Reference documentation and code samples for the Chronicle V1 API class Google::Backstory::Reference.
Reference to model primatives including event and entity. As support is added for fast retrieval of objects by identifiers, this will be expanded to include ID references rather than full object copies.
Inherits
- Object
Extended By
- Google::Protobuf::MessageExts::ClassMethods
Includes
- Google::Protobuf::MessageExts
Methods
#entity
def entity() -> ::Google::Backstory::Entity
Returns
- (::Google::Backstory::Entity) — Entity being referenced. In cases where the entity graph is overridden by data table, this will represent the original entity. End one-of
#entity=
def entity=(value) -> ::Google::Backstory::Entity
Parameter
- value (::Google::Backstory::Entity) — Entity being referenced. In cases where the entity graph is overridden by data table, this will represent the original entity. End one-of
Returns
- (::Google::Backstory::Entity) — Entity being referenced. In cases where the entity graph is overridden by data table, this will represent the original entity. End one-of
#event
def event() -> ::Google::Backstory::UDM
Returns
- (::Google::Backstory::UDM) — Only one of event or entity will be populated for a single reference. Start one-of Event being referenced.
#event=
def event=(value) -> ::Google::Backstory::UDM
Parameter
- value (::Google::Backstory::UDM) — Only one of event or entity will be populated for a single reference. Start one-of Event being referenced.
Returns
- (::Google::Backstory::UDM) — Only one of event or entity will be populated for a single reference. Start one-of Event being referenced.
#graph_enrichment
def graph_enrichment() -> ::Google::Backstory::EntityGraphEnrichment
Returns
- (::Google::Backstory::EntityGraphEnrichment) — The entity graph enrichment details. Only set when the reference is an Entity which has been overridden by a data table or appended from a data table.
#graph_enrichment=
def graph_enrichment=(value) -> ::Google::Backstory::EntityGraphEnrichment
Parameter
- value (::Google::Backstory::EntityGraphEnrichment) — The entity graph enrichment details. Only set when the reference is an Entity which has been overridden by a data table or appended from a data table.
Returns
- (::Google::Backstory::EntityGraphEnrichment) — The entity graph enrichment details. Only set when the reference is an Entity which has been overridden by a data table or appended from a data table.
#id
def id() -> ::Google::Backstory::Id
Returns
- (::Google::Backstory::Id) — Id being referenced. This field will also be populated for both event and entity with the event id. For detections, only this field will be populated.
#id=
def id=(value) -> ::Google::Backstory::Id
Parameter
- value (::Google::Backstory::Id) — Id being referenced. This field will also be populated for both event and entity with the event id. For detections, only this field will be populated.
Returns
- (::Google::Backstory::Id) — Id being referenced. This field will also be populated for both event and entity with the event id. For detections, only this field will be populated.
#joined_data_table_rows
def joined_data_table_rows() -> ::Array<::Google::Backstory::DataTableRowInfo>
Returns
- (::Array<::Google::Backstory::DataTableRowInfo>) — The data table rows joined with the event.
#joined_data_table_rows=
def joined_data_table_rows=(value) -> ::Array<::Google::Backstory::DataTableRowInfo>
Parameter
- value (::Array<::Google::Backstory::DataTableRowInfo>) — The data table rows joined with the event.
Returns
- (::Array<::Google::Backstory::DataTableRowInfo>) — The data table rows joined with the event.
#log_batch_token
def log_batch_token() -> ::String
Returns
- (::String) — The log batch token of the event being referenced. This field is used to fetch the raw log associated with the event in some legacy systems. This field is only populated for events/entities.
#log_batch_token=
def log_batch_token=(value) -> ::String
Parameter
- value (::String) — The log batch token of the event being referenced. This field is used to fetch the raw log associated with the event in some legacy systems. This field is only populated for events/entities.
Returns
- (::String) — The log batch token of the event being referenced. This field is used to fetch the raw log associated with the event in some legacy systems. This field is only populated for events/entities.