Chronicle V1 API - Class Google::Backstory::SecurityResult (v1.4.0)

Reference documentation and code samples for the Chronicle V1 API class Google::Backstory::SecurityResult.

Security related metadata for the event. A security result might be something like "virus detected and quarantined," "malicious connection blocked," or "sensitive data included in document foo.doc." Each security result, of which there may be more than one, may either pertain to the whole event, or to a specific object or device referenced in the event (e.g. a malicious file that was detected, or a sensitive document sent as an email attachment). For security results that apply to a particular object referenced in the event, the security_results message MUST contain details about the implicated object (such as process, user, IP, domain, URL, IP, or email address) in the about field. For security results that apply to the entire event (e.g. SPAM found in this email), the about field must remain empty.

Inherits

  • Object

Extended By

  • Google::Protobuf::MessageExts::ClassMethods

Includes

  • Google::Protobuf::MessageExts

Methods

#about

def about() -> ::Google::Backstory::Noun
Returns
  • (::Google::Backstory::Noun) — If the security result is about a specific entity (Noun), add it here. This field is not populated when the SecurityResult appears in a detection.

#about=

def about=(value) -> ::Google::Backstory::Noun
Parameter
  • value (::Google::Backstory::Noun) — If the security result is about a specific entity (Noun), add it here. This field is not populated when the SecurityResult appears in a detection.
Returns
  • (::Google::Backstory::Noun) — If the security result is about a specific entity (Noun), add it here. This field is not populated when the SecurityResult appears in a detection.

#action

def action() -> ::Array<::Google::Backstory::SecurityResult::Action>
Returns

#action=

def action=(value) -> ::Array<::Google::Backstory::SecurityResult::Action>
Parameter
Returns

#action_details

def action_details() -> ::String
Returns
  • (::String) — The detail of the action taken as provided by the vendor. This field is not populated when the SecurityResult appears in a detection.

#action_details=

def action_details=(value) -> ::String
Parameter
  • value (::String) — The detail of the action taken as provided by the vendor. This field is not populated when the SecurityResult appears in a detection.
Returns
  • (::String) — The detail of the action taken as provided by the vendor. This field is not populated when the SecurityResult appears in a detection.

#alert_state

def alert_state() -> ::Google::Backstory::SecurityResult::AlertState
Returns

#alert_state=

def alert_state=(value) -> ::Google::Backstory::SecurityResult::AlertState
Parameter
Returns

#analytics_metadata

def analytics_metadata() -> ::Array<::Google::Backstory::AnalyticsMetadata>
Returns
  • (::Array<::Google::Backstory::AnalyticsMetadata>) — Stores metadata about each risk analytic metric the rule uses. This field is not populated when the SecurityResult appears in a detection.

#analytics_metadata=

def analytics_metadata=(value) -> ::Array<::Google::Backstory::AnalyticsMetadata>
Parameter
  • value (::Array<::Google::Backstory::AnalyticsMetadata>) — Stores metadata about each risk analytic metric the rule uses. This field is not populated when the SecurityResult appears in a detection.
Returns
  • (::Array<::Google::Backstory::AnalyticsMetadata>) — Stores metadata about each risk analytic metric the rule uses. This field is not populated when the SecurityResult appears in a detection.

#associations

def associations() -> ::Array<::Google::Backstory::SecurityResult::Association>
Returns

#associations=

def associations=(value) -> ::Array<::Google::Backstory::SecurityResult::Association>
Parameter
Returns

#attack_details

def attack_details() -> ::Google::Backstory::AttackDetails
Returns

#attack_details=

def attack_details=(value) -> ::Google::Backstory::AttackDetails
Parameter
Returns

#campaigns

def campaigns() -> ::Array<::String>
Returns
  • (::Array<::String>) — Campaigns using this IOC threat. This is deprecated. Use threat_collections instead.

#campaigns=

def campaigns=(value) -> ::Array<::String>
Parameter
  • value (::Array<::String>) — Campaigns using this IOC threat. This is deprecated. Use threat_collections instead.
Returns
  • (::Array<::String>) — Campaigns using this IOC threat. This is deprecated. Use threat_collections instead.

#category

def category() -> ::Array<::Google::Backstory::SecurityResult::SecurityCategory>
Returns

#category=

def category=(value) -> ::Array<::Google::Backstory::SecurityResult::SecurityCategory>
Parameter
Returns

#category_details

def category_details() -> ::Array<::String>
Returns
  • (::Array<::String>) — For vendor-specific categories. For web categorization, put type in here such as "gambling" or "porn". This field is not populated when the SecurityResult appears in a detection.

#category_details=

def category_details=(value) -> ::Array<::String>
Parameter
  • value (::Array<::String>) — For vendor-specific categories. For web categorization, put type in here such as "gambling" or "porn". This field is not populated when the SecurityResult appears in a detection.
Returns
  • (::Array<::String>) — For vendor-specific categories. For web categorization, put type in here such as "gambling" or "porn". This field is not populated when the SecurityResult appears in a detection.

#confidence

def confidence() -> ::Google::Backstory::SecurityResult::ProductConfidence
Returns

#confidence=

def confidence=(value) -> ::Google::Backstory::SecurityResult::ProductConfidence
Parameter
Returns

#confidence_details

def confidence_details() -> ::String
Returns
  • (::String) — Additional detail with regards to the confidence of a security event as estimated by the product vendor. This field is not populated when the SecurityResult appears in a detection.

#confidence_details=

def confidence_details=(value) -> ::String
Parameter
  • value (::String) — Additional detail with regards to the confidence of a security event as estimated by the product vendor. This field is not populated when the SecurityResult appears in a detection.
Returns
  • (::String) — Additional detail with regards to the confidence of a security event as estimated by the product vendor. This field is not populated when the SecurityResult appears in a detection.

#confidence_score

def confidence_score() -> ::Float
Returns
  • (::Float) — The confidence score of the security result. This field is not populated when the SecurityResult appears in a detection.

#confidence_score=

def confidence_score=(value) -> ::Float
Parameter
  • value (::Float) — The confidence score of the security result. This field is not populated when the SecurityResult appears in a detection.
Returns
  • (::Float) — The confidence score of the security result. This field is not populated when the SecurityResult appears in a detection.

#description

def description() -> ::String
Returns
  • (::String) — A human-readable description (e.g. "user password was wrong"). This can be more detailed than the summary.

#description=

def description=(value) -> ::String
Parameter
  • value (::String) — A human-readable description (e.g. "user password was wrong"). This can be more detailed than the summary.
Returns
  • (::String) — A human-readable description (e.g. "user password was wrong"). This can be more detailed than the summary.

#detection_depth

def detection_depth() -> ::Integer
Returns
  • (::Integer) — The depth of the detection chain. Applies only to composite detections.

#detection_depth=

def detection_depth=(value) -> ::Integer
Parameter
  • value (::Integer) — The depth of the detection chain. Applies only to composite detections.
Returns
  • (::Integer) — The depth of the detection chain. Applies only to composite detections.

#detection_fields

def detection_fields() -> ::Array<::Google::Backstory::Label>
Returns
  • (::Array<::Google::Backstory::Label>) — An ordered list of values, that represent fields in detections for a security finding. This list represents mapping of names of requested entities to their values (the security result matched variables).

    For Collection SecurityResults, prefer variables instead.

#detection_fields=

def detection_fields=(value) -> ::Array<::Google::Backstory::Label>
Parameter
  • value (::Array<::Google::Backstory::Label>) — An ordered list of values, that represent fields in detections for a security finding. This list represents mapping of names of requested entities to their values (the security result matched variables).

    For Collection SecurityResults, prefer variables instead.

Returns
  • (::Array<::Google::Backstory::Label>) — An ordered list of values, that represent fields in detections for a security finding. This list represents mapping of names of requested entities to their values (the security result matched variables).

    For Collection SecurityResults, prefer variables instead.

#display_name

def display_name() -> ::String
Returns
  • (::String) — The display name of the security result. This is populated from 'name_override' Outcome Variable, if present. Otherwise, this field is not set.

#display_name=

def display_name=(value) -> ::String
Parameter
  • value (::String) — The display name of the security result. This is populated from 'name_override' Outcome Variable, if present. Otherwise, this field is not set.
Returns
  • (::String) — The display name of the security result. This is populated from 'name_override' Outcome Variable, if present. Otherwise, this field is not set.

#first_discovered_time

def first_discovered_time() -> ::Google::Protobuf::Timestamp
Returns
  • (::Google::Protobuf::Timestamp) — First time the IoC threat was discovered in the provider. This field is not populated when the SecurityResult appears in a detection.

#first_discovered_time=

def first_discovered_time=(value) -> ::Google::Protobuf::Timestamp
Parameter
  • value (::Google::Protobuf::Timestamp) — First time the IoC threat was discovered in the provider. This field is not populated when the SecurityResult appears in a detection.
Returns
  • (::Google::Protobuf::Timestamp) — First time the IoC threat was discovered in the provider. This field is not populated when the SecurityResult appears in a detection.

#last_discovered_time

def last_discovered_time() -> ::Google::Protobuf::Timestamp
Returns
  • (::Google::Protobuf::Timestamp) — Last time the IoC was seen in the provider data. This field is not populated when the SecurityResult appears in a detection.

#last_discovered_time=

def last_discovered_time=(value) -> ::Google::Protobuf::Timestamp
Parameter
  • value (::Google::Protobuf::Timestamp) — Last time the IoC was seen in the provider data. This field is not populated when the SecurityResult appears in a detection.
Returns
  • (::Google::Protobuf::Timestamp) — Last time the IoC was seen in the provider data. This field is not populated when the SecurityResult appears in a detection.

#last_updated_time

def last_updated_time() -> ::Google::Protobuf::Timestamp
Returns
  • (::Google::Protobuf::Timestamp) — Last time the IoC threat was updated in the provider. This field is not populated when the SecurityResult appears in a detection.

#last_updated_time=

def last_updated_time=(value) -> ::Google::Protobuf::Timestamp
Parameter
  • value (::Google::Protobuf::Timestamp) — Last time the IoC threat was updated in the provider. This field is not populated when the SecurityResult appears in a detection.
Returns
  • (::Google::Protobuf::Timestamp) — Last time the IoC threat was updated in the provider. This field is not populated when the SecurityResult appears in a detection.

#outcomes

def outcomes() -> ::Array<::Google::Backstory::Label>
Returns
  • (::Array<::Google::Backstory::Label>) — A list of outcomes that represent the results of this security finding. This list represents a mapping of names of the requested outcomes, to a stringified version of their values.

    This is only populated when the SecurityResult appears in a detection. This is deprecated. Use variables instead.

#outcomes=

def outcomes=(value) -> ::Array<::Google::Backstory::Label>
Parameter
  • value (::Array<::Google::Backstory::Label>) — A list of outcomes that represent the results of this security finding. This list represents a mapping of names of the requested outcomes, to a stringified version of their values.

    This is only populated when the SecurityResult appears in a detection. This is deprecated. Use variables instead.

Returns
  • (::Array<::Google::Backstory::Label>) — A list of outcomes that represent the results of this security finding. This list represents a mapping of names of the requested outcomes, to a stringified version of their values.

    This is only populated when the SecurityResult appears in a detection. This is deprecated. Use variables instead.

#priority

def priority() -> ::Google::Backstory::SecurityResult::ProductPriority
Returns

#priority=

def priority=(value) -> ::Google::Backstory::SecurityResult::ProductPriority
Parameter
Returns

#priority_details

def priority_details() -> ::String
Returns
  • (::String) — Vendor-specific information about the security result priority. This field is not populated when the SecurityResult appears in a detection.

#priority_details=

def priority_details=(value) -> ::String
Parameter
  • value (::String) — Vendor-specific information about the security result priority. This field is not populated when the SecurityResult appears in a detection.
Returns
  • (::String) — Vendor-specific information about the security result priority. This field is not populated when the SecurityResult appears in a detection.

#reports

def reports() -> ::Array<::String>
Returns
  • (::Array<::String>) — Reports that reference this IOC threat. These are the report IDs. This is deprecated. Use threat_collections instead.

#reports=

def reports=(value) -> ::Array<::String>
Parameter
  • value (::Array<::String>) — Reports that reference this IOC threat. These are the report IDs. This is deprecated. Use threat_collections instead.
Returns
  • (::Array<::String>) — Reports that reference this IOC threat. These are the report IDs. This is deprecated. Use threat_collections instead.

#risk_score

def risk_score() -> ::Float
Returns
  • (::Float) — The risk score of the security result.

#risk_score=

def risk_score=(value) -> ::Float
Parameter
  • value (::Float) — The risk score of the security result.
Returns
  • (::Float) — The risk score of the security result.

#rule_author

def rule_author() -> ::String
Returns
  • (::String) — Author of the security rule. This field is not populated when the SecurityResult appears in a detection.

#rule_author=

def rule_author=(value) -> ::String
Parameter
  • value (::String) — Author of the security rule. This field is not populated when the SecurityResult appears in a detection.
Returns
  • (::String) — Author of the security rule. This field is not populated when the SecurityResult appears in a detection.

#rule_id

def rule_id() -> ::String
Returns
  • (::String) — A vendor-specific ID for a rule, varying by observer type (e.g. "08123", "5d2b44d0-5ef6-40f5-a704-47d61d3babbe").

#rule_id=

def rule_id=(value) -> ::String
Parameter
  • value (::String) — A vendor-specific ID for a rule, varying by observer type (e.g. "08123", "5d2b44d0-5ef6-40f5-a704-47d61d3babbe").
Returns
  • (::String) — A vendor-specific ID for a rule, varying by observer type (e.g. "08123", "5d2b44d0-5ef6-40f5-a704-47d61d3babbe").

#rule_labels

def rule_labels() -> ::Array<::Google::Backstory::Label>
Returns
  • (::Array<::Google::Backstory::Label>) — A list of rule labels that can't be captured by the other fields in security result (e.g. "reference : AnotherRule", "contributor : John"). This is primarily set in rule-generated detections and alerts.

#rule_labels=

def rule_labels=(value) -> ::Array<::Google::Backstory::Label>
Parameter
  • value (::Array<::Google::Backstory::Label>) — A list of rule labels that can't be captured by the other fields in security result (e.g. "reference : AnotherRule", "contributor : John"). This is primarily set in rule-generated detections and alerts.
Returns
  • (::Array<::Google::Backstory::Label>) — A list of rule labels that can't be captured by the other fields in security result (e.g. "reference : AnotherRule", "contributor : John"). This is primarily set in rule-generated detections and alerts.

#rule_name

def rule_name() -> ::String
Returns
  • (::String) — Name of the security rule (e.g. "BlockInboundToOracle").

#rule_name=

def rule_name=(value) -> ::String
Parameter
  • value (::String) — Name of the security rule (e.g. "BlockInboundToOracle").
Returns
  • (::String) — Name of the security rule (e.g. "BlockInboundToOracle").

#rule_set

def rule_set() -> ::String
Returns
  • (::String) — The curated detection's rule set identifier. (for example, "windows-threats") This is primarily set in rule-generated detections and alerts.

#rule_set=

def rule_set=(value) -> ::String
Parameter
  • value (::String) — The curated detection's rule set identifier. (for example, "windows-threats") This is primarily set in rule-generated detections and alerts.
Returns
  • (::String) — The curated detection's rule set identifier. (for example, "windows-threats") This is primarily set in rule-generated detections and alerts.

#rule_set_display_name

def rule_set_display_name() -> ::String
Returns
  • (::String) — The curated detections rule set display name. This is primarily set in rule-generated detections and alerts.

#rule_set_display_name=

def rule_set_display_name=(value) -> ::String
Parameter
  • value (::String) — The curated detections rule set display name. This is primarily set in rule-generated detections and alerts.
Returns
  • (::String) — The curated detections rule set display name. This is primarily set in rule-generated detections and alerts.

#rule_type

def rule_type() -> ::String
Returns
  • (::String) — The type of security rule.

#rule_type=

def rule_type=(value) -> ::String
Parameter
  • value (::String) — The type of security rule.
Returns
  • (::String) — The type of security rule.

#rule_version

def rule_version() -> ::String
Returns
  • (::String) — Version of the security rule. (e.g. "v1.1", "00001", "1604709794", "2020-11-16T23:04:19+00:00"). Note that rule versions are source-dependant and lexical ordering should not be assumed.

#rule_version=

def rule_version=(value) -> ::String
Parameter
  • value (::String) — Version of the security rule. (e.g. "v1.1", "00001", "1604709794", "2020-11-16T23:04:19+00:00"). Note that rule versions are source-dependant and lexical ordering should not be assumed.
Returns
  • (::String) — Version of the security rule. (e.g. "v1.1", "00001", "1604709794", "2020-11-16T23:04:19+00:00"). Note that rule versions are source-dependant and lexical ordering should not be assumed.

#ruleset_category_display_name

def ruleset_category_display_name() -> ::String
Returns
  • (::String) — The curated detection rule set category display name. (for example, if rule_set_display_name is "CDIR SCC Enhanced Exfiltration", the rule_set_category is "Cloud Threats"). This is primarily set in rule-generated detections and alerts.

#ruleset_category_display_name=

def ruleset_category_display_name=(value) -> ::String
Parameter
  • value (::String) — The curated detection rule set category display name. (for example, if rule_set_display_name is "CDIR SCC Enhanced Exfiltration", the rule_set_category is "Cloud Threats"). This is primarily set in rule-generated detections and alerts.
Returns
  • (::String) — The curated detection rule set category display name. (for example, if rule_set_display_name is "CDIR SCC Enhanced Exfiltration", the rule_set_category is "Cloud Threats"). This is primarily set in rule-generated detections and alerts.

#severity

def severity() -> ::Google::Backstory::SecurityResult::ProductSeverity
Returns

#severity=

def severity=(value) -> ::Google::Backstory::SecurityResult::ProductSeverity
Parameter
Returns

#severity_details

def severity_details() -> ::String
Returns
  • (::String) — Vendor-specific severity. This field is not populated when the SecurityResult appears in a detection.

#severity_details=

def severity_details=(value) -> ::String
Parameter
  • value (::String) — Vendor-specific severity. This field is not populated when the SecurityResult appears in a detection.
Returns
  • (::String) — Vendor-specific severity. This field is not populated when the SecurityResult appears in a detection.

#summary

def summary() -> ::String
Returns
  • (::String) — A short human-readable summary (e.g. "failed login occurred")

#summary=

def summary=(value) -> ::String
Parameter
  • value (::String) — A short human-readable summary (e.g. "failed login occurred")
Returns
  • (::String) — A short human-readable summary (e.g. "failed login occurred")

#threat_collections

def threat_collections() -> ::Array<::Google::Backstory::SecurityResult::ThreatCollectionItem>
Returns

#threat_collections=

def threat_collections=(value) -> ::Array<::Google::Backstory::SecurityResult::ThreatCollectionItem>
Parameter
Returns

#threat_feed_name

def threat_feed_name() -> ::String
Returns
  • (::String) — Vendor feed name for a threat indicator feed. This field is not populated when the SecurityResult appears in a detection.

#threat_feed_name=

def threat_feed_name=(value) -> ::String
Parameter
  • value (::String) — Vendor feed name for a threat indicator feed. This field is not populated when the SecurityResult appears in a detection.
Returns
  • (::String) — Vendor feed name for a threat indicator feed. This field is not populated when the SecurityResult appears in a detection.

#threat_id

def threat_id() -> ::String
Returns
  • (::String) — Vendor-specific ID for a threat. This field is not populated when the SecurityResult appears in a detection.

#threat_id=

def threat_id=(value) -> ::String
Parameter
  • value (::String) — Vendor-specific ID for a threat. This field is not populated when the SecurityResult appears in a detection.
Returns
  • (::String) — Vendor-specific ID for a threat. This field is not populated when the SecurityResult appears in a detection.

#threat_id_namespace

def threat_id_namespace() -> ::Google::Backstory::Id::Namespace
Returns
  • (::Google::Backstory::Id::Namespace) — The attribute threat_id_namespace qualifies threat_id with an id namespace to get an unique id. The attribute threat_id by itself is not unique across Chronicle as it is a vendor specific id. This field is not populated when the SecurityResult appears in a detection.

#threat_id_namespace=

def threat_id_namespace=(value) -> ::Google::Backstory::Id::Namespace
Parameter
  • value (::Google::Backstory::Id::Namespace) — The attribute threat_id_namespace qualifies threat_id with an id namespace to get an unique id. The attribute threat_id by itself is not unique across Chronicle as it is a vendor specific id. This field is not populated when the SecurityResult appears in a detection.
Returns
  • (::Google::Backstory::Id::Namespace) — The attribute threat_id_namespace qualifies threat_id with an id namespace to get an unique id. The attribute threat_id by itself is not unique across Chronicle as it is a vendor specific id. This field is not populated when the SecurityResult appears in a detection.

#threat_name

def threat_name() -> ::String
Returns
  • (::String) — A vendor-assigned classification common across multiple customers (for example, "W32/File-A", "Slammer"). This field is not populated when the SecurityResult appears in a detection.

#threat_name=

def threat_name=(value) -> ::String
Parameter
  • value (::String) — A vendor-assigned classification common across multiple customers (for example, "W32/File-A", "Slammer"). This field is not populated when the SecurityResult appears in a detection.
Returns
  • (::String) — A vendor-assigned classification common across multiple customers (for example, "W32/File-A", "Slammer"). This field is not populated when the SecurityResult appears in a detection.

#threat_status

def threat_status() -> ::Google::Backstory::SecurityResult::ThreatStatus
Returns

#threat_status=

def threat_status=(value) -> ::Google::Backstory::SecurityResult::ThreatStatus
Parameter
Returns

#threat_verdict

def threat_verdict() -> ::Google::Backstory::ThreatVerdict
Returns

#threat_verdict=

def threat_verdict=(value) -> ::Google::Backstory::ThreatVerdict
Parameter
  • value (::Google::Backstory::ThreatVerdict) — GCTI threat verdict on the security result entity. This field is not populated when the SecurityResult appears in a detection.
Returns

#url_back_to_product

def url_back_to_product() -> ::String
Returns
  • (::String) — URL that takes the user to the source product console for this event. This field is not populated when the SecurityResult appears in a detection.

#url_back_to_product=

def url_back_to_product=(value) -> ::String
Parameter
  • value (::String) — URL that takes the user to the source product console for this event. This field is not populated when the SecurityResult appears in a detection.
Returns
  • (::String) — URL that takes the user to the source product console for this event. This field is not populated when the SecurityResult appears in a detection.

#variables

def variables() -> ::Google::Protobuf::Map{::String => ::Google::Backstory::FindingVariable}
Returns
  • (::Google::Protobuf::Map{::String => ::Google::Backstory::FindingVariable}) — A list of outcomes and match variables that represent the results of this security finding. This list represents a mapping of names of the requested outcomes or match variables, to their values.

    This is only populated when the SecurityResult appears in a detection.

#variables=

def variables=(value) -> ::Google::Protobuf::Map{::String => ::Google::Backstory::FindingVariable}
Parameter
  • value (::Google::Protobuf::Map{::String => ::Google::Backstory::FindingVariable}) — A list of outcomes and match variables that represent the results of this security finding. This list represents a mapping of names of the requested outcomes or match variables, to their values.

    This is only populated when the SecurityResult appears in a detection.

Returns
  • (::Google::Protobuf::Map{::String => ::Google::Backstory::FindingVariable}) — A list of outcomes and match variables that represent the results of this security finding. This list represents a mapping of names of the requested outcomes or match variables, to their values.

    This is only populated when the SecurityResult appears in a detection.

#verdict

def verdict() -> ::Google::Backstory::SecurityResult::Verdict
Returns

#verdict=

def verdict=(value) -> ::Google::Backstory::SecurityResult::Verdict
Parameter
Returns

#verdict_info

def verdict_info() -> ::Array<::Google::Backstory::SecurityResult::VerdictInfo>
Returns

#verdict_info=

def verdict_info=(value) -> ::Array<::Google::Backstory::SecurityResult::VerdictInfo>
Parameter
Returns