def security_result() -> ::Array<::Google::Backstory::SecurityResult>

Returns

• (::Array<::Google::Backstory::SecurityResult>) — A list of security results.

#security_result=

def security_result=(value) -> ::Array<::Google::Backstory::SecurityResult>

Parameter

• value (::Array<::Google::Backstory::SecurityResult>) — A list of security results.

Returns

• (::Array<::Google::Backstory::SecurityResult>) — A list of security results.

#url

def url() -> ::String

Returns

• (::String) — The URL.

#url=

def url=(value) -> ::String

Parameter

• value (::String) — The URL.

Returns

• (::String) — The URL.

#url_metadata

def url_metadata() -> ::Google::Backstory::Url

Returns

• (::Google::Backstory::Url) — Information about the URL.

#url_metadata=

def url_metadata=(value) -> ::Google::Backstory::Url

Parameter

• value (::Google::Backstory::Url) — Information about the URL.

Returns

• (::Google::Backstory::Url) — Information about the URL.

#user

def user() -> ::Google::Backstory::User

Returns

• (::Google::Backstory::User) — Information about the user.

#user=

def user=(value) -> ::Google::Backstory::User

Parameter

• value (::Google::Backstory::User) — Information about the user.

Returns

• (::Google::Backstory::User) — Information about the user.

#user_management_chain

def user_management_chain() -> ::Array<::Google::Backstory::User>

Returns

• (::Array<::Google::Backstory::User>) — Information about the user's management chain (reporting hierarchy). Note: user_management_chain is only populated when data is exported to BigQuery since recursive fields (e.g. user.managers) are not supported by BigQuery.

#user_management_chain=

def user_management_chain=(value) -> ::Array<::Google::Backstory::User>

Parameter

• value (::Array<::Google::Backstory::User>) — Information about the user's management chain (reporting hierarchy). Note: user_management_chain is only populated when data is exported to BigQuery since recursive fields (e.g. user.managers) are not supported by BigQuery.

Returns

• (::Array<::Google::Backstory::User>) — Information about the user's management chain (reporting hierarchy). Note: user_management_chain is only populated when data is exported to BigQuery since recursive fields (e.g. user.managers) are not supported by BigQuery.