Chronicle V1 API - Class Google::Backstory::UDM (v1.4.0)

Reference documentation and code samples for the Chronicle V1 API class Google::Backstory::UDM.

A Unified Data Model event.

Inherits

  • Object

Extended By

  • Google::Protobuf::MessageExts::ClassMethods

Includes

  • Google::Protobuf::MessageExts

Methods

#about

def about() -> ::Array<::Google::Backstory::Noun>
Returns
  • (::Array<::Google::Backstory::Noun>) — Represents entities referenced by the event that are not otherwise described in principal, src, target, intermediary or observer. For example, it could be used to track email file attachments, domains/URLs/IPs embedded within an email body, and DLLs that are loaded during a PROCESS_LAUNCH event.

#about=

def about=(value) -> ::Array<::Google::Backstory::Noun>
Parameter
  • value (::Array<::Google::Backstory::Noun>) — Represents entities referenced by the event that are not otherwise described in principal, src, target, intermediary or observer. For example, it could be used to track email file attachments, domains/URLs/IPs embedded within an email body, and DLLs that are loaded during a PROCESS_LAUNCH event.
Returns
  • (::Array<::Google::Backstory::Noun>) — Represents entities referenced by the event that are not otherwise described in principal, src, target, intermediary or observer. For example, it could be used to track email file attachments, domains/URLs/IPs embedded within an email body, and DLLs that are loaded during a PROCESS_LAUNCH event.

#additional

def additional() -> ::Google::Protobuf::Struct
Returns
  • (::Google::Protobuf::Struct) — Any important vendor-specific event data that cannot be adequately represented within the formal sections of the UDM model.

#additional=

def additional=(value) -> ::Google::Protobuf::Struct
Parameter
  • value (::Google::Protobuf::Struct) — Any important vendor-specific event data that cannot be adequately represented within the formal sections of the UDM model.
Returns
  • (::Google::Protobuf::Struct) — Any important vendor-specific event data that cannot be adequately represented within the formal sections of the UDM model.

#extensions

def extensions() -> ::Google::Backstory::Extensions
Returns
  • (::Google::Backstory::Extensions) — All other first-class, event-specific metadata goes in this message. Do not place protocol metadata in Extensions; put it in Network.

#extensions=

def extensions=(value) -> ::Google::Backstory::Extensions
Parameter
  • value (::Google::Backstory::Extensions) — All other first-class, event-specific metadata goes in this message. Do not place protocol metadata in Extensions; put it in Network.
Returns
  • (::Google::Backstory::Extensions) — All other first-class, event-specific metadata goes in this message. Do not place protocol metadata in Extensions; put it in Network.

#extracted

def extracted() -> ::Google::Protobuf::Struct
Returns

#extracted=

def extracted=(value) -> ::Google::Protobuf::Struct
Parameter
Returns

#grouped

def grouped() -> ::Google::Backstory::GroupedFields
Returns

#grouped=

def grouped=(value) -> ::Google::Backstory::GroupedFields
Parameter
Returns

#intermediary

def intermediary() -> ::Array<::Google::Backstory::Noun>
Returns
  • (::Array<::Google::Backstory::Noun>) — Represents details on one or more intermediate entities processing activity described in the event. This includes device details about a proxy server or SMTP relay server. If an active event (that has a principal and possibly target) passes through any intermediaries, they're added here. Intermediaries can impact the overall action, for example blocking or modifying an ongoing request. A rule of thumb here is that 'principal', 'target', and description of the initial action should be the same regardless of the intermediary or its action. A successful network connection from A->B should look the same in principal/target/intermediary as one blocked by firewall C: principal: A, target: B (intermediary: C).

#intermediary=

def intermediary=(value) -> ::Array<::Google::Backstory::Noun>
Parameter
  • value (::Array<::Google::Backstory::Noun>) — Represents details on one or more intermediate entities processing activity described in the event. This includes device details about a proxy server or SMTP relay server. If an active event (that has a principal and possibly target) passes through any intermediaries, they're added here. Intermediaries can impact the overall action, for example blocking or modifying an ongoing request. A rule of thumb here is that 'principal', 'target', and description of the initial action should be the same regardless of the intermediary or its action. A successful network connection from A->B should look the same in principal/target/intermediary as one blocked by firewall C: principal: A, target: B (intermediary: C).
Returns
  • (::Array<::Google::Backstory::Noun>) — Represents details on one or more intermediate entities processing activity described in the event. This includes device details about a proxy server or SMTP relay server. If an active event (that has a principal and possibly target) passes through any intermediaries, they're added here. Intermediaries can impact the overall action, for example blocking or modifying an ongoing request. A rule of thumb here is that 'principal', 'target', and description of the initial action should be the same regardless of the intermediary or its action. A successful network connection from A->B should look the same in principal/target/intermediary as one blocked by firewall C: principal: A, target: B (intermediary: C).

#metadata

def metadata() -> ::Google::Backstory::Metadata
Returns

#metadata=

def metadata=(value) -> ::Google::Backstory::Metadata
Parameter
Returns

#network

def network() -> ::Google::Backstory::Network
Returns
  • (::Google::Backstory::Network) — All network details go here, including sub-messages with details on each protocol (for example, DHCP, DNS, or HTTP).

#network=

def network=(value) -> ::Google::Backstory::Network
Parameter
  • value (::Google::Backstory::Network) — All network details go here, including sub-messages with details on each protocol (for example, DHCP, DNS, or HTTP).
Returns
  • (::Google::Backstory::Network) — All network details go here, including sub-messages with details on each protocol (for example, DHCP, DNS, or HTTP).

#observer

def observer() -> ::Google::Backstory::Noun
Returns
  • (::Google::Backstory::Noun) — Represents an observer entity (for example, a packet sniffer or network-based vulnerability scanner), which is not a direct intermediary, but which observes and reports on the event in question.

#observer=

def observer=(value) -> ::Google::Backstory::Noun
Parameter
  • value (::Google::Backstory::Noun) — Represents an observer entity (for example, a packet sniffer or network-based vulnerability scanner), which is not a direct intermediary, but which observes and reports on the event in question.
Returns
  • (::Google::Backstory::Noun) — Represents an observer entity (for example, a packet sniffer or network-based vulnerability scanner), which is not a direct intermediary, but which observes and reports on the event in question.

#principal

def principal() -> ::Google::Backstory::Noun
Returns
  • (::Google::Backstory::Noun) — Represents the acting entity that originates the activity described in the event. The principal must include at least one machine detail (hostname, MACs, IPs, port, product-specific identifiers like an EDR asset ID) or user detail (for example, username), and optionally include process details. It must NOT include any of the following fields: email, files, registry keys or values.

#principal=

def principal=(value) -> ::Google::Backstory::Noun
Parameter
  • value (::Google::Backstory::Noun) — Represents the acting entity that originates the activity described in the event. The principal must include at least one machine detail (hostname, MACs, IPs, port, product-specific identifiers like an EDR asset ID) or user detail (for example, username), and optionally include process details. It must NOT include any of the following fields: email, files, registry keys or values.
Returns
  • (::Google::Backstory::Noun) — Represents the acting entity that originates the activity described in the event. The principal must include at least one machine detail (hostname, MACs, IPs, port, product-specific identifiers like an EDR asset ID) or user detail (for example, username), and optionally include process details. It must NOT include any of the following fields: email, files, registry keys or values.

#security_result

def security_result() -> ::Array<::Google::Backstory::SecurityResult>
Returns

#security_result=

def security_result=(value) -> ::Array<::Google::Backstory::SecurityResult>
Parameter
Returns

#src

def src() -> ::Google::Backstory::Noun
Returns
  • (::Google::Backstory::Noun) — Represents a source entity being acted upon by the participant along with the device or process context for the source object (the machine where the source object resides). For example, if user U copies file A on machine X to file B on machine Y, both file A and machine X would be specified in the src portion of the UDM event.

#src=

def src=(value) -> ::Google::Backstory::Noun
Parameter
  • value (::Google::Backstory::Noun) — Represents a source entity being acted upon by the participant along with the device or process context for the source object (the machine where the source object resides). For example, if user U copies file A on machine X to file B on machine Y, both file A and machine X would be specified in the src portion of the UDM event.
Returns
  • (::Google::Backstory::Noun) — Represents a source entity being acted upon by the participant along with the device or process context for the source object (the machine where the source object resides). For example, if user U copies file A on machine X to file B on machine Y, both file A and machine X would be specified in the src portion of the UDM event.

#target

def target() -> ::Google::Backstory::Noun
Returns
  • (::Google::Backstory::Noun) — Represents a target entity being referenced by the event or an object on the target entity. For example, in a firewall connection from device A to device B, A is described as the principal and B is described as the target. For a process injection by process C into target process D, process C is described as the principal and process D is described as the target.

#target=

def target=(value) -> ::Google::Backstory::Noun
Parameter
  • value (::Google::Backstory::Noun) — Represents a target entity being referenced by the event or an object on the target entity. For example, in a firewall connection from device A to device B, A is described as the principal and B is described as the target. For a process injection by process C into target process D, process C is described as the principal and process D is described as the target.
Returns
  • (::Google::Backstory::Noun) — Represents a target entity being referenced by the event or an object on the target entity. For example, in a firewall connection from device A to device B, A is described as the principal and B is described as the target. For a process injection by process C into target process D, process C is described as the principal and process D is described as the target.