prod/accountsettingsmobile-pa-
dictionary_item_added
  • root['schemas']['CardCapabilities']['properties']['clpPromptCardDismissal']['deprecated']
  • root['schemas']['ClientCapabilities']['properties']['expressiveDesign']
dictionary_item_removed
  • root['schemas']['ClpPromptBlock']
  • root['schemas']['ClpPromptCarouselCard']
  • root['schemas']['ClpPromptDescriptionBlock']
  • root['schemas']['ClpPromptItem']
  • root['schemas']['Card']['properties']['clpPromptCarousel']
  • root['schemas']['Resource']['properties']['clpPromptItem']
values_changed
root['revision']
new_value20250313
old_value20250305
root['schemas']['ClientCapabilities']['description']
new_valueDescribes the client's capabilities to the server. Field names should be without a "supports" prefix. It is implicit in the message, since it's about which features the client supports. Next Id: 23
old_valueDescribes the client's capabilities to the server. Field names should be without a "supports" prefix. It is implicit in the message, since it's about which features the client supports. Next Id: 22
iterable_item_added
root['schemas']['GoogleAccountVisualElementMetadata']['properties']['accountSettingsArea']['enum'][417]VIDEO_VERIFICATION_COLLECTION
root['schemas']['GoogleAccountVisualElementMetadata']['properties']['accountSettingsArea']['enumDescriptions'][254]ResourceId.PLATFORM_PAYMENT_METHOD_LIST_SCREEN
root['schemas']['GoogleAccountVisualElementMetadata']['properties']['accountSettingsArea']['enumDescriptions'][417]ResourceId.VIDEO_VERIFICATION_COLLECTION_SCREEN
prod/accountsettingsmobile-pa-v1
dictionary_item_added
  • root['schemas']['CardCapabilities']['properties']['clpPromptCardDismissal']['deprecated']
  • root['schemas']['ClientCapabilities']['properties']['expressiveDesign']
dictionary_item_removed
  • root['schemas']['ClpPromptBlock']
  • root['schemas']['ClpPromptCarouselCard']
  • root['schemas']['ClpPromptDescriptionBlock']
  • root['schemas']['ClpPromptItem']
  • root['schemas']['Card']['properties']['clpPromptCarousel']
  • root['schemas']['Resource']['properties']['clpPromptItem']
values_changed
root['revision']
new_value20250313
old_value20250305
root['schemas']['ClientCapabilities']['description']
new_valueDescribes the client's capabilities to the server. Field names should be without a "supports" prefix. It is implicit in the message, since it's about which features the client supports. Next Id: 23
old_valueDescribes the client's capabilities to the server. Field names should be without a "supports" prefix. It is implicit in the message, since it's about which features the client supports. Next Id: 22
iterable_item_added
root['schemas']['GoogleAccountVisualElementMetadata']['properties']['accountSettingsArea']['enum'][417]VIDEO_VERIFICATION_COLLECTION
root['schemas']['GoogleAccountVisualElementMetadata']['properties']['accountSettingsArea']['enumDescriptions'][254]ResourceId.PLATFORM_PAYMENT_METHOD_LIST_SCREEN
root['schemas']['GoogleAccountVisualElementMetadata']['properties']['accountSettingsArea']['enumDescriptions'][417]ResourceId.VIDEO_VERIFICATION_COLLECTION_SCREEN
prod/actions-
values_changed
root['revision']
new_value20250313
old_value20250310
prod/actions-v2
values_changed
root['revision']
new_value20250313
old_value20250310
prod/actions-v2alpha
values_changed
root['revision']
new_value20250313
old_value20250310
prod/actions-v3
values_changed
root['revision']
new_value20250313
old_value20250310
prod/adsmarketingfrontend-pa-
dictionary_item_removed
  • root['schemas']['Channel']
  • root['schemas']['GetSpendDataRequest']['properties']['channels']
values_changed
root['revision']
new_value20250312
old_value20250309
prod/adsmarketingfrontend-pa-v1
dictionary_item_removed
  • root['schemas']['Channel']
  • root['schemas']['GetSpendDataRequest']['properties']['channels']
values_changed
root['revision']
new_value20250312
old_value20250309
prod/aerialview-
values_changed
root['revision']
new_value20250312
old_value20250309
prod/aerialview-v1
values_changed
root['revision']
new_value20250312
old_value20250309
prod/aerialview-v1beta
values_changed
root['revision']
new_value20250312
old_value20250309
prod/agreement-
values_changed
root['revision']
new_value20250309
old_value20250227
prod/agreement-v1alpha1
values_changed
root['revision']
new_value20250309
old_value20250227
prod/agreement-v1beta1
values_changed
root['revision']
new_value20250309
old_value20250227
prod/aida-
dictionary_item_added
  • root['resources']['aida']['methods']['proxyDoConversation']
values_changed
root['revision']
new_value20250312
old_value20250308
prod/aida-v1
dictionary_item_added
  • root['resources']['aida']['methods']['proxyDoConversation']
values_changed
root['revision']
new_value20250312
old_value20250308
prod/aiplugin-pa-
values_changed
root['revision']
new_value20250309
old_value20250311
iterable_item_added
root['schemas']['ClientMetadata']['properties']['pluginType']['enum'][5]PANTHEON
root['schemas']['ClientMetadata']['properties']['pluginType']['enumDescriptions'][5]API calls coming from Pantheon and Coliseum.
prod/aiplugin-pa-v1
values_changed
root['revision']
new_value20250309
old_value20250311
prod/aiplugin-pa-v1internal
values_changed
root['revision']
new_value20250309
old_value20250311
iterable_item_added
root['schemas']['ClientMetadata']['properties']['pluginType']['enum'][5]PANTHEON
root['schemas']['ClientMetadata']['properties']['pluginType']['enumDescriptions'][5]API calls coming from Pantheon and Coliseum.
prod/aiui-
values_changed
root['revision']
new_value20250312
old_value20250310
prod/aiui-v1
values_changed
root['revision']
new_value20250312
old_value20250310
prod/alkaliauth-pa-
values_changed
root['revision']
new_value20250311
old_value20250225
prod/alkaliauth-pa-v1
values_changed
root['revision']
new_value20250311
old_value20250225
prod/alkalibasemap-pa-
values_changed
root['revision']
new_value20250311
old_value20250304
root['schemas']['ApiPointFixEdit']['properties']['state']['enumDescriptions'][1]
new_valueWhen the edit's is ready to be processed (or currently being processed).
old_valueWhen the edit's evaluation is in progress.
iterable_item_added
root['schemas']['ApiPointFixEdit']['properties']['state']['enum'][4]DUPLICATE
root['schemas']['ApiPointFixEdit']['properties']['state']['enum'][5]PENDING
root['schemas']['ApiPointFixEdit']['properties']['state']['enumDescriptions'][4]When the corresponding GeoIssue is a duplicate of another GeoIssue. The duplicate may or may not be managed by GMCP.
root['schemas']['ApiPointFixEdit']['properties']['state']['enumDescriptions'][5]When there is not enough information to determine the state of the edit. This should be non-terminal.
prod/alkalibasemap-pa-v1
values_changed
root['revision']
new_value20250311
old_value20250304
root['schemas']['ApiPointFixEdit']['properties']['state']['enumDescriptions'][1]
new_valueWhen the edit's is ready to be processed (or currently being processed).
old_valueWhen the edit's evaluation is in progress.
iterable_item_added
root['schemas']['ApiPointFixEdit']['properties']['state']['enum'][4]DUPLICATE
root['schemas']['ApiPointFixEdit']['properties']['state']['enum'][5]PENDING
root['schemas']['ApiPointFixEdit']['properties']['state']['enumDescriptions'][4]When the corresponding GeoIssue is a duplicate of another GeoIssue. The duplicate may or may not be managed by GMCP.
root['schemas']['ApiPointFixEdit']['properties']['state']['enumDescriptions'][5]When there is not enough information to determine the state of the edit. This should be non-terminal.
prod/alkalidatastore-pa-
values_changed
root['revision']
new_value20250312
old_value20250309
prod/alkalidatastore-pa-v1
values_changed
root['revision']
new_value20250312
old_value20250309
prod/alkalilearn-pa-
values_changed
root['revision']
new_value20250311
old_value20250308
prod/alkalilearn-pa-v1
values_changed
root['revision']
new_value20250311
old_value20250308
prod/alkalilearn-pa-v2
values_changed
root['revision']
new_value20250311
old_value20250308
prod/alkalilogexporter-pa-
values_changed
root['revision']
new_value20250312
old_value20250309
prod/alkalilogexporter-pa-v1
values_changed
root['revision']
new_value20250312
old_value20250309
prod/alkalimetricsink-pa-
values_changed
root['revision']
new_value20250313
old_value20250306
iterable_item_added
root['schemas']['EventMetric']['properties']['metricType']['enum'][14]LARGEST_CONTENTFUL_PAINT
root['schemas']['EventMetric']['properties']['metricType']['enum'][15]LARGEST_CONTENTFUL_PAINT_SPA
root['schemas']['EventMetric']['properties']['metricType']['enumDescriptions'][14]Largest Contentful Paint
root['schemas']['EventMetric']['properties']['metricType']['enumDescriptions'][15]Largest Contentful Paint Transition
prod/alkalimetricsink-pa-v1
values_changed
root['revision']
new_value20250313
old_value20250306
iterable_item_added
root['schemas']['EventMetric']['properties']['metricType']['enum'][14]LARGEST_CONTENTFUL_PAINT
root['schemas']['EventMetric']['properties']['metricType']['enum'][15]LARGEST_CONTENTFUL_PAINT_SPA
root['schemas']['EventMetric']['properties']['metricType']['enumDescriptions'][14]Largest Contentful Paint
root['schemas']['EventMetric']['properties']['metricType']['enumDescriptions'][15]Largest Contentful Paint Transition
prod/alkalipanelstvmeter-pa-
values_changed
root['revision']
new_value20250224
old_value20250207
prod/alkalipanelstvmeter-pa-v1
values_changed
root['revision']
new_value20250224
old_value20250207
prod/alkaliproducer-pa-
dictionary_item_removed
  • root['schemas']['ExperimentValues']['properties']['onboardingGaEnabled']
values_changed
root['revision']
new_value20250312
old_value20250307
prod/alkaliproducer-pa-v1
dictionary_item_removed
  • root['schemas']['ExperimentValues']['properties']['onboardingGaEnabled']
values_changed
root['revision']
new_value20250312
old_value20250307
prod/alkalishoutbox-pa-
values_changed
root['revision']
new_value20250313
old_value20250306
prod/alkalishoutbox-pa-v1
values_changed
root['revision']
new_value20250313
old_value20250306
prod/alkalitermsofservice-pa-
values_changed
root['revision']
new_value20250313
old_value20250306
prod/alkalitermsofservice-pa-v1
values_changed
root['revision']
new_value20250313
old_value20250306
prod/alkaliuploader-pa-
values_changed
root['revision']
new_value20250313
old_value20250306
prod/alkaliuploader-pa-v1
values_changed
root['revision']
new_value20250313
old_value20250306
prod/alpha-ml-
values_changed
root['revision']
new_value20250308
old_value20250222
prod/alpha-ml-v1
values_changed
root['revision']
new_value20250308
old_value20250222
prod/alpha-vision-
values_changed
root['revision']
new_value20250312
old_value20250228
prod/alpha-vision-v1
values_changed
root['revision']
new_value20250312
old_value20250228
prod/alpha-vision-v1p1beta1
values_changed
root['revision']
new_value20250312
old_value20250228
prod/alpha-vision-v1p2beta1
values_changed
root['revision']
new_value20250312
old_value20250228
prod/alpha-vision-v1p3beta1
values_changed
root['revision']
new_value20250312
old_value20250228
prod/alpha-vision-v1p4beta1
values_changed
root['revision']
new_value20250312
old_value20250228
prod/analyticssuitefrontend-pa-
values_changed
root['revision']
new_value20250313
old_value20250310
prod/analyticssuitefrontend-pa-v1
values_changed
root['revision']
new_value20250313
old_value20250310
prod/ap-rbmopenmaap-
values_changed
root['revision']
new_value20250313
old_value20250310
prod/ap-rbmopenmaap-v1
values_changed
root['revision']
new_value20250313
old_value20250310
prod/appsbackup-pa-
values_changed
root['revision']
new_value20250312
old_value20250310
prod/appsbackup-pa-v1
values_changed
root['revision']
new_value20250312
old_value20250310
prod/appsgenaiserver-pa-
dictionary_item_added
  • root['schemas']['AppsExtensionsFileMetadataGmailMetadata']
  • root['schemas']['AppsExtensionsSheetsActionsNavigateAction']
  • root['schemas']['AppsIntelligenceGenAiReferenceMetadata']
  • root['schemas']['AppsIntelligenceGenAiSheetsNavigationActionParams']
  • root['schemas']['AppsIntelligenceGenAiTnfmParams']
  • root['schemas']['AppsUpsellSharedRecommendationCustomizedactionbehaviorAdminconsoleaccordionTaskRedirect']
  • root['schemas']['AppsUpsellSharedRecommendationCustomizedactionbehaviorAdminconsoleaccordionTaskRedirectTaskRedirectAction']
  • root['schemas']['AppsUpsellSharedRecommendationCustomizedactionbehaviorAdminconsoleaccordionTaskRedirectTaskRedirectConfig']
  • root['schemas']['AppsUpsellSharedRecommendationTemplatesValuePropGroup']
  • root['schemas']['AppsUpsellSharedRecommendationTemplatesValuePropGroups']
  • root['schemas']['AssistantLamdaWorkspaceEditorResourceReferenceMetadataOptions']
  • root['schemas']['AssistantLamdaWorkspaceToolContentViewNavigationInfoSheetsGridRange']
  • root['schemas']['AppsExtensionsFileMetadata']['properties']['gmailMetadata']
  • root['schemas']['AppsExtensionsSheetsActions']['properties']['navigateAction']
  • root['schemas']['AppsIntelligenceGenAiAction']['properties']['sheetsNavigationActionParams']
  • root['schemas']['AppsIntelligenceGenAiCitationMetadata']['deprecated']
  • root['schemas']['AppsIntelligenceGenAiCitationMetadata']['properties']['tableMetadata']['deprecated']
  • root['schemas']['AppsIntelligenceGenAiUseCaseParams']['properties']['tnfmParams']
  • root['schemas']['AppsIntelligenceGenAiWorkspaceResourceMetadata']['properties']['referenceMetadata']
  • root['schemas']['AppsIntelligenceGenAiWorkspaceResourceMetadata']['properties']['citations']['deprecated']
  • root['schemas']['AppsUpsellSharedRecommendationCommonRecommendation']['properties']['valuePropGroups']
  • root['schemas']['AppsUpsellSharedRecommendationCustomizedactionbehaviorCustomizedActionBehavior']['properties']['adminConsoleAccordionTaskRedirect']
  • root['schemas']['AssistantLamdaWorkspaceEditorResourceReferenceEditorResourceOptions']['properties']['metadataOptions']
  • root['schemas']['AssistantLamdaWorkspaceToolContentViewNavigationInfo']['properties']['sheetsGridRange']
dictionary_item_removed
  • root['schemas']['AppsIntelligenceGenAiCitationMetadata']['description']
  • root['schemas']['AppsIntelligenceGenAiCitationMetadata']['properties']['tableMetadata']['description']
  • root['schemas']['AppsIntelligenceGenAiWorkspaceResourceMetadata']['properties']['citations']['description']
values_changed
root['revision']
new_value20250310
old_value20250306
root['schemas']['AppsExtensionsWorkflowDataSource']['description']
new_valueWorkflow only. In a `TextInput` or `SelectionInput` widget with MULTI_SELECT type or a `DateTimePicker`, provide data source from Google.
old_valueWorkflow only. In a `SelectionInput` or `TextInput` widget with DROPDOWN or MULTI_SELECT type, provide data source from Google.
root['schemas']['AppsIntelligenceGenAiAction']['description']
new_valueNext ID: 19
old_valueNext ID: 18
root['schemas']['AppsIntelligenceGenAiUseCaseParams']['description']
new_valueGenerate Use Case specific parameters Next ID: 13.
old_valueGenerate Use Case specific parameters Next ID: 12.
root['schemas']['AppsIntelligenceGenAiWorkspaceResourceMetadata']['properties']['attributions']['description']
new_valueList of citations in the response that point at this resource (go/bk-citations-prd).
old_valueMetadata about nodes in response that are attributable to this resource.
root['schemas']['AppsUpsellSharedRecommendationCommonRecommendation']['description']
new_valueA common response for recommendation systems. Next id: 26
old_valueA common response for recommendation systems. Next id: 25
root['schemas']['AssistantLamdaEncryptionMetadata']['properties']['isEncrypted']['description']
new_valueIndicates if the file contents is encrypted. If true, the keyset must also be specified, otherwise the file contents will not be readable. If the file attachment is read from logs, this may be set to true even if the keyset is not present to indicate that the file was encrypted but can no longer be decrypted. Encrypted files are stored as "plain" files in storage, since file-type specific processing (e.g. transcoding of images) would fail due to the encryption. See: go/bard-storage-encryption This has the side effect that FIFE urls will not be generated for encrypted files. Moreover encrypted files are not copied to persistent storage. Trying to copy them will fail. If false, but a keyset is specified, the file will not be decrypted. If the file contents is encrypted, this will lead to garbage data being returned.
old_valueIndicates if the file contents is encrypted. If true, the keyset must also be specified, otherwise the file contents will not be readable. If the file attachment is read from logs, this may be set to true even if the keyset is not present to indicate that the file was encrypted but can no longer be decrypted. If false, but a keyset is specified, the file will not be decrypted. If the file contents is encrypted, this will lead to garbage data being returned.
root['schemas']['AssistantLamdaNightwingMutatingOp']['description']
new_valueAn op that generated by the tool. For now it's also used between the server and the client, but we can also translate this proto into the RobinOp in the future. More on go/bard-rfc-802. LINT.IfChange Next ID: 1091.
old_valueAn op that generated by the tool. For now it's also used between the server and the client, but we can also translate this proto into the RobinOp in the future. More on go/bard-rfc-802. LINT.IfChange Next ID: 1090.
root['schemas']['CccHostedUpsellProtoSourceAttributionSource']['properties']['onramp']['enumDescriptions'][347]
new_valueMeet: Premium feature paywall.
old_valueMeet: Recording paywall
root['schemas']['GoogleInternalSubscriptionsFirstpartyV1CallToActionInAppPurchase']['properties']['onramp']['enumDescriptions'][340]
new_valueMeet: General paywall.
old_valueMeet: Greenroom banner
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['onramp']['enumDescriptions'][338]
new_valueMeet: Breakout room paywall.
old_valueMeet: Carousel
root['schemas']['CccHostedUpsellProtoSourceAttributionSource']['properties']['onramp']['enumDescriptions'][338]
new_valueMeet: Breakout room paywall.
old_valueMeet: Carousel
root['schemas']['AppsUpsellSharedRecommendationRecommendationSurface']['properties']['onramp']['enumDescriptions'][342]
new_valueMeet: Landing page with no agenda listed.
old_valueMeet: Landing page promo
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['onramp']['enumDescriptions'][347]
new_valueMeet: Premium feature paywall.
old_valueMeet: Recording paywall
root['schemas']['GoogleInternalSubscriptionsFirstpartyV1CallToActionInAppPurchase']['properties']['onramp']['enumDescriptions'][343]
new_valueMeet: Landing page promo.
old_valueMeet: Landing page welcome screen
root['schemas']['CccHostedUpsellProtoSourceAttributionSource']['properties']['onramp']['enumDescriptions'][343]
new_valueMeet: Landing page promo.
old_valueMeet: Landing page welcome screen
root['schemas']['AppsUpsellSharedRecommendationRecommendationSurface']['properties']['onramp']['enumDescriptions'][341]
new_valueMeet: Greenroom banner.
old_valueMeet: Landing page with no agenda listed
root['schemas']['AppsUpsellSharedRecommendationRecommendationSurface']['properties']['onramp']['enumDescriptions'][338]
new_valueMeet: Breakout room paywall.
old_valueMeet: Carousel
root['schemas']['GoogleInternalSubscriptionsFirstpartyV1CallToActionInAppPurchase']['properties']['onramp']['enumDescriptions'][347]
new_valueMeet: Premium feature paywall.
old_valueMeet: Recording paywall
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['onramp']['enumDescriptions'][337]
new_valueMeet Android: Homescreen banner.
old_valueMeet: Breakout room paywall
root['schemas']['CccHostedUpsellProtoSourceAttributionSource']['properties']['onramp']['enumDescriptions'][346]
new_valueMeet: Poll paywall.
old_valueMeet: Premium feature paywall
root['schemas']['AppsUpsellSharedRecommendationRecommendationSurface']['properties']['onramp']['enumDescriptions'][339]
new_valueMeet: Carousel.
old_valueMeet: General paywall
root['schemas']['GoogleInternalSubscriptionsFirstpartyV1CallToActionInAppPurchase']['properties']['onramp']['enumDescriptions'][342]
new_valueMeet: Landing page with no agenda listed.
old_valueMeet: Landing page promo
root['schemas']['GoogleInternalSubscriptionsFirstpartyV1CallToActionInAppPurchase']['properties']['onramp']['enumDescriptions'][344]
new_valueMeet: Landing page welcome screen.
old_valueMeet: Landing page with agenda listed
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['onramp']['enumDescriptions'][343]
new_valueMeet: Landing page promo.
old_valueMeet: Landing page welcome screen
root['schemas']['GoogleInternalSubscriptionsFirstpartyV1CallToActionInAppPurchase']['properties']['onramp']['enumDescriptions'][339]
new_valueMeet: Carousel.
old_valueMeet: General paywall
root['schemas']['GoogleInternalSubscriptionsFirstpartyV1CallToActionInAppPurchase']['properties']['onramp']['enumDescriptions'][345]
new_valueMeet: Landing page with agenda listed.
old_valueMeet: Poll paywall
root['schemas']['AppsUpsellSharedRecommendationRecommendationSurface']['properties']['onramp']['enumDescriptions'][337]
new_valueMeet Android: Homescreen banner.
old_valueMeet: Breakout room paywall
root['schemas']['CccHostedUpsellProtoSourceAttributionSource']['properties']['onramp']['enumDescriptions'][342]
new_valueMeet: Landing page with no agenda listed.
old_valueMeet: Landing page promo
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['onramp']['enumDescriptions'][345]
new_valueMeet: Landing page with agenda listed.
old_valueMeet: Poll paywall
root['schemas']['CccHostedUpsellProtoSourceAttributionSource']['properties']['onramp']['enumDescriptions'][340]
new_valueMeet: General paywall.
old_valueMeet: Greenroom banner
root['schemas']['GoogleInternalSubscriptionsFirstpartyV1CallToActionInAppPurchase']['properties']['onramp']['enumDescriptions'][346]
new_valueMeet: Poll paywall.
old_valueMeet: Premium feature paywall
root['schemas']['AppsUpsellSharedRecommendationRecommendationSurface']['properties']['onramp']['enumDescriptions'][340]
new_valueMeet: General paywall.
old_valueMeet: Greenroom banner
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['onramp']['enumDescriptions'][342]
new_valueMeet: Landing page with no agenda listed.
old_valueMeet: Landing page promo
root['schemas']['AppsUpsellSharedRecommendationRecommendationSurface']['properties']['onramp']['enumDescriptions'][347]
new_valueMeet: Premium feature paywall.
old_valueMeet: Recording paywall
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['onramp']['enumDescriptions'][339]
new_valueMeet: Carousel.
old_valueMeet: General paywall
root['schemas']['CccHostedUpsellProtoSourceAttributionSource']['properties']['onramp']['enumDescriptions'][337]
new_valueMeet Android: Homescreen banner.
old_valueMeet: Breakout room paywall
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['onramp']['enumDescriptions'][346]
new_valueMeet: Poll paywall.
old_valueMeet: Premium feature paywall
root['schemas']['CccHostedUpsellProtoSourceAttributionSource']['properties']['onramp']['enumDescriptions'][344]
new_valueMeet: Landing page welcome screen.
old_valueMeet: Landing page with agenda listed
root['schemas']['CccHostedUpsellProtoSourceAttributionSource']['properties']['onramp']['enumDescriptions'][341]
new_valueMeet: Greenroom banner.
old_valueMeet: Landing page with no agenda listed
root['schemas']['GoogleInternalSubscriptionsFirstpartyV1CallToActionInAppPurchase']['properties']['onramp']['enumDescriptions'][338]
new_valueMeet: Breakout room paywall.
old_valueMeet: Carousel
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['onramp']['enumDescriptions'][344]
new_valueMeet: Landing page welcome screen.
old_valueMeet: Landing page with agenda listed
root['schemas']['CccHostedUpsellProtoSourceAttributionSource']['properties']['onramp']['enumDescriptions'][339]
new_valueMeet: Carousel.
old_valueMeet: General paywall
root['schemas']['GoogleInternalSubscriptionsFirstpartyV1CallToActionInAppPurchase']['properties']['onramp']['enumDescriptions'][341]
new_valueMeet: Greenroom banner.
old_valueMeet: Landing page with no agenda listed
root['schemas']['GoogleInternalSubscriptionsFirstpartyV1CallToActionInAppPurchase']['properties']['onramp']['enumDescriptions'][337]
new_valueMeet Android: Homescreen banner.
old_valueMeet: Breakout room paywall
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['onramp']['enumDescriptions'][341]
new_valueMeet: Greenroom banner.
old_valueMeet: Landing page with no agenda listed
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['onramp']['enumDescriptions'][340]
new_valueMeet: General paywall.
old_valueMeet: Greenroom banner
root['schemas']['AppsUpsellSharedRecommendationRecommendationSurface']['properties']['onramp']['enumDescriptions'][345]
new_valueMeet: Landing page with agenda listed.
old_valueMeet: Poll paywall
root['schemas']['CccHostedUpsellProtoSourceAttributionSource']['properties']['onramp']['enumDescriptions'][345]
new_valueMeet: Landing page with agenda listed.
old_valueMeet: Poll paywall
root['schemas']['AppsUpsellSharedRecommendationRecommendationSurface']['properties']['onramp']['enumDescriptions'][344]
new_valueMeet: Landing page welcome screen.
old_valueMeet: Landing page with agenda listed
root['schemas']['AppsUpsellSharedRecommendationRecommendationSurface']['properties']['onramp']['enumDescriptions'][343]
new_valueMeet: Landing page promo.
old_valueMeet: Landing page welcome screen
root['schemas']['AppsUpsellSharedRecommendationRecommendationSurface']['properties']['onramp']['enumDescriptions'][346]
new_valueMeet: Poll paywall.
old_valueMeet: Premium feature paywall
iterable_item_added
root['schemas']['AppsExtensionsDuetAiActionStaticPlanData']['properties']['generateUseCase']['enum'][11]SUMMARIZE_FILE
root['schemas']['AppsExtensionsDuetAiActionStaticPlanData']['properties']['generateUseCase']['enum'][58]GENERATE_ITEM_NAME_SUGGESTIONS
root['schemas']['AppsExtensionsDuetAiActionStaticPlanData']['properties']['generateUseCase']['enumDescriptions'][11]Generate a summary based on the content of a specified file. This use case is now used for 1P Link Summary feature.
root['schemas']['AppsExtensionsDuetAiActionStaticPlanData']['properties']['generateUseCase']['enumDescriptions'][58]Generate item name suggestions from the context (e.g. drive item), and the user can apply a generated suggestion as the item name.
root['schemas']['AppsIntelligenceGenAiAction']['properties']['actionType']['enum'][19]SHEETS_NAVIGATION
root['schemas']['AppsIntelligenceGenAiClientDebugInfo']['properties']['useCase']['enum'][11]SUMMARIZE_FILE
root['schemas']['AppsIntelligenceGenAiClientDebugInfo']['properties']['useCase']['enum'][58]GENERATE_ITEM_NAME_SUGGESTIONS
root['schemas']['AppsIntelligenceGenAiClientDebugInfo']['properties']['useCase']['enumDescriptions'][11]Generate a summary based on the content of a specified file. This use case is now used for 1P Link Summary feature.
root['schemas']['AppsIntelligenceGenAiClientDebugInfo']['properties']['useCase']['enumDescriptions'][58]Generate item name suggestions from the context (e.g. drive item), and the user can apply a generated suggestion as the item name.
root['schemas']['AppsIntelligenceGenAiGenerateRequest']['properties']['generateUseCase']['enum'][11]SUMMARIZE_FILE
root['schemas']['AppsIntelligenceGenAiGenerateRequest']['properties']['generateUseCase']['enum'][58]GENERATE_ITEM_NAME_SUGGESTIONS
root['schemas']['AppsIntelligenceGenAiGenerateRequest']['properties']['generateUseCase']['enumDescriptions'][11]Generate a summary based on the content of a specified file. This use case is now used for 1P Link Summary feature.
root['schemas']['AppsIntelligenceGenAiGenerateRequest']['properties']['generateUseCase']['enumDescriptions'][58]Generate item name suggestions from the context (e.g. drive item), and the user can apply a generated suggestion as the item name.
root['schemas']['AppsIntelligenceGenAiGenerationIteration']['properties']['classicUseCase']['enum'][19]CLASSIC_USE_CASE_GENERATE_TEXT_DEPENDENT_QUESTIONS
root['schemas']['AppsIntelligenceGenAiGenerationIteration']['properties']['classicUseCase']['enum'][20]CLASSIC_USE_CASE_GENERATE_RUBRIC
root['schemas']['AppsIntelligenceGenAiGenerationIteration']['properties']['classicUseCase']['enum'][21]CLASSIC_USE_CASE_GENERATE_STORY
root['schemas']['AppsIntelligenceGenAiGenerationIteration']['properties']['classicUseCase']['enum'][22]CLASSIC_USE_CASE_TRANSLATE_TEXT
root['schemas']['AppsIntelligenceGenAiGenerationIteration']['properties']['classicUseCase']['enum'][23]CLASSIC_USE_CASE_GENERATE_COMMON_MISCONCEPTIONS
root['schemas']['AppsIntelligenceGenAiGenerationIteration']['properties']['classicUseCase']['enum'][24]CLASSIC_USE_CASE_GENERATE_PROJECT_ACTIVITIES
root['schemas']['AppsIntelligenceGenAiGenerationIteration']['properties']['classicUseCase']['enum'][25]CLASSIC_USE_CASE_GENERATE_INFORMATIVE_ARTICLES
root['schemas']['AppsIntelligenceGenAiGenerationIteration']['properties']['classicUseCase']['enum'][26]CLASSIC_USE_CASE_GENERATE_CHOICE_BOARD
root['schemas']['AppsIntelligenceGenAiGenerationIteration']['properties']['genAiServiceErrorReason']['enum'][35]VIDEO_GENERATION_INPUT_UNSAFE
root['schemas']['AppsIntelligenceGenAiGenerationIteration']['properties']['genAiServiceErrorReason']['enum'][36]VIDEO_GENERATION_OUTPUT_UNSAFE
root['schemas']['AppsIntelligenceGenAiGenerationIteration']['properties']['genAiServiceErrorReason']['enum'][37]VIDEO_GENERATION_ALL_GENERATIONS_FAILED
root['schemas']['AppsIntelligenceGenAiGenerationIteration']['properties']['genAiServiceErrorReason']['enum'][38]VIDEO_GENERATION_SOFT_PUSHBACK_REWRITTEN
root['schemas']['AppsIntelligenceGenAiGenerationIteration']['properties']['genAiServiceErrorReason']['enumDescriptions'][35]The Kopi request failed because the input to the video generation was deemed unsafe.
root['schemas']['AppsIntelligenceGenAiGenerationIteration']['properties']['genAiServiceErrorReason']['enumDescriptions'][36]The Kopi request failed because the output of the video generation was deemed unsafe.
root['schemas']['AppsIntelligenceGenAiGenerationIteration']['properties']['genAiServiceErrorReason']['enumDescriptions'][37]The Kopi request failed because all requested video generations failed.
root['schemas']['AppsIntelligenceGenAiGenerationIteration']['properties']['genAiServiceErrorReason']['enumDescriptions'][38]The Kopi request failed because the video generation tool soft pushback was rewritten.
root['schemas']['AppsIntelligenceGenAiGenerationIteration']['properties']['generateUseCase']['enum'][11]SUMMARIZE_FILE
root['schemas']['AppsIntelligenceGenAiGenerationIteration']['properties']['generateUseCase']['enum'][58]GENERATE_ITEM_NAME_SUGGESTIONS
root['schemas']['AppsIntelligenceGenAiGenerationIteration']['properties']['generateUseCase']['enumDescriptions'][11]Generate a summary based on the content of a specified file. This use case is now used for 1P Link Summary feature.
root['schemas']['AppsIntelligenceGenAiGenerationIteration']['properties']['generateUseCase']['enumDescriptions'][58]Generate item name suggestions from the context (e.g. drive item), and the user can apply a generated suggestion as the item name.
root['schemas']['AppsIntelligenceGenAiGetQuotaSummaryRequest']['properties']['classicUseCase']['enum'][19]CLASSIC_USE_CASE_GENERATE_TEXT_DEPENDENT_QUESTIONS
root['schemas']['AppsIntelligenceGenAiGetQuotaSummaryRequest']['properties']['classicUseCase']['enum'][20]CLASSIC_USE_CASE_GENERATE_RUBRIC
root['schemas']['AppsIntelligenceGenAiGetQuotaSummaryRequest']['properties']['classicUseCase']['enum'][21]CLASSIC_USE_CASE_GENERATE_STORY
root['schemas']['AppsIntelligenceGenAiGetQuotaSummaryRequest']['properties']['classicUseCase']['enum'][22]CLASSIC_USE_CASE_TRANSLATE_TEXT
root['schemas']['AppsIntelligenceGenAiGetQuotaSummaryRequest']['properties']['classicUseCase']['enum'][23]CLASSIC_USE_CASE_GENERATE_COMMON_MISCONCEPTIONS
root['schemas']['AppsIntelligenceGenAiGetQuotaSummaryRequest']['properties']['classicUseCase']['enum'][24]CLASSIC_USE_CASE_GENERATE_PROJECT_ACTIVITIES
root['schemas']['AppsIntelligenceGenAiGetQuotaSummaryRequest']['properties']['classicUseCase']['enum'][25]CLASSIC_USE_CASE_GENERATE_INFORMATIVE_ARTICLES
root['schemas']['AppsIntelligenceGenAiGetQuotaSummaryRequest']['properties']['classicUseCase']['enum'][26]CLASSIC_USE_CASE_GENERATE_CHOICE_BOARD
root['schemas']['AppsIntelligenceGenAiGetQuotaSummaryRequest']['properties']['generateUseCase']['enum'][11]SUMMARIZE_FILE
root['schemas']['AppsIntelligenceGenAiGetQuotaSummaryRequest']['properties']['generateUseCase']['enum'][58]GENERATE_ITEM_NAME_SUGGESTIONS
root['schemas']['AppsIntelligenceGenAiGetQuotaSummaryRequest']['properties']['generateUseCase']['enumDescriptions'][11]Generate a summary based on the content of a specified file. This use case is now used for 1P Link Summary feature.
root['schemas']['AppsIntelligenceGenAiGetQuotaSummaryRequest']['properties']['generateUseCase']['enumDescriptions'][58]Generate item name suggestions from the context (e.g. drive item), and the user can apply a generated suggestion as the item name.
root['schemas']['AppsIntelligenceGenAiQuestionAnswerListActionParamsQuestionAnswer']['properties']['useCaseForSuggestionFollowup']['enum'][11]SUMMARIZE_FILE
root['schemas']['AppsIntelligenceGenAiQuestionAnswerListActionParamsQuestionAnswer']['properties']['useCaseForSuggestionFollowup']['enum'][58]GENERATE_ITEM_NAME_SUGGESTIONS
root['schemas']['AppsIntelligenceGenAiQuestionAnswerListActionParamsQuestionAnswer']['properties']['useCaseForSuggestionFollowup']['enumDescriptions'][11]Generate a summary based on the content of a specified file. This use case is now used for 1P Link Summary feature.
root['schemas']['AppsIntelligenceGenAiQuestionAnswerListActionParamsQuestionAnswer']['properties']['useCaseForSuggestionFollowup']['enumDescriptions'][58]Generate item name suggestions from the context (e.g. drive item), and the user can apply a generated suggestion as the item name.
root['schemas']['AppsIntelligenceGenAiRecordFeatureUsageRequest']['properties']['classicUseCase']['enum'][19]CLASSIC_USE_CASE_GENERATE_TEXT_DEPENDENT_QUESTIONS
root['schemas']['AppsIntelligenceGenAiRecordFeatureUsageRequest']['properties']['classicUseCase']['enum'][20]CLASSIC_USE_CASE_GENERATE_RUBRIC
root['schemas']['AppsIntelligenceGenAiRecordFeatureUsageRequest']['properties']['classicUseCase']['enum'][21]CLASSIC_USE_CASE_GENERATE_STORY
root['schemas']['AppsIntelligenceGenAiRecordFeatureUsageRequest']['properties']['classicUseCase']['enum'][22]CLASSIC_USE_CASE_TRANSLATE_TEXT
root['schemas']['AppsIntelligenceGenAiRecordFeatureUsageRequest']['properties']['classicUseCase']['enum'][23]CLASSIC_USE_CASE_GENERATE_COMMON_MISCONCEPTIONS
root['schemas']['AppsIntelligenceGenAiRecordFeatureUsageRequest']['properties']['classicUseCase']['enum'][24]CLASSIC_USE_CASE_GENERATE_PROJECT_ACTIVITIES
root['schemas']['AppsIntelligenceGenAiRecordFeatureUsageRequest']['properties']['classicUseCase']['enum'][25]CLASSIC_USE_CASE_GENERATE_INFORMATIVE_ARTICLES
root['schemas']['AppsIntelligenceGenAiRecordFeatureUsageRequest']['properties']['classicUseCase']['enum'][26]CLASSIC_USE_CASE_GENERATE_CHOICE_BOARD
root['schemas']['AppsIntelligenceGenAiRecordFeatureUsageRequest']['properties']['generateUseCase']['enum'][11]SUMMARIZE_FILE
root['schemas']['AppsIntelligenceGenAiRecordFeatureUsageRequest']['properties']['generateUseCase']['enum'][58]GENERATE_ITEM_NAME_SUGGESTIONS
root['schemas']['AppsIntelligenceGenAiRecordFeatureUsageRequest']['properties']['generateUseCase']['enumDescriptions'][11]Generate a summary based on the content of a specified file. This use case is now used for 1P Link Summary feature.
root['schemas']['AppsIntelligenceGenAiRecordFeatureUsageRequest']['properties']['generateUseCase']['enumDescriptions'][58]Generate item name suggestions from the context (e.g. drive item), and the user can apply a generated suggestion as the item name.
root['schemas']['AppsIntelligenceGenAiStarterTile']['properties']['generateUseCase']['enum'][11]SUMMARIZE_FILE
root['schemas']['AppsIntelligenceGenAiStarterTile']['properties']['generateUseCase']['enum'][58]GENERATE_ITEM_NAME_SUGGESTIONS
root['schemas']['AppsIntelligenceGenAiStarterTile']['properties']['generateUseCase']['enumDescriptions'][11]Generate a summary based on the content of a specified file. This use case is now used for 1P Link Summary feature.
root['schemas']['AppsIntelligenceGenAiStarterTile']['properties']['generateUseCase']['enumDescriptions'][58]Generate item name suggestions from the context (e.g. drive item), and the user can apply a generated suggestion as the item name.
root['schemas']['AppsIntelligenceGenAiStarterTile']['properties']['starterTileType']['enum'][85]GMAIL_COPY_CREATOR_CUSTOMER_REACTIVATION
root['schemas']['AppsIntelligenceGenAiStarterTile']['properties']['starterTileType']['enum'][86]GMAIL_COPY_CREATOR_MARKETING_CAMPAIGN
root['schemas']['AppsIntelligenceGenAiStarterTile']['properties']['starterTileType']['enum'][87]GMAIL_COPY_CREATOR_PRODUCT_INTRODUCTION
root['schemas']['AppsIntelligenceGenAiStarterTile']['properties']['starterTileType']['enum'][88]GMAIL_CUSTOMER_OUTREACH_SPECIALIST_COMPLAINS_APOLOGY
root['schemas']['AppsIntelligenceGenAiStarterTile']['properties']['starterTileType']['enum'][89]GMAIL_CUSTOMER_OUTREACH_SPECIALIST_ENQUIRIES_RESPONSE
root['schemas']['AppsIntelligenceGenAiStarterTile']['properties']['starterTileType']['enum'][90]GMAIL_CUSTOMER_SENTIMENT_ANALYZER_CUSTOMERS_SENTIMENT_COMPARISON
root['schemas']['AppsIntelligenceGenAiStarterTile']['properties']['starterTileType']['enum'][91]GMAIL_CUSTOMER_SENTIMENT_ANALYZER_FEEDBACK_SUMMARY
root['schemas']['AppsIntelligenceGenAiStarterTile']['properties']['starterTileType']['enum'][92]GMAIL_CUSTOMER_SENTIMENT_ANALYZER_NEW_PRODUCT_FEEDBACK_ANALYSIS
root['schemas']['AppsIntelligenceGenAiStarterTile']['properties']['starterTileType']['enum'][97]GMAIL_HIRING_CONSULTANT_CANDIDATES_OUTREACH_EMAIL_GENERATION
root['schemas']['AppsIntelligenceGenAiStarterTile']['properties']['starterTileType']['enum'][98]GMAIL_HIRING_CONSULTANT_INTERVIEW_QUESTION_SUGGESTION
root['schemas']['AppsIntelligenceGenAiStarterTile']['properties']['starterTileType']['enum'][99]GMAIL_HIRING_CONSULTANT_NEW_JOB_DESCRIPTION_CREATION
root['schemas']['AppsIntelligenceGenAiStarterTile']['properties']['starterTileType']['enum'][101]GMAIL_SALES_PITCH_IDEATOR_BRAINSTORM
root['schemas']['AppsIntelligenceGenAiStarterTile']['properties']['starterTileType']['enum'][102]GMAIL_SALES_PITCH_IDEATOR_CRAFT_MESSAGES
root['schemas']['AppsIntelligenceGenAiStarterTile']['properties']['starterTileType']['enum'][103]GMAIL_SALES_PITCH_IDEATOR_OBJECTIONS_RESPONSE
root['schemas']['AppsIntelligenceGenAiStarterTile']['properties']['starterTileType']['enum'][104]GMAIL_SALES_PITCH_IDEATOR_SALES_PITCH
root['schemas']['AppsIntelligenceGenAiTurn']['properties']['generateUseCase']['enum'][11]SUMMARIZE_FILE
root['schemas']['AppsIntelligenceGenAiTurn']['properties']['generateUseCase']['enum'][58]GENERATE_ITEM_NAME_SUGGESTIONS
root['schemas']['AppsIntelligenceGenAiTurn']['properties']['generateUseCase']['enumDescriptions'][11]Generate a summary based on the content of a specified file. This use case is now used for 1P Link Summary feature.
root['schemas']['AppsIntelligenceGenAiTurn']['properties']['generateUseCase']['enumDescriptions'][58]Generate item name suggestions from the context (e.g. drive item), and the user can apply a generated suggestion as the item name.
root['schemas']['AppsIntelligenceGenAiWriteAuditLogRequest']['properties']['classicUseCase']['enum'][19]CLASSIC_USE_CASE_GENERATE_TEXT_DEPENDENT_QUESTIONS
root['schemas']['AppsIntelligenceGenAiWriteAuditLogRequest']['properties']['classicUseCase']['enum'][20]CLASSIC_USE_CASE_GENERATE_RUBRIC
root['schemas']['AppsIntelligenceGenAiWriteAuditLogRequest']['properties']['classicUseCase']['enum'][21]CLASSIC_USE_CASE_GENERATE_STORY
root['schemas']['AppsIntelligenceGenAiWriteAuditLogRequest']['properties']['classicUseCase']['enum'][22]CLASSIC_USE_CASE_TRANSLATE_TEXT
root['schemas']['AppsIntelligenceGenAiWriteAuditLogRequest']['properties']['classicUseCase']['enum'][23]CLASSIC_USE_CASE_GENERATE_COMMON_MISCONCEPTIONS
root['schemas']['AppsIntelligenceGenAiWriteAuditLogRequest']['properties']['classicUseCase']['enum'][24]CLASSIC_USE_CASE_GENERATE_PROJECT_ACTIVITIES
root['schemas']['AppsIntelligenceGenAiWriteAuditLogRequest']['properties']['classicUseCase']['enum'][25]CLASSIC_USE_CASE_GENERATE_INFORMATIVE_ARTICLES
root['schemas']['AppsIntelligenceGenAiWriteAuditLogRequest']['properties']['classicUseCase']['enum'][26]CLASSIC_USE_CASE_GENERATE_CHOICE_BOARD
root['schemas']['AppsIntelligenceGenAiWriteAuditLogRequest']['properties']['generateUseCase']['enum'][11]SUMMARIZE_FILE
root['schemas']['AppsIntelligenceGenAiWriteAuditLogRequest']['properties']['generateUseCase']['enum'][58]GENERATE_ITEM_NAME_SUGGESTIONS
root['schemas']['AppsIntelligenceGenAiWriteAuditLogRequest']['properties']['generateUseCase']['enumDescriptions'][11]Generate a summary based on the content of a specified file. This use case is now used for 1P Link Summary feature.
root['schemas']['AppsIntelligenceGenAiWriteAuditLogRequest']['properties']['generateUseCase']['enumDescriptions'][58]Generate item name suggestions from the context (e.g. drive item), and the user can apply a generated suggestion as the item name.
root['schemas']['AppsUpsellSharedRecommendationRecommendationSurface']['properties']['onramp']['enum'][337]MEET_ANDROID_HOMESCREEN_BANNER
root['schemas']['AppsUpsellSharedRecommendationRecommendationSurface']['properties']['onramp']['enumDescriptions'][348]Meet: Recording paywall.
root['schemas']['AppsUpsellSharedRecommendationTemplatesCategory']['properties']['promoCategory']['enum'][25]PROMO_CATEGORY_G1_UPSELL
root['schemas']['AssistantLamdaWorkspaceToolContentViewNavigationInfo']['properties']['viewDestination']['enum'][2]VIEW_DESTINATION_SHEETS_GRID_RANGE
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['onramp']['enum'][337]MEET_ANDROID_HOMESCREEN_BANNER
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['onramp']['enumDescriptions'][348]Meet: Recording paywall.
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoTemplateId']['enum'][16]DOCS_GEN_AI_LOCKED_FEATURES_CONSUMER_NOTICE
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoTemplateId']['enum'][305]XXX_TEST_ONLY_XWS_FLAG_PROMO_TEMPLATE
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoTemplateId']['enum'][324]GEMRISE_V2_NOTEBOOKLM_DISCOVER_CARD
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoTemplateId']['enum'][423]CORE_VALUE_MONTHLY_V2_BIZ_STARTER_E_SIGNATURE_NO_DISCOUNT_DOCS_UPSELL_BANNER_TEMPLATE
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoTemplateId']['enum'][424]CORE_VALUE_MONTHLY_V2_BIZ_STARTER_E_SIGNATURE_DISCOUNT_DOCS_UPSELL_BANNER_TEMPLATE
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoTemplateId']['enum'][425]CORE_VALUE_MONTHLY_V2_BIZ_STARTER_E_SIGNATURE_NO_DISCOUNT_SHEETS_AND_SLIDES_UPSELL_BANNER_TEMPLATE
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoTemplateId']['enum'][426]CORE_VALUE_MONTHLY_V2_BIZ_STARTER_E_SIGNATURE_DISCOUNT_SHEETS_AND_SLIDES_UPSELL_BANNER_TEMPLATE
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoTemplateId']['enum'][431]CORE_VALUE_MONTHLY_V2_BIZ_STARTER_E_SIGNATURE_NO_DISCOUNT_DISCOVER_UPSELL_BANNER_TEMPLATE
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoTemplateId']['enum'][432]CORE_VALUE_MONTHLY_V2_BIZ_STARTER_E_SIGNATURE_NO_DISCOUNT_AC_UPSELL_BANNER_TEMPLATE
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoTemplateId']['enum'][433]CORE_VALUE_MONTHLY_V2_BIZ_STARTER_E_SIGNATURE_DISCOUNT_DISCOVER_UPSELL_BANNER_TEMPLATE
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoTemplateId']['enum'][434]CORE_VALUE_MONTHLY_V2_BIZ_STARTER_E_SIGNATURE_DISCOUNT_AC_UPSELL_BANNER_TEMPLATE
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoTemplateId']['enum'][435]CORE_VALUE_MONTHLY_V2_BIZ_STARTER_SA_NO_DISCOUNT_DISCOVER_UPSELL_BANNER_TEMPLATE
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoTemplateId']['enum'][436]CORE_VALUE_MONTHLY_V2_BIZ_STARTER_SA_NO_DISCOUNT_AC_UPSELL_BANNER_TEMPLATE
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoTemplateId']['enum'][437]CORE_VALUE_MONTHLY_V2_BIZ_STARTER_SA_DISCOUNT_DISCOVER_UPSELL_BANNER_TEMPLATE
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoTemplateId']['enum'][438]CORE_VALUE_MONTHLY_V2_BIZ_STARTER_SA_DISCOUNT_AC_UPSELL_BANNER_TEMPLATE
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoTemplateId']['enum'][439]CORE_VALUE_MONTHLY_V2_BIZ_STARTER_CA_NO_DISCOUNT_DISCOVER_UPSELL_BANNER_TEMPLATE
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoTemplateId']['enum'][440]CORE_VALUE_MONTHLY_V2_BIZ_STARTER_CA_NO_DISCOUNT_AC_UPSELL_BANNER_TEMPLATE
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoTemplateId']['enum'][441]CORE_VALUE_MONTHLY_V2_BIZ_STARTER_CA_DISCOUNT_DISCOVER_UPSELL_BANNER_TEMPLATE
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoTemplateId']['enum'][442]CORE_VALUE_MONTHLY_V2_BIZ_STARTER_CA_DISCOUNT_AC_UPSELL_BANNER_TEMPLATE
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoTemplateId']['enum'][443]CORE_VALUE_E_SIGNATURE_UPSELL_DOCS_TOOLTIP_TEMPLATE
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoTemplateId']['enum'][479]ADMIN_CONSOLE_ONBOARDING_ADD_USER_TASK_CARD_WITH_CONTEXT
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoTemplateId']['enum'][480]ADMIN_CONSOLE_ONBOARDING_LOGO_UPLOAD_TASK_CARD_WITH_CONTEXT
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoTemplateId']['enum'][481]ADMIN_CONSOLE_ONBOARDING_VERIFY_DOMAIN_TASK_CARD_WITH_CONTEXT
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoTemplateId']['enum'][482]ADMIN_CONSOLE_ONBOARDING_GMAIL_SETTING_TASK_CARD_WITH_CONTEXT
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoTemplateId']['enum'][483]ADMIN_CONSOLE_ONBOARDING_TWOSV_ENFORCEMENT_TASK_CARD_WITH_CONTEXT
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoTemplateId']['enum'][484]ADMIN_CONSOLE_ONBOARDING_MIGRATE_DATA_TASK_CARD_WITH_CONTEXT
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoTemplateId']['enum'][485]ADMIN_CONSOLE_ONBOARDING_CREATE_EMAIL_ALIAS_TASK_CARD_WITH_CONTEXT
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoTemplateId']['enum'][486]ADMIN_CONSOLE_ONBOARDING_MX_RECORDS_SETUP_TASK_CARD_WITH_CONTEXT
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoTemplateId']['enum'][487]ADMIN_CONSOLE_ONBOARDING_ICANN_VERIFICATION_TASK_CARD_WITH_CONTEXT
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoTemplateId']['enum'][488]AC_BILLING_BUYFLOW_V2_SECURITY_ADVISOR_CHECKOUT_CARD
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoTemplateId']['enum'][489]AC_BILLING_BUYFLOW_V2_SECURITY_ADVISOR_CHECKOUT_VALUE_PROP_GROUPS
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoTemplateId']['enum'][490]AC_BILLING_BUYFLOW_V2_APPOINTMENT_SCHEDULING_CHECKOUT_CARD
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoTemplateId']['enum'][491]AC_BILLING_BUYFLOW_V2_APPOINTMENT_SCHEDULING_CHECKOUT_VALUE_PROP_GROUPS
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoTemplateId']['enum'][492]AC_BILLING_BUYFLOW_V2_E_SIGNATURE_CHECKOUT_CARD
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoTemplateId']['enum'][493]AC_BILLING_BUYFLOW_V2_E_SIGNATURE_CHECKOUT_VALUE_PROP_GROUPS
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoTemplateId']['enum'][494]AC_BILLING_BUYFLOW_V2_DEFAULT_CHECKOUT_CARD
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoTemplateId']['enum'][495]AC_BILLING_BUYFLOW_V2_DEFAULT_CHECKOUT_VALUE_PROP_GROUPS
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoTemplateId']['enumDescriptions'][479]go/ac-accordion
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoTemplateId']['enumDescriptions'][488]go/dvp-design
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoType']['enum'][106]CORE_VALUE_E_SIGNATURE_UPSELL_DOCS_TOOLTIP
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoType']['enum'][115]DOCS_GEN_AI_LOCKED_FEATURES_CONSUMER
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoType']['enum'][316]CORE_VALUE_EMAIL_BUSINESS_STARTER_DISCOUNT_UPSELL_MONTHLY_V2
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoType']['enum'][317]CORE_VALUE_EMAIL_BUSINESS_STARTER_NON_DISCOUNT_UPSELL_MONTHLY_V2
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoType']['enum'][318]CORE_VALUE_EMAIL_BUSINESS_STARTER_UPSELL_MONTHLY_V2
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoType']['enum'][325]CORE_VALUE_MONTHLY_V2_BIZ_STARTER_E_SIGNATURE_NO_DISCOUNT_DISCOVER_AC_UPSELL
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoType']['enum'][326]CORE_VALUE_MONTHLY_V2_BIZ_STARTER_E_SIGNATURE_DISCOUNT_DISCOVER_AC_UPSELL
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoType']['enum'][327]CORE_VALUE_MONTHLY_V2_BIZ_STARTER_SA_NO_DISCOUNT_DISCOVER_AC_UPSELL
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoType']['enum'][328]CORE_VALUE_MONTHLY_V2_BIZ_STARTER_SA_DISCOUNT_DISCOVER_AC_UPSELL
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoType']['enum'][329]CORE_VALUE_MONTHLY_V2_BIZ_STARTER_CA_NO_DISCOUNT_DISCOVER_AC_UPSELL
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoType']['enum'][330]CORE_VALUE_MONTHLY_V2_BIZ_STARTER_CA_DISCOUNT_DISCOVER_AC_UPSELL
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoType']['enum'][354]XXX_TEST_ONLY_XWS_FLAG_PROMO
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoType']['enum'][355]XXX_TEST_ONLY_MEET_ANDROID_HOMESCREEN_BANNER
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoType']['enum'][601]G1_GEN_AI_UPSELL_WFAC_WAVE5
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoType']['enum'][700]ABANDONED_BUYFLOW_FOLLOW_UP_EMAIL
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoType']['enum'][701]AC_BILLING_BUYFLOW_V2_SECURITY_ADVISOR_VALUE_PROP
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoType']['enum'][702]AC_BILLING_BUYFLOW_V2_APPOINTMENT_SCHEDULING_VALUE_PROP
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoType']['enum'][703]AC_BILLING_BUYFLOW_V2_E_SIGNATURE_VALUE_PROP
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoType']['enum'][704]AC_BILLING_BUYFLOW_V2_DEFAULT_VALUE_PROP
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoType']['enumDescriptions'][106]eSig Business Standard Upsell http://shortn/_oHS4N2IbSg
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoType']['enumDescriptions'][601]go/g1-ai-wfac-w5-experiment-design
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoType']['enumDescriptions'][700]go/abandoned-buyflow-follow-up-email-design
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoType']['enumDescriptions'][701]go/dvp-design
root['schemas']['CccHostedUpsellProtoSourceAttributionSource']['properties']['onramp']['enum'][337]MEET_ANDROID_HOMESCREEN_BANNER
root['schemas']['CccHostedUpsellProtoSourceAttributionSource']['properties']['onramp']['enumDescriptions'][348]Meet: Recording paywall.
root['schemas']['CccHostedUpsellProtoSourceAttributionSource']['properties']['promoType']['enum'][106]CORE_VALUE_E_SIGNATURE_UPSELL_DOCS_TOOLTIP
root['schemas']['CccHostedUpsellProtoSourceAttributionSource']['properties']['promoType']['enum'][115]DOCS_GEN_AI_LOCKED_FEATURES_CONSUMER
root['schemas']['CccHostedUpsellProtoSourceAttributionSource']['properties']['promoType']['enum'][316]CORE_VALUE_EMAIL_BUSINESS_STARTER_DISCOUNT_UPSELL_MONTHLY_V2
root['schemas']['CccHostedUpsellProtoSourceAttributionSource']['properties']['promoType']['enum'][317]CORE_VALUE_EMAIL_BUSINESS_STARTER_NON_DISCOUNT_UPSELL_MONTHLY_V2
root['schemas']['CccHostedUpsellProtoSourceAttributionSource']['properties']['promoType']['enum'][318]CORE_VALUE_EMAIL_BUSINESS_STARTER_UPSELL_MONTHLY_V2
root['schemas']['CccHostedUpsellProtoSourceAttributionSource']['properties']['promoType']['enum'][325]CORE_VALUE_MONTHLY_V2_BIZ_STARTER_E_SIGNATURE_NO_DISCOUNT_DISCOVER_AC_UPSELL
root['schemas']['CccHostedUpsellProtoSourceAttributionSource']['properties']['promoType']['enum'][326]CORE_VALUE_MONTHLY_V2_BIZ_STARTER_E_SIGNATURE_DISCOUNT_DISCOVER_AC_UPSELL
root['schemas']['CccHostedUpsellProtoSourceAttributionSource']['properties']['promoType']['enum'][327]CORE_VALUE_MONTHLY_V2_BIZ_STARTER_SA_NO_DISCOUNT_DISCOVER_AC_UPSELL
root['schemas']['CccHostedUpsellProtoSourceAttributionSource']['properties']['promoType']['enum'][328]CORE_VALUE_MONTHLY_V2_BIZ_STARTER_SA_DISCOUNT_DISCOVER_AC_UPSELL
root['schemas']['CccHostedUpsellProtoSourceAttributionSource']['properties']['promoType']['enum'][329]CORE_VALUE_MONTHLY_V2_BIZ_STARTER_CA_NO_DISCOUNT_DISCOVER_AC_UPSELL
root['schemas']['CccHostedUpsellProtoSourceAttributionSource']['properties']['promoType']['enum'][330]CORE_VALUE_MONTHLY_V2_BIZ_STARTER_CA_DISCOUNT_DISCOVER_AC_UPSELL
root['schemas']['CccHostedUpsellProtoSourceAttributionSource']['properties']['promoType']['enum'][354]XXX_TEST_ONLY_XWS_FLAG_PROMO
root['schemas']['CccHostedUpsellProtoSourceAttributionSource']['properties']['promoType']['enum'][355]XXX_TEST_ONLY_MEET_ANDROID_HOMESCREEN_BANNER
root['schemas']['CccHostedUpsellProtoSourceAttributionSource']['properties']['promoType']['enum'][601]G1_GEN_AI_UPSELL_WFAC_WAVE5
root['schemas']['CccHostedUpsellProtoSourceAttributionSource']['properties']['promoType']['enum'][700]ABANDONED_BUYFLOW_FOLLOW_UP_EMAIL
root['schemas']['CccHostedUpsellProtoSourceAttributionSource']['properties']['promoType']['enum'][701]AC_BILLING_BUYFLOW_V2_SECURITY_ADVISOR_VALUE_PROP
root['schemas']['CccHostedUpsellProtoSourceAttributionSource']['properties']['promoType']['enum'][702]AC_BILLING_BUYFLOW_V2_APPOINTMENT_SCHEDULING_VALUE_PROP
root['schemas']['CccHostedUpsellProtoSourceAttributionSource']['properties']['promoType']['enum'][703]AC_BILLING_BUYFLOW_V2_E_SIGNATURE_VALUE_PROP
root['schemas']['CccHostedUpsellProtoSourceAttributionSource']['properties']['promoType']['enum'][704]AC_BILLING_BUYFLOW_V2_DEFAULT_VALUE_PROP
root['schemas']['CccHostedUpsellProtoSourceAttributionSource']['properties']['promoType']['enumDescriptions'][106]eSig Business Standard Upsell http://shortn/_oHS4N2IbSg
root['schemas']['CccHostedUpsellProtoSourceAttributionSource']['properties']['promoType']['enumDescriptions'][601]go/g1-ai-wfac-w5-experiment-design
root['schemas']['CccHostedUpsellProtoSourceAttributionSource']['properties']['promoType']['enumDescriptions'][700]go/abandoned-buyflow-follow-up-email-design
root['schemas']['CccHostedUpsellProtoSourceAttributionSource']['properties']['promoType']['enumDescriptions'][701]go/dvp-design
root['schemas']['GoogleInternalSubscriptionsFirstpartyV1CallToActionInAppPurchase']['properties']['onramp']['enum'][337]MEET_ANDROID_HOMESCREEN_BANNER
root['schemas']['GoogleInternalSubscriptionsFirstpartyV1CallToActionInAppPurchase']['properties']['onramp']['enumDescriptions'][348]Meet: Recording paywall.
iterable_item_removed
root['schemas']['AppsExtensionsDuetAiActionStaticPlanData']['properties']['generateUseCase']['enum'][94]CATEGORIZE_EMAIL_FOR_DRIVE
root['schemas']['AppsIntelligenceGenAiClientDebugInfo']['properties']['useCase']['enum'][94]CATEGORIZE_EMAIL_FOR_DRIVE
root['schemas']['AppsIntelligenceGenAiGenerateRequest']['properties']['generateUseCase']['enum'][94]CATEGORIZE_EMAIL_FOR_DRIVE
root['schemas']['AppsIntelligenceGenAiGenerationIteration']['properties']['generateUseCase']['enum'][94]CATEGORIZE_EMAIL_FOR_DRIVE
root['schemas']['AppsIntelligenceGenAiGetQuotaSummaryRequest']['properties']['generateUseCase']['enum'][94]CATEGORIZE_EMAIL_FOR_DRIVE
root['schemas']['AppsIntelligenceGenAiQuestionAnswerListActionParamsQuestionAnswer']['properties']['useCaseForSuggestionFollowup']['enum'][94]CATEGORIZE_EMAIL_FOR_DRIVE
root['schemas']['AppsIntelligenceGenAiRecordFeatureUsageRequest']['properties']['generateUseCase']['enum'][94]CATEGORIZE_EMAIL_FOR_DRIVE
root['schemas']['AppsIntelligenceGenAiStarterTile']['properties']['generateUseCase']['enum'][94]CATEGORIZE_EMAIL_FOR_DRIVE
root['schemas']['AppsIntelligenceGenAiTurn']['properties']['generateUseCase']['enum'][94]CATEGORIZE_EMAIL_FOR_DRIVE
root['schemas']['AppsIntelligenceGenAiWriteAuditLogRequest']['properties']['generateUseCase']['enum'][94]CATEGORIZE_EMAIL_FOR_DRIVE
prod/appsgenaiserver-pa-v1
dictionary_item_added
  • root['schemas']['AppsExtensionsFileMetadataGmailMetadata']
  • root['schemas']['AppsExtensionsSheetsActionsNavigateAction']
  • root['schemas']['AppsIntelligenceGenAiReferenceMetadata']
  • root['schemas']['AppsIntelligenceGenAiSheetsNavigationActionParams']
  • root['schemas']['AppsIntelligenceGenAiTnfmParams']
  • root['schemas']['AppsUpsellSharedRecommendationCustomizedactionbehaviorAdminconsoleaccordionTaskRedirect']
  • root['schemas']['AppsUpsellSharedRecommendationCustomizedactionbehaviorAdminconsoleaccordionTaskRedirectTaskRedirectAction']
  • root['schemas']['AppsUpsellSharedRecommendationCustomizedactionbehaviorAdminconsoleaccordionTaskRedirectTaskRedirectConfig']
  • root['schemas']['AppsUpsellSharedRecommendationTemplatesValuePropGroup']
  • root['schemas']['AppsUpsellSharedRecommendationTemplatesValuePropGroups']
  • root['schemas']['AssistantLamdaWorkspaceEditorResourceReferenceMetadataOptions']
  • root['schemas']['AssistantLamdaWorkspaceToolContentViewNavigationInfoSheetsGridRange']
  • root['schemas']['AppsExtensionsFileMetadata']['properties']['gmailMetadata']
  • root['schemas']['AppsExtensionsSheetsActions']['properties']['navigateAction']
  • root['schemas']['AppsIntelligenceGenAiAction']['properties']['sheetsNavigationActionParams']
  • root['schemas']['AppsIntelligenceGenAiCitationMetadata']['deprecated']
  • root['schemas']['AppsIntelligenceGenAiCitationMetadata']['properties']['tableMetadata']['deprecated']
  • root['schemas']['AppsIntelligenceGenAiUseCaseParams']['properties']['tnfmParams']
  • root['schemas']['AppsIntelligenceGenAiWorkspaceResourceMetadata']['properties']['referenceMetadata']
  • root['schemas']['AppsIntelligenceGenAiWorkspaceResourceMetadata']['properties']['citations']['deprecated']
  • root['schemas']['AppsUpsellSharedRecommendationCommonRecommendation']['properties']['valuePropGroups']
  • root['schemas']['AppsUpsellSharedRecommendationCustomizedactionbehaviorCustomizedActionBehavior']['properties']['adminConsoleAccordionTaskRedirect']
  • root['schemas']['AssistantLamdaWorkspaceEditorResourceReferenceEditorResourceOptions']['properties']['metadataOptions']
  • root['schemas']['AssistantLamdaWorkspaceToolContentViewNavigationInfo']['properties']['sheetsGridRange']
dictionary_item_removed
  • root['schemas']['AppsIntelligenceGenAiCitationMetadata']['description']
  • root['schemas']['AppsIntelligenceGenAiCitationMetadata']['properties']['tableMetadata']['description']
  • root['schemas']['AppsIntelligenceGenAiWorkspaceResourceMetadata']['properties']['citations']['description']
values_changed
root['revision']
new_value20250310
old_value20250306
root['schemas']['AppsExtensionsWorkflowDataSource']['description']
new_valueWorkflow only. In a `TextInput` or `SelectionInput` widget with MULTI_SELECT type or a `DateTimePicker`, provide data source from Google.
old_valueWorkflow only. In a `SelectionInput` or `TextInput` widget with DROPDOWN or MULTI_SELECT type, provide data source from Google.
root['schemas']['AppsIntelligenceGenAiAction']['description']
new_valueNext ID: 19
old_valueNext ID: 18
root['schemas']['AppsIntelligenceGenAiUseCaseParams']['description']
new_valueGenerate Use Case specific parameters Next ID: 13.
old_valueGenerate Use Case specific parameters Next ID: 12.
root['schemas']['AppsIntelligenceGenAiWorkspaceResourceMetadata']['properties']['attributions']['description']
new_valueList of citations in the response that point at this resource (go/bk-citations-prd).
old_valueMetadata about nodes in response that are attributable to this resource.
root['schemas']['AppsUpsellSharedRecommendationCommonRecommendation']['description']
new_valueA common response for recommendation systems. Next id: 26
old_valueA common response for recommendation systems. Next id: 25
root['schemas']['AssistantLamdaEncryptionMetadata']['properties']['isEncrypted']['description']
new_valueIndicates if the file contents is encrypted. If true, the keyset must also be specified, otherwise the file contents will not be readable. If the file attachment is read from logs, this may be set to true even if the keyset is not present to indicate that the file was encrypted but can no longer be decrypted. Encrypted files are stored as "plain" files in storage, since file-type specific processing (e.g. transcoding of images) would fail due to the encryption. See: go/bard-storage-encryption This has the side effect that FIFE urls will not be generated for encrypted files. Moreover encrypted files are not copied to persistent storage. Trying to copy them will fail. If false, but a keyset is specified, the file will not be decrypted. If the file contents is encrypted, this will lead to garbage data being returned.
old_valueIndicates if the file contents is encrypted. If true, the keyset must also be specified, otherwise the file contents will not be readable. If the file attachment is read from logs, this may be set to true even if the keyset is not present to indicate that the file was encrypted but can no longer be decrypted. If false, but a keyset is specified, the file will not be decrypted. If the file contents is encrypted, this will lead to garbage data being returned.
root['schemas']['AssistantLamdaNightwingMutatingOp']['description']
new_valueAn op that generated by the tool. For now it's also used between the server and the client, but we can also translate this proto into the RobinOp in the future. More on go/bard-rfc-802. LINT.IfChange Next ID: 1091.
old_valueAn op that generated by the tool. For now it's also used between the server and the client, but we can also translate this proto into the RobinOp in the future. More on go/bard-rfc-802. LINT.IfChange Next ID: 1090.
root['schemas']['CccHostedUpsellProtoSourceAttributionSource']['properties']['onramp']['enumDescriptions'][347]
new_valueMeet: Premium feature paywall.
old_valueMeet: Recording paywall
root['schemas']['GoogleInternalSubscriptionsFirstpartyV1CallToActionInAppPurchase']['properties']['onramp']['enumDescriptions'][340]
new_valueMeet: General paywall.
old_valueMeet: Greenroom banner
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['onramp']['enumDescriptions'][338]
new_valueMeet: Breakout room paywall.
old_valueMeet: Carousel
root['schemas']['CccHostedUpsellProtoSourceAttributionSource']['properties']['onramp']['enumDescriptions'][338]
new_valueMeet: Breakout room paywall.
old_valueMeet: Carousel
root['schemas']['AppsUpsellSharedRecommendationRecommendationSurface']['properties']['onramp']['enumDescriptions'][342]
new_valueMeet: Landing page with no agenda listed.
old_valueMeet: Landing page promo
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['onramp']['enumDescriptions'][347]
new_valueMeet: Premium feature paywall.
old_valueMeet: Recording paywall
root['schemas']['GoogleInternalSubscriptionsFirstpartyV1CallToActionInAppPurchase']['properties']['onramp']['enumDescriptions'][343]
new_valueMeet: Landing page promo.
old_valueMeet: Landing page welcome screen
root['schemas']['CccHostedUpsellProtoSourceAttributionSource']['properties']['onramp']['enumDescriptions'][343]
new_valueMeet: Landing page promo.
old_valueMeet: Landing page welcome screen
root['schemas']['AppsUpsellSharedRecommendationRecommendationSurface']['properties']['onramp']['enumDescriptions'][341]
new_valueMeet: Greenroom banner.
old_valueMeet: Landing page with no agenda listed
root['schemas']['AppsUpsellSharedRecommendationRecommendationSurface']['properties']['onramp']['enumDescriptions'][338]
new_valueMeet: Breakout room paywall.
old_valueMeet: Carousel
root['schemas']['GoogleInternalSubscriptionsFirstpartyV1CallToActionInAppPurchase']['properties']['onramp']['enumDescriptions'][347]
new_valueMeet: Premium feature paywall.
old_valueMeet: Recording paywall
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['onramp']['enumDescriptions'][337]
new_valueMeet Android: Homescreen banner.
old_valueMeet: Breakout room paywall
root['schemas']['CccHostedUpsellProtoSourceAttributionSource']['properties']['onramp']['enumDescriptions'][346]
new_valueMeet: Poll paywall.
old_valueMeet: Premium feature paywall
root['schemas']['AppsUpsellSharedRecommendationRecommendationSurface']['properties']['onramp']['enumDescriptions'][339]
new_valueMeet: Carousel.
old_valueMeet: General paywall
root['schemas']['GoogleInternalSubscriptionsFirstpartyV1CallToActionInAppPurchase']['properties']['onramp']['enumDescriptions'][342]
new_valueMeet: Landing page with no agenda listed.
old_valueMeet: Landing page promo
root['schemas']['GoogleInternalSubscriptionsFirstpartyV1CallToActionInAppPurchase']['properties']['onramp']['enumDescriptions'][344]
new_valueMeet: Landing page welcome screen.
old_valueMeet: Landing page with agenda listed
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['onramp']['enumDescriptions'][343]
new_valueMeet: Landing page promo.
old_valueMeet: Landing page welcome screen
root['schemas']['GoogleInternalSubscriptionsFirstpartyV1CallToActionInAppPurchase']['properties']['onramp']['enumDescriptions'][339]
new_valueMeet: Carousel.
old_valueMeet: General paywall
root['schemas']['GoogleInternalSubscriptionsFirstpartyV1CallToActionInAppPurchase']['properties']['onramp']['enumDescriptions'][345]
new_valueMeet: Landing page with agenda listed.
old_valueMeet: Poll paywall
root['schemas']['AppsUpsellSharedRecommendationRecommendationSurface']['properties']['onramp']['enumDescriptions'][337]
new_valueMeet Android: Homescreen banner.
old_valueMeet: Breakout room paywall
root['schemas']['CccHostedUpsellProtoSourceAttributionSource']['properties']['onramp']['enumDescriptions'][342]
new_valueMeet: Landing page with no agenda listed.
old_valueMeet: Landing page promo
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['onramp']['enumDescriptions'][345]
new_valueMeet: Landing page with agenda listed.
old_valueMeet: Poll paywall
root['schemas']['CccHostedUpsellProtoSourceAttributionSource']['properties']['onramp']['enumDescriptions'][340]
new_valueMeet: General paywall.
old_valueMeet: Greenroom banner
root['schemas']['GoogleInternalSubscriptionsFirstpartyV1CallToActionInAppPurchase']['properties']['onramp']['enumDescriptions'][346]
new_valueMeet: Poll paywall.
old_valueMeet: Premium feature paywall
root['schemas']['AppsUpsellSharedRecommendationRecommendationSurface']['properties']['onramp']['enumDescriptions'][340]
new_valueMeet: General paywall.
old_valueMeet: Greenroom banner
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['onramp']['enumDescriptions'][342]
new_valueMeet: Landing page with no agenda listed.
old_valueMeet: Landing page promo
root['schemas']['AppsUpsellSharedRecommendationRecommendationSurface']['properties']['onramp']['enumDescriptions'][347]
new_valueMeet: Premium feature paywall.
old_valueMeet: Recording paywall
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['onramp']['enumDescriptions'][339]
new_valueMeet: Carousel.
old_valueMeet: General paywall
root['schemas']['CccHostedUpsellProtoSourceAttributionSource']['properties']['onramp']['enumDescriptions'][337]
new_valueMeet Android: Homescreen banner.
old_valueMeet: Breakout room paywall
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['onramp']['enumDescriptions'][346]
new_valueMeet: Poll paywall.
old_valueMeet: Premium feature paywall
root['schemas']['CccHostedUpsellProtoSourceAttributionSource']['properties']['onramp']['enumDescriptions'][344]
new_valueMeet: Landing page welcome screen.
old_valueMeet: Landing page with agenda listed
root['schemas']['CccHostedUpsellProtoSourceAttributionSource']['properties']['onramp']['enumDescriptions'][341]
new_valueMeet: Greenroom banner.
old_valueMeet: Landing page with no agenda listed
root['schemas']['GoogleInternalSubscriptionsFirstpartyV1CallToActionInAppPurchase']['properties']['onramp']['enumDescriptions'][338]
new_valueMeet: Breakout room paywall.
old_valueMeet: Carousel
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['onramp']['enumDescriptions'][344]
new_valueMeet: Landing page welcome screen.
old_valueMeet: Landing page with agenda listed
root['schemas']['CccHostedUpsellProtoSourceAttributionSource']['properties']['onramp']['enumDescriptions'][339]
new_valueMeet: Carousel.
old_valueMeet: General paywall
root['schemas']['GoogleInternalSubscriptionsFirstpartyV1CallToActionInAppPurchase']['properties']['onramp']['enumDescriptions'][341]
new_valueMeet: Greenroom banner.
old_valueMeet: Landing page with no agenda listed
root['schemas']['GoogleInternalSubscriptionsFirstpartyV1CallToActionInAppPurchase']['properties']['onramp']['enumDescriptions'][337]
new_valueMeet Android: Homescreen banner.
old_valueMeet: Breakout room paywall
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['onramp']['enumDescriptions'][341]
new_valueMeet: Greenroom banner.
old_valueMeet: Landing page with no agenda listed
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['onramp']['enumDescriptions'][340]
new_valueMeet: General paywall.
old_valueMeet: Greenroom banner
root['schemas']['AppsUpsellSharedRecommendationRecommendationSurface']['properties']['onramp']['enumDescriptions'][345]
new_valueMeet: Landing page with agenda listed.
old_valueMeet: Poll paywall
root['schemas']['CccHostedUpsellProtoSourceAttributionSource']['properties']['onramp']['enumDescriptions'][345]
new_valueMeet: Landing page with agenda listed.
old_valueMeet: Poll paywall
root['schemas']['AppsUpsellSharedRecommendationRecommendationSurface']['properties']['onramp']['enumDescriptions'][344]
new_valueMeet: Landing page welcome screen.
old_valueMeet: Landing page with agenda listed
root['schemas']['AppsUpsellSharedRecommendationRecommendationSurface']['properties']['onramp']['enumDescriptions'][343]
new_valueMeet: Landing page promo.
old_valueMeet: Landing page welcome screen
root['schemas']['AppsUpsellSharedRecommendationRecommendationSurface']['properties']['onramp']['enumDescriptions'][346]
new_valueMeet: Poll paywall.
old_valueMeet: Premium feature paywall
iterable_item_added
root['schemas']['AppsExtensionsDuetAiActionStaticPlanData']['properties']['generateUseCase']['enum'][11]SUMMARIZE_FILE
root['schemas']['AppsExtensionsDuetAiActionStaticPlanData']['properties']['generateUseCase']['enum'][58]GENERATE_ITEM_NAME_SUGGESTIONS
root['schemas']['AppsExtensionsDuetAiActionStaticPlanData']['properties']['generateUseCase']['enumDescriptions'][11]Generate a summary based on the content of a specified file. This use case is now used for 1P Link Summary feature.
root['schemas']['AppsExtensionsDuetAiActionStaticPlanData']['properties']['generateUseCase']['enumDescriptions'][58]Generate item name suggestions from the context (e.g. drive item), and the user can apply a generated suggestion as the item name.
root['schemas']['AppsIntelligenceGenAiAction']['properties']['actionType']['enum'][19]SHEETS_NAVIGATION
root['schemas']['AppsIntelligenceGenAiClientDebugInfo']['properties']['useCase']['enum'][11]SUMMARIZE_FILE
root['schemas']['AppsIntelligenceGenAiClientDebugInfo']['properties']['useCase']['enum'][58]GENERATE_ITEM_NAME_SUGGESTIONS
root['schemas']['AppsIntelligenceGenAiClientDebugInfo']['properties']['useCase']['enumDescriptions'][11]Generate a summary based on the content of a specified file. This use case is now used for 1P Link Summary feature.
root['schemas']['AppsIntelligenceGenAiClientDebugInfo']['properties']['useCase']['enumDescriptions'][58]Generate item name suggestions from the context (e.g. drive item), and the user can apply a generated suggestion as the item name.
root['schemas']['AppsIntelligenceGenAiGenerateRequest']['properties']['generateUseCase']['enum'][11]SUMMARIZE_FILE
root['schemas']['AppsIntelligenceGenAiGenerateRequest']['properties']['generateUseCase']['enum'][58]GENERATE_ITEM_NAME_SUGGESTIONS
root['schemas']['AppsIntelligenceGenAiGenerateRequest']['properties']['generateUseCase']['enumDescriptions'][11]Generate a summary based on the content of a specified file. This use case is now used for 1P Link Summary feature.
root['schemas']['AppsIntelligenceGenAiGenerateRequest']['properties']['generateUseCase']['enumDescriptions'][58]Generate item name suggestions from the context (e.g. drive item), and the user can apply a generated suggestion as the item name.
root['schemas']['AppsIntelligenceGenAiGenerationIteration']['properties']['classicUseCase']['enum'][19]CLASSIC_USE_CASE_GENERATE_TEXT_DEPENDENT_QUESTIONS
root['schemas']['AppsIntelligenceGenAiGenerationIteration']['properties']['classicUseCase']['enum'][20]CLASSIC_USE_CASE_GENERATE_RUBRIC
root['schemas']['AppsIntelligenceGenAiGenerationIteration']['properties']['classicUseCase']['enum'][21]CLASSIC_USE_CASE_GENERATE_STORY
root['schemas']['AppsIntelligenceGenAiGenerationIteration']['properties']['classicUseCase']['enum'][22]CLASSIC_USE_CASE_TRANSLATE_TEXT
root['schemas']['AppsIntelligenceGenAiGenerationIteration']['properties']['classicUseCase']['enum'][23]CLASSIC_USE_CASE_GENERATE_COMMON_MISCONCEPTIONS
root['schemas']['AppsIntelligenceGenAiGenerationIteration']['properties']['classicUseCase']['enum'][24]CLASSIC_USE_CASE_GENERATE_PROJECT_ACTIVITIES
root['schemas']['AppsIntelligenceGenAiGenerationIteration']['properties']['classicUseCase']['enum'][25]CLASSIC_USE_CASE_GENERATE_INFORMATIVE_ARTICLES
root['schemas']['AppsIntelligenceGenAiGenerationIteration']['properties']['classicUseCase']['enum'][26]CLASSIC_USE_CASE_GENERATE_CHOICE_BOARD
root['schemas']['AppsIntelligenceGenAiGenerationIteration']['properties']['genAiServiceErrorReason']['enum'][35]VIDEO_GENERATION_INPUT_UNSAFE
root['schemas']['AppsIntelligenceGenAiGenerationIteration']['properties']['genAiServiceErrorReason']['enum'][36]VIDEO_GENERATION_OUTPUT_UNSAFE
root['schemas']['AppsIntelligenceGenAiGenerationIteration']['properties']['genAiServiceErrorReason']['enum'][37]VIDEO_GENERATION_ALL_GENERATIONS_FAILED
root['schemas']['AppsIntelligenceGenAiGenerationIteration']['properties']['genAiServiceErrorReason']['enum'][38]VIDEO_GENERATION_SOFT_PUSHBACK_REWRITTEN
root['schemas']['AppsIntelligenceGenAiGenerationIteration']['properties']['genAiServiceErrorReason']['enumDescriptions'][35]The Kopi request failed because the input to the video generation was deemed unsafe.
root['schemas']['AppsIntelligenceGenAiGenerationIteration']['properties']['genAiServiceErrorReason']['enumDescriptions'][36]The Kopi request failed because the output of the video generation was deemed unsafe.
root['schemas']['AppsIntelligenceGenAiGenerationIteration']['properties']['genAiServiceErrorReason']['enumDescriptions'][37]The Kopi request failed because all requested video generations failed.
root['schemas']['AppsIntelligenceGenAiGenerationIteration']['properties']['genAiServiceErrorReason']['enumDescriptions'][38]The Kopi request failed because the video generation tool soft pushback was rewritten.
root['schemas']['AppsIntelligenceGenAiGenerationIteration']['properties']['generateUseCase']['enum'][11]SUMMARIZE_FILE
root['schemas']['AppsIntelligenceGenAiGenerationIteration']['properties']['generateUseCase']['enum'][58]GENERATE_ITEM_NAME_SUGGESTIONS
root['schemas']['AppsIntelligenceGenAiGenerationIteration']['properties']['generateUseCase']['enumDescriptions'][11]Generate a summary based on the content of a specified file. This use case is now used for 1P Link Summary feature.
root['schemas']['AppsIntelligenceGenAiGenerationIteration']['properties']['generateUseCase']['enumDescriptions'][58]Generate item name suggestions from the context (e.g. drive item), and the user can apply a generated suggestion as the item name.
root['schemas']['AppsIntelligenceGenAiGetQuotaSummaryRequest']['properties']['classicUseCase']['enum'][19]CLASSIC_USE_CASE_GENERATE_TEXT_DEPENDENT_QUESTIONS
root['schemas']['AppsIntelligenceGenAiGetQuotaSummaryRequest']['properties']['classicUseCase']['enum'][20]CLASSIC_USE_CASE_GENERATE_RUBRIC
root['schemas']['AppsIntelligenceGenAiGetQuotaSummaryRequest']['properties']['classicUseCase']['enum'][21]CLASSIC_USE_CASE_GENERATE_STORY
root['schemas']['AppsIntelligenceGenAiGetQuotaSummaryRequest']['properties']['classicUseCase']['enum'][22]CLASSIC_USE_CASE_TRANSLATE_TEXT
root['schemas']['AppsIntelligenceGenAiGetQuotaSummaryRequest']['properties']['classicUseCase']['enum'][23]CLASSIC_USE_CASE_GENERATE_COMMON_MISCONCEPTIONS
root['schemas']['AppsIntelligenceGenAiGetQuotaSummaryRequest']['properties']['classicUseCase']['enum'][24]CLASSIC_USE_CASE_GENERATE_PROJECT_ACTIVITIES
root['schemas']['AppsIntelligenceGenAiGetQuotaSummaryRequest']['properties']['classicUseCase']['enum'][25]CLASSIC_USE_CASE_GENERATE_INFORMATIVE_ARTICLES
root['schemas']['AppsIntelligenceGenAiGetQuotaSummaryRequest']['properties']['classicUseCase']['enum'][26]CLASSIC_USE_CASE_GENERATE_CHOICE_BOARD
root['schemas']['AppsIntelligenceGenAiGetQuotaSummaryRequest']['properties']['generateUseCase']['enum'][11]SUMMARIZE_FILE
root['schemas']['AppsIntelligenceGenAiGetQuotaSummaryRequest']['properties']['generateUseCase']['enum'][58]GENERATE_ITEM_NAME_SUGGESTIONS
root['schemas']['AppsIntelligenceGenAiGetQuotaSummaryRequest']['properties']['generateUseCase']['enumDescriptions'][11]Generate a summary based on the content of a specified file. This use case is now used for 1P Link Summary feature.
root['schemas']['AppsIntelligenceGenAiGetQuotaSummaryRequest']['properties']['generateUseCase']['enumDescriptions'][58]Generate item name suggestions from the context (e.g. drive item), and the user can apply a generated suggestion as the item name.
root['schemas']['AppsIntelligenceGenAiQuestionAnswerListActionParamsQuestionAnswer']['properties']['useCaseForSuggestionFollowup']['enum'][11]SUMMARIZE_FILE
root['schemas']['AppsIntelligenceGenAiQuestionAnswerListActionParamsQuestionAnswer']['properties']['useCaseForSuggestionFollowup']['enum'][58]GENERATE_ITEM_NAME_SUGGESTIONS
root['schemas']['AppsIntelligenceGenAiQuestionAnswerListActionParamsQuestionAnswer']['properties']['useCaseForSuggestionFollowup']['enumDescriptions'][11]Generate a summary based on the content of a specified file. This use case is now used for 1P Link Summary feature.
root['schemas']['AppsIntelligenceGenAiQuestionAnswerListActionParamsQuestionAnswer']['properties']['useCaseForSuggestionFollowup']['enumDescriptions'][58]Generate item name suggestions from the context (e.g. drive item), and the user can apply a generated suggestion as the item name.
root['schemas']['AppsIntelligenceGenAiRecordFeatureUsageRequest']['properties']['classicUseCase']['enum'][19]CLASSIC_USE_CASE_GENERATE_TEXT_DEPENDENT_QUESTIONS
root['schemas']['AppsIntelligenceGenAiRecordFeatureUsageRequest']['properties']['classicUseCase']['enum'][20]CLASSIC_USE_CASE_GENERATE_RUBRIC
root['schemas']['AppsIntelligenceGenAiRecordFeatureUsageRequest']['properties']['classicUseCase']['enum'][21]CLASSIC_USE_CASE_GENERATE_STORY
root['schemas']['AppsIntelligenceGenAiRecordFeatureUsageRequest']['properties']['classicUseCase']['enum'][22]CLASSIC_USE_CASE_TRANSLATE_TEXT
root['schemas']['AppsIntelligenceGenAiRecordFeatureUsageRequest']['properties']['classicUseCase']['enum'][23]CLASSIC_USE_CASE_GENERATE_COMMON_MISCONCEPTIONS
root['schemas']['AppsIntelligenceGenAiRecordFeatureUsageRequest']['properties']['classicUseCase']['enum'][24]CLASSIC_USE_CASE_GENERATE_PROJECT_ACTIVITIES
root['schemas']['AppsIntelligenceGenAiRecordFeatureUsageRequest']['properties']['classicUseCase']['enum'][25]CLASSIC_USE_CASE_GENERATE_INFORMATIVE_ARTICLES
root['schemas']['AppsIntelligenceGenAiRecordFeatureUsageRequest']['properties']['classicUseCase']['enum'][26]CLASSIC_USE_CASE_GENERATE_CHOICE_BOARD
root['schemas']['AppsIntelligenceGenAiRecordFeatureUsageRequest']['properties']['generateUseCase']['enum'][11]SUMMARIZE_FILE
root['schemas']['AppsIntelligenceGenAiRecordFeatureUsageRequest']['properties']['generateUseCase']['enum'][58]GENERATE_ITEM_NAME_SUGGESTIONS
root['schemas']['AppsIntelligenceGenAiRecordFeatureUsageRequest']['properties']['generateUseCase']['enumDescriptions'][11]Generate a summary based on the content of a specified file. This use case is now used for 1P Link Summary feature.
root['schemas']['AppsIntelligenceGenAiRecordFeatureUsageRequest']['properties']['generateUseCase']['enumDescriptions'][58]Generate item name suggestions from the context (e.g. drive item), and the user can apply a generated suggestion as the item name.
root['schemas']['AppsIntelligenceGenAiStarterTile']['properties']['generateUseCase']['enum'][11]SUMMARIZE_FILE
root['schemas']['AppsIntelligenceGenAiStarterTile']['properties']['generateUseCase']['enum'][58]GENERATE_ITEM_NAME_SUGGESTIONS
root['schemas']['AppsIntelligenceGenAiStarterTile']['properties']['generateUseCase']['enumDescriptions'][11]Generate a summary based on the content of a specified file. This use case is now used for 1P Link Summary feature.
root['schemas']['AppsIntelligenceGenAiStarterTile']['properties']['generateUseCase']['enumDescriptions'][58]Generate item name suggestions from the context (e.g. drive item), and the user can apply a generated suggestion as the item name.
root['schemas']['AppsIntelligenceGenAiStarterTile']['properties']['starterTileType']['enum'][85]GMAIL_COPY_CREATOR_CUSTOMER_REACTIVATION
root['schemas']['AppsIntelligenceGenAiStarterTile']['properties']['starterTileType']['enum'][86]GMAIL_COPY_CREATOR_MARKETING_CAMPAIGN
root['schemas']['AppsIntelligenceGenAiStarterTile']['properties']['starterTileType']['enum'][87]GMAIL_COPY_CREATOR_PRODUCT_INTRODUCTION
root['schemas']['AppsIntelligenceGenAiStarterTile']['properties']['starterTileType']['enum'][88]GMAIL_CUSTOMER_OUTREACH_SPECIALIST_COMPLAINS_APOLOGY
root['schemas']['AppsIntelligenceGenAiStarterTile']['properties']['starterTileType']['enum'][89]GMAIL_CUSTOMER_OUTREACH_SPECIALIST_ENQUIRIES_RESPONSE
root['schemas']['AppsIntelligenceGenAiStarterTile']['properties']['starterTileType']['enum'][90]GMAIL_CUSTOMER_SENTIMENT_ANALYZER_CUSTOMERS_SENTIMENT_COMPARISON
root['schemas']['AppsIntelligenceGenAiStarterTile']['properties']['starterTileType']['enum'][91]GMAIL_CUSTOMER_SENTIMENT_ANALYZER_FEEDBACK_SUMMARY
root['schemas']['AppsIntelligenceGenAiStarterTile']['properties']['starterTileType']['enum'][92]GMAIL_CUSTOMER_SENTIMENT_ANALYZER_NEW_PRODUCT_FEEDBACK_ANALYSIS
root['schemas']['AppsIntelligenceGenAiStarterTile']['properties']['starterTileType']['enum'][97]GMAIL_HIRING_CONSULTANT_CANDIDATES_OUTREACH_EMAIL_GENERATION
root['schemas']['AppsIntelligenceGenAiStarterTile']['properties']['starterTileType']['enum'][98]GMAIL_HIRING_CONSULTANT_INTERVIEW_QUESTION_SUGGESTION
root['schemas']['AppsIntelligenceGenAiStarterTile']['properties']['starterTileType']['enum'][99]GMAIL_HIRING_CONSULTANT_NEW_JOB_DESCRIPTION_CREATION
root['schemas']['AppsIntelligenceGenAiStarterTile']['properties']['starterTileType']['enum'][101]GMAIL_SALES_PITCH_IDEATOR_BRAINSTORM
root['schemas']['AppsIntelligenceGenAiStarterTile']['properties']['starterTileType']['enum'][102]GMAIL_SALES_PITCH_IDEATOR_CRAFT_MESSAGES
root['schemas']['AppsIntelligenceGenAiStarterTile']['properties']['starterTileType']['enum'][103]GMAIL_SALES_PITCH_IDEATOR_OBJECTIONS_RESPONSE
root['schemas']['AppsIntelligenceGenAiStarterTile']['properties']['starterTileType']['enum'][104]GMAIL_SALES_PITCH_IDEATOR_SALES_PITCH
root['schemas']['AppsIntelligenceGenAiTurn']['properties']['generateUseCase']['enum'][11]SUMMARIZE_FILE
root['schemas']['AppsIntelligenceGenAiTurn']['properties']['generateUseCase']['enum'][58]GENERATE_ITEM_NAME_SUGGESTIONS
root['schemas']['AppsIntelligenceGenAiTurn']['properties']['generateUseCase']['enumDescriptions'][11]Generate a summary based on the content of a specified file. This use case is now used for 1P Link Summary feature.
root['schemas']['AppsIntelligenceGenAiTurn']['properties']['generateUseCase']['enumDescriptions'][58]Generate item name suggestions from the context (e.g. drive item), and the user can apply a generated suggestion as the item name.
root['schemas']['AppsIntelligenceGenAiWriteAuditLogRequest']['properties']['classicUseCase']['enum'][19]CLASSIC_USE_CASE_GENERATE_TEXT_DEPENDENT_QUESTIONS
root['schemas']['AppsIntelligenceGenAiWriteAuditLogRequest']['properties']['classicUseCase']['enum'][20]CLASSIC_USE_CASE_GENERATE_RUBRIC
root['schemas']['AppsIntelligenceGenAiWriteAuditLogRequest']['properties']['classicUseCase']['enum'][21]CLASSIC_USE_CASE_GENERATE_STORY
root['schemas']['AppsIntelligenceGenAiWriteAuditLogRequest']['properties']['classicUseCase']['enum'][22]CLASSIC_USE_CASE_TRANSLATE_TEXT
root['schemas']['AppsIntelligenceGenAiWriteAuditLogRequest']['properties']['classicUseCase']['enum'][23]CLASSIC_USE_CASE_GENERATE_COMMON_MISCONCEPTIONS
root['schemas']['AppsIntelligenceGenAiWriteAuditLogRequest']['properties']['classicUseCase']['enum'][24]CLASSIC_USE_CASE_GENERATE_PROJECT_ACTIVITIES
root['schemas']['AppsIntelligenceGenAiWriteAuditLogRequest']['properties']['classicUseCase']['enum'][25]CLASSIC_USE_CASE_GENERATE_INFORMATIVE_ARTICLES
root['schemas']['AppsIntelligenceGenAiWriteAuditLogRequest']['properties']['classicUseCase']['enum'][26]CLASSIC_USE_CASE_GENERATE_CHOICE_BOARD
root['schemas']['AppsIntelligenceGenAiWriteAuditLogRequest']['properties']['generateUseCase']['enum'][11]SUMMARIZE_FILE
root['schemas']['AppsIntelligenceGenAiWriteAuditLogRequest']['properties']['generateUseCase']['enum'][58]GENERATE_ITEM_NAME_SUGGESTIONS
root['schemas']['AppsIntelligenceGenAiWriteAuditLogRequest']['properties']['generateUseCase']['enumDescriptions'][11]Generate a summary based on the content of a specified file. This use case is now used for 1P Link Summary feature.
root['schemas']['AppsIntelligenceGenAiWriteAuditLogRequest']['properties']['generateUseCase']['enumDescriptions'][58]Generate item name suggestions from the context (e.g. drive item), and the user can apply a generated suggestion as the item name.
root['schemas']['AppsUpsellSharedRecommendationRecommendationSurface']['properties']['onramp']['enum'][337]MEET_ANDROID_HOMESCREEN_BANNER
root['schemas']['AppsUpsellSharedRecommendationRecommendationSurface']['properties']['onramp']['enumDescriptions'][348]Meet: Recording paywall.
root['schemas']['AppsUpsellSharedRecommendationTemplatesCategory']['properties']['promoCategory']['enum'][25]PROMO_CATEGORY_G1_UPSELL
root['schemas']['AssistantLamdaWorkspaceToolContentViewNavigationInfo']['properties']['viewDestination']['enum'][2]VIEW_DESTINATION_SHEETS_GRID_RANGE
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['onramp']['enum'][337]MEET_ANDROID_HOMESCREEN_BANNER
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['onramp']['enumDescriptions'][348]Meet: Recording paywall.
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoTemplateId']['enum'][16]DOCS_GEN_AI_LOCKED_FEATURES_CONSUMER_NOTICE
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoTemplateId']['enum'][305]XXX_TEST_ONLY_XWS_FLAG_PROMO_TEMPLATE
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoTemplateId']['enum'][324]GEMRISE_V2_NOTEBOOKLM_DISCOVER_CARD
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoTemplateId']['enum'][423]CORE_VALUE_MONTHLY_V2_BIZ_STARTER_E_SIGNATURE_NO_DISCOUNT_DOCS_UPSELL_BANNER_TEMPLATE
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoTemplateId']['enum'][424]CORE_VALUE_MONTHLY_V2_BIZ_STARTER_E_SIGNATURE_DISCOUNT_DOCS_UPSELL_BANNER_TEMPLATE
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoTemplateId']['enum'][425]CORE_VALUE_MONTHLY_V2_BIZ_STARTER_E_SIGNATURE_NO_DISCOUNT_SHEETS_AND_SLIDES_UPSELL_BANNER_TEMPLATE
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoTemplateId']['enum'][426]CORE_VALUE_MONTHLY_V2_BIZ_STARTER_E_SIGNATURE_DISCOUNT_SHEETS_AND_SLIDES_UPSELL_BANNER_TEMPLATE
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoTemplateId']['enum'][431]CORE_VALUE_MONTHLY_V2_BIZ_STARTER_E_SIGNATURE_NO_DISCOUNT_DISCOVER_UPSELL_BANNER_TEMPLATE
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoTemplateId']['enum'][432]CORE_VALUE_MONTHLY_V2_BIZ_STARTER_E_SIGNATURE_NO_DISCOUNT_AC_UPSELL_BANNER_TEMPLATE
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoTemplateId']['enum'][433]CORE_VALUE_MONTHLY_V2_BIZ_STARTER_E_SIGNATURE_DISCOUNT_DISCOVER_UPSELL_BANNER_TEMPLATE
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoTemplateId']['enum'][434]CORE_VALUE_MONTHLY_V2_BIZ_STARTER_E_SIGNATURE_DISCOUNT_AC_UPSELL_BANNER_TEMPLATE
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoTemplateId']['enum'][435]CORE_VALUE_MONTHLY_V2_BIZ_STARTER_SA_NO_DISCOUNT_DISCOVER_UPSELL_BANNER_TEMPLATE
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoTemplateId']['enum'][436]CORE_VALUE_MONTHLY_V2_BIZ_STARTER_SA_NO_DISCOUNT_AC_UPSELL_BANNER_TEMPLATE
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoTemplateId']['enum'][437]CORE_VALUE_MONTHLY_V2_BIZ_STARTER_SA_DISCOUNT_DISCOVER_UPSELL_BANNER_TEMPLATE
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoTemplateId']['enum'][438]CORE_VALUE_MONTHLY_V2_BIZ_STARTER_SA_DISCOUNT_AC_UPSELL_BANNER_TEMPLATE
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoTemplateId']['enum'][439]CORE_VALUE_MONTHLY_V2_BIZ_STARTER_CA_NO_DISCOUNT_DISCOVER_UPSELL_BANNER_TEMPLATE
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoTemplateId']['enum'][440]CORE_VALUE_MONTHLY_V2_BIZ_STARTER_CA_NO_DISCOUNT_AC_UPSELL_BANNER_TEMPLATE
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoTemplateId']['enum'][441]CORE_VALUE_MONTHLY_V2_BIZ_STARTER_CA_DISCOUNT_DISCOVER_UPSELL_BANNER_TEMPLATE
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoTemplateId']['enum'][442]CORE_VALUE_MONTHLY_V2_BIZ_STARTER_CA_DISCOUNT_AC_UPSELL_BANNER_TEMPLATE
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoTemplateId']['enum'][443]CORE_VALUE_E_SIGNATURE_UPSELL_DOCS_TOOLTIP_TEMPLATE
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoTemplateId']['enum'][479]ADMIN_CONSOLE_ONBOARDING_ADD_USER_TASK_CARD_WITH_CONTEXT
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoTemplateId']['enum'][480]ADMIN_CONSOLE_ONBOARDING_LOGO_UPLOAD_TASK_CARD_WITH_CONTEXT
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoTemplateId']['enum'][481]ADMIN_CONSOLE_ONBOARDING_VERIFY_DOMAIN_TASK_CARD_WITH_CONTEXT
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoTemplateId']['enum'][482]ADMIN_CONSOLE_ONBOARDING_GMAIL_SETTING_TASK_CARD_WITH_CONTEXT
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoTemplateId']['enum'][483]ADMIN_CONSOLE_ONBOARDING_TWOSV_ENFORCEMENT_TASK_CARD_WITH_CONTEXT
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoTemplateId']['enum'][484]ADMIN_CONSOLE_ONBOARDING_MIGRATE_DATA_TASK_CARD_WITH_CONTEXT
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoTemplateId']['enum'][485]ADMIN_CONSOLE_ONBOARDING_CREATE_EMAIL_ALIAS_TASK_CARD_WITH_CONTEXT
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoTemplateId']['enum'][486]ADMIN_CONSOLE_ONBOARDING_MX_RECORDS_SETUP_TASK_CARD_WITH_CONTEXT
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoTemplateId']['enum'][487]ADMIN_CONSOLE_ONBOARDING_ICANN_VERIFICATION_TASK_CARD_WITH_CONTEXT
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoTemplateId']['enum'][488]AC_BILLING_BUYFLOW_V2_SECURITY_ADVISOR_CHECKOUT_CARD
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoTemplateId']['enum'][489]AC_BILLING_BUYFLOW_V2_SECURITY_ADVISOR_CHECKOUT_VALUE_PROP_GROUPS
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoTemplateId']['enum'][490]AC_BILLING_BUYFLOW_V2_APPOINTMENT_SCHEDULING_CHECKOUT_CARD
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoTemplateId']['enum'][491]AC_BILLING_BUYFLOW_V2_APPOINTMENT_SCHEDULING_CHECKOUT_VALUE_PROP_GROUPS
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoTemplateId']['enum'][492]AC_BILLING_BUYFLOW_V2_E_SIGNATURE_CHECKOUT_CARD
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoTemplateId']['enum'][493]AC_BILLING_BUYFLOW_V2_E_SIGNATURE_CHECKOUT_VALUE_PROP_GROUPS
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoTemplateId']['enum'][494]AC_BILLING_BUYFLOW_V2_DEFAULT_CHECKOUT_CARD
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoTemplateId']['enum'][495]AC_BILLING_BUYFLOW_V2_DEFAULT_CHECKOUT_VALUE_PROP_GROUPS
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoTemplateId']['enumDescriptions'][479]go/ac-accordion
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoTemplateId']['enumDescriptions'][488]go/dvp-design
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoType']['enum'][106]CORE_VALUE_E_SIGNATURE_UPSELL_DOCS_TOOLTIP
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoType']['enum'][115]DOCS_GEN_AI_LOCKED_FEATURES_CONSUMER
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoType']['enum'][316]CORE_VALUE_EMAIL_BUSINESS_STARTER_DISCOUNT_UPSELL_MONTHLY_V2
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoType']['enum'][317]CORE_VALUE_EMAIL_BUSINESS_STARTER_NON_DISCOUNT_UPSELL_MONTHLY_V2
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoType']['enum'][318]CORE_VALUE_EMAIL_BUSINESS_STARTER_UPSELL_MONTHLY_V2
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoType']['enum'][325]CORE_VALUE_MONTHLY_V2_BIZ_STARTER_E_SIGNATURE_NO_DISCOUNT_DISCOVER_AC_UPSELL
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoType']['enum'][326]CORE_VALUE_MONTHLY_V2_BIZ_STARTER_E_SIGNATURE_DISCOUNT_DISCOVER_AC_UPSELL
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoType']['enum'][327]CORE_VALUE_MONTHLY_V2_BIZ_STARTER_SA_NO_DISCOUNT_DISCOVER_AC_UPSELL
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoType']['enum'][328]CORE_VALUE_MONTHLY_V2_BIZ_STARTER_SA_DISCOUNT_DISCOVER_AC_UPSELL
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoType']['enum'][329]CORE_VALUE_MONTHLY_V2_BIZ_STARTER_CA_NO_DISCOUNT_DISCOVER_AC_UPSELL
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoType']['enum'][330]CORE_VALUE_MONTHLY_V2_BIZ_STARTER_CA_DISCOUNT_DISCOVER_AC_UPSELL
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoType']['enum'][354]XXX_TEST_ONLY_XWS_FLAG_PROMO
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoType']['enum'][355]XXX_TEST_ONLY_MEET_ANDROID_HOMESCREEN_BANNER
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoType']['enum'][601]G1_GEN_AI_UPSELL_WFAC_WAVE5
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoType']['enum'][700]ABANDONED_BUYFLOW_FOLLOW_UP_EMAIL
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoType']['enum'][701]AC_BILLING_BUYFLOW_V2_SECURITY_ADVISOR_VALUE_PROP
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoType']['enum'][702]AC_BILLING_BUYFLOW_V2_APPOINTMENT_SCHEDULING_VALUE_PROP
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoType']['enum'][703]AC_BILLING_BUYFLOW_V2_E_SIGNATURE_VALUE_PROP
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoType']['enum'][704]AC_BILLING_BUYFLOW_V2_DEFAULT_VALUE_PROP
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoType']['enumDescriptions'][106]eSig Business Standard Upsell http://shortn/_oHS4N2IbSg
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoType']['enumDescriptions'][601]go/g1-ai-wfac-w5-experiment-design
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoType']['enumDescriptions'][700]go/abandoned-buyflow-follow-up-email-design
root['schemas']['CccHostedUpsellProtoEventsDerivedRecommendationInteractionDetails']['properties']['promoType']['enumDescriptions'][701]go/dvp-design
root['schemas']['CccHostedUpsellProtoSourceAttributionSource']['properties']['onramp']['enum'][337]MEET_ANDROID_HOMESCREEN_BANNER
root['schemas']['CccHostedUpsellProtoSourceAttributionSource']['properties']['onramp']['enumDescriptions'][348]Meet: Recording paywall.
root['schemas']['CccHostedUpsellProtoSourceAttributionSource']['properties']['promoType']['enum'][106]CORE_VALUE_E_SIGNATURE_UPSELL_DOCS_TOOLTIP
root['schemas']['CccHostedUpsellProtoSourceAttributionSource']['properties']['promoType']['enum'][115]DOCS_GEN_AI_LOCKED_FEATURES_CONSUMER
root['schemas']['CccHostedUpsellProtoSourceAttributionSource']['properties']['promoType']['enum'][316]CORE_VALUE_EMAIL_BUSINESS_STARTER_DISCOUNT_UPSELL_MONTHLY_V2
root['schemas']['CccHostedUpsellProtoSourceAttributionSource']['properties']['promoType']['enum'][317]CORE_VALUE_EMAIL_BUSINESS_STARTER_NON_DISCOUNT_UPSELL_MONTHLY_V2
root['schemas']['CccHostedUpsellProtoSourceAttributionSource']['properties']['promoType']['enum'][318]CORE_VALUE_EMAIL_BUSINESS_STARTER_UPSELL_MONTHLY_V2
root['schemas']['CccHostedUpsellProtoSourceAttributionSource']['properties']['promoType']['enum'][325]CORE_VALUE_MONTHLY_V2_BIZ_STARTER_E_SIGNATURE_NO_DISCOUNT_DISCOVER_AC_UPSELL
root['schemas']['CccHostedUpsellProtoSourceAttributionSource']['properties']['promoType']['enum'][326]CORE_VALUE_MONTHLY_V2_BIZ_STARTER_E_SIGNATURE_DISCOUNT_DISCOVER_AC_UPSELL
root['schemas']['CccHostedUpsellProtoSourceAttributionSource']['properties']['promoType']['enum'][327]CORE_VALUE_MONTHLY_V2_BIZ_STARTER_SA_NO_DISCOUNT_DISCOVER_AC_UPSELL
root['schemas']['CccHostedUpsellProtoSourceAttributionSource']['properties']['promoType']['enum'][328]CORE_VALUE_MONTHLY_V2_BIZ_STARTER_SA_DISCOUNT_DISCOVER_AC_UPSELL
root['schemas']['CccHostedUpsellProtoSourceAttributionSource']['properties']['promoType']['enum'][329]CORE_VALUE_MONTHLY_V2_BIZ_STARTER_CA_NO_DISCOUNT_DISCOVER_AC_UPSELL
root['schemas']['CccHostedUpsellProtoSourceAttributionSource']['properties']['promoType']['enum'][330]CORE_VALUE_MONTHLY_V2_BIZ_STARTER_CA_DISCOUNT_DISCOVER_AC_UPSELL
root['schemas']['CccHostedUpsellProtoSourceAttributionSource']['properties']['promoType']['enum'][354]XXX_TEST_ONLY_XWS_FLAG_PROMO
root['schemas']['CccHostedUpsellProtoSourceAttributionSource']['properties']['promoType']['enum'][355]XXX_TEST_ONLY_MEET_ANDROID_HOMESCREEN_BANNER
root['schemas']['CccHostedUpsellProtoSourceAttributionSource']['properties']['promoType']['enum'][601]G1_GEN_AI_UPSELL_WFAC_WAVE5
root['schemas']['CccHostedUpsellProtoSourceAttributionSource']['properties']['promoType']['enum'][700]ABANDONED_BUYFLOW_FOLLOW_UP_EMAIL
root['schemas']['CccHostedUpsellProtoSourceAttributionSource']['properties']['promoType']['enum'][701]AC_BILLING_BUYFLOW_V2_SECURITY_ADVISOR_VALUE_PROP
root['schemas']['CccHostedUpsellProtoSourceAttributionSource']['properties']['promoType']['enum'][702]AC_BILLING_BUYFLOW_V2_APPOINTMENT_SCHEDULING_VALUE_PROP
root['schemas']['CccHostedUpsellProtoSourceAttributionSource']['properties']['promoType']['enum'][703]AC_BILLING_BUYFLOW_V2_E_SIGNATURE_VALUE_PROP
root['schemas']['CccHostedUpsellProtoSourceAttributionSource']['properties']['promoType']['enum'][704]AC_BILLING_BUYFLOW_V2_DEFAULT_VALUE_PROP
root['schemas']['CccHostedUpsellProtoSourceAttributionSource']['properties']['promoType']['enumDescriptions'][106]eSig Business Standard Upsell http://shortn/_oHS4N2IbSg
root['schemas']['CccHostedUpsellProtoSourceAttributionSource']['properties']['promoType']['enumDescriptions'][601]go/g1-ai-wfac-w5-experiment-design
root['schemas']['CccHostedUpsellProtoSourceAttributionSource']['properties']['promoType']['enumDescriptions'][700]go/abandoned-buyflow-follow-up-email-design
root['schemas']['CccHostedUpsellProtoSourceAttributionSource']['properties']['promoType']['enumDescriptions'][701]go/dvp-design
root['schemas']['GoogleInternalSubscriptionsFirstpartyV1CallToActionInAppPurchase']['properties']['onramp']['enum'][337]MEET_ANDROID_HOMESCREEN_BANNER
root['schemas']['GoogleInternalSubscriptionsFirstpartyV1CallToActionInAppPurchase']['properties']['onramp']['enumDescriptions'][348]Meet: Recording paywall.
iterable_item_removed
root['schemas']['AppsExtensionsDuetAiActionStaticPlanData']['properties']['generateUseCase']['enum'][94]CATEGORIZE_EMAIL_FOR_DRIVE
root['schemas']['AppsIntelligenceGenAiClientDebugInfo']['properties']['useCase']['enum'][94]CATEGORIZE_EMAIL_FOR_DRIVE
root['schemas']['AppsIntelligenceGenAiGenerateRequest']['properties']['generateUseCase']['enum'][94]CATEGORIZE_EMAIL_FOR_DRIVE
root['schemas']['AppsIntelligenceGenAiGenerationIteration']['properties']['generateUseCase']['enum'][94]CATEGORIZE_EMAIL_FOR_DRIVE
root['schemas']['AppsIntelligenceGenAiGetQuotaSummaryRequest']['properties']['generateUseCase']['enum'][94]CATEGORIZE_EMAIL_FOR_DRIVE
root['schemas']['AppsIntelligenceGenAiQuestionAnswerListActionParamsQuestionAnswer']['properties']['useCaseForSuggestionFollowup']['enum'][94]CATEGORIZE_EMAIL_FOR_DRIVE
root['schemas']['AppsIntelligenceGenAiRecordFeatureUsageRequest']['properties']['generateUseCase']['enum'][94]CATEGORIZE_EMAIL_FOR_DRIVE
root['schemas']['AppsIntelligenceGenAiStarterTile']['properties']['generateUseCase']['enum'][94]CATEGORIZE_EMAIL_FOR_DRIVE
root['schemas']['AppsIntelligenceGenAiTurn']['properties']['generateUseCase']['enum'][94]CATEGORIZE_EMAIL_FOR_DRIVE
root['schemas']['AppsIntelligenceGenAiWriteAuditLogRequest']['properties']['generateUseCase']['enum'][94]CATEGORIZE_EMAIL_FOR_DRIVE
prod/arcore-
values_changed
root['revision']
new_value20250313
old_value20250309
prod/arcore-v1
values_changed
root['revision']
new_value20250313
old_value20250309
prod/arcore-v1beta2
values_changed
root['revision']
new_value20250313
old_value20250309
prod/arcorecloudanchor-
values_changed
root['revision']
new_value20250313
old_value20250309
prod/arcorecloudanchor-v1beta2
values_changed
root['revision']
new_value20250313
old_value20250309
prod/asia-east1-connectgateway-
values_changed
root['revision']
new_value20250310
old_value20250303
prod/asia-east1-connectgateway-v1
values_changed
root['revision']
new_value20250310
old_value20250303
prod/asia-east1-connectgateway-v1beta1
values_changed
root['revision']
new_value20250310
old_value20250303
prod/asia-east1-containerfilesystem-
values_changed
root['revision']
new_value20250307
old_value20250221
prod/asia-east1-containerfilesystem-v1
values_changed
root['revision']
new_value20250307
old_value20250221
prod/asia-east1-dataproccontrol-
values_changed
root['revision']
new_value20250311
old_value20250224
prod/asia-east1-dataproccontrol-v1
values_changed
root['revision']
new_value20250311
old_value20250224
prod/asia-south1-dataproccontrol-
values_changed
root['revision']
new_value20250311
old_value20250224
prod/asia-south1-dataproccontrol-v1
values_changed
root['revision']
new_value20250311
old_value20250224
prod/asia-southeast1-chronicle-
values_changed
root['resources']['projects']['resources']['locations']['resources']['instances']['methods']['get']['parameters']['name']['description']
new_valueRequired. The name of the instance to retrieve. Format: projects/{project_id}/locations/{location}/instances/{instance}
old_valueRequired. The name of the instance to retrieve. Format: projects/{project_id}/locations/{region}/instances/{instance}
root['revision']
new_value20250310
old_value20250227
root['schemas']
new_value
AIOverview
descriptionAI generated overview for the search results.
idAIOverview
properties
aiSummary
descriptionAI summary for the search results. Markdown formatted.
typestring
complete
descriptionWhether AI overview generation is complete.
typeboolean
suggestions
descriptionSuggested actions to continue the investigation in chat.
items
$refAction
typearray
typeobject
Action
descriptionAction represents an action that can be performed in the host UI.
idAction
properties
actionType
descriptionOutput only. Type of action.
enum
  • ACTION_TYPE_UNSPECIFIED
  • FOLLOW_UP
  • NAVIGATION
  • EXECUTION
enumDescriptions
  • The action type is unspecified.
  • The action is a follow up action.
  • The action is a navigation action.
  • The action is an execution action.
readOnlyTrue
typestring
displayText
descriptionOutput only. The text that'll be displayed to the user if this is rendered in the UI as a suggested action.
readOnlyTrue
typestring
execution
$refExecution
descriptionMetadata for execution action.
followUp
$refFollowUp
descriptionMetadata for follow up action.
navigation
$refNavigation
descriptionMetadata for navigation action.
useCaseId
descriptionOutput only. The use case ID of the action. It's used internally to identify in which context the action is used.
readOnlyTrue
typestring
typeobject
AlertFieldAggregation
idAlertFieldAggregation
properties
alertCount
formatint32
typeinteger
allValues
items
$refAlertFieldValueCount
typearray
baselineAlertCount
formatint32
typeinteger
bottomValues
items
$refAlertFieldValueCount
typearray
fieldName
typestring
tooManyValues
typeboolean
topValues
items
$refAlertFieldValueCount
typearray
valueCount
formatint32
typeinteger
typeobject
AlertFieldAggregations
idAlertFieldAggregations
properties
fields
items
$refAlertFieldAggregation
typearray
typeobject
AlertFieldValue
idAlertFieldValue
properties
boolValue
typeboolean
bytesValue
formatbyte
typestring
doubleValue
formatdouble
typenumber
enumValue
typestring
floatValue
formatfloat
typenumber
int32Value
formatint32
typeinteger
int64Value
formatint64
typestring
stringValue
typestring
uint32Value
formatuint32
typeinteger
uint64Value
formatuint64
typestring
typeobject
AlertFieldValueCount
idAlertFieldValueCount
properties
alertCount
formatint32
typeinteger
baselineAlertCount
formatint32
typeinteger
value
$refAlertFieldValue
typeobject
AnalystVerdict
descriptionVerdict provided by the human analyst. These fields are used to model Mandiant sources.
idAnalystVerdict
properties
confidenceScore
descriptionConfidence score of the verdict.
formatint32
typeinteger
verdictResponse
descriptionDetails of the verdict.
enum
  • VERDICT_RESPONSE_UNSPECIFIED
  • MALICIOUS
  • BENIGN
enumDescriptions
  • The default verdict response type.
  • VerdictResponse resulted a threat as malicious.
  • VerdictResponse resulted a threat as benign.
typestring
verdictTime
descriptionTimestamp at which the verdict was generated.
formatgoogle-datetime
typestring
typeobject
AnalyticsMetadata
descriptionStores information about an analytics metric used in a rule.
idAnalyticsMetadata
properties
analytic
descriptionName of the analytic.
typestring
typeobject
Annotation
descriptionExtra parameters that don't fit anywhere else, captured as key/value. For example "VendorID/42" in BlackBerry user agents. The following keys are modified with reduced User-Agent and no client hints (go/ua-reduction-ua-string-reference): * "Chrome" (see `browser_version`) * "ChromiumBrowser" (unavailable) * "ChromeWebview" (unavailable) * "OS_VERSION" (see `os`) * "Rest" (unavailable) * "misc" (see `device`)
idAnnotation
properties
key
typestring
value
typestring
typeobject
Artifact
descriptionInformation about an artifact. The artifact can only be an IP.
idArtifact
properties
anonymous
descriptionWhether the VPN tunnels are configured for anonymous browsing or not.
typeboolean
artifactClient
$refArtifactClient
descriptionEntity or software accessing or utilizing network resources.
asOwner
descriptionOwner of the Autonomous System to which the IP address belongs.
typestring
asn
descriptionAutonomous System Number to which the IP address belongs.
formatint64
typestring
firstSeenTime
descriptionFirst seen timestamp of the IP in the customer's environment.
formatgoogle-datetime
typestring
ip
descriptionIP address of the artifact. This field can be used as an entity indicator for an external destination IP entity.
typestring
jarm
descriptionThe JARM hash for the IP address. (https://engineering.salesforce.com/easily-identify-malicious-servers-on-the-internet-with-jarm-e095edac525a).
typestring
lastHttpsCertificate
$refSSLCertificate
descriptionSSL certificate information about the IP address.
lastHttpsCertificateDate
descriptionMost recent date for the certificate in VirusTotal.
formatgoogle-datetime
typestring
lastSeenTime
descriptionLast seen timestamp of the IP address in the customer's environment.
formatgoogle-datetime
typestring
location
$refLocation
descriptionLocation of the Artifact's IP address.
network
$refNetwork
descriptionNetwork information related to the Artifact's IP address.
prevalence
$refPrevalence
descriptionThe prevalence of the artifact within the customer's environment.
regionalInternetRegistry
descriptionRIR (one of the current RIRs: AFRINIC, ARIN, APNIC, LACNIC or RIPE NCC).
typestring
risks
descriptionThis field lists potential risks associated with the network activity.
items
typestring
typearray
tags
descriptionIdentification attributes
items
typestring
typearray
tunnels
descriptionVPN tunnels.
items
$refTunnels
typearray
whois
descriptionWHOIS information as returned from the pertinent WHOIS server.
typestring
whoisDate
descriptionDate of the last update of the WHOIS record in VirusTotal.
formatgoogle-datetime
typestring
typeobject
ArtifactClient
descriptionEntity or software accessing or utilizing network resources.
idArtifactClient
properties
behaviors
descriptionThe behaviors of the client accessing the network.
items
typestring
typearray
proxies
descriptionThe type of proxies used by the client.
items
typestring
typearray
typeobject
Asset
descriptionInformation about a compute asset such as a workstation, laptop, phone, virtual desktop, or VM.
idAsset
properties
assetId
descriptionThe asset ID. Value must contain the ':' character. For example, cs:abcdd23434. This field can be used as an entity indicator for asset entities.
typestring
attribute
$refAttribute
descriptionGeneric entity metadata attributes of the asset.
category
descriptionThe category of the asset (e.g. "End User Asset", "Workstation", "Server").
typestring
creationTime
deprecatedTrue
descriptionTime the asset was created or provisioned. Deprecate: creation_time should be populated in Attribute as generic metadata.
formatgoogle-datetime
typestring
deploymentStatus
descriptionThe deployment status of the asset for device lifecycle purposes.
enum
  • DEPLOYMENT_STATUS_UNSPECIFIED
  • ACTIVE
  • PENDING_DECOMISSION
  • DECOMISSIONED
enumDescriptions
  • Unspecified deployment status.
  • Asset is active, functional and deployed.
  • Asset is pending decommission and no longer deployed.
  • Asset is decommissioned.
typestring
firstDiscoverTime
descriptionTime the asset was first discovered (by asset management/discoverability software).
formatgoogle-datetime
typestring
firstSeenTime
descriptionThe first observed time for an asset. The value is calculated on the basis of the first time the identifier was observed.
formatgoogle-datetime
typestring
hardware
descriptionThe asset hardware specifications.
items
$refHardware
typearray
hostname
descriptionAsset hostname or domain name field. This field can be used as an entity indicator for asset entities.
typestring
ip
descriptionA list of IP addresses associated with an asset. This field can be used as an entity indicator for asset entities.
items
typestring
typearray
labels
deprecatedTrue
descriptionMetadata labels for the asset. Deprecated: labels should be populated in Attribute as generic metadata.
items
$refLabel
typearray
lastBootTime
descriptionTime the asset was last boot started.
formatgoogle-datetime
typestring
lastDiscoverTime
descriptionTime the asset was last discovered (by asset management/discoverability software).
formatgoogle-datetime
typestring
location
$refLocation
descriptionLocation of the asset.
mac
descriptionList of MAC addresses associated with an asset. This field can be used as an entity indicator for asset entities.
items
typestring
typearray
natIp
descriptionList of NAT IP addresses associated with an asset.
items
typestring
typearray
networkDomain
descriptionThe network domain of the asset (e.g. "corp.acme.com")
typestring
platformSoftware
$refPlatformSoftware
descriptionThe asset operating system platform software.
productObjectId
descriptionA vendor-specific identifier to uniquely identify the entity (a GUID or similar). This field can be used as an entity indicator for asset entities.
typestring
software
descriptionThe asset software details.
items
$refSoftware
typearray
systemLastUpdateTime
descriptionTime the asset system or OS was last updated. For all other operations that are not system updates (such as resizing a VM), use Attribute.last_update_time.
formatgoogle-datetime
typestring
type
descriptionThe type of the asset (e.g. workstation or laptop or server).
enum
  • ROLE_UNSPECIFIED
  • WORKSTATION
  • LAPTOP
  • IOT
  • NETWORK_ATTACHED_STORAGE
  • PRINTER
  • SCANNER
  • SERVER
  • TAPE_LIBRARY
  • MOBILE
enumDescriptions
  • Unspecified asset role.
  • A workstation or desktop.
  • A laptop computer.
  • An IOT asset.
  • A network attached storage device.
  • A printer.
  • A scanner.
  • A server.
  • A tape library device.
  • A mobile device such as a mobile phone or PDA.
typestring
vulnerabilities
descriptionVulnerabilities discovered on asset.
items
$refVulnerability
typearray
typeobject
Association
descriptionAssociations represents different metadata about malware and threat actors involved with an IoC.
idAssociation
properties
alias
descriptionDifferent aliases of the threat actor given by different sources.
items
$refAssociationAlias
typearray
associatedActors
descriptionList of associated threat actors for a malware. Not applicable for threat actors.
items
$refAssociation
typearray
countryCode
descriptionCountry from which the threat actor/ malware is originated.
items
typestring
typearray
description
descriptionHuman readable description about the association.
typestring
firstReferenceTime
descriptionFirst time the threat actor was referenced or seen.
formatgoogle-datetime
typestring
id
descriptionUnique association id generated by mandiant.
typestring
industriesAffected
descriptionList of industries the threat actor affects.
items
typestring
typearray
lastReferenceTime
descriptionLast time the threat actor was referenced or seen.
formatgoogle-datetime
typestring
name
descriptionName of the threat actor/malware.
typestring
regionCode
$refLocation
descriptionName of the country, the threat is originating from.
role
descriptionRole of the malware. Not applicable for threat actor.
typestring
sourceCountry
deprecatedTrue
descriptionName of the country the threat originated from.
typestring
sponsorRegion
$refLocation
descriptionSponsor region of the threat actor.
tags
descriptionTags.
items
typestring
typearray
targetedRegions
descriptionTargeted regions.
items
$refLocation
typearray
type
descriptionSignifies the type of association.
enum
  • ASSOCIATION_TYPE_UNSPECIFIED
  • THREAT_ACTOR
  • MALWARE
enumDescriptions
  • The default Association Type.
  • Association type Threat actor.
  • Association type Malware.
typestring
typeobject
AssociationAlias
descriptionAssociation Alias used to represent Mandiant Threat Intelligence.
idAssociationAlias
properties
company
descriptionName of the provider who gave the association's name.
typestring
name
descriptionName of the alias.
typestring
typeobject
AttackDetails
descriptionMITRE ATT&CK details.
idAttackDetails
properties
tactics
descriptionTactics employed.
items
$refTactic
typearray
techniques
descriptionTechniques employed.
items
$refTechnique
typearray
version
descriptionATT&CK version (e.g. 12.1).
typestring
typeobject
Attribute
descriptionAttribute is a container for generic entity attributes including common attributes across core entities (such as, user or asset). For example, Cloud is a generic entity attribute since it can apply to an asset (for example, a VM) or a user (for example, an identity service account).
idAttribute
properties
cloud
$refCloud
descriptionCloud metadata attributes such as project ID, account ID, or organizational hierarchy.
creationTime
descriptionTime the resource or entity was created or provisioned.
formatgoogle-datetime
typestring
labels
descriptionSet of labels for the entity. Should only be used for product labels (for example, Google Cloud resource labels or Azure AD sensitivity labels. Should not be used for arbitrary key-value mappings.
items
$refLabel
typearray
lastUpdateTime
descriptionTime the resource or entity was last updated.
formatgoogle-datetime
typestring
permissions
descriptionSystem permissions for IAM entity (human principal, service account, group).
items
$refPermission
typearray
roles
descriptionSystem IAM roles to be assumed by resources to use the role's permissions for access control.
items
$refRole
typearray
typeobject
Authentication
descriptionThe Authentication extension captures details specific to authentication events. General guidelines for authentication events: * Details about the source of the authentication event (for example, client IP or hostname), should be captured in principal. The principal may be empty if we have no details about the source of the login. * Details about the target of the authentication event (for example, details about the machine that is being logged into or logged out of) should be captured in target. * Some authentication events may involve a third-party. For example, a user logs into a cloud service (for example, Chronicle) via their company's SSO (the event is logged by their SSO solution). In this case, the principal captures information about the user's device, the target captures details about the cloud service they logged into, and the intermediary captures details about the SSO solution.
idAuthentication
properties
authDetails
descriptionThe vendor defined details of the authentication.
typestring
mechanism
descriptionThe authentication mechanism.
items
enum
  • MECHANISM_UNSPECIFIED
  • USERNAME_PASSWORD
  • OTP
  • HARDWARE_KEY
  • LOCAL
  • REMOTE
  • REMOTE_INTERACTIVE
  • MECHANISM_OTHER
  • BADGE_READER
  • NETWORK
  • BATCH
  • SERVICE
  • UNLOCK
  • NETWORK_CLEAR_TEXT
  • NEW_CREDENTIALS
  • INTERACTIVE
  • CACHED_INTERACTIVE
  • CACHED_REMOTE_INTERACTIVE
  • CACHED_UNLOCK
  • BIOMETRIC
  • WEARABLE
enumDescriptions
  • The default mechanism.
  • Username + password authentication.
  • OTP authentication.
  • Hardware key authentication.
  • Local authentication.
  • Remote authentication.
  • RDP, Terminal Services, or VNC.
  • Some other mechanism that is not defined here.
  • Badge reader authentication
  • Network authentication.
  • Batch authentication.
  • Service authentication
  • Direct human-interactive unlock authentication.
  • Network clear text authentication.
  • Authentication with new credentials.
  • Interactive authentication.
  • Interactive authentication using cached credentials.
  • Cached Remote Interactive authentication using cached credentials.
  • Cached Remote Interactive authentication using cached credentials.
  • Biometric device such as a fingerprint reader.
  • Wearable such as an Apple Watch.
typestring
typearray
type
descriptionThe type of authentication.
enum
  • AUTHTYPE_UNSPECIFIED
  • MACHINE
  • SSO
  • VPN
  • PHYSICAL
  • TACACS
enumDescriptions
  • The default type.
  • A machine authentication.
  • An SSO authentication.
  • A VPN authentication.
  • A Physical authentication (e.g. "Badge reader").
  • A TACACS family protocol for networked systems authentication (e.g. TACACS, TACACS+).
typestring
typeobject
AuthorityKeyId
descriptionIdentifies the public key to be used to verify the signature on this certificate or CRL.
idAuthorityKeyId
properties
keyid
descriptionKey hexdump.
typestring
serialNumber
descriptionSerial number hexdump.
typestring
typeobject
BackstoryEntity
descriptionAn Entity provides additional context about an item in a UDM event. For example, a PROCESS_LAUNCH event describes that user 'abc@example.corp' launched process 'shady.exe'. The event does not include information that user 'abc@example.com' is a recently terminated employee who administers a server storing finance data. Information stored in one or more Entities can add this additional context.
idBackstoryEntity
properties
additional
additionalProperties
descriptionProperties of the object.
typeany
descriptionImportant entity data that cannot be adequately represented within the formal sections of the Entity.
typeobject
entity
$refNoun
descriptionNoun in the UDM event that this entity represents.
metadata
$refEntityMetadata
descriptionEntity metadata such as timestamp, product, etc.
metric
$refMetric
descriptionStores statistical metrics about the entity. Used if metadata.entity_type is METRIC.
relations
descriptionOne or more relationships between the entity (a) and other entities, including the relationship type and related entity.
items
$refRelation
typearray
riskScore
$refEntityRisk
descriptionStores information related to the entity's risk score.
typeobject
BackstoryFile
descriptionInformation about a file.
idBackstoryFile
properties
ahash
deprecatedTrue
descriptionDeprecated. Use authentihash instead.
typestring
authentihash
descriptionAuthentihash of the file.
typestring
capabilitiesTags
descriptionCapabilities tags.
items
typestring
typearray
createTime
descriptionTimestamp when the file was created.
formatgoogle-datetime
typestring
embeddedDomains
descriptionEmbedded domains found in the file.
items
typestring
typearray
embeddedIps
descriptionEmbedded IP addresses found in the file.
items
typestring
typearray
embeddedUrls
descriptionEmbedded urls found in the file.
items
typestring
typearray
exifInfo
$refExifInfo
descriptionExif metadata from different file formats extracted by exiftool.
fileMetadata
$refFileMetadata
deprecatedTrue
descriptionMetadata associated with the file. Deprecate FileMetadata in favor of using fields in File.
fileType
descriptionFileType field.
enum
  • FILE_TYPE_UNSPECIFIED
  • FILE_TYPE_PE_EXE
  • FILE_TYPE_PE_DLL
  • FILE_TYPE_MSI
  • FILE_TYPE_NE_EXE
  • FILE_TYPE_NE_DLL
  • FILE_TYPE_DOS_EXE
  • FILE_TYPE_DOS_COM
  • FILE_TYPE_COFF
  • FILE_TYPE_ELF
  • FILE_TYPE_LINUX_KERNEL
  • FILE_TYPE_RPM
  • FILE_TYPE_LINUX
  • FILE_TYPE_MACH_O
  • FILE_TYPE_JAVA_BYTECODE
  • FILE_TYPE_DMG
  • FILE_TYPE_DEB
  • FILE_TYPE_PKG
  • FILE_TYPE_PYC
  • FILE_TYPE_LNK
  • FILE_TYPE_DESKTOP_ENTRY
  • FILE_TYPE_JPEG
  • FILE_TYPE_TIFF
  • FILE_TYPE_GIF
  • FILE_TYPE_PNG
  • FILE_TYPE_BMP
  • FILE_TYPE_GIMP
  • FILE_TYPE_IN_DESIGN
  • FILE_TYPE_PSD
  • FILE_TYPE_TARGA
  • FILE_TYPE_XWD
  • FILE_TYPE_DIB
  • FILE_TYPE_JNG
  • FILE_TYPE_ICO
  • FILE_TYPE_FPX
  • FILE_TYPE_EPS
  • FILE_TYPE_SVG
  • FILE_TYPE_EMF
  • FILE_TYPE_WEBP
  • FILE_TYPE_DWG
  • FILE_TYPE_DXF
  • FILE_TYPE_THREEDS
  • FILE_TYPE_OGG
  • FILE_TYPE_FLC
  • FILE_TYPE_FLI
  • FILE_TYPE_MP3
  • FILE_TYPE_FLAC
  • FILE_TYPE_WAV
  • FILE_TYPE_MIDI
  • FILE_TYPE_AVI
  • FILE_TYPE_MPEG
  • FILE_TYPE_QUICKTIME
  • FILE_TYPE_ASF
  • FILE_TYPE_DIVX
  • FILE_TYPE_FLV
  • FILE_TYPE_WMA
  • FILE_TYPE_WMV
  • FILE_TYPE_RM
  • FILE_TYPE_MOV
  • FILE_TYPE_MP4
  • FILE_TYPE_T3GP
  • FILE_TYPE_WEBM
  • FILE_TYPE_MKV
  • FILE_TYPE_PDF
  • FILE_TYPE_PS
  • FILE_TYPE_DOC
  • FILE_TYPE_DOCX
  • FILE_TYPE_PPT
  • FILE_TYPE_PPTX
  • FILE_TYPE_XLS
  • FILE_TYPE_XLSX
  • FILE_TYPE_RTF
  • FILE_TYPE_PPSX
  • FILE_TYPE_ODP
  • FILE_TYPE_ODS
  • FILE_TYPE_ODT
  • FILE_TYPE_HWP
  • FILE_TYPE_GUL
  • FILE_TYPE_ODF
  • FILE_TYPE_ODG
  • FILE_TYPE_ONE_NOTE
  • FILE_TYPE_OOXML
  • FILE_TYPE_SLK
  • FILE_TYPE_EBOOK
  • FILE_TYPE_LATEX
  • FILE_TYPE_TTF
  • FILE_TYPE_EOT
  • FILE_TYPE_WOFF
  • FILE_TYPE_CHM
  • FILE_TYPE_ZIP
  • FILE_TYPE_GZIP
  • FILE_TYPE_BZIP
  • FILE_TYPE_RZIP
  • FILE_TYPE_DZIP
  • FILE_TYPE_SEVENZIP
  • FILE_TYPE_CAB
  • FILE_TYPE_JAR
  • FILE_TYPE_RAR
  • FILE_TYPE_MSCOMPRESS
  • FILE_TYPE_ACE
  • FILE_TYPE_ARC
  • FILE_TYPE_ARJ
  • FILE_TYPE_ASD
  • FILE_TYPE_BLACKHOLE
  • FILE_TYPE_KGB
  • FILE_TYPE_ZLIB
  • FILE_TYPE_TAR
  • FILE_TYPE_ZST
  • FILE_TYPE_LZFSE
  • FILE_TYPE_PYTHON_WHL
  • FILE_TYPE_PYTHON_PKG
  • FILE_TYPE_MSIX
  • FILE_TYPE_TEXT
  • FILE_TYPE_SCRIPT
  • FILE_TYPE_PHP
  • FILE_TYPE_PYTHON
  • FILE_TYPE_PERL
  • FILE_TYPE_RUBY
  • FILE_TYPE_C
  • FILE_TYPE_CPP
  • FILE_TYPE_JAVA
  • FILE_TYPE_SHELLSCRIPT
  • FILE_TYPE_PASCAL
  • FILE_TYPE_AWK
  • FILE_TYPE_DYALOG
  • FILE_TYPE_FORTRAN
  • FILE_TYPE_JAVASCRIPT
  • FILE_TYPE_POWERSHELL
  • FILE_TYPE_VBA
  • FILE_TYPE_M4
  • FILE_TYPE_OBJETIVEC
  • FILE_TYPE_JMOD
  • FILE_TYPE_MAKEFILE
  • FILE_TYPE_INI
  • FILE_TYPE_CLJ
  • FILE_TYPE_PDB
  • FILE_TYPE_SQL
  • FILE_TYPE_NEKO
  • FILE_TYPE_WER
  • FILE_TYPE_GOLANG
  • FILE_TYPE_M3U
  • FILE_TYPE_BAT
  • FILE_TYPE_MSC
  • FILE_TYPE_RDP
  • FILE_TYPE_SYMBIAN
  • FILE_TYPE_PALMOS
  • FILE_TYPE_WINCE
  • FILE_TYPE_ANDROID
  • FILE_TYPE_IPHONE
  • FILE_TYPE_HTML
  • FILE_TYPE_XML
  • FILE_TYPE_SWF
  • FILE_TYPE_FLA
  • FILE_TYPE_COOKIE
  • FILE_TYPE_TORRENT
  • FILE_TYPE_EMAIL_TYPE
  • FILE_TYPE_OUTLOOK
  • FILE_TYPE_SGML
  • FILE_TYPE_JSON
  • FILE_TYPE_CSV
  • FILE_TYPE_HTA
  • FILE_TYPE_INTERNET_SHORTCUT
  • FILE_TYPE_CAP
  • FILE_TYPE_ISOIMAGE
  • FILE_TYPE_SQUASHFS
  • FILE_TYPE_VHD
  • FILE_TYPE_APPLE
  • FILE_TYPE_MACINTOSH
  • FILE_TYPE_APPLESINGLE
  • FILE_TYPE_APPLEDOUBLE
  • FILE_TYPE_MACINTOSH_HFS
  • FILE_TYPE_APPLE_PLIST
  • FILE_TYPE_MACINTOSH_LIB
  • FILE_TYPE_APPLESCRIPT
  • FILE_TYPE_APPLESCRIPT_COMPILED
  • FILE_TYPE_CRX
  • FILE_TYPE_XPI
  • FILE_TYPE_ROM
  • FILE_TYPE_IPS
  • FILE_TYPE_PEM
  • FILE_TYPE_PGP
  • FILE_TYPE_CRT
enumDescriptions
  • File type is UNSPECIFIED.
  • File type is PE_EXE.
  • Although DLLs are actually portable executables, this value enables the file type to be identified separately. File type is PE_DLL.
  • File type is MSI.
  • File type is NE_EXE.
  • File type is NE_DLL.
  • File type is DOS_EXE.
  • File type is DOS_COM.
  • File type is COFF.
  • File type is ELF.
  • File type is LINUX_KERNEL.
  • File type is RPM.
  • File type is LINUX.
  • File type is MACH_O.
  • File type is JAVA_BYTECODE.
  • File type is DMG.
  • File type is DEB.
  • File type is PKG.
  • File type is PYC.
  • File type is LNK.
  • File type is DESKTOP_ENTRY.
  • File type is JPEG.
  • File type is TIFF.
  • File type is GIF.
  • File type is PNG.
  • File type is BMP.
  • File type is GIMP.
  • File type is Adobe InDesign.
  • File type is PSD. Adobe Photoshop.
  • File type is TARGA.
  • File type is XWD.
  • File type is DIB.
  • File type is JNG.
  • File type is ICO.
  • File type is FPX.
  • File type is EPS.
  • File type is SVG.
  • File type is EMF.
  • File type is WEBP.
  • File type is DWG.
  • File type is DXF.
  • File type is 3DS.
  • File type is OGG.
  • File type is FLC.
  • File type is FLI.
  • File type is MP3.
  • File type is FLAC.
  • File type is WAV.
  • File type is MIDI.
  • File type is AVI.
  • File type is MPEG.
  • File type is QUICKTIME.
  • File type is ASF.
  • File type is DIVX.
  • File type is FLV.
  • File type is WMA.
  • File type is WMV.
  • File type is RM. RealMedia type.
  • File type is MOV.
  • File type is MP4.
  • File type is T3GP.
  • File type is WEBM.
  • File type is MKV.
  • File type is PDF.
  • File type is PS.
  • File type is DOC.
  • File type is DOCX.
  • File type is PPT.
  • File type is PPTX.
  • File type is XLS.
  • File type is XLSX.
  • File type is RTF.
  • File type is PPSX.
  • File type is ODP.
  • File type is ODS.
  • File type is ODT.
  • File type is HWP.
  • File type is GUL.
  • File type is ODF.
  • File type is ODG.
  • File type is ONE_NOTE.
  • File type is OOXML.
  • File type is SLK.
  • File type is EBOOK.
  • File type is LATEX.
  • File type is TTF.
  • File type is EOT.
  • File type is WOFF.
  • File type is CHM.
  • File type is ZIP.
  • File type is GZIP.
  • File type is BZIP.
  • File type is RZIP.
  • File type is DZIP.
  • File type is SEVENZIP.
  • File type is CAB.
  • File type is JAR.
  • File type is RAR.
  • File type is MSCOMPRESS.
  • File type is ACE.
  • File type is ARC.
  • File type is ARJ.
  • File type is ASD.
  • File type is BLACKHOLE.
  • File type is KGB.
  • File type is ZLIB.
  • File type is TAR.
  • File type is ZST.
  • File type is LZFSE.
  • File type is PYTHON_WHL.
  • File type is PYTHON_PKG.
  • File type is MSIX, new Windows app package format.
  • File type is TEXT.
  • File type is SCRIPT.
  • File type is PHP.
  • File type is PYTHON.
  • File type is PERL.
  • File type is RUBY.
  • File type is C.
  • File type is CPP.
  • File type is JAVA.
  • File type is SHELLSCRIPT.
  • File type is PASCAL.
  • File type is AWK.
  • File type is DYALOG.
  • File type is FORTRAN.
  • File type is JAVASCRIPT.
  • File type is POWERSHELL.
  • File type is VBA.
  • File type is M4.
  • File type is OBJETIVEC.
  • File type is JMOD.
  • File type is MAKEFILE.
  • File type is INI.
  • File type is CLJ.
  • File type is PDB.
  • File type is SQL.
  • File type is NEKO.
  • File type is WER.
  • File type is GOLANG.
  • File type is M3U.
  • File type is BAT, Windows .bat/.cmd (old files are tagged as SHELLSCRIPT).
  • File type is MSC, Microsoft Management Console (MMC).
  • File type is RDP, Microsoft Remote Desktop Protocol (RDP) file.
  • File type is SYMBIAN.
  • File type is PALMOS.
  • File type is WINCE.
  • File type is ANDROID.
  • File type is IPHONE.
  • File type is HTML.
  • File type is XML.
  • File type is SWF.
  • File type is FLA.
  • File type is COOKIE.
  • File type is TORRENT.
  • File type is EMAIL_TYPE.
  • File type is OUTLOOK.
  • File type is SGML.
  • File type is JSON.
  • File type is CSV.
  • File type is HTA (HTML Application).
  • File type is MSHTML .url.
  • File type is CAP.
  • File type is ISOIMAGE.
  • File type is SQUASHFS.
  • File type is VHD.
  • File type is APPLE.
  • File type is MACINTOSH.
  • File type is APPLESINGLE.
  • File type is APPLEDOUBLE.
  • File type is MACINTOSH_HFS.
  • File type is APPLE_PLIST.
  • File type is MACINTOSH_LIB.
  • File type is APPLESCRIPT.
  • File type is APPLESCRIPT_COMPILED .
  • File type is CRX.
  • File type is XPI.
  • File type is ROM.
  • File type is IPS.
  • File type is PEM.
  • File type is PGP.
  • File type is CRT.
typestring
firstSeenTime
descriptionTimestamp the file was first seen in the customer's environment.
formatgoogle-datetime
typestring
firstSubmissionTime
descriptionFirst submission time of the file.
formatgoogle-datetime
typestring
fullPath
descriptionThe full path identifying the location of the file on the system. This field can be used as an entity indicator for file entities.
typestring
lastAccessTime
descriptionTimestamp when the file was accessed.
formatgoogle-datetime
typestring
lastAnalysisTime
descriptionTimestamp the file was last analysed.
formatgoogle-datetime
typestring
lastModificationTime
descriptionTimestamp when the file was last updated.
formatgoogle-datetime
typestring
lastSeenTime
descriptionTimestamp the file was last seen in the customer's environment.
formatgoogle-datetime
typestring
lastSubmissionTime
descriptionLast submission time of the file.
formatgoogle-datetime
typestring
mainIcon
$refFavicon
descriptionIcon's relevant hashes.
md5
descriptionThe MD5 hash of the file, as a hex-encoded string. This field can be used as an entity indicator for file entities.
typestring
mimeType
descriptionThe MIME (Multipurpose Internet Mail Extensions) type of the file, for example "PE", "PDF", or "powershell script".
typestring
names
descriptionNames fields.
items
typestring
typearray
ntfs
$refNtfsFileMetadata
descriptionNTFS metadata.
pdfInfo
$refPDFInfo
descriptionInformation about the PDF file structure.
peFile
$refFileMetadataPE
descriptionMetadata about the Portable Executable (PE) file.
prevalence
$refPrevalence
descriptionPrevalence of the file hash in the customer's environment.
securityResult
$refSecurityResult
descriptionGoogle Cloud Threat Intelligence (GCTI) security result for the file including threat context and detection metadata.
sha1
descriptionThe SHA1 hash of the file, as a hex-encoded string. This field can be used as an entity indicator for file entities.
typestring
sha256
descriptionThe SHA256 hash of the file, as a hex-encoded string. This field can be used as an entity indicator for file entities.
typestring
signatureInfo
$refSignatureInfo
descriptionFile signature information extracted from different tools.
size
descriptionThe size of the file in bytes.
formatuint64
typestring
ssdeep
descriptionSsdeep of the file
typestring
statDev
descriptionThe file system identifier to which the object belongs.
formatuint64
typestring
statFlags
descriptionUser defined flags for file.
formatuint32
typeinteger
statInode
descriptionThe file identifier. Unique identifier of object within a file system.
formatuint64
typestring
statMode
descriptionThe mode of the file. A bit string indicating the permissions and privileges of the file.
formatuint64
typestring
statNlink
descriptionNumber of links to file.
formatuint64
typestring
symhash
descriptionSymHash of the file. Used for Mach-O (e.g. MacOS) binaries, to identify similar files based on their symbol table.
typestring
tags
descriptionTags for the file.
items
typestring
typearray
vhash
descriptionVhash of the file.
typestring
typeobject
BoolSequence
descriptionBoolSequence represents a sequence of bools.
idBoolSequence
properties
boolVals
descriptionbool sequence.
items
typeboolean
typearray
typeobject
BytesSequence
descriptionBytesSequence represents a sequence of bytes.
idBytesSequence
properties
bytesVals
descriptionbytes sequence.
items
formatbyte
typestring
typearray
typeobject
CancelOperationRequest
descriptionThe request message for Operations.CancelOperation.
idCancelOperationRequest
properties
typeobject
CertSignature
descriptionCertificate's signature and algorithm.
idCertSignature
properties
signature
descriptionSignature.
typestring
signatureAlgorithm
descriptionAlgorithm.
typestring
typeobject
Certificate
descriptionCertificate information
idCertificate
properties
issuer
descriptionIssuer of the certificate.
typestring
md5
descriptionThe MD5 hash of the certificate, as a hex-encoded string.
typestring
notAfter
descriptionIndicates when the certificate is no longer valid.
formatgoogle-datetime
typestring
notBefore
descriptionIndicates when the certificate is first valid.
formatgoogle-datetime
typestring
serial
descriptionCertificate serial number.
typestring
sha1
descriptionThe SHA1 hash of the certificate, as a hex-encoded string.
typestring
sha256
descriptionThe SHA256 hash of the certificate, as a hex-encoded string.
typestring
subject
descriptionSubject of the certificate.
typestring
version
descriptionCertificate version.
typestring
typeobject
Chip
idChip
properties
text
typestring
type
enum
  • UNSPECIFIED
  • ALERT
  • NETWORK_CONNECTION
  • EDR
  • UNPARSED_RAW_LOG
  • LOGIN_EVENT
  • EMAIL_EVENT
  • GENERIC
  • TELEMETRY
enumDescriptions
typestring
typeobject
Client
descriptionTransport Layer Security (TLS) information associated with the client (for example, Certificate or JA3 hash).
idClient
properties
certificate
$refCertificate
descriptionClient certificate.
ja3
descriptionJA3 hash from the TLS ClientHello, as a hex-encoded string.
typestring
serverName
descriptionHost name of the server, that the client is connecting to.
typestring
supportedCiphers
descriptionCiphers supported by the client during client hello.
items
typestring
typearray
typeobject
Cloud
descriptionMetadata related to the cloud environment.
idCloud
properties
availabilityZone
descriptionThe cloud environment availability zone (different from region which is location.name).
typestring
environment
descriptionThe Cloud environment.
enum
  • UNSPECIFIED_CLOUD_ENVIRONMENT
  • GOOGLE_CLOUD_PLATFORM
  • AMAZON_WEB_SERVICES
  • MICROSOFT_AZURE
enumDescriptions
  • Default.
  • Google Cloud Platform.
  • Amazon Web Services.
  • Microsoft Azure.
typestring
project
$refResource
deprecatedTrue
descriptionThe cloud environment project information. Deprecated: Use Resource.resource_ancestors
vpc
$refResource
deprecatedTrue
descriptionThe cloud environment VPC. Deprecated.
typeobject
Collection
descriptionCollection represents a container of objects (such as events, entity context metadata, detection finding metadata) and state (such as investigation details). BEGIN GOOGLE-INTERNAL See go/udm:collections for additional details. END GOOGLE-INTERNAL An example use case for Collection is to model a detection and investigation from detection finding metadata to investigative state collected in the course of the investigation. For more complex investigation and response workflows a Collection could represent an incident consisting of multiple child findings or incidents. This can be expanded on to model remediation elements of a full detection and response workflow. NEXT TAG: 20
idCollection
properties
caseName
descriptionThe resource name of the Case that this collection belongs to. Example: projects/{project id}/locations/{region}/chronicle/cases/{internal_case_id}
typestring
collectionElements
descriptionConstituent elements of the collection. Each element shares an association that groups it together and is a component of the overall collection. For example, a detection collection may have several constituent elements that each share a correlation association that together represent a particular pattern or behavior.
items
$refElement
typearray
createdTime
descriptionTime the collection was created.
formatgoogle-datetime
typestring
dataAccessScope
descriptionThe resource name of the DataAccessScope of this collection. BEGIN GOOGLE-INTERNAL We may change this name based on the final resource design of the scope. END GOOGLE-INTERNAL
typestring
detection
descriptionDetection metadata for findings that represent detections, can include rule details, machine learning model metadata, and indicators implicated in the detection (using the .about field).
items
$refSecurityResult
typearray
detectionTime
descriptionTimestamp within the time_window related to the time of the collection_elements. For Rule Detections, this timestamp is the end of the the time_window for multi-event rules or the time of the event for single event rules. For late-arriving events that trigger new alerts, the detection_time will be the event time of the event.
formatgoogle-datetime
typestring
feedbackHistory
descriptionThe history of feedback submitted by analysts for this finding, in descending order by timestamp. This field is limited to the most recent 1000 feedback events. The primary feedback will also be included in this list.
items
$refFeedback
typearray
feedbackSummary
$refFeedback
descriptionThe current primary analyst feedback. This does not include the history of feedback given, which may be supplied in `feedback`.
id
descriptionUnique ID for the collection. The ID is specific to the type of collection. For example, with rule detections this is the detection ID.
typestring
idNamespace
descriptionThe ID namespace used for the Collection.
enum
  • NORMALIZED_TELEMETRY
  • RAW_TELEMETRY
  • RULE_DETECTIONS
  • UPPERCASE
  • MACHINE_INTELLIGENCE
  • SECURITY_COMMAND_CENTER
  • UNSPECIFIED
  • SOAR_ALERT
  • VIRUS_TOTAL
enumDescriptions
  • Ingested and Normalized telemetry events
  • Ingested Raw telemetry
  • Chronicle Rules engine
  • Uppercase
  • DSML - Machine Intelligence
  • A normalized telemetry event from Google Security Command Center.
  • Unspecified Namespace
  • An alert coming from other SIEMs via Chronicle SOAR.
  • VirusTotal.
typestring
investigation
$refInvestigation
descriptionConsolidated investigation details (categorization, status, etc) typically for collections that begin as detection findings and then evolve with analyst action and feedback into investigations around the detection output.
lastUpdatedTime
descriptionTime the collection was last updated.
formatgoogle-datetime
typestring
responsePlatformInfo
$refResponsePlatformInfo
descriptionAlert related info of this same alert in customer's SOAR platform.
soarAlert
descriptionA boolean field indicating that the alert is present in SOAR.
typeboolean
soarAlertMetadata
$refSoarAlertMetadata
descriptionMetadata fields of alerts coming from other SIEM systems via SOAR.
tags
descriptionTags set by UC/DSML/RE for the Finding during creation.
items
typestring
typearray
timeWindow
$refInterval
descriptionTime interval that the collection represents.
type
descriptionWhat the collection represents.
enum
  • COLLECTION_TYPE_UNSPECIFIED
  • TELEMETRY_ALERT
  • GCTI_FINDING
  • UPPERCASE_ALERT
  • RULE_DETECTION
  • MACHINE_INTELLIGENCE_ALERT
  • SOAR_ALERT
enumDescriptions
  • An unspecified collection type.
  • An alert reported in customer telemetry.
  • A finding from the Uppercase team.
  • A detection found by applying a rule.
  • An alert generated by Chronicle machine learning models.
  • An alert coming from other SIEMs via Chronicle SOAR.
typestring
typeobject
ColumnNames
idColumnNames
properties
names
items
typestring
typearray
typeobject
CompilationDiagnostic
descriptionCompilationDiagnostic represents a compilation diagnostic generated during a rule's compilation, such as a compilation error or a compilation warning.
idCompilationDiagnostic
properties
message
descriptionOutput only. The diagnostic message.
readOnlyTrue
typestring
position
$refCompilationPosition
descriptionOutput only. The approximate position in the rule text associated with the compilation diagnostic. Compilation Position may be empty.
readOnlyTrue
severity
descriptionOutput only. The severity of a rule's compilation diagnostic.
enum
  • SEVERITY_UNSPECIFIED
  • WARNING
  • ERROR
enumDescriptions
  • An unspecified severity level.
  • A compilation warning.
  • A compilation error.
readOnlyTrue
typestring
uri
descriptionOutput only. Link to documentation that describes a diagnostic in more detail.
readOnlyTrue
typestring
typeobject
CompilationPosition
descriptionCompilationPosition represents the location of a compilation diagnostic in rule text.
idCompilationPosition
properties
endColumn
descriptionOutput only. End column number, beginning at 1.
formatint32
readOnlyTrue
typeinteger
endLine
descriptionOutput only. End line number, beginning at 1.
formatint32
readOnlyTrue
typeinteger
startColumn
descriptionOutput only. Start column number, beginning at 1.
formatint32
readOnlyTrue
typeinteger
startLine
descriptionOutput only. Start line number, beginning at 1.
formatint32
readOnlyTrue
typeinteger
typeobject
CreateParserExtensionMetadata
descriptionOperation metadata for creating a parser extension.
idCreateParserExtensionMetadata
properties
state
descriptionThe state of the parser extension creation process.
enum
  • STATE_UNSPECIFIED
  • NEW
  • VALIDATING
  • LIVE
  • REJECTED
  • INTERNAL_ERROR
  • VALIDATED
  • ARCHIVED
enumDescriptions
  • The state for this parser extension was not specified.
  • The parser extension has been newly submitted and is waiting to be validated.
  • The parser extension is currently going through the validation pipeline.
  • The parser extension is live in production. Only configs that have successfully passed the validation stage will be set to LIVE.
  • Validation completed, but the parser extension was rejected with errors.
  • An error occurred when processing this parser extension.
  • Extension is validated.
  • Extension is archived and is no more being used.
typestring
stateLastChangedTime
descriptionThe time the config state was last changed.
formatgoogle-datetime
typestring
validationErrors
descriptionAny validation error while validating the extension, this have cap of size 10
items
typestring
typearray
validationReport
descriptionThe validation report generated during validation of the parser extension.
typestring
typeobject
CreateParserMetadata
descriptionOperation metadata for creating a parser.
idCreateParserMetadata
properties
stage
descriptionThe validation stage of the parser creation process.
enum
  • VALIDATION_STAGE_UNSPECIFIED
  • NEW
  • VALIDATING
  • PASSED
  • FAILED
  • DELETE_CANDIDATE
enumDescriptions
  • The validation stage is not specified.
  • The custom parser is submitted for validation.
  • The custom parser is currently going through the validation pipeline
  • The custom parser has successfully passed the validation.
  • The custom parser has failed validation.
  • The parser is no good, It is available for auto deletion.
typestring
validationReport
descriptionThe validation report generated during validation of the parser.
typestring
typeobject
DNSRecord
descriptionDNS record.
idDNSRecord
properties
expire
descriptionExpire.
formatgoogle-duration
typestring
minimum
descriptionMinimum.
formatgoogle-duration
typestring
priority
descriptionPriority.
formatint64
typestring
refresh
descriptionRefresh.
formatgoogle-duration
typestring
retry
descriptionRetry.
formatint64
typestring
rname
descriptionRname.
typestring
serial
descriptionSerial.
formatint64
typestring
ttl
descriptionTime to live.
formatgoogle-duration
typestring
type
descriptionType.
typestring
value
descriptionValue.
typestring
typeobject
DataAccessIngestionLabel
idDataAccessIngestionLabel
properties
key
descriptionThe key.
typestring
value
descriptionThe value.
typestring
typeobject
DataAccessLabel
descriptionA DataAccessLabel is a label on events to define user access to data.
idDataAccessLabel
properties
author
descriptionOutput only. The user who created the data access label.
readOnlyTrue
typestring
createTime
descriptionOutput only. The time at which the data access label was created.
formatgoogle-datetime
readOnlyTrue
typestring
description
descriptionOptional. A description of the data access label for a human reader.
typestring
displayName
descriptionOutput only. The short name displayed for the label as it appears on event data.
readOnlyTrue
typestring
lastEditor
descriptionOutput only. The user who last updated the data access label.
readOnlyTrue
typestring
name
descriptionRequired. The unique resource name of the data access label.
typestring
udmQuery
descriptionA UDM query over event data.
typestring
updateTime
descriptionOutput only. The time at which the data access label was last updated.
formatgoogle-datetime
readOnlyTrue
typestring
typeobject
DataAccessLabelReference
descriptionReference object to a data access label.
idDataAccessLabelReference
properties
assetNamespace
descriptionThe asset namespace configured in the forwarder of the customer's events.
typestring
dataAccessLabel
descriptionThe name of the data access label.
typestring
displayName
descriptionOutput only. The display name of the label. Data access label and log types's name will match the display name of the resource. The asset namespace will match the namespace itself. The ingestion key value pair will match the key of the tuple.
readOnlyTrue
typestring
ingestionLabel
$refIngestionLabel
descriptionThe ingestion label configured in the forwarder of the customer's events.
logType
descriptionThe name of the log type.
typestring
typeobject
DataAccessLabels
idDataAccessLabels
properties
allowScopedAccess
descriptionAre the labels ready for scoped access
typeboolean
customLabels
descriptionAll the complex labels (UDM search syntax based).
items
typestring
typearray
ingestionKvLabels
descriptionAll the ingestion labels (key/value pairs).
items
$refDataAccessIngestionLabel
typearray
ingestionLabels
deprecatedTrue
descriptionAll the ingestion labels.
items
typestring
typearray
logTypes
descriptionAll the LogType labels.
items
typestring
typearray
namespaces
descriptionAll the namespaces.
items
typestring
typearray
typeobject
DataAccessScope
descriptionA DataAccessScope is a boolean expression of data access labels used to restrict access to data for users.
idDataAccessScope
properties
allowAll
descriptionOptional. Whether or not the scope allows all labels, allow_all and allowed_data_access_labels are mutually exclusive and one of them must be present. denied_data_access_labels can still be used along with allow_all. When combined with denied_data_access_labels, access will be granted to all data that doesn't have labels mentioned in denied_data_access_labels. E.g.: A customer with scope with denied labels A and B and allow_all will be able to see all data except data labeled with A and data labeled with B and data with labels A and B.
typeboolean
allowedDataAccessLabels
descriptionOptional. The allowed labels for the scope. Either allow_all or allowed_data_access_labels needs to be provided. When provided, there has to be at least one label allowed for the scope to be valid. The logical operator for evaluation of the allowed labels is OR. E.g.: A customer with scope with allowed labels A and B will be able to see data with labeled with A or B or (A and B).
items
$refDataAccessLabelReference
typearray
author
descriptionOutput only. The user who created the data access scope.
readOnlyTrue
typestring
createTime
descriptionOutput only. The time at which the data access scope was created.
formatgoogle-datetime
readOnlyTrue
typestring
deniedDataAccessLabels
descriptionOptional. The denied labels for the scope. The logical operator for evaluation of the denied labels is AND. E.g.: A customer with scope with denied labels A and B won't be able to see data labeled with A and data labeled with B and data with labels A and B.
items
$refDataAccessLabelReference
typearray
description
descriptionOptional. A description of the data access scope for a human reader.
typestring
displayName
descriptionOutput only. The name to be used for display to customers of the data access scope.
readOnlyTrue
typestring
lastEditor
descriptionOutput only. The user who last updated the data access scope.
readOnlyTrue
typestring
name
descriptionRequired. The unique full name of the data access scope. The name should comply with https://google.aip.dev/122 standards.
typestring
updateTime
descriptionOutput only. The time at which the data access scope was last updated.
formatgoogle-datetime
readOnlyTrue
typestring
typeobject
Date
descriptionRepresents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values. * A month and day, with a zero year (for example, an anniversary). * A year on its own, with a zero month and a zero day. * A year and month, with a zero day (for example, a credit card expiration date). Related types: * google.type.TimeOfDay * google.type.DateTime * google.protobuf.Timestamp
idDate
properties
day
descriptionDay of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.
formatint32
typeinteger
month
descriptionMonth of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.
formatint32
typeinteger
year
descriptionYear of the date. Must be from 1 to 9999, or 0 to specify a date without a year.
formatint32
typeinteger
typeobject
Detections
idDetections
properties
baselineAlertsCount
formatint32
typeinteger
complete
typeboolean
detectionFieldAggregations
$refAlertFieldAggregations
detections
items
$refCollection
typearray
filteredAlertsCount
formatint32
typeinteger
tooManyDetections
typeboolean
validSnapshotQuery
typeboolean
typeobject
Dhcp
descriptionDHCP information.
idDhcp
properties
chaddr
descriptionClient hardware address (chaddr).
typestring
ciaddr
descriptionClient IP address (ciaddr).
typestring
clientHostname
descriptionClient hostname. See RFC2132, section 3.14.
typestring
clientIdentifier
descriptionClient identifier. See RFC2132, section 9.14. Note: Make sure to update the client_identifier_string field as well if you update this field.
formatbyte
typestring
clientIdentifierString
descriptionClient identifier as string. See RFC2132, section 9.14. This field holds the string value of the client_identifier.
typestring
file
descriptionBoot image filename.
typestring
flags
descriptionFlags.
formatuint32
typeinteger
giaddr
descriptionRelay agent IP address (giaddr).
typestring
hlen
descriptionHardware address length.
formatuint32
typeinteger
hops
descriptionHardware ops.
formatuint32
typeinteger
htype
descriptionHardware address type.
formatuint32
typeinteger
leaseTimeSeconds
descriptionLease time in seconds. See RFC2132, section 9.2.
formatuint32
typeinteger
opcode
descriptionThe BOOTP op code.
enum
  • UNKNOWN_OPCODE
  • BOOTREQUEST
  • BOOTREPLY
enumDescriptions
  • Default opcode.
  • Request.
  • Reply.
typestring
options
descriptionList of DHCP options.
items
$refOption
typearray
requestedAddress
descriptionRequested IP address. See RFC2132, section 9.1.
typestring
seconds
descriptionSeconds elapsed since client began address acquisition/renewal process.
formatuint32
typeinteger
siaddr
descriptionIP address of the next bootstrap server.
typestring
sname
descriptionServer name that the client wishes to boot from.
typestring
transactionId
descriptionTransaction ID.
formatuint32
typeinteger
type
descriptionDHCP message type.
enum
  • UNKNOWN_MESSAGE_TYPE
  • DISCOVER
  • OFFER
  • REQUEST
  • DECLINE
  • ACK
  • NAK
  • RELEASE
  • INFORM
  • WIN_DELETED
  • WIN_EXPIRED
enumDescriptions
  • Default message type.
  • DHCPDISCOVER.
  • DHCPOFFER.
  • DHCPREQUEST.
  • DHCPDECLINE.
  • DHCPACK.
  • DHCPNAK.
  • DHCPRELEASE.
  • DHCPINFORM.
  • Microsoft Windows DHCP "lease deleted".
  • Microsoft Windows DHCP "lease expired".
typestring
yiaddr
descriptionYour IP address (yiaddr).
typestring
typeobject
Dns
descriptionDNS information.
idDns
properties
additional
descriptionA list of additional domain name servers that can be used to verify the answer to the domain.
items
$refResourceRecord
typearray
answers
descriptionA list of answers to the domain name query.
items
$refResourceRecord
typearray
authoritative
descriptionOther DNS header flags. See RFC1035, section 4.1.1.
typeboolean
authority
descriptionA list of domain name servers which verified the answers to the domain name queries.
items
$refResourceRecord
typearray
id
descriptionDNS query id.
formatuint32
typeinteger
opcode
descriptionThe DNS OpCode used to specify the type of DNS query (for example, QUERY, IQUERY, or STATUS).
formatuint32
typeinteger
questions
descriptionA list of domain protocol message questions.
items
$refQuestion
typearray
recursionAvailable
descriptionWhether a recursive DNS lookup is available.
typeboolean
recursionDesired
descriptionWhether a recursive DNS lookup is desired.
typeboolean
response
descriptionSet to true if the event is a DNS response. See QR field from RFC1035.
typeboolean
responseCode
descriptionResponse code. See RCODE from RFC1035.
formatuint32
typeinteger
truncated
descriptionWhether the DNS response was truncated.
typeboolean
typeobject
Domain
descriptionInformation about a domain.
idDomain
properties
admin
$refUser
descriptionParsed contact information for the administrative contact for the domain.
auditUpdateTime
descriptionAudit updated time.
formatgoogle-datetime
typestring
billing
$refUser
descriptionParsed contact information for the billing contact of the domain.
categories
descriptionCategories assign to the domain as retrieved from VirusTotal.
items
typestring
typearray
contactEmail
descriptionContact email address.
typestring
creationTime
descriptionDomain creation time.
formatgoogle-datetime
typestring
expirationTime
descriptionExpiration time.
formatgoogle-datetime
typestring
favicon
$refFavicon
descriptionIncludes difference hash and MD5 hash of the domain's favicon.
firstSeenTime
descriptionFirst seen timestamp of the domain in the customer's environment.
formatgoogle-datetime
typestring
ianaRegistrarId
descriptionIANA Registrar ID. See https://www.iana.org/assignments/registrar-ids/registrar-ids.xhtml
formatint32
typeinteger
jarm
descriptionDomain's JARM hash.
typestring
lastDnsRecords
descriptionDomain's DNS records from the last scan.
items
$refDNSRecord
typearray
lastDnsRecordsTime
descriptionDate when the DNS records list was retrieved by VirusTotal.
formatgoogle-datetime
typestring
lastHttpsCertificate
$refSSLCertificate
descriptionSSL certificate object retrieved last time the domain was analyzed.
lastHttpsCertificateTime
descriptionWhen the certificate was retrieved by VirusTotal.
formatgoogle-datetime
typestring
lastSeenTime
descriptionLast seen timestamp of the domain in the customer's environment.
formatgoogle-datetime
typestring
name
descriptionThe domain name. This field can be used as an entity indicator for Domain entities.
typestring
nameServer
descriptionRepeated list of name servers.
items
typestring
typearray
popularityRanks
descriptionDomain's position in popularity ranks such as Alexa, Quantcast, Statvoo, etc
items
$refPopularityRank
typearray
prevalence
$refPrevalence
descriptionThe prevalence of the domain within the customer's environment.
privateRegistration
descriptionIndicates whether the domain appears to be using a private registration service to mask the owner's contact information.
typeboolean
registrant
$refUser
descriptionParsed contact information for the registrant of the domain.
registrar
descriptionRegistrar name . FOr example, "Wild West Domains, Inc. (R120-LROR)", "GoDaddy.com, LLC", or "PDR LTD. D/B/A PUBLICDOMAINREGISTRY.COM".
typestring
registryDataRawText
descriptionRegistry Data raw text.
formatbyte
typestring
status
descriptionDomain status. See https://www.icann.org/resources/pages/epp-status-codes-2014-06-16-en for meanings of possible values
typestring
tags
descriptionList of representative attributes.
items
typestring
typearray
tech
$refUser
descriptionParsed contact information for the technical contact for the domain
updateTime
descriptionLast updated time.
formatgoogle-datetime
typestring
whoisRecordRawText
descriptionWHOIS raw text.
formatbyte
typestring
whoisServer
descriptionWhois server name.
typestring
whoisTime
descriptionDate of the last update of the WHOIS record.
formatgoogle-datetime
typestring
zone
$refUser
descriptionParsed contact information for the zone.
typeobject
DoubleSequence
descriptionDoubleSequence represents a sequence of doubles.
idDoubleSequence
properties
doubleVals
descriptiondouble sequence.
items
formatdouble
typenumber
typearray
typeobject
EC
descriptionEC public key information.
idEC
properties
oid
descriptionCurve name.
typestring
pub
descriptionPublic key hexdump.
typestring
typeobject
Element
descriptionNEXT TAG: 5
idElement
properties
association
$refSecurityResult
descriptionMetadata that provides the relevant association for the references in the element. For a detection, this can be the correlated aspect of the references that contributed to the overall detection. For example, may include sub-rule condition, machine learning model metadata, and/or indicators implicated in this component of the detection (using the .about field).
label
descriptionA name that labels the entire references group.
typestring
references
descriptionReferences to model primatives including events and entities that share a common association. Even though a reference can have both UDM and entity, a collection of references (of a single element) will only have one type of message in it (either UDM / Entity).
items
$refReference
typearray
referencesSampled
descriptionCopied from the detection event_sample.too_many_event_samples field. If true, the number of references will be capped at the sample limit (set at rule service). This is applicable to both UDM references and Entity references.
typeboolean
typeobject
Email
descriptionEmail info.
idEmail
properties
bcc
descriptionA list of 'bcc' addresses.
items
typestring
typearray
bounceAddress
descriptionThe envelope from address. https://en.wikipedia.org/wiki/Bounce_address
typestring
cc
descriptionA list of 'cc' addresses.
items
typestring
typearray
from
descriptionThe 'from' address.
typestring
mailId
descriptionThe mail (or message) ID.
typestring
replyTo
descriptionThe 'reply to' address.
typestring
subject
descriptionThe subject line(s) of the email.
items
typestring
typearray
to
descriptionA list of 'to' addresses.
items
typestring
typearray
typeobject
Empty
descriptionA generic empty message that you can re-use to avoid defining duplicated empty messages in your APIs. A typical example is to use it as the request or the response type of an API method. For instance: service Foo { rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty); }
idEmpty
properties
typeobject
EntityChangedCountTimelineBucket
idEntityChangedCountTimelineBucket
properties
entityChangedInfo
items
$refEntityChangedInfo
typearray
totalChangedEntitiesCount
formatint32
typeinteger
typeobject
EntityChangedInfo
idEntityChangedInfo
properties
artifacts
$refFieldAndValue
entityCount
formatint32
typeinteger
typeobject
EntityCount
descriptionCount of different types of entities in the watchlist.
idEntityCount
properties
asset
descriptionOutput only. Count of asset type entities in the watchlist.
formatint32
readOnlyTrue
typeinteger
user
descriptionOutput only. Count of user type entities in the watchlist.
formatint32
readOnlyTrue
typeinteger
typeobject
EntityMetadata
descriptionInformation about the Entity and the product where the entity was created. Next Tag: 17
idEntityMetadata
properties
collectedTimestamp
descriptionGMT timestamp when the entity information was collected by the vendor's local collection infrastructure.
formatgoogle-datetime
typestring
creationTimestamp
descriptionGMT timestamp when the entity described by the product_entity_id was created on the system where data was collected.
formatgoogle-datetime
typestring
description
descriptionHuman-readable description of the entity.
typestring
entityType
descriptionEntity type. If an entity has multiple possible types, this specifies the most specific type.
enum
  • UNKNOWN_ENTITYTYPE
  • ASSET
  • USER
  • GROUP
  • RESOURCE
  • IP_ADDRESS
  • FILE
  • DOMAIN_NAME
  • URL
  • MUTEX
  • METRIC
enumDescriptions
  • @hide_from_doc
  • An asset, such as workstation, laptop, phone, virtual machine, etc.
  • User.
  • Group.
  • Resource.
  • An external IP address.
  • A file.
  • A domain.
  • A url.
  • A mutex.
  • A metric.
typestring
eventMetadata
$refMetadata
descriptionMetadata field from the event.
extracted
additionalProperties
descriptionProperties of the object.
typeany
descriptionFlattened fields extracted from the log.
typeobject
feed
descriptionVendor feed name for a threat indicator feed.
typestring
interval
$refInterval
descriptionValid existence time range for the version of the entity represented by this entity data.
productEntityId
descriptionA vendor-specific identifier that uniquely identifies the entity (e.g. a GUID, LDAP, OID, or similar).
typestring
productName
descriptionProduct name that produced the entity information.
typestring
productVersion
descriptionVersion of the product that produced the entity information.
typestring
sourceLabels
descriptionEntity source metadata labels.
items
$refLabel
typearray
sourceType
descriptionThe source of the entity.
enum
  • SOURCE_TYPE_UNSPECIFIED
  • ENTITY_CONTEXT
  • DERIVED_CONTEXT
  • GLOBAL_CONTEXT
enumDescriptions
  • Default source type
  • Entities ingested from customers (e.g. AD_CONTEXT, DLP_CONTEXT)
  • Entities derived from customer data such as prevalence, artifact first/last seen, or asset/user first seen stats.
  • Global contextual entities such as WHOIS or Safe Browsing.
typestring
structuredFields
additionalProperties
descriptionProperties of the object.
typeany
deprecatedTrue
descriptionStructured fields extracted from the log.
typeobject
threat
descriptionMetadata provided by a threat intelligence feed that identified the entity as malicious.
items
$refSecurityResult
typearray
vendorName
descriptionVendor name of the product that produced the entity information.
typestring
typeobject
EntityPopulationMechanism
descriptionMechanism to populate entities in the watchlist.
idEntityPopulationMechanism
properties
manual
$refManual
descriptionOptional. Entities are added manually.
typeobject
EntityRisk
descriptionStores information related to the risk score of an entity. Next ID: 15
idEntityRisk
properties
DEPRECATEDRiskScore
deprecatedTrue
descriptionDeprecated risk score.
formatint32
typeinteger
detailUri
descriptionLink to the Google Security Operations UI with information about the entity risk score. If the SecOps instance has multiple frontend paths configured, this will be a relative path that can be used to construct the full URL.
typestring
detectionsCount
descriptionNumber of detections that make up the risk score within the time window.
formatint32
typeinteger
firstDetectionTime
descriptionTimestamp of the first detection within the specified time window. This field is empty when there are no detections.
formatgoogle-datetime
typestring
lastDetectionTime
descriptionTimestamp of the last detection within the specified time window. This field is empty when there are no detections.
formatgoogle-datetime
typestring
lastResetTime
descriptionTimestamp for UEBA risk score reset based deduplication. Used specifically for risk based meta rules.
formatgoogle-datetime
typestring
normalizedRiskScore
descriptionNormalized risk score for the entity. This value is between 0-1000.
formatint32
typeinteger
rawRiskDelta
$refRiskDelta
descriptionRepresents the change in raw risk score for an entity between the end of the previous time window and the end of the current time window.
riskDelta
$refRiskDelta
descriptionRepresents the change in risk score for an entity between the end of the previous time window and the end of the current time window.
riskScore
descriptionRaw risk score for the entity.
formatfloat
typenumber
riskVersion
descriptionVersion of the risk score calculation algorithm.
typestring
riskWindow
$refInterval
descriptionTime window used when computing the risk score for an entity, for example 24 hours or 7 days.
riskWindowHasNewDetections
descriptionWhether there are new detections for the risk window.
typeboolean
riskWindowSize
descriptionRisk window duration for the entity.
formatgoogle-duration
typestring
typeobject
ErrorMessage
idErrorMessage
properties
errorText
typestring
type
enum
  • UNDEFINED_ERROR_TYPE
  • INVALID_QUERY_TYPE
  • INVALID_FIELD_PATH_TYPE
  • UNCLOSED_BRACKET_TYPE
  • BACKEND_ERROR_TYPE
  • UNCLOSED_QUOTES_TYPE
  • QUERY_TOO_LARGE_TYPE
enumDescriptions
typestring
typeobject
EventCountTimeline
idEventCountTimeline
properties
buckets
items
$refEventCountTimelineBucket
typearray
sizeOfBucketMs
formatint64
typestring
typeobject
EventCountTimelineBucket
idEventCountTimelineBucket
properties
alertCount
formatint32
typeinteger
baselineAlertCount
formatint32
typeinteger
baselineEventCount
formatint32
typeinteger
baselineTimedEntityCount
formatint32
typeinteger
entityChangedCount
$refEntityChangedCountTimelineBucket
eventCount
formatint32
typeinteger
filteredTimedEntityCount
formatint32
typeinteger
typeobject
Execution
descriptionExecution can be used to store metadata required for what action the UI should execute.
idExecution
properties
metadata
additionalProperties
typestring
descriptionOutput only. The payload to use when executing the action.
readOnlyTrue
typeobject
typeobject
ExifInfo
descriptionExif information.
idExifInfo
properties
company
descriptioncompany name.
typestring
compilationTime
descriptionCompilation time.
formatgoogle-datetime
typestring
entryPoint
descriptionentry point.
formatint64
typestring
fileDescription
descriptiondescription of a file.
typestring
originalFile
descriptionoriginal file name.
typestring
product
descriptionproduct name.
typestring
typeobject
Extension
descriptionCertificate's extensions.
idExtension
properties
authorityKeyId
$refAuthorityKeyId
descriptionIdentifies the public key to be used to verify the signature on this certificate or CRL.
ca
descriptionWhether the subject acts as a certificate authority (CA) or not.
typeboolean
caInfoAccess
descriptionAuthority information access locations are URLs that are added to a certificate in its authority information access extension.
typestring
certTemplateNameDc
descriptionBMP data value "DomainController". See MS Q291010.
typestring
certificatePolicies
descriptionDifferent certificate policies will relate to different applications which may use the certified key.
typestring
crlDistributionPoints
descriptionCRL distribution points to which a certificate user should refer to ascertain if the certificate has been revoked.
typestring
extendedKeyUsage
descriptionOne or more purposes for which the certified public key may be used, in addition to or in place of the basic purposes indicated in the key usage extension field.
typestring
keyUsage
descriptionThe purpose for which the certified public key is used.
typestring
netscapeCertComment
descriptionUsed to include free-form text comments inside certificates.
typestring
netscapeCertificate
descriptionIdentify whether the certificate subject is an SSL client, an SSL server, or a CA.
typeboolean
oldAuthorityKeyId
descriptionWhether the certificate has an old authority key identifier extension.
typeboolean
peLogotype
descriptionWhether the certificate includes a logotype.
typeboolean
subjectAlternativeName
descriptionContains one or more alternative names, using any of a variety of name forms, for the entity that is bound by the CA to the certified public key.
typestring
subjectKeyId
descriptionIdentifies the public key being certified.
typestring
typeobject
Extensions
descriptionExtensions to a UDM event.
idExtensions
properties
auth
$refAuthentication
descriptionAn authentication extension.
entityRisk
$refEntityRisk
descriptionAn entity risk change extension.
vulns
$refVulnerabilities
descriptionA vulnerability extension.
typeobject
Favicon
descriptionDifference hash and MD5 hash of the domain's favicon.
idFavicon
properties
dhash
descriptionDifference hash.
typestring
rawMd5
descriptionFavicon's MD5 hash.
typestring
typeobject
Feedback
idFeedback
properties
comment
descriptionOptional.
typestring
confidenceScore
formatint32
typeinteger
createdTime
formatgoogle-datetime
typestring
disregarded
typeboolean
idpUserId
typestring
priority
descriptionOptional.
enum
  • PRIORITY_UNSPECIFIED
  • PRIORITY_INFO
  • PRIORITY_LOW
  • PRIORITY_MEDIUM
  • PRIORITY_HIGH
  • PRIORITY_CRITICAL
enumDescriptions
  • Default priority level.
  • Informational priority.
  • Low priority.
  • Medium priority.
  • High priority.
  • Critical priority.
typestring
priorityDisplay
descriptionOptional.
typestring
reason
descriptionOptional.
enum
  • REASON_UNSPECIFIED
  • REASON_NOT_MALICIOUS
  • REASON_MALICIOUS
  • REASON_MAINTENANCE
enumDescriptions
  • Default reason.
  • Case or Alert not malicious.
  • Case or Alert is malicious.
  • Case or Alert is under maintenance.
typestring
reputation
enum
  • REPUTATION_UNSPECIFIED
  • USEFUL
  • NOT_USEFUL
enumDescriptions
  • An unspecified reputation.
  • A categorization of the finding as useful.
  • A categorization of the finding as not useful.
typestring
riskScore
formatint32
typeinteger
rootCause
descriptionOptional.
typestring
severity
formatint32
typeinteger
severityDisplay
descriptionOptional.
typestring
status
descriptionOptional.
enum
  • STATUS_UNSPECIFIED
  • NEW
  • REVIEWED
  • CLOSED
  • OPEN
enumDescriptions
  • Unspecified finding status.
  • New finding.
  • When a finding has feedback.
  • When an analyst closes an finding.
  • Open. Used to indicate that a Case / Alert is open.
typestring
verdict
enum
  • VERDICT_UNSPECIFIED
  • TRUE_POSITIVE
  • FALSE_POSITIVE
enumDescriptions
  • An unspecified verdict.
  • A categorization of the finding as a "true positive".
  • A categorization of the finding as a "false positive".
typestring
typeobject
FieldAndValue
idFieldAndValue
properties
entityNamespace
typestring
fieldPath
typestring
kvalueType
enum
  • UNKNOWN
  • COLLECTOR_ID
  • EVENT_SHARD
  • ASSET_IP_ADDRESS
  • MAC
  • HOSTNAME
  • PRODUCT_SPECIFIC_ID
  • NAMESPACE
  • DOMAIN_NAME
  • RESOLVED_IP_ADDRESS
  • STEMMED_DOMAIN_NAME
  • PROCESS_ID
  • FULL_COMMAND_LINE
  • FILE_NAME
  • FILE_PATH
  • HASH_MD5
  • HASH_SHA256
  • HASH_SHA1
  • RAW_PID
  • PARENT_PROCESS_ID
  • EMAIL
  • USERNAME
  • WINDOWS_SID
  • EMPLOYEE_ID
  • PRODUCT_OBJECT_ID
  • USER_DISPLAY_NAME
  • CLOUD_RESOURCE_NAME
  • REGISTRY_KEY
  • REGISTRY_VALUE_DATA
  • REGISTRY_VALUE_NAME
enumDescriptions
typestring
value
typestring
typeobject
FileMetadata
descriptionMetadata about a file. Place metadata about different file types here, for example data from the Microsoft Windows VersionInfo block or digital signer details. Use a different sub-message per file type.
idFileMetadata
properties
pe
$refPeFileMetadata
deprecatedTrue
descriptionMetadata for Microsoft Windows PE files. Deprecate PeFileMetadata in favor of single File proto.
typeobject
FileMetadataCodesign
descriptionFile metadata from the codesign utility.
idFileMetadataCodesign
properties
compilationTime
descriptionCode sign timestamp
formatgoogle-datetime
typestring
format
descriptionCode sign format.
typestring
id
descriptionCode sign identifier.
typestring
teamId
descriptionThe assigned team identifier of the developer who signed the application.
typestring
typeobject
FileMetadataImports
descriptionFile metadata imports.
idFileMetadataImports
properties
functions
descriptionFunction field.
items
typestring
typearray
library
descriptionLibrary field.
typestring
typeobject
FileMetadataPE
descriptionMetadata about the Portable Executable (PE) file.
idFileMetadataPE
properties
compilationExiftoolTime
descriptioninfo.exiftool.TimeStamp.
formatgoogle-datetime
typestring
compilationTime
descriptioninfo.pe-timestamp.
formatgoogle-datetime
typestring
entryPoint
descriptioninfo.pe-entry-point.
formatint64
typestring
entryPointExiftool
descriptioninfo.exiftool.EntryPoint.
formatint64
typestring
imphash
descriptionImphash of the file.
typestring
imports
descriptionFilemetadataImports fields.
items
$refFileMetadataImports
typearray
resource
descriptionFilemetadataPeResourceInfo fields.
items
$refFileMetadataPeResourceInfo
typearray
resourcesLanguageCount
deprecatedTrue
descriptionDeprecated: use resources_language_count_str.
items
$refStringToInt64MapEntry
typearray
resourcesLanguageCountStr
descriptionNumber of resources by language. Example: NEUTRAL: 20, ENGLISH US: 10
items
$refLabel
typearray
resourcesTypeCount
deprecatedTrue
descriptionDeprecated: use resources_type_count_str.
items
$refStringToInt64MapEntry
typearray
resourcesTypeCountStr
descriptionNumber of resources by resource type. Example: RT_ICON: 10, RT_DIALOG: 5
items
$refLabel
typearray
section
descriptionFilemetadataSection fields.
items
$refFileMetadataSection
typearray
signatureInfo
$refFileMetadataSignatureInfo
deprecatedTrue
descriptionFilemetadataSignatureInfo field. deprecated, user File.signature_info instead.
typeobject
FileMetadataPeResourceInfo
descriptionFile metadata for PE resource.
idFileMetadataPeResourceInfo
properties
entropy
descriptionEntropy of the resource.
formatdouble
typenumber
fileType
descriptionFile type. Note that this value may not match any of the well-known type identifiers defined in the ResourceType enum.
typestring
filetypeMagic
descriptionType of resource content, as identified by the magic Python module.
typestring
languageCode
descriptionHuman-readable version of the language and sublanguage identifiers, as defined in the Microsoft Windows PE specification. Examples: | Language | Sublanguage | Field value | | LANG_NEUTRAL | SUBLANG_NEUTRAL | NEUTRAL | | LANG_FRENCH | - | FRENCH | | LANG_ENGLISH | SUBLANG_ENGLISH US | ENGLISH US |
typestring
sha256Hex
descriptionSHA256_hex field..
typestring
typeobject
FileMetadataSection
descriptionFile metadata section.
idFileMetadataSection
properties
entropy
descriptionEntropy of the section.
formatdouble
typenumber
md5Hex
descriptionMD5 hex of the file.
typestring
name
descriptionName of the section.
typestring
rawSizeBytes
descriptionRaw file size in bytes.
formatint64
typestring
virtualSizeBytes
descriptionVirtual file size in bytes.
formatint64
typestring
typeobject
FileMetadataSignatureInfo
descriptionSignature information.
idFileMetadataSignatureInfo
properties
signer
deprecatedTrue
descriptionDeprecated: use signers field.
items
typestring
typearray
signers
descriptionFile metadata signer information. The order of the signers matters. Each element is a higher level authority, being the last the root authority.
items
$refSignerInfo
typearray
verificationMessage
descriptionStatus of the certificate. Valid values are "Signed", "Unsigned" or a description of the certificate anomaly, if found.
typestring
verified
descriptionTrue if verification_message == "Signed"
typeboolean
x509
descriptionList of certificates.
items
$refX509
typearray
typeobject
FilterProperties
idFilterProperties
properties
hidden
typeboolean
stringProperties
additionalProperties
$refStringValues
typeobject
typeobject
FindingVariable
descriptionA structure that holds the value and associated metadata for values extracted while producing a Finding.
idFindingVariable
properties
boolSeq
$refBoolSequence
descriptionThe value in boolsequence format.
boolVal
descriptionThe value in boolean format.
typeboolean
bytesSeq
$refBytesSequence
descriptionThe value in bytessequence format.
bytesVal
descriptionThe value in bytes format.
formatbyte
typestring
doubleSeq
$refDoubleSequence
descriptionThe value in doublesequence format.
doubleVal
descriptionThe value in double format.
formatdouble
typenumber
int64Seq
$refInt64Sequence
descriptionThe value in int64sequence format.
int64Val
descriptionThe value in int64 format.
formatint64
typestring
nullVal
descriptionWhether the value is null.
typeboolean
sourcePath
descriptionThe UDM field path for the field which this value was derived from. Example: `principal.user.username`
typestring
stringSeq
$refStringSequence
descriptionThe value in stringsequence format.
stringVal
descriptionThe value in string format. Enum values are returned as strings.
typestring
type
descriptionThe type of the variable.
enum
  • TYPE_UNSPECIFIED
  • MATCH
  • OUTCOME
enumDescriptions
  • An unspecified variable type.
  • A variable coming from the match conditions.
  • A variable representing significant data that was found in the detection logic.
typestring
uint64Seq
$refUint64Sequence
descriptionThe value in uint64sequence format.
uint64Val
descriptionThe value in uint64 format.
formatuint64
typestring
value
descriptionThe value in string form.
typestring
typeobject
FollowUp
descriptionFollowUp can be used to store metadata required to send a follow up message by the UI.
idFollowUp
properties
followUp
descriptionOutput only. The text to use as input when generating the follow up message.
readOnlyTrue
typestring
typeobject
Ftp
descriptionFTP info.
idFtp
properties
command
descriptionThe FTP command.
typestring
typeobject
FunctionResponse
idFunctionResponse
properties
rows
items
$refFunctionResponseRow
typearray
tooManyRows
typeboolean
typeobject
FunctionResponseRow
idFunctionResponseRow
properties
values
items
$refUdmFieldValue
typearray
typeobject
GoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStats
descriptionLINT.IfChange(stats_data) Stats results when the query is for statistics NEXT TAG = 6;
idGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStats
properties
dataQueryExpression
descriptionExpression that represent the subset of the requested query used to filter data. The expression will be used to enable features such as drill-down from stats results to UDM events. In that case, the new query will be composed by this expression and the expression related to a stats result.
typestring
results
descriptionResult rows that are queried.
items
$refGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnData
typearray
sortOrder
descriptionIndicates the columns used for sorting and the order in which they are sorted. If no ORDER section is specified in the query, this will be empty.
items
$refGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnSort
typearray
tooManyResults
descriptionIf true, there are too many results to return and some have been omitted.
typeboolean
totalResults
descriptionThe total number of results returned.
formatint32
typeinteger
typeobject
GoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnData
descriptionRepresents a single column in the set of columns returned as the stats query result.
idGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnData
properties
column
descriptionUsed to store column names.
typestring
filterExpression
descriptionExpression used to compose a query for filtering/drill-downs related to the data in this column.
typestring
filterable
descriptionTo identify if the column can be used for filtering/drill-downs.
typeboolean
values
descriptionTo store store column data.
items
$refGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnType
typearray
typeobject
GoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnSort
descriptionContains the column name and which direction the column is sorted (ascending or descenging).
idGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnSort
properties
descending
descriptionWhether the column is sorted in descending order (ascending by default);
typeboolean
name
descriptionName of the column.
typestring
typeobject
GoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnType
descriptionSingular vs list of values in a column.
idGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnType
properties
list
$refGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnTypeList
descriptionList of values in a column e.g. IPs
value
$refGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnValue
descriptionSingle value in a column.
typeobject
GoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnTypeList
descriptionStore list of values in a column.
idGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnTypeList
properties
values
descriptionList of values in one cell of the column.
items
$refGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnValue
typearray
typeobject
GoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnValue
descriptionValue of the column based on data type
idGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnValue
properties
boolVal
descriptionBoolean value.
typeboolean
bytesVal
descriptionBytes value.
formatbyte
typestring
dateVal
$refDate
descriptionDate values.
doubleVal
descriptionDouble value.
formatdouble
typenumber
int64Val
descriptionInteger value (signed).
formatint64
typestring
nullVal
descriptionTrue if the value is NULL.
typeboolean
protoVal
additionalProperties
descriptionProperties of the object. Contains field @type with type URL.
typeany
descriptionFor any proto values that are not any of the above.
typeobject
stringVal
descriptionString value. Enum values are returned as strings.
typestring
timestampVal
descriptionTimestamp values.
formatgoogle-datetime
typestring
uint64Val
descriptionUn-signed integer value.
formatuint64
typestring
typeobject
Group
descriptionInformation about an organizational group.
idGroup
properties
attribute
$refAttribute
descriptionGeneric entity metadata attributes of the group.
creationTime
deprecatedTrue
descriptionGroup creation time. Deprecated: creation_time should be populated in Attribute as generic metadata.
formatgoogle-datetime
typestring
emailAddresses
descriptionEmail addresses of the group.
items
typestring
typearray
groupDisplayName
descriptionGroup display name. e.g. "Finance".
typestring
productObjectId
descriptionProduct globally unique user object identifier, such as an LDAP Object Identifier.
typestring
windowsSid
descriptionMicrosoft Windows SID of the group.
typestring
typeobject
GroupAggregationByField
idGroupAggregationByField
properties
baselineEventCount
formatint32
typeinteger
eventCount
formatint32
typeinteger
fieldName
typestring
fieldValue
$refUdmFieldValue
fields
items
$refUdmFieldAggregation
typearray
valueCount
formatint32
typeinteger
typeobject
Hardware
descriptionHardware specification details for a resource, including both physical and virtual hardware.
idHardware
properties
cpuClockSpeed
descriptionClock speed of the hardware CPU in MHz.
formatuint64
typestring
cpuMaxClockSpeed
descriptionMaximum possible clock speed of the hardware CPU in MHz.
formatuint64
typestring
cpuModel
descriptionModel description of the hardware CPU (e.g. "2.8 GHz Quad-Core Intel Core i5").
typestring
cpuNumberCores
descriptionNumber of CPU cores.
formatuint64
typestring
cpuPlatform
descriptionPlatform of the hardware CPU (e.g. "Intel Broadwell").
typestring
manufacturer
descriptionHardware manufacturer.
typestring
model
descriptionHardware model.
typestring
ram
descriptionAmount of the hardware ramdom access memory (RAM) in Mb.
formatuint64
typestring
serialNumber
descriptionHardware serial number.
typestring
typeobject
Http
descriptionSpecify the full URL of the HTTP request within "target". Also specify any uploaded or downloaded file information within "source" or "target".
idHttp
properties
method
descriptionThe HTTP request method (e.g. "GET", "POST", "PATCH", "DELETE").
typestring
parsedUserAgent
$refUserAgentProto
descriptionThe parsed user_agent string.
referralUrl
descriptionThe URL for the HTTP referer.
typestring
responseCode
descriptionThe response status code, for example 200, 302, 404, or 500.
formatint32
typeinteger
userAgent
descriptionThe User-Agent request header which includes the application type, operating system, software vendor or software version of the requesting software user agent.
typestring
typeobject
Id
descriptionIdentifier to identify a UDM object like a UDM event, Entity, Collection. The full identifier for persistence is created by setting the 32 most significant bits as the Id.Namespace enum and the rest according to go/udm:ids. This is a convenience wrapper to define the id space enum values and provide an easy interface for RPCs, most persistence use cases should use a denormalized form. See go/udm:ids for background and details.
idId
properties
id
descriptionFull raw ID.
formatbyte
typestring
namespace
descriptionNamespace the id belongs to.
enum
  • NORMALIZED_TELEMETRY
  • RAW_TELEMETRY
  • RULE_DETECTIONS
  • UPPERCASE
  • MACHINE_INTELLIGENCE
  • SECURITY_COMMAND_CENTER
  • UNSPECIFIED
  • SOAR_ALERT
  • VIRUS_TOTAL
enumDescriptions
  • Ingested and Normalized telemetry events
  • Ingested Raw telemetry
  • Chronicle Rules engine
  • Uppercase
  • DSML - Machine Intelligence
  • A normalized telemetry event from Google Security Command Center.
  • Unspecified Namespace
  • An alert coming from other SIEMs via Chronicle SOAR.
  • VirusTotal.
typestring
stringId
descriptionSome ids are stored as strings that are not able to be translated to bytes, so store these separately. Ex. detection id of the form de_aaaaaaaa-aaaa...
typestring
typeobject
IngestionLabel
descriptionRepresentation of an ingestion label type.
idIngestionLabel
properties
ingestionLabelKey
descriptionRequired. The key of the ingestion label. Always required.
typestring
ingestionLabelValue
descriptionOptional. The value of the ingestion label. Optional. An object with no provided value and some key provided would match against the given key and ANY value.
typestring
typeobject
InputsUsed
descriptionInputsUsed is a convenience field that tells us which sources of events (if any) were used in the rule. NEXT TAG: 4
idInputsUsed
properties
usesDetection
descriptionOptional. Whether the rule queries detections.
typeboolean
usesEntity
descriptionOptional. Whether the rule queries entity events.
typeboolean
usesUdm
descriptionOptional. Whether the rule queries UDM events.
typeboolean
typeobject
Instance
descriptionA Instance represents an instantiation of the Instance product.
idInstance
properties
name
descriptionOutput only. The resource name of this instance. Format: projects/{project}/locations/{location}/instances/{instance}
readOnlyTrue
typestring
typeobject
InstanceUdmSearchResponse
idInstanceUdmSearchResponse
properties
baselineEventsCount
formatint32
typeinteger
complete
typeboolean
detections
$refDetections
filteredEventsCount
formatint32
typeinteger
instanceId
typestring
prevalence
$refUdmPrevalenceResponse
progress
formatdouble
typenumber
runtimeErrors
$refRuntimeError
timeline
$refEventCountTimeline
tooManyEvents
typeboolean
typeobject
Int64Sequence
descriptionInt64Sequence represents a sequence of int64s.
idInt64Sequence
properties
int64Vals
descriptionint64 sequence.
items
formatint64
typestring
typearray
typeobject
Interval
descriptionRepresents a time interval, encoded as a Timestamp start (inclusive) and a Timestamp end (exclusive). The start must be less than or equal to the end. When the start equals the end, the interval is empty (matches no time). When both start and end are unspecified, the interval matches any time.
idInterval
properties
endTime
descriptionOptional. Exclusive end of the interval. If specified, a Timestamp matching this interval will have to be before the end.
formatgoogle-datetime
typestring
startTime
descriptionOptional. Inclusive start of the interval. If specified, a Timestamp matching this interval will have to be the same or after the start.
formatgoogle-datetime
typestring
typeobject
Investigation
descriptionRepresents the aggregated state of an investigation such as categorization, severity, and status. Can be expanded to include analyst assignment details and more.
idInvestigation
properties
comments
descriptionComment added by the Analyst.
items
typestring
typearray
priority
descriptionPriority of the Alert or Finding set by analyst.
enum
  • PRIORITY_UNSPECIFIED
  • PRIORITY_INFO
  • PRIORITY_LOW
  • PRIORITY_MEDIUM
  • PRIORITY_HIGH
  • PRIORITY_CRITICAL
enumDescriptions
  • Default priority level.
  • Informational priority.
  • Low priority.
  • Medium priority.
  • High priority.
  • Critical priority.
typestring
reason
descriptionReason for closing the Case or Alert.
enum
  • REASON_UNSPECIFIED
  • REASON_NOT_MALICIOUS
  • REASON_MALICIOUS
  • REASON_MAINTENANCE
enumDescriptions
  • Default reason.
  • Case or Alert not malicious.
  • Case or Alert is malicious.
  • Case or Alert is under maintenance.
typestring
reputation
descriptionDescribes whether a finding was useful or not-useful.
enum
  • REPUTATION_UNSPECIFIED
  • USEFUL
  • NOT_USEFUL
enumDescriptions
  • An unspecified reputation.
  • A categorization of the finding as useful.
  • A categorization of the finding as not useful.
typestring
riskScore
descriptionRisk score for a finding set by an analyst.
formatuint32
typeinteger
rootCause
descriptionRoot cause of the Alert or Finding set by analyst.
typestring
severityScore
descriptionSeverity score for a finding set by an analyst.
formatuint32
typeinteger
status
descriptionDescribes the workflow status of a finding.
enum
  • STATUS_UNSPECIFIED
  • NEW
  • REVIEWED
  • CLOSED
  • OPEN
enumDescriptions
  • Unspecified finding status.
  • New finding.
  • When a finding has feedback.
  • When an analyst closes an finding.
  • Open. Used to indicate that a Case / Alert is open.
typestring
verdict
descriptionDescribes reason a finding investigation was resolved.
enum
  • VERDICT_UNSPECIFIED
  • TRUE_POSITIVE
  • FALSE_POSITIVE
enumDescriptions
  • An unspecified verdict.
  • A categorization of the finding as a "true positive".
  • A categorization of the finding as a "false positive".
typestring
typeobject
IoCStats
descriptionInformation about the threat intelligence source. These fields are used to model Mandiant sources.
idIoCStats
properties
benignCount
descriptionCount of responses where the IoC was identified as benign.
formatint32
typeinteger
firstLevelSource
descriptionName of first level IoC source, for example Mandiant or a third-party.
typestring
iocStatsType
descriptionDescribes the source of the IoCStat.
enum
  • UNSPECIFIED_IOC_STATS_TYPE
  • MANDIANT_SOURCES
  • THIRD_PARTY_SOURCES
  • THREAT_INTELLIGENCE_IOC_STATS
enumDescriptions
  • IoCStat source is unidentified.
  • IoCStat is from a Mandiant Source.
  • IoCStat is from a third-party source.
  • IoCStat is from a threat intelligence feed.
typestring
maliciousCount
descriptionCount of responses where the IoC was identified as malicious.
formatint32
typeinteger
quality
descriptionLevel of confidence in the IoC mapping extracted from the source.
enum
  • UNKNOWN_CONFIDENCE
  • LOW_CONFIDENCE
  • MEDIUM_CONFIDENCE
  • HIGH_CONFIDENCE
enumDescriptions
  • The default confidence level.
  • Low confidence.
  • Medium confidence.
  • High confidence.
typestring
responseCount
descriptionTotal number of response from the source.
formatint32
typeinteger
secondLevelSource
descriptionName of the second-level IoC source, for example Crowdsourced Threat Analysis or Knowledge Graph.
typestring
sourceCount
descriptionNumber of sources from which information was extracted.
formatint32
typeinteger
typeobject
Label
descriptionKey value labels.
idLabel
properties
key
descriptionThe key.
typestring
rbacEnabled
descriptionIndicates whether this label can be used for Data RBAC
typeboolean
source
descriptionWhere the label is derived from.
typestring
value
descriptionThe value.
typestring
typeobject
LatLng
descriptionAn object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges.
idLatLng
properties
latitude
descriptionThe latitude in degrees. It must be in the range [-90.0, +90.0].
formatdouble
typenumber
longitude
descriptionThe longitude in degrees. It must be in the range [-180.0, +180.0].
formatdouble
typenumber
typeobject
LegacyFederatedUdmSearchViewResponse
descriptionResponse to a Federated UDM Search query. This will be used by StreamSearchOperation RPC to return the results of a federated search operation.
idLegacyFederatedUdmSearchViewResponse
properties
activityTimeline
$refEventCountTimeline
descriptionTimeline of event counts broken into hourly/daily buckets to identify activity.
aiOverview
$refAIOverview
descriptionLINT.ThenChange( //depot/google3/google/cloud/chronicle/v1main/dashboard_query.proto:data_sources, //depot/google3/googlex/security/malachite/proto/udm_search.proto:data_sources ) AI generated overview for the search results. Only populated if the AI features are enabled for the customer and generate_ai_overview is set to true in the request.
baselineEventsCount
descriptionThe number of events in the baseline query.
formatint32
typeinteger
complete
descriptionStreaming for this response is done. There will be no additional updates.
typeboolean
dataSources
descriptionDatasource of the query and results in case of a statistics query
items
enum
  • SEARCH_DATA_SOURCE_UNSPECIFIED
  • SEARCH_UDM
  • SEARCH_ENTITY
  • SEARCH_RULE_DETECTIONS
  • SEARCH_RULESETS
enumDescriptions
  • Unspecified data source.
  • Events
  • Entities
  • To be used for detections data source.
  • To be used for ruleset with detections datasource.
typestring
typearray
detectionFieldAggregations
$refAlertFieldAggregations
descriptionList of detection fields with aggregated values. This enabled filtering in the Alerts panel for federated search.
events
$refUdmEventList
descriptionList of UDM events. NOTE: After complete is set to true, the `UdmEventList` message will be omitted from the response. The latest message should be used as reference. If the `UdmEventList` message is returned again, then it should replace the previous value.
fieldAggregations
$refUdmFieldAggregations
descriptionList of UDM fields with aggregated values.
filteredEventsCount
descriptionThe number of events in the snapshot that match the snapshot_query. This is <= `baseline_events_count`. If the snapshot query is empty this will be equivalent to `baseline_events_count`.
formatint32
typeinteger
groupedFieldAggregations
$refUdmFieldAggregations
descriptionList of grouped fields with aggregated values.
instanceAggregations
$refUdmFieldAggregations
descriptionInstance aggregations for the search results. Provides information on the number of events per instance for the aggregations panel in the UI. This allows users to easily drill-down into the individual instances.
instanceUdmSearchResponses
descriptionAll the instance specific UDM search responses.
items
$refInstanceUdmSearchResponse
typearray
operation
descriptionThe name of the operation resource representing the UDM Search operation. This can be passed to `StreamSearchOperation` to fetch stored results or stream the results of an in-progress operation. The metadata type of the operation is `UdmSearchMetadata`. The response type is `LegacyFetchUdmSearchViewResponse`. Format: projects/{project}/locations/{location}/instances/{instance}/operations/{operation}
typestring
progress
descriptionProgress of the query represented as a double between 0 and 1.
formatdouble
typenumber
queryValidationErrors
descriptionParse error for the baseline_query and/or the snapshot_query.
items
$refErrorMessage
typearray
runtimeErrors
descriptionRuntime errors.
items
$refRuntimeError
typearray
stats
$refGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStats
descriptionStats results when the query is for statistics
statsFunctionParameterValidationErrorMessage
descriptionIf the request's stats_function_parameter` is invalid, this field will contain the detailed error message.
typestring
statsFunctionResponse
$refFunctionResponse
descriptionResult for statistical function.
timeline
$refEventCountTimeline
descriptionTimeline of event counts broken into buckets. This populates the trend-over-time chart in the UI.
tooLargeResponse
descriptionIf true, the response to be returned to the UI is too large and some events have been omitted.
typeboolean
tooManyEvents
descriptionIf true, there are too many events to return and some have been omitted.
typeboolean
validBaselineQuery
descriptionIndicates whether the request baseline_query is a valid structured query or not. If not, `query_validation_errors` will include the parse error.
typeboolean
validSnapshotQuery
descriptionIndicates whether the request baseline and snapshot queries are valid. If not, `query_validation_errors` will include the parse error.
typeboolean
typeobject
ListDataAccessLabelsResponse
descriptionResponse message for ListDataAccessLabels.
idListDataAccessLabelsResponse
properties
dataAccessLabels
descriptionList of data access labels.
items
$refDataAccessLabel
typearray
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
typeobject
ListDataAccessScopesResponse
descriptionResponse message for ListDataAccessScopes.
idListDataAccessScopesResponse
properties
dataAccessScopes
descriptionList of data access scopes.
items
$refDataAccessScope
typearray
globalDataAccessScopeGranted
descriptionWhether or not global scope is granted to the user.
typeboolean
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
typeobject
ListOperationsResponse
descriptionThe response message for Operations.ListOperations.
idListOperationsResponse
properties
nextPageToken
descriptionThe standard List next-page token.
typestring
operations
descriptionA list of operations that matches the specified filter in the request.
items
$refOperation
typearray
typeobject
ListReferenceListsResponse
descriptionA response to a request for a list of reference lists.
idListReferenceListsResponse
properties
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
referenceLists
descriptionThe reference lists. Ordered in ascending alphabetical order by name.
items
$refReferenceList
typearray
typeobject
ListRetrohuntsResponse
descriptionResponse message for ListRetrohunts method.
idListRetrohuntsResponse
properties
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
retrohunts
descriptionThe retrohunts from the specified rule.
items
$refRetrohunt
typearray
typeobject
ListRuleDeploymentsResponse
descriptionResponse message for ListRuleDeployments.
idListRuleDeploymentsResponse
properties
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
ruleDeployments
descriptionThe rule deployments from all rules.
items
$refRuleDeployment
typearray
typeobject
ListRuleRevisionsResponse
descriptionResponse message for ListRuleRevisions method.
idListRuleRevisionsResponse
properties
nextPageToken
descriptionA token that can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
rules
descriptionThe revisions of the rule.
items
$refRule
typearray
typeobject
ListRulesResponse
descriptionResponse message for ListRules method.
idListRulesResponse
properties
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
rules
descriptionThe rules from the specified instance.
items
$refRule
typearray
typeobject
ListWatchlistsResponse
descriptionResponse message for listing watchlists.
idListWatchlistsResponse
properties
nextPageToken
descriptionOptional. A token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
watchlists
descriptionOptional. The watchlists from the specified instance.
items
$refWatchlist
typearray
typeobject
Location
descriptionInformation about a location.
idLocation
properties
city
descriptionThe city.
typestring
countryOrRegion
descriptionThe country or region.
typestring
deskName
descriptionDesk name or individual location, typically for an employee in an office. (e.g. "IN-BLR-BCPC-11-1121D").
typestring
floorName
descriptionFloor name, number or a combination of the two for a building. (e.g. "1-A").
typestring
name
descriptionCustom location name (e.g. building or site name like "London Office"). For cloud environments, this is the region (e.g. "us-west2").
typestring
regionCoordinates
$refLatLng
descriptionCoordinates for the associated region. See https://cloud.google.com/vision/docs/reference/rest/v1/LatLng for a description of the fields.
regionLatitude
deprecatedTrue
descriptionDeprecated: use region_coordinates.
formatfloat
typenumber
regionLongitude
deprecatedTrue
descriptionDeprecated: use region_coordinates.
formatfloat
typenumber
state
descriptionThe state.
typestring
typeobject
Manual
descriptionEntities are added manually.
idManual
properties
typeobject
Measure
descriptionDescribes the precomputed measure.
idMeasure
properties
aggregateFunction
descriptionFunction used to calculate the aggregated measure.
enum
  • AGGREGATE_FUNCTION_UNSPECIFIED
  • MIN
  • MAX
  • COUNT
  • SUM
  • AVG
  • STDDEV
enumDescriptions
  • Default value.
  • Minimum.
  • Maximum.
  • Count.
  • Sum.
  • Average.
  • Standard Deviation.
typestring
value
descriptionValue of the aggregated measure.
formatdouble
typenumber
typeobject
Metadata
descriptionGeneral information associated with a UDM event.
idMetadata
properties
baseLabels
$refDataAccessLabels
descriptionData access labels on the base event.
collectedTimestamp
descriptionThe GMT timestamp when the event was collected by the vendor's local collection infrastructure.
formatgoogle-datetime
typestring
description
descriptionA human-readable unparsable description of the event.
typestring
enrichmentLabels
$refDataAccessLabels
descriptionData access labels from all the contextual events used to enrich the base event.
enrichmentState
descriptionThe enrichment state.
enum
  • ENRICHMENT_STATE_UNSPECIFIED
  • ENRICHED
  • UNENRICHED
enumDescriptions
  • Unspecified.
  • The event has been enriched by Chronicle.
  • The event has not been enriched by Chronicle.
typestring
eventTimestamp
descriptionThe GMT timestamp when the event was generated.
formatgoogle-datetime
typestring
eventType
descriptionThe event type. If an event has multiple possible types, this specifies the most specific type.
enum
  • EVENTTYPE_UNSPECIFIED
  • PROCESS_UNCATEGORIZED
  • PROCESS_LAUNCH
  • PROCESS_INJECTION
  • PROCESS_PRIVILEGE_ESCALATION
  • PROCESS_TERMINATION
  • PROCESS_OPEN
  • PROCESS_MODULE_LOAD
  • REGISTRY_UNCATEGORIZED
  • REGISTRY_CREATION
  • REGISTRY_MODIFICATION
  • REGISTRY_DELETION
  • SETTING_UNCATEGORIZED
  • SETTING_CREATION
  • SETTING_MODIFICATION
  • SETTING_DELETION
  • MUTEX_UNCATEGORIZED
  • MUTEX_CREATION
  • FILE_UNCATEGORIZED
  • FILE_CREATION
  • FILE_DELETION
  • FILE_MODIFICATION
  • FILE_READ
  • FILE_COPY
  • FILE_OPEN
  • FILE_MOVE
  • FILE_SYNC
  • USER_UNCATEGORIZED
  • USER_LOGIN
  • USER_LOGOUT
  • USER_CREATION
  • USER_CHANGE_PASSWORD
  • USER_CHANGE_PERMISSIONS
  • USER_STATS
  • USER_BADGE_IN
  • USER_DELETION
  • USER_RESOURCE_CREATION
  • USER_RESOURCE_UPDATE_CONTENT
  • USER_RESOURCE_UPDATE_PERMISSIONS
  • USER_COMMUNICATION
  • USER_RESOURCE_ACCESS
  • USER_RESOURCE_DELETION
  • GROUP_UNCATEGORIZED
  • GROUP_CREATION
  • GROUP_DELETION
  • GROUP_MODIFICATION
  • EMAIL_UNCATEGORIZED
  • EMAIL_TRANSACTION
  • EMAIL_URL_CLICK
  • NETWORK_UNCATEGORIZED
  • NETWORK_FLOW
  • NETWORK_CONNECTION
  • NETWORK_FTP
  • NETWORK_DHCP
  • NETWORK_DNS
  • NETWORK_HTTP
  • NETWORK_SMTP
  • STATUS_UNCATEGORIZED
  • STATUS_HEARTBEAT
  • STATUS_STARTUP
  • STATUS_SHUTDOWN
  • STATUS_UPDATE
  • SCAN_UNCATEGORIZED
  • SCAN_FILE
  • SCAN_PROCESS_BEHAVIORS
  • SCAN_PROCESS
  • SCAN_HOST
  • SCAN_VULN_HOST
  • SCAN_VULN_NETWORK
  • SCAN_NETWORK
  • SCHEDULED_TASK_UNCATEGORIZED
  • SCHEDULED_TASK_CREATION
  • SCHEDULED_TASK_DELETION
  • SCHEDULED_TASK_ENABLE
  • SCHEDULED_TASK_DISABLE
  • SCHEDULED_TASK_MODIFICATION
  • SYSTEM_AUDIT_LOG_UNCATEGORIZED
  • SYSTEM_AUDIT_LOG_WIPE
  • SERVICE_UNSPECIFIED
  • SERVICE_CREATION
  • SERVICE_DELETION
  • SERVICE_START
  • SERVICE_STOP
  • SERVICE_MODIFICATION
  • GENERIC_EVENT
  • RESOURCE_CREATION
  • RESOURCE_DELETION
  • RESOURCE_PERMISSIONS_CHANGE
  • RESOURCE_READ
  • RESOURCE_WRITTEN
  • DEVICE_FIRMWARE_UPDATE
  • DEVICE_CONFIG_UPDATE
  • DEVICE_PROGRAM_UPLOAD
  • DEVICE_PROGRAM_DOWNLOAD
  • ANALYST_UPDATE_VERDICT
  • ANALYST_UPDATE_REPUTATION
  • ANALYST_UPDATE_SEVERITY_SCORE
  • ANALYST_UPDATE_STATUS
  • ANALYST_ADD_COMMENT
  • ANALYST_UPDATE_PRIORITY
  • ANALYST_UPDATE_ROOT_CAUSE
  • ANALYST_UPDATE_REASON
  • ANALYST_UPDATE_RISK_SCORE
  • ENTITY_RISK_CHANGE
enumDeprecated
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • True
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • True
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • True
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
enumDescriptions
  • Default event type
  • Activity related to a process which does not match any other event types.
  • Process launch.
  • Process injecting into another process.
  • Process privilege escalation.
  • Process termination.
  • Process being opened.
  • Process loading a module.
  • Registry event which does not match any of the other event types.
  • Registry creation.
  • Registry modification.
  • Registry deletion.
  • Settings-related event which does not match any of the other event types.
  • Setting creation.
  • Setting modification.
  • Setting deletion.
  • Any mutex event other than creation.
  • Mutex creation.
  • File event which does not match any of the other event types.
  • File created.
  • File deleted.
  • File modified.
  • File read.
  • File copied. Used for file copies, for example, to a thumb drive.
  • File opened.
  • File moved or renamed.
  • File synced (for example, Google Drive, Dropbox, backup).
  • User activity which does not match any of the other event types.
  • User login.
  • User logout.
  • User creation.
  • User password change event.
  • Change in user permissions.
  • Deprecated. Used to update user info for an LDAP dump.
  • User physically badging into a location.
  • User deletion.
  • User creating a virtual resource. This is equivalent to RESOURCE_CREATION.
  • User updating content of a virtual resource. This is equivalent to RESOURCE_WRITTEN.
  • User updating permissions of a virtual resource. This is equivalent to RESOURCE_PERMISSIONS_CHANGE.
  • User initiating communication through a medium (for example, video).
  • User accessing a virtual resource. This is equivalent to RESOURCE_READ.
  • User deleting a virtual resource. This is equivalent to RESOURCE_DELETION.
  • A group activity that does not fall into one of the other event types.
  • A group creation.
  • A group deletion.
  • A group modification.
  • Email messages
  • An email transaction.
  • Deprecated: use NETWORK_HTTP instead. An email URL click event.
  • A network event that does not fit into one of the other event types.
  • Aggregated flow stats like netflow.
  • Network connection details like from a FW.
  • FTP telemetry.
  • DHCP payload.
  • DNS payload.
  • HTTP telemetry.
  • SMTP telemetry.
  • A status message that does not fit into one of the other event types.
  • Heartbeat indicating product is alive.
  • An agent startup.
  • An agent shutdown.
  • A software or fingerprint update.
  • Scan item that does not fit into one of the other event types.
  • A file scan.
  • Scan process behaviors. Please use SCAN_PROCESS instead.
  • Scan process.
  • Scan results from scanning an entire host device for threats/sensitive documents.
  • Vulnerability scan logs about host vulnerabilities (e.g., out of date software) and network vulnerabilities (e.g., unprotected service detected via a network scan).
  • Vulnerability scan logs about network vulnerabilities.
  • Scan network for suspicious activity
  • Scheduled task event that does not fall into one of the other event types.
  • Scheduled task creation.
  • Scheduled task deletion.
  • Scheduled task being enabled.
  • Scheduled task being disabled.
  • Scheduled task being modified.
  • A system audit log event that is not a wipe.
  • A system audit log wipe.
  • Service event that does not fit into one of the other event types.
  • A service creation.
  • A service deletion.
  • A service start.
  • A service stop.
  • A service modification.
  • Operating system events that are not described by any of the other event types. Might include uncategorized Microsoft Windows event logs.
  • The resource was created/provisioned. This is equivalent to USER_RESOURCE_CREATION.
  • The resource was deleted/deprovisioned. This is equivalent to USER_RESOURCE_DELETION.
  • The resource had it's permissions or ACLs updated. This is equivalent to USER_RESOURCE_UPDATE_PERMISSIONS.
  • The resource was read. This is equivalent to USER_RESOURCE_ACCESS.
  • The resource was written to. This is equivalent to USER_RESOURCE_UPDATE_CONTENT.
  • Firmware update.
  • Configuration update.
  • A program or application uploaded to a device.
  • A program or application downloaded to a device.
  • Analyst update about the Verdict (such as true positive, false positive, or disregard) of a finding.
  • Analyst update about the Reputation (such as useful or not useful) of a finding.
  • Analyst update about the Severity score (0-100) of a finding.
  • Analyst update about the finding status.
  • Analyst addition of a comment for a finding.
  • Analyst update about the priority (such as low, medium, or high) for a finding.
  • Analyst update about the root cause for a finding.
  • Analyst update about the reason (such as malicious or not malicious) for a finding.
  • Analyst update about the risk score (0-100) of a finding.
  • An update to an entity risk score. This event type is restricted to events published by Google Securit Operations Risk Analytics.
typestring
id
descriptionID of the UDM event. Can be used for raw and normalized event retrieval.
formatbyte
typestring
ingestedTimestamp
descriptionThe GMT timestamp when the event was ingested (received) by Chronicle.
formatgoogle-datetime
typestring
ingestionLabels
descriptionUser-configured ingestion metadata labels.
items
$refLabel
typearray
logType
descriptionThe string value of log type.
typestring
productDeploymentId
descriptionThe deployment identifier assigned by the vendor for a product deployment.
typestring
productEventType
descriptionA short, descriptive, human-readable, product-specific event name or type (e.g. "Scanned X", "User account created", "process_start").
typestring
productLogId
descriptionA vendor-specific event identifier to uniquely identify the event (e.g. a GUID).
typestring
productName
descriptionThe name of the product.
typestring
productVersion
descriptionThe version of the product.
typestring
structuredFields
additionalProperties
descriptionProperties of the object.
typeany
deprecatedTrue
descriptionFlattened fields extracted from the log.
typeobject
tags
$refTags
descriptionTags added by Chronicle after an event is parsed. It is an error to populate this field from within a parser.
urlBackToProduct
descriptionA URL that takes the user to the source product console for this event.
typestring
vendorName
descriptionThe name of the product vendor.
typestring
typeobject
Metric
descriptionStores precomputed aggregated analytic data for an entity.
idMetric
properties
dimensions
descriptionAll group by clauses used to calculate the metric.
items
enum
  • DIMENSION_UNSPECIFIED
  • PRINCIPAL_DEVICE
  • TARGET_USER
  • TARGET_DEVICE
  • PRINCIPAL_USER
  • TARGET_IP
  • PRINCIPAL_FILE_HASH
  • PRINCIPAL_COUNTRY
  • SECURITY_CATEGORY
  • NETWORK_ASN
  • CLIENT_CERTIFICATE_HASH
  • DNS_QUERY_TYPE
  • DNS_DOMAIN
  • HTTP_USER_AGENT
  • EVENT_TYPE
  • PRODUCT_NAME
  • PRODUCT_EVENT_TYPE
  • PARENT_FOLDER_PATH
  • TARGET_RESOURCE_NAME
  • PRINCIPAL_APPLICATION
  • TARGET_APPLICATION
  • EMAIL_TO_ADDRESS
  • EMAIL_FROM_ADDRESS
  • MAIL_ID
  • PRINCIPAL_IP
  • SECURITY_ACTION
  • SECURITY_RULE_ID
  • TARGET_NETWORK_ORGANIZATION_NAME
  • PRINCIPAL_NETWORK_ORGANIZATION_NAME
  • PRINCIPAL_PROCESS_FILE_PATH
  • PRINCIPAL_PROCESS_FILE_HASH
  • SECURITY_RESULT_RULE_NAME
  • TARGET_RESOURCE_LABEL_KEY
  • VENDOR_NAME
  • TARGET_RESOURCE_TYPE
  • TARGET_LOCATION_NAME
enumDescriptions
  • Default
  • Principal Device
  • Target User
  • Target Device
  • Principal User
  • Target IP
  • Principal File Hash
  • Principal Country
  • Security Category
  • Network ASN
  • Client Certificate Hash
  • DNS Query Type
  • DNS Domain
  • HTTP User Agent
  • Event Type
  • Product Name
  • Product Event Type
  • Parent Folder Path
  • Target resource Name
  • Principal Application.
  • Target Application.
  • Email To Address.
  • Email From Address.
  • Mail Id.
  • Principal IP.
  • Security Action.
  • Security Rule Id.
  • Target Network Organization name.
  • Principal Network Organization name.
  • Principal Process File Path.
  • Principal Process File SHA256 Hash.
  • Security Result rule name.
  • Target Resource label key.
  • Vendor name.
  • Target Resource type.
  • Target Location name.
typestring
typearray
exportWindow
descriptionExport window for which the metric was exported.
formatint64
typestring
firstSeen
descriptionTimestamp of the first time the entity was seen in the environment.
formatgoogle-datetime
typestring
lastSeen
descriptionTime stamp of the last time last time the entity was seen in the environment.
formatgoogle-datetime
typestring
metricName
descriptionName of the analytic.
enum
  • METRIC_NAME_UNSPECIFIED
  • NETWORK_BYTES_INBOUND
  • NETWORK_BYTES_OUTBOUND
  • NETWORK_BYTES_TOTAL
  • AUTH_ATTEMPTS_SUCCESS
  • AUTH_ATTEMPTS_FAIL
  • AUTH_ATTEMPTS_TOTAL
  • DNS_BYTES_OUTBOUND
  • NETWORK_FLOWS_INBOUND
  • NETWORK_FLOWS_OUTBOUND
  • NETWORK_FLOWS_TOTAL
  • DNS_QUERIES_SUCCESS
  • DNS_QUERIES_FAIL
  • DNS_QUERIES_TOTAL
  • FILE_EXECUTIONS_SUCCESS
  • FILE_EXECUTIONS_FAIL
  • FILE_EXECUTIONS_TOTAL
  • HTTP_QUERIES_SUCCESS
  • HTTP_QUERIES_FAIL
  • HTTP_QUERIES_TOTAL
  • WORKSPACE_EMAILS_SENT_TOTAL
  • WORKSPACE_TOTAL_DOWNLOAD_ACTIONS
  • WORKSPACE_TOTAL_CHANGE_ACTIONS
  • WORKSPACE_AUTH_ATTEMPTS_TOTAL
  • WORKSPACE_NETWORK_BYTES_OUTBOUND
  • WORKSPACE_NETWORK_BYTES_TOTAL
  • ALERT_EVENT_NAME_COUNT
  • RESOURCE_CREATION_TOTAL
  • RESOURCE_CREATION_SUCCESS
  • RESOURCE_READ_SUCCESS
  • RESOURCE_READ_FAIL
  • RESOURCE_DELETION_SUCCESS
enumDescriptions
  • Default
  • Total received network bytes.
  • Total network sent bytes.
  • Total network sent bytes and received bytes.
  • Successful authentication attempts.
  • Failed authentication attempts.
  • Total authentication attempts.
  • Total number of sent bytes for DNS events.
  • Total number of events having non-null received bytes.
  • Total number of events having non-null sent bytes.
  • Total events having non-null sent or received bytes.
  • DNS query success count - Number of events with response_code = 0.
  • Number of events with response_code != 0.
  • Total number of DNS queries made.
  • Number of successfule file executions.
  • Number of failed file executions.
  • Total number file executions.
  • Number of successful HTTP queries.
  • Number of failed HTTP queries.
  • Total number of HTTP queries.
  • Total number of emails sent in Google Workspace.
  • Total number of download actions in Google Workspace.
  • Total number of change actions in Google Workspace.
  • Total number of authentication attempts in Google Workspace.
  • Number of outbound network bytes (total sent) in Google Workspace.
  • Total number of network bytes (both sent and received) in Google Workspace.
  • Track number of alerts fired by EDR/SENTINEL/MICROSOFT_GRAPH.
  • First-time analytic tracking successful resource creations.
  • Volume-based analytic tracking successful resource creations.
  • Volume-based analytic tracking successful resource reads.
  • Volume-based analytic tracking failed resource reads.
  • Volume-based analytic tracking successful resource deletions.
typestring
sumMeasure
$refMeasure
descriptionSum of all precomputed measures for the given metric.
totalEvents
descriptionTotal number of events used to calculate the given precomputed metric.
formatint64
typestring
typeobject
Navigation
descriptionNavigation can be used to store the metadata required to navigate the user to a new URL.
idNavigation
properties
targetUri
descriptionOutput only. The URI to redirect the user to.
readOnlyTrue
typestring
typeobject
Network
descriptionA network event.
idNetwork
properties
applicationProtocol
descriptionThe application protocol.
enum
  • UNKNOWN_APPLICATION_PROTOCOL
  • AFP
  • APPC
  • AMQP
  • ATOM
  • BEEP
  • BITCOIN
  • BIT_TORRENT
  • CFDP
  • CIP
  • COAP
  • COTP
  • DCERPC
  • DDS
  • DEVICE_NET
  • DHCP
  • DICOM
  • DNP3
  • DNS
  • E_DONKEY
  • ENRP
  • FAST_TRACK
  • FINGER
  • FREENET
  • FTAM
  • GOOSE
  • GOPHER
  • GRPC
  • HL7
  • H323
  • HTTP
  • HTTPS
  • IEC104
  • IRCP
  • KADEMLIA
  • KRB5
  • LDAP
  • LPD
  • MIME
  • MMS
  • MODBUS
  • MQTT
  • NETCONF
  • NFS
  • NIS
  • NNTP
  • NTCIP
  • NTP
  • OSCAR
  • PNRP
  • PTP
  • QUIC
  • RDP
  • RELP
  • RIP
  • RLOGIN
  • RPC
  • RTMP
  • RTP
  • RTPS
  • RTSP
  • SAP
  • SDP
  • SIP
  • SLP
  • SMB
  • SMTP
  • SNMP
  • SNTP
  • SSH
  • SSMS
  • STYX
  • SV
  • TCAP
  • TDS
  • TOR
  • TSP
  • VTP
  • WHOIS
  • WEB_DAV
  • X400
  • X500
  • XMPP
enumDescriptions
  • The default application protocol.
  • Apple Filing Protocol.
  • Advanced Program-to-Program Communication.
  • Advanced Message Queuing Protocol.
  • Publishing Protocol.
  • Block Extensible Exchange Protocol.
  • Crypto currency protocol.
  • Peer-to-peer file sharing.
  • Coherent File Distribution Protocol.
  • Common Industrial Protocol.
  • Constrained Application Protocol.
  • Connection Oriented Transport Protocol.
  • DCE/RPC.
  • Data Distribution Service.
  • Automation industry protocol.
  • DHCP.
  • Digital Imaging and Communications in Medicine Protocol.
  • Distributed Network Protocol 3 (DNP3)
  • DNS.
  • Classic file sharing protocol.
  • Endpoint Handlespace Redundancy Protocol.
  • Filesharing peer-to-peer protocol.
  • User Information Protocol.
  • Censorship resistant peer-to-peer network.
  • File Transfer Access and Management.
  • GOOSE Protocol.
  • Gopher protocol.
  • gRPC Remote Procedure Call.
  • Health Level Seven.
  • Packet-based multimedia communications system.
  • HTTP.
  • HTTPS.
  • IEC 60870-5-104 (IEC 104) Protocol.
  • Internet Relay Chat Protocol.
  • Peer-to-peer hashtables.
  • Kerberos 5.
  • Lightweight Directory Access Protocol.
  • Line Printer Daemon Protocol.
  • Multipurpose Internet Mail Extensions and Secure MIME.
  • Multimedia Messaging Service.
  • Serial communications protocol.
  • Message Queuing Telemetry Transport.
  • Network Configuration.
  • Network File System.
  • Network Information Service.
  • Network News Transfer Protocol.
  • National Transportation Communications for Intelligent Transportation System.
  • Network Time Protocol.
  • AOL Instant Messenger Protocol.
  • Peer Name Resolution Protocol.
  • Precision Time Protocol.
  • QUIC.
  • Remote Desktop Protocol.
  • Reliable Event Logging Protocol.
  • Routing Information Protocol.
  • Remote Login in UNIX Systems.
  • Remote Procedure Call.
  • Real Time Messaging Protocol.
  • Real-time Transport Protocol.
  • Real Time Publish Subscribe.
  • Real Time Streaming Protocol.
  • Session Announcement Protocol.
  • Session Description Protocol.
  • Session Initiation Protocol.
  • Service Location Protocol.
  • Server Message Block.
  • Simple Mail Transfer Protocol.
  • Simple Network Management Protocol.
  • Simple Network Time Protocol.
  • Secure Shell.
  • Secure SMS Messaging Protocol.
  • Styx/9P - Plan 9 from Bell Labs distributed file system protocol.
  • Sampled Values Protocol.
  • Transaction Capabilities Application Part.
  • Tabular Data Stream.
  • Anonymity network.
  • Time Stamp Protocol.
  • Virtual Terminal Protocol.
  • Remote Directory Access Protocol.
  • Web Distributed Authoring and Versioning.
  • Message Handling Service Protocol.
  • Directory Access Protocol (DAP).
  • Extensible Messaging and Presence Protocol.
typestring
applicationProtocolVersion
descriptionThe version of the application protocol. e.g. "1.1, 2.0"
typestring
asn
descriptionAutonomous system number.
typestring
carrierName
descriptionCarrier identification.
typestring
communityId
descriptionCommunity ID network flow value.
typestring
dhcp
$refDhcp
descriptionDHCP info.
direction
descriptionThe direction of network traffic.
enum
  • UNKNOWN_DIRECTION
  • INBOUND
  • OUTBOUND
  • BROADCAST
enumDescriptions
  • The default direction.
  • An inbound request.
  • An outbound request.
  • A broadcast.
typestring
dns
$refDns
descriptionDNS info.
dnsDomain
descriptionDNS domain name.
typestring
email
$refEmail
descriptionEmail info for the sender/recipient.
ftp
$refFtp
descriptionFTP info.
http
$refHttp
descriptionHTTP info.
ipProtocol
descriptionThe IP protocol.
enum
  • UNKNOWN_IP_PROTOCOL
  • ICMP
  • IGMP
  • TCP
  • UDP
  • IP6IN4
  • GRE
  • ESP
  • ICMP6
  • EIGRP
  • ETHERIP
  • PIM
  • VRRP
  • SCTP
enumDescriptions
  • The default protocol.
  • ICMP.
  • IGMP
  • TCP.
  • UDP.
  • IPv6 Encapsulation
  • Generic Routing Encapsulation
  • Encapsulating Security Payload
  • ICMPv6
  • Enhanced Interior Gateway Routing
  • Ethernet-within-IP Encapsulation
  • Protocol Independent Multicast
  • Virtual Router Redundancy Protocol
  • Stream Control Transmission Protocol
typestring
ipSubnetRange
descriptionAssociated human-readable IP subnet range (e.g. 10.1.2.0/24).
typestring
organizationName
descriptionOrganization name (e.g Google).
typestring
parentSessionId
descriptionThe ID of the parent network session.
typestring
receivedBytes
descriptionThe number of bytes received.
formatuint64
typestring
receivedPackets
descriptionThe number of packets received.
formatint64
typestring
sentBytes
descriptionThe number of bytes sent.
formatuint64
typestring
sentPackets
descriptionThe number of packets sent.
formatint64
typestring
sessionDuration
descriptionThe duration of the session as the number of seconds and nanoseconds. For seconds, network.session_duration.seconds, the type is a 64-bit integer. For nanoseconds, network.session_duration.nanos, the type is a 32-bit integer.
formatgoogle-duration
typestring
sessionId
descriptionThe ID of the network session.
typestring
smtp
$refSmtp
descriptionSMTP info. Store fields specific to SMTP not covered by Email.
tls
$refTls
descriptionTLS info.
typeobject
Noun
descriptionThe Noun type is used to represent the different entities in an event: principal, src, target, observer, intermediary, and about. It stores attributes known about the entity. For example, if the entity is a device with multiple IP or MAC addresses, it stores the IP and MAC addresses that are relevant to the event.
idNoun
properties
administrativeDomain
descriptionDomain which the device belongs to (for example, the Microsoft Windows domain).
typestring
application
descriptionThe name of an application or service. Some SSO solutions only capture the name of a target application such as "Atlassian" or "Chronicle".
typestring
artifact
$refArtifact
descriptionInformation about an artifact.
asset
$refAsset
descriptionInformation about the asset.
assetId
descriptionThe asset ID. This field can be used as an entity indicator for asset entities.
typestring
cloud
$refCloud
deprecatedTrue
descriptionCloud metadata. Deprecated: cloud should be populated in entity Attribute as generic metadata (e.g. asset.attribute.cloud).
domain
$refDomain
descriptionInformation about the domain.
email
descriptionEmail address. Only filled in for security_result.about
typestring
file
$refBackstoryFile
descriptionInformation about the file.
group
$refGroup
descriptionInformation about the group.
hostname
descriptionClient hostname or domain name field. Hostname also doubles as the domain for remote entities. This field can be used as an entity indicator for asset entities.
typestring
investigation
$refInvestigation
descriptionAnalyst feedback/investigation for alerts.
ip
descriptionA list of IP addresses associated with a network connection. This field can be used as an entity indicator for asset entities.
items
typestring
typearray
ipGeoArtifact
descriptionEnriched geographic information corresponding to an IP address. Specifically, location and network data.
items
$refArtifact
typearray
ipLocation
deprecatedTrue
descriptionDeprecated: use ip_geo_artifact.location instead.
items
$refLocation
typearray
labels
deprecatedTrue
descriptionLabels are key-value pairs. For example: key = "env", value = "prod". Deprecated: labels should be populated in entity Attribute as generic metadata (e.g. user.attribute.labels).
items
$refLabel
typearray
location
$refLocation
descriptionPhysical location. For cloud environments, set the region in location.name.
mac
descriptionList of MAC addresses associated with a device. This field can be used as an entity indicator for asset entities.
items
typestring
typearray
namespace
descriptionNamespace which the device belongs to, such as "AD forest". Uses for this field include Microsoft Windows AD forest, the name of subsidiary, or the name of acquisition. This field can be used along with an asset indicator to identify an asset.
typestring
natIp
descriptionA list of NAT translated IP addresses associated with a network connection.
items
typestring
typearray
natPort
descriptionNAT external network port number when a specific network connection is described within an event.
formatint32
typeinteger
network
$refNetwork
descriptionNetwork details, including sub-messages with details on each protocol (for example, DHCP, DNS, or HTTP).
objectReference
$refId
descriptionFinding to which the Analyst updated the feedback.
platform
descriptionPlatform.
enum
  • UNKNOWN_PLATFORM
  • WINDOWS
  • MAC
  • LINUX
  • GCP
  • AWS
  • AZURE
  • IOS
  • ANDROID
  • CHROME_OS
enumDeprecated
  • False
  • False
  • False
  • False
  • True
  • True
  • True
  • False
  • False
  • False
enumDescriptions
  • Default value.
  • Microsoft Windows.
  • macOS.
  • Linux.
  • Deprecated: see cloud.environment.
  • Deprecated: see cloud.environment.
  • Deprecated: see cloud.environment.
  • IOS
  • Android
  • Chrome OS
typestring
platformPatchLevel
descriptionPlatform patch level. For example, "Build 17134.48"
typestring
platformVersion
descriptionPlatform version. For example, "Microsoft Windows 1803".
typestring
port
descriptionSource or destination network port number when a specific network connection is described within an event.
formatint32
typeinteger
process
$refProcess
descriptionInformation about the process.
processAncestors
descriptionInformation about the process's ancestors ordered from immediate ancestor (parent process) to root. Note: process_ancestors is only populated when data is exported to BigQuery since recursive fields (e.g. process.parent_process) are not supported by BigQuery.
items
$refProcess
typearray
registry
$refRegistry
descriptionRegistry information.
resource
$refResource
descriptionInformation about the resource (e.g. scheduled task, calendar entry). This field should not be used for files, registry, or processes because these objects are already part of Noun.
resourceAncestors
descriptionInformation about the resource's ancestors ordered from immediate ancestor (starting with parent resource).
items
$refResource
typearray
securityResult
descriptionA list of security results.
items
$refSecurityResult
typearray
url
descriptionThe URL.
typestring
urlMetadata
$refUrl
descriptionInformation about the URL.
user
$refUser
descriptionInformation about the user.
userManagementChain
descriptionInformation about the user's management chain (reporting hierarchy). Note: user_management_chain is only populated when data is exported to BigQuery since recursive fields (e.g. user.managers) are not supported by BigQuery.
items
$refUser
typearray
typeobject
NtfsFileMetadata
descriptionNTFS-specific file metadata.
idNtfsFileMetadata
properties
changeTime
descriptionNTFS MFT entry changed timestamp.
formatgoogle-datetime
typestring
filenameAccessTime
descriptionNTFS $FILE_NAME attribute accessed timestamp.
formatgoogle-datetime
typestring
filenameChangeTime
descriptionNTFS $FILE_NAME attribute changed timestamp.
formatgoogle-datetime
typestring
filenameCreateTime
descriptionNTFS $FILE_NAME attribute created timestamp.
formatgoogle-datetime
typestring
filenameModifyTime
descriptionNTFS $FILE_NAME attribute modified timestamp.
formatgoogle-datetime
typestring
typeobject
Operation
descriptionThis resource represents a long-running operation that is the result of a network API call.
idOperation
properties
done
descriptionIf the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available.
typeboolean
error
$refStatus
descriptionThe error result of the operation in case of failure or cancellation.
metadata
additionalProperties
descriptionProperties of the object. Contains field @type with type URL.
typeany
descriptionService-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any.
typeobject
name
descriptionThe server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`.
typestring
response
additionalProperties
descriptionProperties of the object. Contains field @type with type URL.
typeany
descriptionThe normal, successful response of the operation. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`.
typeobject
typeobject
Option
descriptionDHCP options.
idOption
properties
code
descriptionCode. See RFC1533.
formatuint32
typeinteger
data
descriptionData.
formatbyte
typestring
typeobject
PDFInfo
descriptionInformation about the PDF file structure. See https://developers.virustotal.com/reference/pdf_info
idPDFInfo
properties
acroform
descriptionNumber of /AcroForm tags found in the PDF.
formatint64
typestring
autoaction
descriptionNumber of /AA tags found in the PDF.
formatint64
typestring
embeddedFile
descriptionNumber of /EmbeddedFile tags found in the PDF.
formatint64
typestring
encrypted
descriptionWhether the document is encrypted or not. This is defined by the /Encrypt tag.
formatint64
typestring
endobjCount
descriptionNumber of object definitions (endobj keyword).
formatint64
typestring
endstreamCount
descriptionNumber of defined stream objects (stream keyword).
formatint64
typestring
flash
descriptionNumber of /RichMedia tags found in the PDF.
formatint64
typestring
header
descriptionPDF version.
typestring
javascript
descriptionNumber of /JavaScript tags found in the PDF file. Should be the same as the js field in normal scenarios.
formatint64
typestring
jbig2Compression
descriptionNumber of /JBIG2Decode tags found in the PDF.
formatint64
typestring
js
descriptionNumber of /JS tags found in the PDF file. Should be the same as javascript field in normal scenarios.
formatint64
typestring
launchActionCount
descriptionNumber of /Launch tags found in the PDF file.
formatint64
typestring
objCount
descriptionNumber of objects definitions (obj keyword).
formatint64
typestring
objectStreamCount
descriptionNumber of object streams.
formatint64
typestring
openaction
descriptionNumber of /OpenAction tags found in the PDF.
formatint64
typestring
pageCount
descriptionNumber of pages in the PDF.
formatint64
typestring
startxref
descriptionNumber of startxref keywords in the PDF.
formatint64
typestring
streamCount
descriptionNumber of defined stream objects (stream keyword).
formatint64
typestring
suspiciousColors
descriptionNumber of colors expressed with more than 3 bytes (CVE-2009-3459).
formatint64
typestring
trailer
descriptionNumber of trailer keywords in the PDF.
formatint64
typestring
xfa
descriptionNumber of \XFA tags found in the PDF.
formatint64
typestring
xref
descriptionNumber of xref keywords in the PDF.
formatint64
typestring
typeobject
PeFileMetadata
descriptionMetadata about a Microsoft Windows Portable Executable.
idPeFileMetadata
properties
importHash
descriptionHash of PE imports.
typestring
typeobject
Permission
descriptionSystem permission for resource access and modification.
idPermission
properties
description
descriptionDescription of the permission (e.g. 'Ability to update detect rules').
typestring
name
descriptionName of the permission (e.g. chronicle.analyst.updateRule).
typestring
type
descriptionType of the permission.
enum
  • UNKNOWN_PERMISSION_TYPE
  • ADMIN_WRITE
  • ADMIN_READ
  • DATA_WRITE
  • DATA_READ
enumDescriptions
  • Default permission type.
  • Administrator write permission.
  • Administrator read permission.
  • Data resource access write permission.
  • Data resource access read permission.
typestring
typeobject
PlatformSoftware
descriptionPlatform software information about an operating system.
idPlatformSoftware
properties
platform
descriptionThe platform operating system.
enum
  • UNKNOWN_PLATFORM
  • WINDOWS
  • MAC
  • LINUX
  • GCP
  • AWS
  • AZURE
  • IOS
  • ANDROID
  • CHROME_OS
enumDeprecated
  • False
  • False
  • False
  • False
  • True
  • True
  • True
  • False
  • False
  • False
enumDescriptions
  • Default value.
  • Microsoft Windows.
  • macOS.
  • Linux.
  • Deprecated: see cloud.environment.
  • Deprecated: see cloud.environment.
  • Deprecated: see cloud.environment.
  • IOS
  • Android
  • Chrome OS
typestring
platformPatchLevel
descriptionThe platform software patch level ( e.g. "Build 17134.48", "SP1").
typestring
platformVersion
descriptionThe platform software version ( e.g. "Microsoft Windows 1803").
typestring
typeobject
PopularityRank
descriptionDomain's position in popularity ranks for sources such as Alexa, Quantcast, or Statvoo.
idPopularityRank
properties
giver
descriptionName of the rank serial number hexdump.
typestring
ingestionTime
descriptionTimestamp when the rank was ingested.
formatgoogle-datetime
typestring
rank
descriptionRank position.
formatint64
typestring
typeobject
Prevalence
descriptionThe prevalence of a resource within the customer's environment. This measures how common it is for assets to access the resource.
idPrevalence
properties
dayCount
descriptionThe number of days over which rolling_max is calculated.
formatint32
typeinteger
dayMax
descriptionThe max prevalence score in a day interval window.
formatint32
typeinteger
dayMaxSubDomains
descriptionThe max prevalence score in a day interval window across sub-domains. This field is only valid for domains.
formatint32
typeinteger
rollingMax
descriptionThe maximum number of assets per day accessing the resource over the trailing day_count days.
formatint32
typeinteger
rollingMaxSubDomains
descriptionThe maximum number of assets per day accessing the domain along with sub-domains over the trailing day_count days. This field is only valid for domains.
formatint32
typeinteger
typeobject
Process
descriptionInformation about a process.
idProcess
properties
accessMask
descriptionA bit mask representing the level of access.
formatuint64
typestring
commandLine
descriptionThe command line command that created the process. This field can be used as an entity indicator for process entities.
typestring
commandLineHistory
descriptionThe command line history of the process.
items
typestring
typearray
egid
descriptionThe effective group ID of the process.
typestring
euid
descriptionThe effective user ID of the process.
typestring
file
$refBackstoryFile
descriptionInformation about the file in use by the process.
integrityLevelRid
descriptionThe Microsoft Windows integrity level relative ID (RID) of the process.
formatuint64
typestring
parentPid
deprecatedTrue
descriptionThe ID of the parent process. Deprecated: use parent_process.pid instead.
typestring
parentProcess
$refProcess
descriptionInformation about the parent process.
pgid
descriptionThe identifier that points to the process group ID leader.
typestring
pid
descriptionThe process ID. This field can be used as an entity indicator for process entities.
typestring
productSpecificParentProcessId
deprecatedTrue
descriptionA product specific id for the parent process. Please use parent_process.product_specific_process_id instead.
typestring
productSpecificProcessId
descriptionA product specific process id.
typestring
rgid
descriptionThe real group ID of the process.
typestring
ruid
descriptionThe real user ID of the process.
typestring
sessionLeaderPid
descriptionThe process ID of the session leader process.
typestring
tokenElevationType
descriptionThe elevation type of the process on Microsoft Windows. This determines if any privileges are removed when UAC is enabled.
enum
  • UNKNOWN
  • TYPE_1
  • TYPE_2
  • TYPE_3
enumDescriptions
  • An undetermined token type.
  • A full token with no privileges removed or groups disabled.
  • An elevated token with no privileges removed or groups disabled. Used when running as administrator.
  • A limited token with administrative privileges removed and administrative groups disabled.
typestring
tty
descriptionThe teletype terminal which the command was executed within.
typestring
typeobject
ProviderMLVerdict
descriptionDeprecated. MLVerdict result provided from threat providers, like Mandiant. These fields are used to model Mandiant sources.
idProviderMLVerdict
properties
benignCount
descriptionCount of responses where this IoC was marked benign.
formatint32
typeinteger
confidenceScore
descriptionConfidence score of the verdict.
formatint32
typeinteger
maliciousCount
descriptionCount of responses where this IoC was marked malicious.
formatint32
typeinteger
mandiantSources
descriptionList of mandiant sources from which the verdict was generated.
items
$refSource
typearray
sourceProvider
descriptionSource provider giving the ML verdict.
typestring
thirdPartySources
descriptionList of third-party sources from which the verdict was generated.
items
$refSource
typearray
typeobject
PublicKey
descriptionSubject public key info.
idPublicKey
properties
algorithm
descriptionAny of "RSA", "DSA" or "EC". Indicates the algorithm used to generate the certificate.
typestring
rsa
$refRSA
descriptionRSA public key information.
typeobject
Question
descriptionDNS Questions. See RFC1035, section 4.1.2.
idQuestion
properties
class
descriptionThe code specifying the class of the query.
formatuint32
typeinteger
name
descriptionThe domain name.
typestring
prevalence
$refPrevalence
descriptionThe prevalence of the domain within the customer's environment.
type
descriptionThe code specifying the type of the query.
formatuint32
typeinteger
typeobject
RSA
descriptionRSA public key information.
idRSA
properties
exponent
descriptionKey exponent hexdump.
typestring
keySize
descriptionKey size.
formatint64
typestring
modulus
descriptionKey modulus hexdump.
typestring
typeobject
Reference
descriptionReference to model primatives including event and entity. As support is added for fast retrieval of objects by identifiers, this will be expanded to include ID references rather than full object copies. BEGIN GOOGLE-INTERNAL See go/udm:ids for additional details. END GOOGLE-INTERNAL
idReference
properties
entity
$refBackstoryEntity
descriptionEntity being referenced. End one-of
event
$refUDM
descriptionOnly one of event or entity will be populated for a single reference. Start one-of Event being referenced.
id
$refId
descriptionId being referenced. This field will also be populated for both event and entity with the event id. For detections, only this field will be populated.
typeobject
ReferenceList
descriptionA reference list. Reference lists are user-defined lists of values which users can use in multiple Rules.
idReferenceList
properties
description
descriptionRequired. A user-provided description of the reference list.
typestring
displayName
descriptionOutput only. The unique display name of the reference list.
readOnlyTrue
typestring
entries
descriptionRequired. The entries of the reference list. When listed, they are returned in the order that was specified at creation or update. The combined size of the values of the reference list may not exceed 6MB. This is returned only when the view is REFERENCE_LIST_VIEW_FULL.
items
$refReferenceListEntry
typearray
name
descriptionOutput only. The resource name of the reference list. Format: projects/{project}/locations/{location}/instances/{instance}/referenceLists/{reference_list}
readOnlyTrue
typestring
revisionCreateTime
descriptionOutput only. The timestamp when the reference list was last updated.
formatgoogle-datetime
readOnlyTrue
typestring
ruleAssociationsCount
descriptionOutput only. The count of self-authored rules using the reference list.
formatint32
readOnlyTrue
typeinteger
rules
descriptionOutput only. The resource names for the associated self-authored Rules that use this reference list. This is returned only when the view is REFERENCE_LIST_VIEW_FULL.
items
typestring
readOnlyTrue
typearray
scopeInfo
$refScopeInfo
descriptionOutput only. The scope info of the reference list. During reference list creation, if this field is not set, the reference list without scopes (an unscoped list) will be created for an unscoped user. For a scoped user, this field must be set. During reference list update, if scope_info is requested to be updated, this field must be set.
readOnlyTrue
syntaxType
descriptionRequired. The syntax type indicating how list entries should be validated.
enum
  • REFERENCE_LIST_SYNTAX_TYPE_UNSPECIFIED
  • REFERENCE_LIST_SYNTAX_TYPE_PLAIN_TEXT_STRING
  • REFERENCE_LIST_SYNTAX_TYPE_REGEX
  • REFERENCE_LIST_SYNTAX_TYPE_CIDR
enumDescriptions
  • Defaults to REFERENCE_LIST_SYNTAX_TYPE_PLAIN_TEXT_STRING.
  • List contains plain text patterns.
  • List contains only Regular Expression patterns.
  • List contains only CIDR patterns.
typestring
typeobject
ReferenceListEntry
descriptionAn entry in a reference list.
idReferenceListEntry
properties
value
descriptionRequired. The value of the entry. Maximum length is 512 characters.
typestring
typeobject
ReferenceListScope
descriptionReferenceListScope specifies the list of scope names of the reference list.
idReferenceListScope
properties
scopeNames
descriptionOptional. The list of scope names of the reference list. The scope names should be full resource names and should be of the format: "projects/{project}/locations/{location}/instances/{instance}/dataAccessScopes/{scope_name}".
items
typestring
typearray
typeobject
Registry
descriptionInformation about a registry key or value.
idRegistry
properties
registryKey
descriptionRegistry key associated with an application or system component (e.g., HKEY_, HKCU\Environment...).
typestring
registryValueData
descriptionData associated with a registry value (e.g. %USERPROFILE%\Local Settings\Temp).
typestring
registryValueName
descriptionName of the registry value associated with an application or system component (e.g. TEMP).
typestring
registryValueType
descriptionType of the registry value.
enum
  • TYPE_UNSPECIFIED
  • NONE
  • SZ
  • EXPAND_SZ
  • BINARY
  • DWORD
  • DWORD_LITTLE_ENDIAN
  • DWORD_BIG_ENDIAN
  • LINK
  • MULTI_SZ
  • RESOURCE_LIST
  • QWORD
  • QWORD_LITTLE_ENDIAN
enumDescriptions
  • Default registry value type used when the type is unknown.
  • The registry value is not set and only the key exists.
  • A null-terminated string.
  • A null-terminated string that contains unexpanded references to environment variables
  • Binary data in any form.
  • A 32-bit number.
  • A 32-bit number in little-endian format.
  • A 32-bit number in big-endian format.
  • A null-terminated Unicode string that contains the target path of a symbolic link.
  • A sequence of null-terminated strings, terminated by an empty string
  • A device driver resource list.
  • A 64-bit number.
  • A 64-bit number in little-endian format.
typestring
typeobject
Relation
descriptionDefines the relationship between the entity (a) and another entity (b).
idRelation
properties
direction
descriptionDirectionality of relationship between primary entity (a) and the related entity (b).
enum
  • DIRECTIONALITY_UNSPECIFIED
  • BIDIRECTIONAL
  • UNIDIRECTIONAL
enumDescriptions
  • Default value.
  • Modeled in both directions. Primary entity (a) to related entity (b) and related entity (b) to primary entity (a).
  • Modeled in a single direction. Primary entity (a) to related entity (b).
typestring
entity
$refNoun
descriptionEntity (b) that the primary entity (a) is related to.
entityLabel
descriptionLabel to identify the Noun of the relation.
enum
  • ENTITY_LABEL_UNSPECIFIED
  • PRINCIPAL
  • TARGET
  • OBSERVER
  • SRC
  • NETWORK
  • SECURITY_RESULT
  • INTERMEDIARY
enumDescriptions
  • Default value.
  • The Noun represents a principal type object.
  • The Noun represents a target type object.
  • The Noun represents an observer type object.
  • The Noun represents src type object.
  • The Noun represents a network type object.
  • The Noun represents a SecurityResult object.
  • The Noun represents an intermediary type object.
typestring
entityType
descriptionType of the related entity (b) in this relationship.
enum
  • UNKNOWN_ENTITYTYPE
  • ASSET
  • USER
  • GROUP
  • RESOURCE
  • IP_ADDRESS
  • FILE
  • DOMAIN_NAME
  • URL
  • MUTEX
  • METRIC
enumDescriptions
  • @hide_from_doc
  • An asset, such as workstation, laptop, phone, virtual machine, etc.
  • User.
  • Group.
  • Resource.
  • An external IP address.
  • A file.
  • A domain.
  • A url.
  • A mutex.
  • A metric.
typestring
relationship
descriptionType of relationship.
enum
  • RELATIONSHIP_UNSPECIFIED
  • OWNS
  • ADMINISTERS
  • MEMBER
  • EXECUTES
  • DOWNLOADED_FROM
  • CONTACTS
enumDescriptions
  • Default value
  • Related entity is owned by the primary entity (e.g. user owns device asset).
  • Related entity is administered by the primary entity (e.g. user administers a group).
  • Primary entity is a member of the related entity (e.g. user is a member of a group).
  • Primary entity may have executed the related entity.
  • Primary entity may have been downloaded from the related entity.
  • Primary entity contacts the related entity.
typestring
uid
descriptionUID of the relationship.
formatbyte
typestring
typeobject
Resource
descriptionInformation about a resource such as a task, Cloud Storage bucket, database, disk, logical policy, or something similar.
idResource
properties
attribute
$refAttribute
descriptionGeneric entity metadata attributes of the resource.
id
deprecatedTrue
descriptionDeprecated: Use resource.name or resource.product_object_id.
typestring
name
descriptionThe full name of the resource. For example, Google Cloud: //cloudresourcemanager.googleapis.com/projects/wombat-123, and AWS: arn:aws:iam::123456789012:user/johndoe.
typestring
parent
deprecatedTrue
descriptionThe parent of the resource. For a database table, the parent is the database. For a storage object, the bucket name. Deprecated: use resource_ancestors.name.
typestring
productObjectId
descriptionA vendor-specific identifier to uniquely identify the entity (a GUID, OID, or similar) This field can be used as an entity indicator for a Resource entity.
typestring
resourceSubtype
descriptionResource sub-type (e.g. "BigQuery", "Bigtable").
typestring
resourceType
descriptionResource type.
enum
  • UNSPECIFIED
  • MUTEX
  • TASK
  • PIPE
  • DEVICE
  • FIREWALL_RULE
  • MAILBOX_FOLDER
  • VPC_NETWORK
  • VIRTUAL_MACHINE
  • STORAGE_BUCKET
  • STORAGE_OBJECT
  • DATABASE
  • TABLE
  • CLOUD_PROJECT
  • CLOUD_ORGANIZATION
  • SERVICE_ACCOUNT
  • ACCESS_POLICY
  • CLUSTER
  • SETTING
  • DATASET
  • BACKEND_SERVICE
  • POD
  • CONTAINER
  • FUNCTION
  • RUNTIME
  • IP_ADDRESS
  • DISK
  • VOLUME
  • IMAGE
  • SNAPSHOT
  • REPOSITORY
  • CREDENTIAL
  • LOAD_BALANCER
  • GATEWAY
  • SUBNET
  • USER
enumDescriptions
  • Default type.
  • Mutex.
  • Task.
  • Named pipe.
  • Device.
  • Firewall rule.
  • Mailbox folder.
  • VPC Network.
  • Virtual machine.
  • Storage bucket.
  • Storage object.
  • Database.
  • Data table.
  • Cloud project.
  • Cloud organization.
  • Service account.
  • Access policy.
  • Cluster.
  • Settings.
  • Dataset.
  • Endpoint that receive traffic from a load balancer or proxy.
  • Pod, which is a collection of containers. Often used in Kubernetes.
  • Container.
  • Cloud function.
  • Runtime.
  • IP address.
  • Disk.
  • Volume.
  • Machine image.
  • Snapshot.
  • Repository.
  • Credential, e.g. access keys, ssh keys, tokens, certificates.
  • Load balancer.
  • Gateway.
  • Subnet.
  • User.
typestring
type
deprecatedTrue
descriptionDeprecated: use resource_type instead.
typestring
typeobject
ResourceRecord
descriptionDNS Resource Records. See RFC1035, section 4.1.3.
idResourceRecord
properties
binaryData
descriptionThe raw bytes of any non-UTF8 strings that might be included as part of a DNS response.
formatbyte
typestring
class
descriptionThe code specifying the class of the resource record.
formatuint32
typeinteger
data
descriptionThe payload or response to the DNS question for all responses encoded in UTF-8 format
typestring
name
descriptionThe name of the owner of the resource record.
typestring
ttl
descriptionThe time interval for which the resource record can be cached before the source of the information should again be queried.
formatuint32
typeinteger
type
descriptionThe code specifying the type of the resource record.
formatuint32
typeinteger
typeobject
ResponsePlatformInfo
descriptionRelated info of an Alert in customer's SOAR platform.
idResponsePlatformInfo
properties
alertId
descriptionId of the alert in SOAR product.
typestring
responsePlatformType
descriptionType of SOAR product.
enum
  • RESPONSE_PLATFORM_TYPE_UNSPECIFIED
  • RESPONSE_PLATFORM_TYPE_SIEMPLIFY
enumDescriptions
  • Response platform not specified.
  • Siemplify
typestring
typeobject
Retrohunt
descriptionRetrohunt is an execution of a Rule over a time range in the past.
idRetrohunt
properties
executionInterval
$refInterval
descriptionOutput only. The start and end time of the retrohunt execution. If the retrohunt is not yet finished, the end time of the interval will not be populated.
readOnlyTrue
name
descriptionThe resource name of the retrohunt. Retrohunt is the child of a rule revision. {rule} in the format below is structured as {rule_id@revision_id}. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}/retrohunts/{retrohunt}
typestring
processInterval
$refInterval
descriptionRequired. The start and end time of the event time range this retrohunt processes.
progressPercentage
descriptionOutput only. Percent progress of the retrohunt towards completion, from 0.00 to 100.00.
formatfloat
readOnlyTrue
typenumber
state
descriptionOutput only. The state of the retrohunt.
enum
  • STATE_UNSPECIFIED
  • RUNNING
  • DONE
  • CANCELLED
  • FAILED
enumDescriptions
  • Unspecified or unknown retrohunt state.
  • Running state.
  • Done state.
  • Cancelled state.
  • Failed state.
readOnlyTrue
typestring
typeobject
RetrohuntMetadata
descriptionOperation Metadata for Retrohunts.
idRetrohuntMetadata
properties
executionInterval
$refInterval
descriptionThe start and end time of the retrohunt execution. If the retrohunt is not yet finished, the end time of the interval will not be filled.
progressPercentage
descriptionPercent progress of the retrohunt towards completion, from 0.00 to 100.00.
formatfloat
typenumber
retrohunt
descriptionThe name of the retrohunt. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}/retrohunts/{retrohunt}
typestring
typeobject
RiskDelta
descriptionDescribes the difference in risk score between two points in time.
idRiskDelta
properties
previousRangeEndTime
descriptionEnd time of the previous time window.
formatgoogle-datetime
typestring
previousRiskScore
descriptionRisk score from previous risk window
formatint32
typeinteger
riskScoreDelta
descriptionDifference in the normalized risk score from the previous recorded value.
formatint32
typeinteger
riskScoreNumericDelta
descriptionNumeric change between current and previous risk score
formatint32
typeinteger
typeobject
Role
descriptionSystem role for resource access and modification.
idRole
properties
description
descriptionSystem role description for user.
typestring
name
descriptionSystem role name for user.
typestring
type
descriptionSystem role type for well known roles.
enum
  • TYPE_UNSPECIFIED
  • ADMINISTRATOR
  • SERVICE_ACCOUNT
enumDescriptions
  • Default user role.
  • Product administrator with elevated privileges.
  • System service account for automated privilege access.
typestring
typeobject
Rule
descriptionThe Rule resource represents a user-created rule. NEXT TAG: 21
idRule
properties
allowedRunFrequencies
descriptionOutput only. The run frequencies that are allowed for the rule. Populated in BASIC view and FULL view.
items
enum
  • RUN_FREQUENCY_UNSPECIFIED
  • LIVE
  • HOURLY
  • DAILY
enumDescriptions
  • The run frequency is unspecified/unknown.
  • Executes in real time.
  • Executes once per hour.
  • Executes once per day.
typestring
readOnlyTrue
typearray
author
descriptionOutput only. The author of the rule. Extracted from the meta section of text. Populated in BASIC view and FULL view.
readOnlyTrue
typestring
compilationDiagnostics
descriptionOutput only. A list of a rule's corresponding compilation diagnostic messages such as compilation errors and compilation warnings. Populated in FULL view.
items
$refCompilationDiagnostic
readOnlyTrue
typearray
compilationState
descriptionOutput only. The current compilation state of the rule. Populated in FULL view.
enum
  • COMPILATION_STATE_UNSPECIFIED
  • SUCCEEDED
  • FAILED
enumDescriptions
  • The compilation state is unspecified/unknown.
  • The Rule can successfully compile.
  • The Rule cannot successfully compile. This is possible if a backwards-incompatible change was made to the compiler.
readOnlyTrue
typestring
createTime
descriptionOutput only. The timestamp of when the rule was created. Populated in FULL view.
formatgoogle-datetime
readOnlyTrue
typestring
dataTables
descriptionOutput only. Resource names of the data tables used in this rule.
items
typestring
readOnlyTrue
typearray
displayName
descriptionOutput only. Display name of the rule. Populated in BASIC view and FULL view.
readOnlyTrue
typestring
etag
descriptionThe etag for this rule. If this is provided on update, the request will succeed if and only if it matches the server-computed value, and will fail with an ABORTED error otherwise. Populated in BASIC view and FULL view.
typestring
inputsUsed
$refInputsUsed
descriptionOutput only. The set of inputs used in the rule. For example, if the rule uses $e.principal.hostname, then the uses_udm field will be true.
readOnlyTrue
metadata
additionalProperties
typestring
descriptionOutput only. Additional metadata specified in the meta section of text. Populated in FULL view.
readOnlyTrue
typeobject
name
descriptionFull resource name for the rule. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}
typestring
nearRealTimeLiveRuleEligible
descriptionOutput only. Indicate the rule can run in near real time live rule. If this is true, the rule uses the near real time live rule when the run frequency is set to LIVE.
readOnlyTrue
typeboolean
referenceLists
descriptionOutput only. Resource names of the reference lists used in this rule. Populated in FULL view.
items
typestring
readOnlyTrue
typearray
revisionCreateTime
descriptionOutput only. The timestamp of when the rule revision was created. Populated in FULL, REVISION_METADATA_ONLY views.
formatgoogle-datetime
readOnlyTrue
typestring
revisionId
descriptionOutput only. The revision ID of the rule. A new revision is created whenever the rule text is changed in any way. Format: v_{10 digits}_{9 digits} Populated in REVISION_METADATA_ONLY view and FULL view.
readOnlyTrue
typestring
scope
descriptionResource name of the DataAccessScope bound to this rule. Populated in BASIC view and FULL view. If reference lists are used in the rule, validations will be performed against this scope to ensure that the reference lists are compatible with both the user's and the rule's scopes. The scope should be in the format: "projects/{project}/locations/{location}/instances/{instance}/dataAccessScopes/{scope}".
typestring
severity
$refSeverity
descriptionOutput only. The severity of the rule as specified in the meta section of text. Populated in BASIC view and FULL view.
readOnlyTrue
text
descriptionThe YARA-L content of the rule. Populated in FULL view.
typestring
type
descriptionOutput only. User-facing type of the rule. Extracted from the events section of rule text. Populated in BASIC view and FULL view.
enum
  • RULE_TYPE_UNSPECIFIED
  • SINGLE_EVENT
  • MULTI_EVENT
enumDescriptions
  • The rule type is unspecified/unknown.
  • Rule checks for the existence of a single event.
  • Rule checks for correlation between multiple events
readOnlyTrue
typestring
typeobject
RuleDeployment
descriptionThe RuleDeployment resource represents the deployment state of a Rule.
idRuleDeployment
properties
alerting
descriptionWhether detections resulting from this deployment should be considered alerts.
typeboolean
archiveTime
descriptionOutput only. The timestamp when the rule deployment archive state was last set to true. If the rule deployment's current archive state is not set to true, the field will be empty.
formatgoogle-datetime
readOnlyTrue
typestring
archived
descriptionThe archive state of the rule deployment. Cannot be set to true unless enabled is set to false. If set to true, alerting will automatically be set to false. If currently set to true, enabled, alerting, and run_frequency cannot be updated.
typeboolean
consumerRules
descriptionOutput only. The names of the associated/chained consumer rules. Rules are considered consumers of this rule if their rule text explicitly filters on this rule's ruleid. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}
items
typestring
readOnlyTrue
typearray
enabled
descriptionWhether the rule is currently deployed continuously against incoming data.
typeboolean
executionState
descriptionOutput only. The execution state of the rule deployment.
enum
  • EXECUTION_STATE_UNSPECIFIED
  • DEFAULT
  • LIMITED
  • PAUSED
enumDescriptions
  • Unspecified or unknown execution state.
  • Default execution state.
  • Rules in limited state may not have their executions guaranteed.
  • Paused rules are not executed at all.
readOnlyTrue
typestring
lastAlertStatusChangeTime
descriptionOutput only. The timestamp when the rule deployment alert state was lastly changed. This is filled regardless of the current alert state. E.g. if the current alert status is false, this timestamp will be the timestamp when the alert status was changed to false.
formatgoogle-datetime
readOnlyTrue
typestring
name
descriptionRequired. The resource name of the rule deployment. Note that RuleDeployment is a child of the overall Rule, not any individual revision, so the resource ID segment for the Rule resource must not reference a specific revision. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}/deployment
typestring
producerRules
descriptionOutput only. The names of the associated/chained producer rules. Rules are considered producers for this rule if this rule explicitly filters on their ruleid. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}
items
typestring
readOnlyTrue
typearray
runFrequency
descriptionThe run frequency of the rule deployment.
enum
  • RUN_FREQUENCY_UNSPECIFIED
  • LIVE
  • HOURLY
  • DAILY
enumDescriptions
  • The run frequency is unspecified/unknown.
  • Executes in real time.
  • Executes once per hour.
  • Executes once per day.
typestring
typeobject
RuntimeError
idRuntimeError
properties
errorText
typestring
timeRange
$refInterval
typeobject
SSLCertificate
descriptionSSL certificate.
idSSLCertificate
properties
certExtensions
additionalProperties
descriptionProperties of the object.
typeany
descriptionCertificate's extensions.
typeobject
certSignature
$refCertSignature
descriptionCertificate's signature and algorithm.
ec
$refEC
descriptionEC public key information.
extension
$refExtension
deprecatedTrue
description(DEPRECATED) certificate's extension.
firstSeenTime
descriptionDate the certificate was first retrieved by VirusTotal.
formatgoogle-datetime
typestring
issuer
$refSubject
descriptionCertificate's issuer data.
publicKey
$refPublicKey
descriptionPublic key information.
serialNumber
descriptionCertificate's serial number hexdump.
typestring
signatureAlgorithm
descriptionAlgorithm used for the signature (for example, "sha1RSA").
typestring
size
descriptionCertificate content length.
formatint64
typestring
subject
$refSubject
descriptionCertificate's subject data.
thumbprint
descriptionCertificate's content SHA1 hash.
typestring
thumbprintSha256
descriptionCertificate's content SHA256 hash.
typestring
validity
$refValidity
descriptionCertificate's validity period.
version
descriptionCertificate version (typically "V1", "V2" or "V3").
typestring
typeobject
ScopeInfo
descriptionScopeInfo specifies the scope info of the reference list.
idScopeInfo
properties
referenceListScope
$refReferenceListScope
descriptionRequired. The list of scope names of the reference list, if the list is empty the reference list is treated as unscoped.
typeobject
SearchDataTableColumnInfo
idSearchDataTableColumnInfo
properties
isDefault
typeboolean
originalColumn
typestring
typeobject
SearchDataTableInfo
idSearchDataTableInfo
properties
columnInfo
items
$refSearchDataTableColumnInfo
typearray
dataTable
typestring
typeobject
SearchDataTableRow
idSearchDataTableRow
properties
column
typestring
value
typestring
typeobject
SearchDataTableRowInfo
idSearchDataTableRowInfo
properties
dataTable
typestring
rows
items
$refSearchDataTableRow
typearray
typeobject
SecurityResult
descriptionSecurity related metadata for the event. A security result might be something like "virus detected and quarantined," "malicious connection blocked," or "sensitive data included in document foo.doc." Each security result, of which there may be more than one, may either pertain to the whole event, or to a specific object or device referenced in the event (e.g. a malicious file that was detected, or a sensitive document sent as an email attachment). For security results that apply to a particular object referenced in the event, the security_results message MUST contain details about the implicated object (such as process, user, IP, domain, URL, IP, or email address) in the about field. For security results that apply to the entire event (e.g. SPAM found in this email), the about field must remain empty.
idSecurityResult
properties
about
$refNoun
descriptionIf the security result is about a specific entity (Noun), add it here. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
action
descriptionActions taken for this event. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
items
enum
  • UNKNOWN_ACTION
  • ALLOW
  • BLOCK
  • ALLOW_WITH_MODIFICATION
  • QUARANTINE
  • FAIL
  • CHALLENGE
enumDescriptions
  • The default action.
  • Allowed.
  • Blocked.
  • Strip, modify something (e.g. File or email was disinfected or rewritten and still forwarded).
  • Put somewhere for later analysis (does NOT imply block).
  • Failed (e.g. the event was allowed but failed).
  • Challenged (e.g. the user was challenged by a Captcha, 2FA).
typestring
typearray
actionDetails
descriptionThe detail of the action taken as provided by the vendor. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
typestring
alertState
descriptionThe alerting types of this security result. This is primarily set for rule-generated detections and alerts.
enum
  • UNSPECIFIED
  • NOT_ALERTING
  • ALERTING
enumDescriptions
  • The security result type is not known.
  • The security result is not an alert.
  • The security result is an alert.
typestring
analyticsMetadata
descriptionStores metadata about each risk analytic metric the rule uses. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
items
$refAnalyticsMetadata
typearray
associations
descriptionAssociations related to the threat. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
items
$refAssociation
typearray
attackDetails
$refAttackDetails
descriptionMITRE ATT&CK details. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
campaigns
descriptionCampaigns using this IOC threat. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
items
typestring
typearray
category
descriptionThe security category. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
items
enum
  • UNKNOWN_CATEGORY
  • SOFTWARE_MALICIOUS
  • SOFTWARE_SUSPICIOUS
  • SOFTWARE_PUA
  • NETWORK_MALICIOUS
  • NETWORK_SUSPICIOUS
  • NETWORK_CATEGORIZED_CONTENT
  • NETWORK_DENIAL_OF_SERVICE
  • NETWORK_RECON
  • NETWORK_COMMAND_AND_CONTROL
  • ACL_VIOLATION
  • AUTH_VIOLATION
  • EXPLOIT
  • DATA_EXFILTRATION
  • DATA_AT_REST
  • DATA_DESTRUCTION
  • TOR_EXIT_NODE
  • MAIL_SPAM
  • MAIL_PHISHING
  • MAIL_SPOOFING
  • POLICY_VIOLATION
  • SOCIAL_ENGINEERING
  • PHISHING
enumDescriptions
  • The default category.
  • Malware, spyware, rootkit.
  • Below the conviction threshold; probably bad.
  • Potentially Unwanted App (such as adware).
  • Includes C&C or network exploit.
  • Suspicious activity, such as potential reverse tunnel.
  • Non-security related: URL has category like gambling or porn.
  • DoS, DDoS.
  • Port scan detected by an IDS, probing of web app.
  • If we know this is a C&C channel.
  • Unauthorized access attempted, including attempted access to files, web services, processes, web objects, etc.
  • Authentication failed (e.g. bad password or bad 2-factor authentication).
  • Exploit: For all manner of exploits including attempted overflows, bad protocol encodings, ROP, SQL injection, etc. For both network and host- based exploits.
  • DLP: Sensitive data transmission, copy to thumb drive.
  • DLP: Sensitive data found at rest in a scan.
  • Attempt to destroy/delete data.
  • TOR Exit Nodes.
  • Spam email, message, etc.
  • Phishing email, chat messages, etc.
  • Spoofed source email address, etc.
  • Security-related policy violation (e.g. firewall/proxy/HIPS rule violated, NAC block action).
  • Threats which manipulate to break normal security procedures.
  • Phishing pages, pops, https phishing etc.
typestring
typearray
categoryDetails
descriptionFor vendor-specific categories. For web categorization, put type in here such as "gambling" or "porn". This field is not populated when the SecurityResult appears in a finding (a detection or alert).
items
typestring
typearray
confidence
descriptionThe confidence level of the result as estimated by the product. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
enum
  • UNKNOWN_CONFIDENCE
  • LOW_CONFIDENCE
  • MEDIUM_CONFIDENCE
  • HIGH_CONFIDENCE
enumDescriptions
  • The default confidence level.
  • Low confidence.
  • Medium confidence.
  • High confidence.
typestring
confidenceDetails
descriptionAdditional detail with regards to the confidence of a security event as estimated by the product vendor. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
typestring
confidenceScore
descriptionThe confidence score of the security result. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
formatfloat
typenumber
description
descriptionA human-readable description (e.g. "user password was wrong"). This can be more detailed than the summary.
typestring
detectionDepth
descriptionThe depth of the detection chain. Applies only to composite detections.
formatint64
typestring
detectionFields
descriptionAn ordered list of values, that represent fields in detections for a security finding. This list represents mapping of names of requested entities to their values (the security result matched variables). This is only populated when the SecurityResult appears in a finding (a detection or alert).
items
$refLabel
typearray
firstDiscoveredTime
descriptionFirst time the IoC threat was discovered in the provider. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
formatgoogle-datetime
typestring
lastDiscoveredTime
descriptionLast time the IoC was seen in the provider data. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
formatgoogle-datetime
typestring
lastUpdatedTime
descriptionLast time the IoC threat was updated in the provider. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
formatgoogle-datetime
typestring
outcomes
descriptionA list of outcomes that represent the results of this security finding. This list represents a mapping of names of the requested outcomes, to a stringified version of their values. This is only populated when the SecurityResult appears in a finding (a detection or alert).
items
$refLabel
typearray
priority
descriptionThe priority of the result. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
enum
  • UNKNOWN_PRIORITY
  • LOW_PRIORITY
  • MEDIUM_PRIORITY
  • HIGH_PRIORITY
enumDescriptions
  • Default priority level.
  • Low priority.
  • Medium priority.
  • High priority.
typestring
priorityDetails
descriptionVendor-specific information about the security result priority. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
typestring
reports
descriptionReports that reference this IOC threat. These are the report IDs. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
items
typestring
typearray
riskScore
descriptionThe risk score of the security result.
formatfloat
typenumber
ruleAuthor
descriptionAuthor of the security rule. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
typestring
ruleId
descriptionA vendor-specific ID for a rule, varying by observer type (e.g. "08123", "5d2b44d0-5ef6-40f5-a704-47d61d3babbe").
typestring
ruleLabels
descriptionA list of rule labels that can't be captured by the other fields in security result (e.g. "reference : AnotherRule", "contributor : John"). This is primarily set in rule-generated detections and alerts.
items
$refLabel
typearray
ruleName
descriptionName of the security rule (e.g. "BlockInboundToOracle").
typestring
ruleSet
descriptionThe curated detection's rule set identifier. (for example, "windows-threats") This is primarily set in rule-generated detections and alerts.
typestring
ruleSetDisplayName
descriptionThe curated detections rule set display name. This is primarily set in rule-generated detections and alerts.
typestring
ruleType
descriptionThe type of security rule.
typestring
ruleVersion
descriptionVersion of the security rule. (e.g. "v1.1", "00001", "1604709794", "2020-11-16T23:04:19+00:00"). Note that rule versions are source-dependant and lexical ordering should not be assumed.
typestring
rulesetCategoryDisplayName
descriptionThe curated detection rule set category display name. (for example, if rule_set_display_name is "CDIR SCC Enhanced Exfiltration", the rule_set_category is "Cloud Threats"). This is primarily set in rule-generated detections and alerts.
typestring
severity
descriptionThe severity of the result.
enum
  • UNKNOWN_SEVERITY
  • INFORMATIONAL
  • ERROR
  • NONE
  • LOW
  • MEDIUM
  • HIGH
  • CRITICAL
enumDescriptions
  • The default severity level.
  • Info severity.
  • An error.
  • No malicious result.
  • Low-severity malicious result.
  • Medium-severity malicious result.
  • High-severity malicious result.
  • Critical-severity malicious result.
typestring
severityDetails
descriptionVendor-specific severity. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
typestring
summary
descriptionA short human-readable summary (e.g. "failed login occurred")
typestring
threatFeedName
descriptionVendor feed name for a threat indicator feed. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
typestring
threatId
descriptionVendor-specific ID for a threat. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
typestring
threatIdNamespace
descriptionThe attribute threat_id_namespace qualifies threat_id with an id namespace to get an unique id. The attribute threat_id by itself is not unique across Chronicle as it is a vendor specific id. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
enum
  • NORMALIZED_TELEMETRY
  • RAW_TELEMETRY
  • RULE_DETECTIONS
  • UPPERCASE
  • MACHINE_INTELLIGENCE
  • SECURITY_COMMAND_CENTER
  • UNSPECIFIED
  • SOAR_ALERT
  • VIRUS_TOTAL
enumDescriptions
  • Ingested and Normalized telemetry events
  • Ingested Raw telemetry
  • Chronicle Rules engine
  • Uppercase
  • DSML - Machine Intelligence
  • A normalized telemetry event from Google Security Command Center.
  • Unspecified Namespace
  • An alert coming from other SIEMs via Chronicle SOAR.
  • VirusTotal.
typestring
threatName
descriptionA vendor-assigned classification common across multiple customers (for example, "W32/File-A", "Slammer"). This field is not populated when the SecurityResult appears in a finding (a detection or alert).
typestring
threatStatus
descriptionCurrent status of the threat This field is not populated when the SecurityResult appears in a finding (a detection or alert).
enum
  • THREAT_STATUS_UNSPECIFIED
  • ACTIVE
  • CLEARED
  • FALSE_POSITIVE
enumDescriptions
  • Default threat status
  • Active threat.
  • Cleared threat.
  • False positive.
typestring
threatVerdict
descriptionGCTI threat verdict on the security result entity. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
enum
  • THREAT_VERDICT_UNSPECIFIED
  • UNDETECTED
  • SUSPICIOUS
  • MALICIOUS
enumDescriptions
  • Unspecified threat verdict level.
  • Undetected threat verdict level.
  • Suspicious threat verdict level.
  • Malicious threat verdict level.
typestring
urlBackToProduct
descriptionURL that takes the user to the source product console for this event. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
typestring
variables
additionalProperties
$refFindingVariable
descriptionA list of outcomes and match variables that represent the results of this security finding. This list represents a mapping of names of the requested outcomes or match variables, to their values. This is only populated when the SecurityResult appears in a finding (a detection or alert).
typeobject
verdict
$refVerdict
deprecatedTrue
descriptionVerdict about the IoC from the provider. This field is now deprecated. Use VerdictInfo instead.
verdictInfo
descriptionVerdict information about the IoC from the provider. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
items
$refVerdictInfo
typearray
typeobject
Server
descriptionTransport Layer Security (TLS) information associated with the server (for example, Certificate or JA3 hash).
idServer
properties
certificate
$refCertificate
descriptionServer certificate.
ja3s
descriptionJA3 hash from the TLS ServerHello, as a hex-encoded string.
typestring
typeobject
Severity
descriptionSeverity represents the severity level of the rule.
idSeverity
properties
displayName
descriptionThe display name of the severity level. Extracted from the meta section of the rule text.
typestring
typeobject
SignatureInfo
descriptionFile signature information extracted from different tools.
idSignatureInfo
properties
codesign
$refFileMetadataCodesign
descriptionSignature information extracted from the codesign utility.
sigcheck
$refFileMetadataSignatureInfo
descriptionSignature information extracted from the sigcheck tool.
typeobject
SignerInfo
descriptionFile metadata related to the signer information.
idSignerInfo
properties
certIssuer
descriptionCompany that issued the certificate.
typestring
name
descriptionCommon name of the signers/certificate. The order of the signers matters. Each element is a higher level authority, the last being the root authority.
typestring
status
descriptionIt can say "Valid" or state the problem with the certificate if any (e.g. "This certificate or one of the certificates in the certificate chain is not time valid.").
typestring
validUsage
descriptionIndicates which situations the certificate is valid for (e.g. "Code Signing").
typestring
typeobject
Smtp
descriptionSMTP info. See RFC 2821.
idSmtp
properties
helo
descriptionThe client's 'HELO'/'EHLO' string.
typestring
isTls
descriptionIf the connection switched to TLS.
typeboolean
isWebmail
descriptionIf the message was sent via a webmail client.
typeboolean
mailFrom
descriptionThe client's 'MAIL FROM' string.
typestring
messagePath
descriptionThe message's path (extracted from the headers).
typestring
rcptTo
descriptionThe client's 'RCPT TO' string(s).
items
typestring
typearray
serverResponse
descriptionThe server's response(s) to the client.
items
typestring
typearray
typeobject
SoarAlertMetadata
descriptionMetadata fields of alerts coming from other SIEM systems.
idSoarAlertMetadata
properties
alertId
descriptionAlert ID in the source SIEM system.
typestring
product
descriptionName of the product the alert is coming from.
typestring
sourceRule
descriptionName of the rule triggering the alert in the source SIEM.
typestring
sourceSystem
descriptionName of the Source SIEM system.
typestring
sourceSystemTicketId
descriptionTicket id for the alert in the source system.
typestring
sourceSystemUri
descriptionUrl to the source SIEM system.
typestring
vendor
descriptionName of the vendor.
typestring
typeobject
Software
descriptionInformation about a software package or application.
idSoftware
properties
description
descriptionThe description of the software.
typestring
name
descriptionThe name of the software.
typestring
permissions
descriptionSystem permissions granted to the software. For example, "android.permission.WRITE_EXTERNAL_STORAGE"
items
$refPermission
typearray
vendorName
descriptionThe name of the software vendor.
typestring
version
descriptionThe version of the software.
typestring
typeobject
Source
descriptionDeprecated. Information about the threat intelligence source. These fields are used to model Mandiant sources.
idSource
properties
benignCount
descriptionCount of responses where this IoC was marked benign.
formatint32
typeinteger
maliciousCount
descriptionCount of responses where this IoC was marked malicious.
formatint32
typeinteger
name
descriptionName of the IoC source.
typestring
quality
descriptionQuality of the IoC mapping extracted from the source.
enum
  • UNKNOWN_CONFIDENCE
  • LOW_CONFIDENCE
  • MEDIUM_CONFIDENCE
  • HIGH_CONFIDENCE
enumDescriptions
  • The default confidence level.
  • Low confidence.
  • Medium confidence.
  • High confidence.
typestring
responseCount
descriptionTotal response count from this source.
formatint32
typeinteger
sourceCount
descriptionNumber of sources from which intelligence was extracted.
formatint32
typeinteger
threatIntelligenceSources
descriptionDifferent threat intelligence sources from which IoC info was extracted.
items
$refSource
typearray
typeobject
Status
descriptionThe `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors).
idStatus
properties
code
descriptionThe status code, which should be an enum value of google.rpc.Code.
formatint32
typeinteger
details
descriptionA list of messages that carry the error details. There is a common set of message types for APIs to use.
items
additionalProperties
descriptionProperties of the object. Contains field @type with type URL.
typeany
typeobject
typearray
message
descriptionA developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
typestring
typeobject
StringSequence
descriptionStringSequence represents a sequence of string.
idStringSequence
properties
stringVals
descriptionstring sequence.
items
typestring
typearray
typeobject
StringToInt64MapEntry
idStringToInt64MapEntry
properties
key
descriptionKey field.
typestring
value
descriptionValue field.
formatint64
typestring
typeobject
StringValue
idStringValue
properties
displayValue
typestring
rawValue
typestring
typeobject
StringValues
idStringValues
properties
values
items
$refStringValue
typearray
typeobject
Subject
descriptionSubject data.
idSubject
properties
commonName
descriptionCN: CommonName.
typestring
countryName
descriptionC: Country name.
typestring
locality
descriptionL: Locality.
typestring
organization
descriptionO: Organization.
typestring
organizationalUnit
descriptionOU: OrganizationalUnit.
typestring
stateOrProvinceName
descriptionST: StateOrProvinceName.
typestring
typeobject
Tactic
descriptionTactic information related to an attack or threat.
idTactic
properties
id
descriptionTactic ID (e.g. "TA0043").
typestring
name
descriptionTactic Name (e.g. "Reconnaissance")
typestring
typeobject
Tags
descriptionTags are event metadata which is set by examining event contents post-parsing. For example, a UDM event may be assigned a tenant_id based on certain customer-defined parameters.
idTags
properties
dataTapConfigName
descriptionA list of sink name values defined in DataTap configurations.
items
typestring
typearray
tenantId
descriptionA list of subtenant ids that this event belongs to.
items
formatbyte
typestring
typearray
typeobject
Technique
descriptionTechnique information related to an attack or threat.
idTechnique
properties
id
descriptionTechnique ID (e.g. "T1595").
typestring
name
descriptionTechnique Name (e.g. "Active Scanning").
typestring
subtechniqueId
descriptionSubtechnique ID (e.g. "T1595.001").
typestring
subtechniqueName
descriptionSubtechnique Name (e.g. "Scanning IP Blocks").
typestring
typeobject
TimeOff
descriptionSystem record for leave/time-off from a Human Capital Management (HCM) system.
idTimeOff
properties
description
descriptionDescription of the leave if available (e.g. 'Vacation').
typestring
interval
$refInterval
descriptionInterval duration of the leave.
typeobject
Tls
descriptionTransport Layer Security (TLS) information.
idTls
properties
cipher
descriptionCipher used during the connection.
typestring
client
$refClient
descriptionCertificate information for the client certificate.
curve
descriptionElliptical curve used for a given cipher.
typestring
established
descriptionIndicates whether the TLS negotiation was successful.
typeboolean
nextProtocol
descriptionProtocol to be used for tunnel.
typestring
resumed
descriptionIndicates whether the TLS connection was resumed from a previous TLS negotiation.
typeboolean
server
$refServer
descriptionCertificate information for the server certificate.
version
descriptionTLS version.
typestring
versionProtocol
descriptionProtocol.
typestring
typeobject
Tracker
descriptionURL Tracker.
idTracker
properties
id
descriptionTracker ID, if available.
typestring
timestamp
descriptionTracker ingestion date.
formatgoogle-datetime
typestring
tracker
descriptionTracker name.
typestring
url
descriptionTracker script URL.
typestring
typeobject
Tunnels
descriptionVPN tunnels.
idTunnels
properties
provider
descriptionThe provider of the VPN tunnels being used.
typestring
type
descriptionThe type of the VPN tunnels.
typestring
typeobject
UDM
descriptionA Unified Data Model event.
idUDM
properties
about
descriptionRepresents entities referenced by the event that are not otherwise described in principal, src, target, intermediary or observer. For example, it could be used to track email file attachments, domains/URLs/IPs embedded within an email body, and DLLs that are loaded during a PROCESS_LAUNCH event.
items
$refNoun
typearray
additional
additionalProperties
descriptionProperties of the object.
typeany
descriptionAny important vendor-specific event data that cannot be adequately represented within the formal sections of the UDM model.
typeobject
extensions
$refExtensions
descriptionAll other first-class, event-specific metadata goes in this message. Do not place protocol metadata in Extensions; put it in Network.
extracted
additionalProperties
descriptionProperties of the object.
typeany
descriptionFlattened fields extracted from the log.
typeobject
intermediary
descriptionRepresents details on one or more intermediate entities processing activity described in the event. This includes device details about a proxy server or SMTP relay server. If an active event (that has a principal and possibly target) passes through any intermediaries, they're added here. Intermediaries can impact the overall action, for example blocking or modifying an ongoing request. A rule of thumb here is that 'principal', 'target', and description of the initial action should be the same regardless of the intermediary or its action. A successful network connection from A->B should look the same in principal/target/intermediary as one blocked by firewall C: principal: A, target: B (intermediary: C).
items
$refNoun
typearray
metadata
$refMetadata
descriptionEvent metadata such as timestamp, source product, etc.
network
$refNetwork
descriptionAll network details go here, including sub-messages with details on each protocol (for example, DHCP, DNS, or HTTP).
observer
$refNoun
descriptionRepresents an observer entity (for example, a packet sniffer or network-based vulnerability scanner), which is not a direct intermediary, but which observes and reports on the event in question.
principal
$refNoun
descriptionRepresents the acting entity that originates the activity described in the event. The principal must include at least one machine detail (hostname, MACs, IPs, port, product-specific identifiers like an EDR asset ID) or user detail (for example, username), and optionally include process details. It must NOT include any of the following fields: email, files, registry keys or values.
securityResult
descriptionA list of security results.
items
$refSecurityResult
typearray
src
$refNoun
descriptionRepresents a source entity being acted upon by the participant along with the device or process context for the source object (the machine where the source object resides). For example, if user U copies file A on machine X to file B on machine Y, both file A and machine X would be specified in the src portion of the UDM event.
target
$refNoun
descriptionRepresents a target entity being referenced by the event or an object on the target entity. For example, in a firewall connection from device A to device B, A is described as the principal and B is described as the target. For a process injection by process C into target process D, process C is described as the principal and process D is described as the target.
typeobject
UdmColumnList
idUdmColumnList
properties
values
items
$refUdmColumnValue
typearray
typeobject
UdmColumnType
idUdmColumnType
properties
list
$refUdmColumnList
value
$refUdmColumnValue
typeobject
UdmColumnValue
idUdmColumnValue
properties
boolVal
typeboolean
bytesVal
formatbyte
typestring
dateVal
$refDate
doubleVal
formatdouble
typenumber
int64Val
formatint64
typestring
nullVal
typeboolean
protoVal
additionalProperties
descriptionProperties of the object. Contains field @type with type URL.
typeany
typeobject
stringVal
typestring
timestampVal
formatgoogle-datetime
typestring
uint64Val
formatuint64
typestring
typeobject
UdmEventInfo
idUdmEventInfo
properties
alertNumber
formatint32
typeinteger
annotations
items
enum
  • ANNOTATION_UNSPECIFIED
  • ANNOTATION_ALERT
enumDescriptions
typestring
typearray
chip
$refChip
deprecatedTrue
connectedComponentLabel
descriptionOptional.
formatbyte
typestring
datatableRowInfo
items
$refSearchDataTableRowInfo
typearray
detections
items
$refCollection
typearray
displayName
deprecatedTrue
typestring
entity
$refBackstoryEntity
event
$refUDM
eventLogToken
typestring
filterProperties
$refFilterProperties
deprecatedTrue
outcomes
items
$refUdmColumnType
typearray
tenantId
descriptionOptional.
typestring
uid
formatbyte
typestring
typeobject
UdmEventList
idUdmEventList
properties
columnNames
$refColumnNames
complete
typeboolean
datatableInfo
items
$refSearchDataTableInfo
typearray
events
items
$refUdmEventInfo
typearray
progress
formatdouble
typenumber
tooManyEvents
typeboolean
typeobject
UdmFieldAggregation
idUdmFieldAggregation
properties
aggregationType
enum
  • UNSPECIFIED_FIELD_AGGREGATION_TYPE
  • UDM_FIELD_AGGREGATION_TYPE
  • ENTITY_FIELD_AGGREGATION_TYPE
enumDescriptions
typestring
allValues
items
$refUdmValueCount
typearray
baselineEventCount
formatint32
typeinteger
bottomValues
items
$refUdmValueCount
typearray
eventCount
formatint32
typeinteger
fieldName
typestring
tooManyValues
typeboolean
topValues
items
$refUdmValueCount
typearray
valueCount
formatint32
typeinteger
typeobject
UdmFieldAggregations
idUdmFieldAggregations
properties
complete
typeboolean
fields
items
$refUdmFieldAggregation
typearray
groupByFields
items
$refGroupAggregationByField
typearray
typeobject
UdmFieldValue
idUdmFieldValue
properties
boolValue
typeboolean
bytesValue
formatbyte
typestring
doubleValue
formatdouble
typenumber
enumValue
typestring
floatValue
formatfloat
typenumber
int32Value
formatint32
typeinteger
int64Value
formatint64
typestring
isNull
typeboolean
stringValue
typestring
timestampValue
formatgoogle-datetime
typestring
uint32Value
formatuint32
typeinteger
uint64Value
formatuint64
typestring
typeobject
UdmPrevalence
idUdmPrevalence
properties
artifacts
items
$refFieldAndValue
typearray
prevalence
formatint32
typeinteger
typeobject
UdmPrevalenceBucket
idUdmPrevalenceBucket
properties
prevalence
items
$refUdmPrevalence
typearray
typeobject
UdmPrevalenceResponse
idUdmPrevalenceResponse
properties
buckets
items
$refUdmPrevalenceBucket
typearray
partialPrevalence
typeboolean
typeobject
UdmSearchOperationMetadata
descriptionInformation about a UDM Search operation. This message is used to populate the `metadata` field of `Operation` resources created by UDM Search.
idUdmSearchOperationMetadata
properties
baselineEventsCount
descriptionThe number of events matching the baseline query so far.
formatint32
typeinteger
baselineQuery
descriptionQuery used to search for events.
typestring
baselineTimeRange
$refInterval
descriptionThe time range used for the baseline query [inclusive start time, exclusive end time).
caseInsensitive
descriptionIf true, the search was performed in a case-insensitive manner.
typeboolean
endTime
descriptionThe end time of the operation, if done.
formatgoogle-datetime
typestring
expireTime
descriptionThe time when the operation results expire. This time may change while the operation is in progress. If unset, the results never expire.
formatgoogle-datetime
typestring
filteredEventsCount
descriptionThe number of events matching the snapshot query so far. This is <= `baseline_events_count`. If the snapshot query is empty, this will be equal to `baseline_events_count`.
formatint32
typeinteger
progress
descriptionA value from 0 to 1 representing the progress of the operation.
formatdouble
typenumber
snapshotQuery
descriptionQuery used to filter the baseline query's events.
typestring
snapshotTimeRange
$refInterval
descriptionTime range used to filter the baseline query's events [inclusive start time, exclusive end time). This time range is completely within `baseline_time_range`. If not set, it is assumed to match `baseline_time_range`.
startTime
descriptionThe start time of the operation.
formatgoogle-datetime
typestring
statsRowsCount
descriptionThe total number of rows returned for a stats query.
formatint32
typeinteger
typeobject
UdmValueCount
idUdmValueCount
properties
baselineEventCount
formatint32
typeinteger
eventCount
formatint32
typeinteger
value
$refUdmFieldValue
typeobject
Uint64Sequence
descriptionUint64Sequence represents a sequence of uint64s.
idUint64Sequence
properties
uint64Vals
descriptionuint64 sequence.
items
formatuint64
typestring
typearray
typeobject
Url
descriptionUrl.
idUrl
properties
categories
descriptionCategorisation done by VirusTotal partners.
items
typestring
typearray
favicon
$refFavicon
descriptionDifference hash and MD5 hash of the URL's.
htmlMeta
additionalProperties
descriptionProperties of the object.
typeany
descriptionMeta tags (only for URLs downloading HTML).
typeobject
lastFinalUrl
descriptionIf the original URL redirects, where does it end.
typestring
lastHttpResponseCode
descriptionHTTP response code of the last response.
formatint32
typeinteger
lastHttpResponseContentLength
descriptionLength in bytes of the content received.
formatint64
typestring
lastHttpResponseContentSha256
descriptionURL response body's SHA256 hash.
typestring
lastHttpResponseCookies
additionalProperties
descriptionProperties of the object.
typeany
descriptionWebsite's cookies.
typeobject
lastHttpResponseHeaders
additionalProperties
descriptionProperties of the object.
typeany
descriptionHeaders and values of the last HTTP response.
typeobject
tags
descriptionTags.
items
typestring
typearray
title
descriptionWebpage title.
typestring
trackers
descriptionTrackers found in the URL in a historical manner.
items
$refTracker
typearray
url
descriptionURL.
typestring
typeobject
User
descriptionInformation about a user.
idUser
properties
accountExpirationTime
descriptionUser account expiration timestamp.
formatgoogle-datetime
typestring
accountLockoutTime
descriptionUser account lockout timestamp.
formatgoogle-datetime
typestring
accountType
descriptionType of user account (for example, service, domain, or cloud). This is somewhat aligned to: https://attack.mitre.org/techniques/T1078/
enum
  • ACCOUNT_TYPE_UNSPECIFIED
  • DOMAIN_ACCOUNT_TYPE
  • LOCAL_ACCOUNT_TYPE
  • CLOUD_ACCOUNT_TYPE
  • SERVICE_ACCOUNT_TYPE
  • DEFAULT_ACCOUNT_TYPE
enumDescriptions
  • Default user account type.
  • A human account part of some domain in directory services.
  • A local machine account.
  • A SaaS service account type (such as Slack or GitHub).
  • A non-human account for data access.
  • A system built in default account.
typestring
attribute
$refAttribute
descriptionGeneric entity metadata attributes of the user.
companyName
descriptionUser job company name.
typestring
department
descriptionUser job department
items
typestring
typearray
emailAddresses
descriptionEmail addresses of the user. This field can be used as an entity indicator for user entities.
items
typestring
typearray
employeeId
descriptionHuman capital management identifier. This field can be used as an entity indicator for user entities.
typestring
firstName
descriptionFirst name of the user (e.g. "John").
typestring
firstSeenTime
descriptionThe first observed time for a user. The value is calculated on the basis of the first time the identifier was observed.
formatgoogle-datetime
typestring
groupIdentifiers
descriptionProduct object identifiers of the group(s) the user belongs to A vendor-specific identifier to uniquely identify the group(s) the user belongs to (a GUID, LDAP OID, or similar).
items
typestring
typearray
groupid
deprecatedTrue
descriptionThe ID of the group that the user belongs to. Deprecated in favor of the repeated group_identifiers field.
typestring
hireDate
descriptionUser job employment hire date.
formatgoogle-datetime
typestring
lastBadPasswordAttemptTime
descriptionUser last bad password attempt timestamp.
formatgoogle-datetime
typestring
lastLoginTime
descriptionUser last login timestamp.
formatgoogle-datetime
typestring
lastName
descriptionLast name of the user (e.g. "Locke").
typestring
lastPasswordChangeTime
descriptionUser last password change timestamp.
formatgoogle-datetime
typestring
managers
descriptionUser job manager(s).
items
$refUser
typearray
middleName
descriptionMiddle name of the user.
typestring
officeAddress
$refLocation
descriptionUser job office location.
passwordExpirationTime
descriptionUser password expiration timestamp.
formatgoogle-datetime
typestring
personalAddress
$refLocation
descriptionPersonal address of the user.
phoneNumbers
descriptionPhone numbers for the user.
items
typestring
typearray
productObjectId
descriptionA vendor-specific identifier to uniquely identify the entity (e.g. a GUID, LDAP, OID, or similar). This field can be used as an entity indicator for user entities.
typestring
roleDescription
deprecatedTrue
descriptionSystem role description for user. Deprecated: use attribute.roles.
typestring
roleName
deprecatedTrue
descriptionSystem role name for user. Deprecated: use attribute.roles.
typestring
terminationDate
descriptionUser job employment termination date.
formatgoogle-datetime
typestring
timeOff
descriptionUser time off leaves from active work.
items
$refTimeOff
typearray
title
descriptionUser job title.
typestring
userAuthenticationStatus
descriptionSystem authentication status for user.
enum
  • UNKNOWN_AUTHENTICATION_STATUS
  • ACTIVE
  • SUSPENDED
  • NO_ACTIVE_CREDENTIALS
  • DELETED
enumDescriptions
  • The default authentication status.
  • The authentication method is in active state.
  • The authentication method is in suspended/disabled state.
  • The authentication method has no active credentials.
  • The authentication method has been deleted.
typestring
userDisplayName
descriptionThe display name of the user (e.g. "John Locke").
typestring
userRole
deprecatedTrue
descriptionSystem role for user. Deprecated: use attribute.roles.
enum
  • UNKNOWN_ROLE
  • ADMINISTRATOR
  • SERVICE_ACCOUNT
enumDeprecated
  • False
  • False
  • True
enumDescriptions
  • Default user role.
  • Product administrator with elevated privileges.
  • System service account for automated privilege access. Deprecated: not a role, instead set User.account_type.
typestring
userid
descriptionThe ID of the user. This field can be used as an entity indicator for user entities.
typestring
windowsSid
descriptionThe Microsoft Windows SID of the user. This field can be used as an entity indicator for user entities.
typestring
typeobject
UserAgentProto
idUserAgentProto
properties
annotation
items
$refAnnotation
typearray
browser
descriptionProduct brand within the family: Firefox, Netscape, Camino etc.. Or Earth, Windows-Media-Player etc.. for non-browser user agents.
typestring
browserEngineVersion
descriptionVersion of the rendering engine e.g. "8.01" for "Opera/8.01"
typestring
browserVersion
descriptionMinor and lower versions unavailable with reduced User-Agent and no client hints (go/ua-reduction-ua-string-reference).
typestring
carrier
descriptionMobile specific: name of mobile carrier
typestring
device
description(Usually) Mobile specific: name of hardware device, may or may not contain the full model name. e.g. iPhone, Palm750, SPH-M800. Reduced to "K" for Android devices with reduced User-Agent and no client hints (go/ua-reduction-ua-string-reference).
typestring
deviceVersion
description(Usually) Mobile specific: version of hardware device Unavailable with reduced User-Agent and no client hints (go/ua-reduction-ua-string-reference).
typestring
family
descriptionUser agent family captures the type of browser/app at a high-level e.g. MSIE, Gecko, Safari etc..
enum
  • USER_DEFINED
  • MSIE
  • GECKO
  • APPLEWEBKIT
  • OPERA
  • KHTML
  • OTHER
  • APPLE
  • BLACKBERRY
  • DOCOMO
  • GOOGLE
  • OPENWAVE
  • POLARIS
  • OBIGO
  • TELECA
  • MICROSOFT
  • NOKIA
  • NETFRONT
  • SEMC
  • SMIT
  • KOREAN
  • CLIENT_HINTS
enumDescriptions
  • Used to represent new families supported by user-defined parsers
  • Desktop user agent families
  • WebKit based browsers e.g. Safari
  • e.g. Konqueror
  • Mobile and non-browser user agent families UA's w/o enough data to fit into a family
  • Apple apps e.g. YouTube on iPhone
  • Google Earth, Sketchup, UpdateChecker etc...
  • UP.Browser
  • Windows Media Player, RSS platform etc...
  • Sony Ericsson Mobile Communications
  • SKT, LGT
  • Constructed from UA-CH instead of UserAgent string.
typestring
googleToolbarVersion
descriptionVersion number of GoogleToolbar, if installed. Applies only to MSIE and Firefox at this time.
typestring
javaConfiguration
descriptionMobile specific: e.g. Configuration/CLDC-1.1
typestring
javaConfigurationVersion
typestring
javaProfile
descriptionMobile specific: e.g. Profile/MIDP-2.0
typestring
javaProfileVersion
typestring
locale
descriptionLocale in which the browser is running as country code and optionally language pair. Unavailable with reduced User-Agent and no client hints (go/ua-reduction-ua-string-reference).
typestring
messaging
descriptionMobile specific: e.g. MMP/2.0
typestring
messagingVersion
typestring
os
descriptionFull name of the operating system e.g. "Darwin/9.7.0", "Android 1.5", "Windows 98" Version is reduced, and other data might also be missing, for reduced User-Agent and no client hints (go/ua-reduction-ua-string-reference).
typestring
osVariant
descriptionExtra qualifier for the OS e.g. "(i386)", "Build/CUPCAKE", "PalmSource/Palm-D061" Unavailable with reduced User-Agent and no client hints (go/ua-reduction-ua-string-reference).
typestring
platform
descriptionThe platform describes the environment in which the browser or app runs. For desktop user agents, Platform is a string describing the OS family e.g. Windows, Macintosh, Linux. For mobile user agents, Platform either describes the OS family (if available) or the hardware maker. e.g. Linux, or HTC, LG, Palm.
typestring
security
descriptionSecurity level reported by user agent, either U, I or N. Unavailable with reduced User-Agent and no client hints (go/ua-reduction-ua-string-reference).
typestring
subFamily
descriptionSub-family identifies individual regexps when a family has more than 1. This is used to generate the right UA string from a protobuf. Examples in the AppleWebKit family: Chrome and Safari. Can also be an arbitrary identifier.
typestring
typeobject
UserError
descriptionThis message exists solely to get the `UserErrorReason` enum to appear in the service discovery document.
idUserError
properties
reason
descriptionThe reason for a specific error that should be shown to the app user.
enum
  • USER_ERROR_REASON_UNSPECIFIED
  • RULE_REFERENCES_OUT_OF_SCOPE
  • RULE_ARCHIVED
  • RULE_STALE_VERSION
  • RULE_ACTIVE
  • RULE_RETROHUNT_RUNNING
  • RULE_LIVE
  • RULE_ALREADY_DISABLED
  • EXPENSIVE_RULE_LARGE_WINDOW
  • RULE_LIMITED_PAUSED
  • REFERENCE_LIST_NOT_FOUND
  • UEBA_RULES_NO_SCOPE
  • RULE_TESTING_INTERVAL_TOO_SHORT
  • SEARCH_CSV_FIELDS_NOT_SUPPORTED
  • INVALID_ARGUMENT_FOR_DASHBOARD_FILTER
  • INVALID_CONFIG_FOR_DASHBOARD_IMPORT
  • RETROHUNT_LIMIT_REACHED
enumDescriptions
  • Do not use this default value.
  • The rule text references resources, such as reference lists, that are out of scope for the rule. Example of an ErrorInfo for this reason: { "reason": "RULE_REFERENCES_OUT_OF_SCOPE", "domain": "chronicle.googleapis.com", "metadata": { "reference_lists": "list_name1,list_name2,list_name3,", } }
  • The rule being operated on (saving or setting run frequency) is archived, and so the operation can't be done.
  • The rule version being operated on is not the latest, and so the operation can't be done.
  • The rule can't be archived because it is live (detecting) and a retrohunt is running.
  • The rule can't be archived because a retrohunt is running against it.
  • The rule can't be archived because it is live (detecting).
  • The rule can't be disabled because is is already disabled.
  • The rule's match time window is too large for its current run frequency.
  • The rule can't be enabled because it has been limited or paused because of high resource use.
  • The list being referred to doesn't exist.
  • UEBA rules may not be assigned a data access scope.
  • The rule's match window is longer than the time range it's being tested over. Returns the match window duration and testing interval duration as metadata labeled `match_window_duration` and `testing_interval_duration`, formatted as Go durations. Example ErrorInfo: { "reason": "RULE_TESTING_INTERVAL_TOO_SHORT", "domain": "chronicle.googleapis.com", "metadata": { "match_window_duration": "24h", "testing_interval_duration": "12h", } }
  • The CSV fields are not supported for download. Returns the unsupported fields as metadata labeled `unsupported_fields`. Example ErrorInfo: { "reason": "SEARCH_CSV_FIELDS_NOT_SUPPORTED", "domain": "chronicle.googleapis.com", "metadata": { "unsupported_fields": "udm.about.security_result.variables,udm.network.http.parsed_user_agent.family", } }
  • Invalid argument for dashboard chart filters. Returns the filter name, filter value, operator, and expected type as metadata labeled `filter_name`, `filter_value`, `operator`, and `expected_type`, respectively. Example ErrorInfo: { "reason": "INVALID_ARGUMENT_FOR_DASHBOARD_FILTER", "domain": "chronicle.googleapis.com", "metadata": { "filter_name": "filter_name", "filter_value": "filter_value", "operater": "operator", "expected_type": "expected_type", } }
  • Invalid config for dashboard import. Example ErrorInfo: { "reason": "INVALID_CONFIG_FOR_DASHBOARD_IMPORT", "domain": "chronicle.googleapis.com", }
  • The user has reached the limit of retrohunts that can be run. Returns the retrohunt limit as metadata labeled `retrohunt_limit`. Example ErrorInfo: { "reason": "RETROHUNT_LIMIT_REACHED", "domain": "chronicle.googleapis.com", "metadata": { "retrohunt_limit": "10", } }
typestring
typeobject
Validity
descriptionDefines certificate's validity period.
idValidity
properties
expiryTime
descriptionExpiry date.
formatgoogle-datetime
typestring
issueTime
descriptionIssue date.
formatgoogle-datetime
typestring
typeobject
Verdict
descriptionDeprecated. Encapsulates the threat verdict provided by human analysts and ML models. These fields are used to model Mandiant sources.
idVerdict
properties
analystVerdict
$refAnalystVerdict
descriptionHuman analyst verdict provided by sources like Mandiant.
neighbourInfluence
descriptionDescribes the neighbour influence of the verdict.
typestring
responseCount
descriptionTotal response count across all sources.
formatint32
typeinteger
sourceCount
descriptionNumber of sources from which intelligence was extracted.
formatint32
typeinteger
verdict
$refProviderMLVerdict
descriptionML Verdict provided by sources like Mandiant.
typeobject
VerdictInfo
descriptionDescribes the threat verdict provided by human analysts and machine learning models. These fields are used to model Mandiant sources.
idVerdictInfo
properties
benignCount
descriptionCount of responses where this IoC was marked as benign.
formatint32
typeinteger
categoryDetails
descriptionTags related to the verdict.
typestring
confidenceScore
descriptionConfidence score of the verdict.
formatint32
typeinteger
globalCustomerCount
descriptionGlobal customer count over the last 30 days
formatint32
typeinteger
globalHitsCount
descriptionGlobal hit count over the last 30 days.
formatint32
typeinteger
iocStats
descriptionList of IoCStats from which the verdict was generated.
items
$refIoCStats
typearray
maliciousCount
descriptionCount of responses where this IoC was marked as malicious.
formatint32
typeinteger
neighbourInfluence
descriptionDescribes the near neighbor influence of the verdict.
typestring
pwn
descriptionWhether one or more Mandiant incident response customers had this indicator in their environment.
typeboolean
pwnFirstTaggedTime
descriptionThe timestamp of the first time a pwn was associated to this entity.
formatgoogle-datetime
typestring
responseCount
descriptionTotal response count across all sources.
formatint32
typeinteger
sourceCount
descriptionNumber of sources from which intelligence was extracted.
formatint32
typeinteger
sourceProvider
descriptionSource provider giving the machine learning verdict.
typestring
verdictResponse
descriptionDetails about the verdict.
enum
  • VERDICT_RESPONSE_UNSPECIFIED
  • MALICIOUS
  • BENIGN
enumDescriptions
  • The default verdict response type.
  • VerdictResponse resulted a threat as malicious.
  • VerdictResponse resulted a threat as benign.
typestring
verdictTime
descriptionTimestamp when the verdict was generated.
formatgoogle-datetime
typestring
verdictType
descriptionType of verdict.
enum
  • VERDICT_TYPE_UNSPECIFIED
  • PROVIDER_ML_VERDICT
  • ANALYST_VERDICT
enumDescriptions
  • Verdict category not specified.
  • MLVerdict result provided from threat providers, like Mandiant. These fields are used to model Mandiant sources.
  • Verdict provided by the human analyst. These fields are used to model Mandiant sources.
typestring
typeobject
Vulnerabilities
descriptionThe Vulnerabilities extension captures details on observed/detected vulnerabilities.
idVulnerabilities
properties
vulnerabilities
descriptionA list of vulnerabilities.
items
$refVulnerability
typearray
typeobject
Vulnerability
descriptionA vulnerability.
idVulnerability
properties
about
$refNoun
descriptionIf the vulnerability is about a specific noun (e.g. executable), then add it here.
cveDescription
descriptionCommon Vulnerabilities and Exposures Description. https://cve.mitre.org/about/faqs.html#what_is_cve_record
typestring
cveId
descriptionCommon Vulnerabilities and Exposures Id. https://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures https://cve.mitre.org/about/faqs.html#what_is_cve_id
typestring
cvssBaseScore
descriptionCVSS Base Score in the range of 0.0 to 10.0. Useful for sorting.
formatfloat
typenumber
cvssVector
descriptionVector of CVSS properties (e.g. "AV:L/AC:H/Au:N/C:N/I:P/A:C") Can be linked to via: https://nvd.nist.gov/vuln-metrics/cvss/v2-calculator
typestring
cvssVersion
descriptionVersion of CVSS Vector/Score.
typestring
description
descriptionDescription of the vulnerability.
typestring
firstFound
descriptionProducts that maintain a history of vuln scans should populate first_found with the time that a scan first detected the vulnerability on this asset.
formatgoogle-datetime
typestring
lastFound
descriptionProducts that maintain a history of vuln scans should populate last_found with the time that a scan last detected the vulnerability on this asset.
formatgoogle-datetime
typestring
name
descriptionName of the vulnerability (e.g. "Unsupported OS Version detected").
typestring
scanEndTime
descriptionIf the vulnerability was discovered during an asset scan, then this field should be populated with the time the scan ended. This field can be left unset if the end time is not available or not applicable.
formatgoogle-datetime
typestring
scanStartTime
descriptionIf the vulnerability was discovered during an asset scan, then this field should be populated with the time the scan started. This field can be left unset if the start time is not available or not applicable.
formatgoogle-datetime
typestring
severity
descriptionThe severity of the vulnerability.
enum
  • UNKNOWN_SEVERITY
  • LOW
  • MEDIUM
  • HIGH
  • CRITICAL
enumDescriptions
  • The default severity level.
  • Low severity.
  • Medium severity.
  • High severity.
  • Critical severity.
typestring
severityDetails
descriptionVendor-specific severity
typestring
vendor
descriptionVendor of scan that discovered vulnerability.
typestring
vendorKnowledgeBaseArticleId
descriptionVendor specific knowledge base article (e.g. "KBXXXXXX" from Microsoft). https://en.wikipedia.org/wiki/Microsoft_Knowledge_Base https://access.redhat.com/knowledgebase
typestring
vendorVulnerabilityId
descriptionVendor specific vulnerability id (e.g. Microsoft security bulletin id).
typestring
typeobject
Watchlist
descriptionA watchlist is a list of entities that allows for bulk operations over the included entities.
idWatchlist
properties
createTime
descriptionOutput only. Time the watchlist was created.
formatgoogle-datetime
readOnlyTrue
typestring
description
descriptionOptional. Description of the watchlist.
typestring
displayName
descriptionRequired. Display name of the watchlist. Note that it must be at least one character and less than 63 characters (https://google.aip.dev/148).
typestring
entityCount
$refEntityCount
descriptionOutput only. Entity count in the watchlist.
readOnlyTrue
entityPopulationMechanism
$refEntityPopulationMechanism
descriptionRequired. Mechanism to populate entities in the watchlist.
multiplyingFactor
descriptionOptional. Weight applied to the risk score for entities in this watchlist. The default is 1.0 if it is not specified.
formatfloat
typenumber
name
descriptionIdentifier. Resource name of the watchlist. Format: projects/{project}/locations/{location}/instances/{instance}/watchlists/{watchlist}
typestring
updateTime
descriptionOutput only. Time the watchlist was last updated.
formatgoogle-datetime
readOnlyTrue
typestring
watchlistUserPreferences
$refWatchlistUserPreferences
descriptionOptional. User preferences for watchlist configuration.
typeobject
WatchlistUserPreferences
descriptionA collection of user preferences for watchlist UI configuration.
idWatchlistUserPreferences
properties
pinned
descriptionOptional. Whether the watchlist is pinned on the dashboard.
typeboolean
typeobject
X509
descriptionFile certificate.
idX509
properties
algorithm
descriptionCertificate algorithm.
typestring
certIssuer
descriptionIssuer of the certificate.
typestring
name
descriptionCertificate name.
typestring
serialNumber
descriptionCertificate serial number.
typestring
thumbprint
descriptionCertificate thumbprint.
typestring
typeobject
old_value
CancelOperationRequest
descriptionThe request message for Operations.CancelOperation.
idCancelOperationRequest
properties
typeobject
CompilationDiagnostic
descriptionCompilationDiagnostic represents a compilation diagnostic generated during a rule's compilation, such as a compilation error or a compilation warning.
idCompilationDiagnostic
properties
message
descriptionOutput only. The diagnostic message.
readOnlyTrue
typestring
position
$refCompilationPosition
descriptionOutput only. The approximate position in the rule text associated with the compilation diagnostic. Compilation Position may be empty.
readOnlyTrue
severity
descriptionOutput only. The severity of a rule's compilation diagnostic.
enum
  • SEVERITY_UNSPECIFIED
  • WARNING
  • ERROR
enumDescriptions
  • An unspecified severity level.
  • A compilation warning.
  • A compilation error.
readOnlyTrue
typestring
uri
descriptionOutput only. Link to documentation that describes a diagnostic in more detail.
readOnlyTrue
typestring
typeobject
CompilationPosition
descriptionCompilationPosition represents the location of a compilation diagnostic in rule text.
idCompilationPosition
properties
endColumn
descriptionOutput only. End column number, beginning at 1.
formatint32
readOnlyTrue
typeinteger
endLine
descriptionOutput only. End line number, beginning at 1.
formatint32
readOnlyTrue
typeinteger
startColumn
descriptionOutput only. Start column number, beginning at 1.
formatint32
readOnlyTrue
typeinteger
startLine
descriptionOutput only. Start line number, beginning at 1.
formatint32
readOnlyTrue
typeinteger
typeobject
CreateParserExtensionMetadata
descriptionOperation metadata for creating a parser extension.
idCreateParserExtensionMetadata
properties
state
descriptionThe state of the parser extension creation process.
enum
  • STATE_UNSPECIFIED
  • NEW
  • VALIDATING
  • LIVE
  • REJECTED
  • INTERNAL_ERROR
  • VALIDATED
  • ARCHIVED
enumDescriptions
  • The state for this parser extension was not specified.
  • The parser extension has been newly submitted and is waiting to be validated.
  • The parser extension is currently going through the validation pipeline.
  • The parser extension is live in production. Only configs that have successfully passed the validation stage will be set to LIVE.
  • Validation completed, but the parser extension was rejected with errors.
  • An error occurred when processing this parser extension.
  • Extension is validated.
  • Extension is archived and is no more being used.
typestring
stateLastChangedTime
descriptionThe time the config state was last changed.
formatgoogle-datetime
typestring
validationErrors
descriptionAny validation error while validating the extension, this have cap of size 10
items
typestring
typearray
validationReport
descriptionThe validation report generated during validation of the parser extension.
typestring
typeobject
CreateParserMetadata
descriptionOperation metadata for creating a parser.
idCreateParserMetadata
properties
stage
descriptionThe validation stage of the parser creation process.
enum
  • VALIDATION_STAGE_UNSPECIFIED
  • NEW
  • VALIDATING
  • PASSED
  • FAILED
  • DELETE_CANDIDATE
enumDescriptions
  • The validation stage is not specified.
  • The custom parser is submitted for validation.
  • The custom parser is currently going through the validation pipeline
  • The custom parser has successfully passed the validation.
  • The custom parser has failed validation.
  • The parser is no good, It is available for auto deletion.
typestring
validationReport
descriptionThe validation report generated during validation of the parser.
typestring
typeobject
DataAccessLabel
descriptionA DataAccessLabel is a label on events to define user access to data.
idDataAccessLabel
properties
author
descriptionOutput only. The user who created the data access label.
readOnlyTrue
typestring
createTime
descriptionOutput only. The time at which the data access label was created.
formatgoogle-datetime
readOnlyTrue
typestring
description
descriptionOptional. A description of the data access label for a human reader.
typestring
displayName
descriptionOutput only. The short name displayed for the label as it appears on event data.
readOnlyTrue
typestring
lastEditor
descriptionOutput only. The user who last updated the data access label.
readOnlyTrue
typestring
name
descriptionRequired. The unique resource name of the data access label.
typestring
udmQuery
descriptionA UDM query over event data.
typestring
updateTime
descriptionOutput only. The time at which the data access label was last updated.
formatgoogle-datetime
readOnlyTrue
typestring
typeobject
DataAccessLabelReference
descriptionReference object to a data access label.
idDataAccessLabelReference
properties
assetNamespace
descriptionThe asset namespace configured in the forwarder of the customer's events.
typestring
dataAccessLabel
descriptionThe name of the data access label.
typestring
displayName
descriptionOutput only. The display name of the label. Data access label and log types's name will match the display name of the resource. The asset namespace will match the namespace itself. The ingestion key value pair will match the key of the tuple.
readOnlyTrue
typestring
ingestionLabel
$refIngestionLabel
descriptionThe ingestion label configured in the forwarder of the customer's events.
logType
descriptionThe name of the log type.
typestring
typeobject
DataAccessScope
descriptionA DataAccessScope is a boolean expression of data access labels used to restrict access to data for users.
idDataAccessScope
properties
allowAll
descriptionOptional. Whether or not the scope allows all labels, allow_all and allowed_data_access_labels are mutually exclusive and one of them must be present. denied_data_access_labels can still be used along with allow_all. When combined with denied_data_access_labels, access will be granted to all data that doesn't have labels mentioned in denied_data_access_labels. E.g.: A customer with scope with denied labels A and B and allow_all will be able to see all data except data labeled with A and data labeled with B and data with labels A and B.
typeboolean
allowedDataAccessLabels
descriptionOptional. The allowed labels for the scope. Either allow_all or allowed_data_access_labels needs to be provided. When provided, there has to be at least one label allowed for the scope to be valid. The logical operator for evaluation of the allowed labels is OR. E.g.: A customer with scope with allowed labels A and B will be able to see data with labeled with A or B or (A and B).
items
$refDataAccessLabelReference
typearray
author
descriptionOutput only. The user who created the data access scope.
readOnlyTrue
typestring
createTime
descriptionOutput only. The time at which the data access scope was created.
formatgoogle-datetime
readOnlyTrue
typestring
deniedDataAccessLabels
descriptionOptional. The denied labels for the scope. The logical operator for evaluation of the denied labels is AND. E.g.: A customer with scope with denied labels A and B won't be able to see data labeled with A and data labeled with B and data with labels A and B.
items
$refDataAccessLabelReference
typearray
description
descriptionOptional. A description of the data access scope for a human reader.
typestring
displayName
descriptionOutput only. The name to be used for display to customers of the data access scope.
readOnlyTrue
typestring
lastEditor
descriptionOutput only. The user who last updated the data access scope.
readOnlyTrue
typestring
name
descriptionRequired. The unique full name of the data access scope. The name should comply with https://google.aip.dev/122 standards.
typestring
updateTime
descriptionOutput only. The time at which the data access scope was last updated.
formatgoogle-datetime
readOnlyTrue
typestring
typeobject
Empty
descriptionA generic empty message that you can re-use to avoid defining duplicated empty messages in your APIs. A typical example is to use it as the request or the response type of an API method. For instance: service Foo { rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty); }
idEmpty
properties
typeobject
EntityCount
descriptionCount of different types of entities in the watchlist.
idEntityCount
properties
asset
descriptionOutput only. Count of asset type entities in the watchlist.
formatint32
readOnlyTrue
typeinteger
user
descriptionOutput only. Count of user type entities in the watchlist.
formatint32
readOnlyTrue
typeinteger
typeobject
EntityPopulationMechanism
descriptionMechanism to populate entities in the watchlist.
idEntityPopulationMechanism
properties
manual
$refManual
descriptionOptional. Entities are added manually.
typeobject
IngestionLabel
descriptionRepresentation of an ingestion label type.
idIngestionLabel
properties
ingestionLabelKey
descriptionRequired. The key of the ingestion label. Always required.
typestring
ingestionLabelValue
descriptionOptional. The value of the ingestion label. Optional. An object with no provided value and some key provided would match against the given key and ANY value.
typestring
typeobject
InputsUsed
descriptionInputsUsed is a convenience field that tells us which sources of events (if any) were used in the rule. NEXT TAG: 4
idInputsUsed
properties
usesDetection
descriptionOptional. Whether the rule queries detections.
typeboolean
usesEntity
descriptionOptional. Whether the rule queries entity events.
typeboolean
usesUdm
descriptionOptional. Whether the rule queries UDM events.
typeboolean
typeobject
Instance
descriptionA Instance represents an instantiation of the Instance product.
idInstance
properties
name
descriptionOutput only. The resource name of this instance. Format: projects/{project}/locations/{region}/instances/{instance}
readOnlyTrue
typestring
typeobject
Interval
descriptionRepresents a time interval, encoded as a Timestamp start (inclusive) and a Timestamp end (exclusive). The start must be less than or equal to the end. When the start equals the end, the interval is empty (matches no time). When both start and end are unspecified, the interval matches any time.
idInterval
properties
endTime
descriptionOptional. Exclusive end of the interval. If specified, a Timestamp matching this interval will have to be before the end.
formatgoogle-datetime
typestring
startTime
descriptionOptional. Inclusive start of the interval. If specified, a Timestamp matching this interval will have to be the same or after the start.
formatgoogle-datetime
typestring
typeobject
ListDataAccessLabelsResponse
descriptionResponse message for ListDataAccessLabels.
idListDataAccessLabelsResponse
properties
dataAccessLabels
descriptionList of data access labels.
items
$refDataAccessLabel
typearray
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
typeobject
ListDataAccessScopesResponse
descriptionResponse message for ListDataAccessScopes.
idListDataAccessScopesResponse
properties
dataAccessScopes
descriptionList of data access scopes.
items
$refDataAccessScope
typearray
globalDataAccessScopeGranted
descriptionWhether or not global scope is granted to the user.
typeboolean
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
typeobject
ListOperationsResponse
descriptionThe response message for Operations.ListOperations.
idListOperationsResponse
properties
nextPageToken
descriptionThe standard List next-page token.
typestring
operations
descriptionA list of operations that matches the specified filter in the request.
items
$refOperation
typearray
typeobject
ListReferenceListsResponse
descriptionA response to a request for a list of reference lists.
idListReferenceListsResponse
properties
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
referenceLists
descriptionThe reference lists. Ordered in ascending alphabetical order by name.
items
$refReferenceList
typearray
typeobject
ListRetrohuntsResponse
descriptionResponse message for ListRetrohunts method.
idListRetrohuntsResponse
properties
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
retrohunts
descriptionThe retrohunts from the specified rule.
items
$refRetrohunt
typearray
typeobject
ListRuleDeploymentsResponse
descriptionResponse message for ListRuleDeployments.
idListRuleDeploymentsResponse
properties
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
ruleDeployments
descriptionThe rule deployments from all rules.
items
$refRuleDeployment
typearray
typeobject
ListRuleRevisionsResponse
descriptionResponse message for ListRuleRevisions method.
idListRuleRevisionsResponse
properties
nextPageToken
descriptionA token that can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
rules
descriptionThe revisions of the rule.
items
$refRule
typearray
typeobject
ListRulesResponse
descriptionResponse message for ListRules method.
idListRulesResponse
properties
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
rules
descriptionThe rules from the specified instance.
items
$refRule
typearray
typeobject
ListWatchlistsResponse
descriptionResponse message for listing watchlists.
idListWatchlistsResponse
properties
nextPageToken
descriptionOptional. A token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
watchlists
descriptionOptional. The watchlists from the specified instance.
items
$refWatchlist
typearray
typeobject
Manual
descriptionEntities are added manually.
idManual
properties
typeobject
Operation
descriptionThis resource represents a long-running operation that is the result of a network API call.
idOperation
properties
done
descriptionIf the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available.
typeboolean
error
$refStatus
descriptionThe error result of the operation in case of failure or cancellation.
metadata
additionalProperties
descriptionProperties of the object. Contains field @type with type URL.
typeany
descriptionService-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any.
typeobject
name
descriptionThe server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`.
typestring
response
additionalProperties
descriptionProperties of the object. Contains field @type with type URL.
typeany
descriptionThe normal, successful response of the operation. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`.
typeobject
typeobject
ReferenceList
descriptionA reference list. Reference lists are user-defined lists of values which users can use in multiple Rules.
idReferenceList
properties
description
descriptionRequired. A user-provided description of the reference list.
typestring
displayName
descriptionOutput only. The unique display name of the reference list.
readOnlyTrue
typestring
entries
descriptionRequired. The entries of the reference list. When listed, they are returned in the order that was specified at creation or update. The combined size of the values of the reference list may not exceed 6MB. This is returned only when the view is REFERENCE_LIST_VIEW_FULL.
items
$refReferenceListEntry
typearray
name
descriptionOutput only. The resource name of the reference list. Format: projects/{project}/locations/{location}/instances/{instance}/referenceLists/{reference_list}
readOnlyTrue
typestring
revisionCreateTime
descriptionOutput only. The timestamp when the reference list was last updated.
formatgoogle-datetime
readOnlyTrue
typestring
ruleAssociationsCount
descriptionOutput only. The count of self-authored rules using the reference list.
formatint32
readOnlyTrue
typeinteger
rules
descriptionOutput only. The resource names for the associated self-authored Rules that use this reference list. This is returned only when the view is REFERENCE_LIST_VIEW_FULL.
items
typestring
readOnlyTrue
typearray
scopeInfo
$refScopeInfo
descriptionOutput only. The scope info of the reference list. During reference list creation, if this field is not set, the reference list without scopes (an unscoped list) will be created for an unscoped user. For a scoped user, this field must be set. During reference list update, if scope_info is requested to be updated, this field must be set.
readOnlyTrue
syntaxType
descriptionRequired. The syntax type indicating how list entries should be validated.
enum
  • REFERENCE_LIST_SYNTAX_TYPE_UNSPECIFIED
  • REFERENCE_LIST_SYNTAX_TYPE_PLAIN_TEXT_STRING
  • REFERENCE_LIST_SYNTAX_TYPE_REGEX
  • REFERENCE_LIST_SYNTAX_TYPE_CIDR
enumDescriptions
  • Defaults to REFERENCE_LIST_SYNTAX_TYPE_PLAIN_TEXT_STRING.
  • List contains plain text patterns.
  • List contains only Regular Expression patterns.
  • List contains only CIDR patterns.
typestring
typeobject
ReferenceListEntry
descriptionAn entry in a reference list.
idReferenceListEntry
properties
value
descriptionRequired. The value of the entry. Maximum length is 512 characters.
typestring
typeobject
ReferenceListScope
descriptionReferenceListScope specifies the list of scope names of the reference list.
idReferenceListScope
properties
scopeNames
descriptionOptional. The list of scope names of the reference list. The scope names should be full resource names and should be of the format: "projects/{project}/locations/{location}/instances/{instance}/dataAccessScopes/{scope_name}".
items
typestring
typearray
typeobject
Retrohunt
descriptionRetrohunt is an execution of a Rule over a time range in the past.
idRetrohunt
properties
executionInterval
$refInterval
descriptionOutput only. The start and end time of the retrohunt execution. If the retrohunt is not yet finished, the end time of the interval will not be populated.
readOnlyTrue
name
descriptionThe resource name of the retrohunt. Retrohunt is the child of a rule revision. {rule} in the format below is structured as {rule_id@revision_id}. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}/retrohunts/{retrohunt}
typestring
processInterval
$refInterval
descriptionRequired. The start and end time of the event time range this retrohunt processes.
progressPercentage
descriptionOutput only. Percent progress of the retrohunt towards completion, from 0.00 to 100.00.
formatfloat
readOnlyTrue
typenumber
state
descriptionOutput only. The state of the retrohunt.
enum
  • STATE_UNSPECIFIED
  • RUNNING
  • DONE
  • CANCELLED
  • FAILED
enumDescriptions
  • Unspecified or unknown retrohunt state.
  • Running state.
  • Done state.
  • Cancelled state.
  • Failed state.
readOnlyTrue
typestring
typeobject
RetrohuntMetadata
descriptionOperation Metadata for Retrohunts.
idRetrohuntMetadata
properties
executionInterval
$refInterval
descriptionThe start and end time of the retrohunt execution. If the retrohunt is not yet finished, the end time of the interval will not be filled.
progressPercentage
descriptionPercent progress of the retrohunt towards completion, from 0.00 to 100.00.
formatfloat
typenumber
retrohunt
descriptionThe name of the retrohunt. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}/retrohunts/{retrohunt}
typestring
typeobject
Rule
descriptionThe Rule resource represents a user-created rule. NEXT TAG: 21
idRule
properties
allowedRunFrequencies
descriptionOutput only. The run frequencies that are allowed for the rule. Populated in BASIC view and FULL view.
items
enum
  • RUN_FREQUENCY_UNSPECIFIED
  • LIVE
  • HOURLY
  • DAILY
enumDescriptions
  • The run frequency is unspecified/unknown.
  • Executes in real time.
  • Executes once per hour.
  • Executes once per day.
typestring
readOnlyTrue
typearray
author
descriptionOutput only. The author of the rule. Extracted from the meta section of text. Populated in BASIC view and FULL view.
readOnlyTrue
typestring
compilationDiagnostics
descriptionOutput only. A list of a rule's corresponding compilation diagnostic messages such as compilation errors and compilation warnings. Populated in FULL view.
items
$refCompilationDiagnostic
readOnlyTrue
typearray
compilationState
descriptionOutput only. The current compilation state of the rule. Populated in FULL view.
enum
  • COMPILATION_STATE_UNSPECIFIED
  • SUCCEEDED
  • FAILED
enumDescriptions
  • The compilation state is unspecified/unknown.
  • The Rule can successfully compile.
  • The Rule cannot successfully compile. This is possible if a backwards-incompatible change was made to the compiler.
readOnlyTrue
typestring
createTime
descriptionOutput only. The timestamp of when the rule was created. Populated in FULL view.
formatgoogle-datetime
readOnlyTrue
typestring
dataTables
descriptionOutput only. Resource names of the data tables used in this rule.
items
typestring
readOnlyTrue
typearray
displayName
descriptionOutput only. Display name of the rule. Populated in BASIC view and FULL view.
readOnlyTrue
typestring
etag
descriptionThe etag for this rule. If this is provided on update, the request will succeed if and only if it matches the server-computed value, and will fail with an ABORTED error otherwise. Populated in BASIC view and FULL view.
typestring
inputsUsed
$refInputsUsed
descriptionOutput only. The set of inputs used in the rule. For example, if the rule uses $e.principal.hostname, then the uses_udm field will be true.
readOnlyTrue
metadata
additionalProperties
typestring
descriptionOutput only. Additional metadata specified in the meta section of text. Populated in FULL view.
readOnlyTrue
typeobject
name
descriptionFull resource name for the rule. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}
typestring
nearRealTimeLiveRuleEligible
descriptionOutput only. Indicate the rule can run in near real time live rule. If this is true, the rule uses the near real time live rule when the run frequency is set to LIVE.
readOnlyTrue
typeboolean
referenceLists
descriptionOutput only. Resource names of the reference lists used in this rule. Populated in FULL view.
items
typestring
readOnlyTrue
typearray
revisionCreateTime
descriptionOutput only. The timestamp of when the rule revision was created. Populated in FULL, REVISION_METADATA_ONLY views.
formatgoogle-datetime
readOnlyTrue
typestring
revisionId
descriptionOutput only. The revision ID of the rule. A new revision is created whenever the rule text is changed in any way. Format: v_{10 digits}_{9 digits} Populated in REVISION_METADATA_ONLY view and FULL view.
readOnlyTrue
typestring
scope
descriptionResource name of the DataAccessScope bound to this rule. Populated in BASIC view and FULL view. If reference lists are used in the rule, validations will be performed against this scope to ensure that the reference lists are compatible with both the user's and the rule's scopes. The scope should be in the format: "projects/{project}/locations/{location}/instances/{instance}/dataAccessScopes/{scope}".
typestring
severity
$refSeverity
descriptionOutput only. The severity of the rule as specified in the meta section of text. Populated in BASIC view and FULL view.
readOnlyTrue
text
descriptionThe YARA-L content of the rule. Populated in FULL view.
typestring
type
descriptionOutput only. User-facing type of the rule. Extracted from the events section of rule text. Populated in BASIC view and FULL view.
enum
  • RULE_TYPE_UNSPECIFIED
  • SINGLE_EVENT
  • MULTI_EVENT
enumDescriptions
  • The rule type is unspecified/unknown.
  • Rule checks for the existence of a single event.
  • Rule checks for correlation between multiple events
readOnlyTrue
typestring
typeobject
RuleDeployment
descriptionThe RuleDeployment resource represents the deployment state of a Rule.
idRuleDeployment
properties
alerting
descriptionWhether detections resulting from this deployment should be considered alerts.
typeboolean
archiveTime
descriptionOutput only. The timestamp when the rule deployment archive state was last set to true. If the rule deployment's current archive state is not set to true, the field will be empty.
formatgoogle-datetime
readOnlyTrue
typestring
archived
descriptionThe archive state of the rule deployment. Cannot be set to true unless enabled is set to false. If set to true, alerting will automatically be set to false. If currently set to true, enabled, alerting, and run_frequency cannot be updated.
typeboolean
consumerRules
descriptionOutput only. The names of the associated/chained consumer rules. Rules are considered consumers of this rule if their rule text explicitly filters on this rule's ruleid. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}
items
typestring
readOnlyTrue
typearray
enabled
descriptionWhether the rule is currently deployed continuously against incoming data.
typeboolean
executionState
descriptionOutput only. The execution state of the rule deployment.
enum
  • EXECUTION_STATE_UNSPECIFIED
  • DEFAULT
  • LIMITED
  • PAUSED
enumDescriptions
  • Unspecified or unknown execution state.
  • Default execution state.
  • Rules in limited state may not have their executions guaranteed.
  • Paused rules are not executed at all.
readOnlyTrue
typestring
lastAlertStatusChangeTime
descriptionOutput only. The timestamp when the rule deployment alert state was lastly changed. This is filled regardless of the current alert state. E.g. if the current alert status is false, this timestamp will be the timestamp when the alert status was changed to false.
formatgoogle-datetime
readOnlyTrue
typestring
name
descriptionRequired. The resource name of the rule deployment. Note that RuleDeployment is a child of the overall Rule, not any individual revision, so the resource ID segment for the Rule resource must not reference a specific revision. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}/deployment
typestring
producerRules
descriptionOutput only. The names of the associated/chained producer rules. Rules are considered producers for this rule if this rule explicitly filters on their ruleid. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}
items
typestring
readOnlyTrue
typearray
runFrequency
descriptionThe run frequency of the rule deployment.
enum
  • RUN_FREQUENCY_UNSPECIFIED
  • LIVE
  • HOURLY
  • DAILY
enumDescriptions
  • The run frequency is unspecified/unknown.
  • Executes in real time.
  • Executes once per hour.
  • Executes once per day.
typestring
typeobject
ScopeInfo
descriptionScopeInfo specifies the scope info of the reference list.
idScopeInfo
properties
referenceListScope
$refReferenceListScope
descriptionRequired. The list of scope names of the reference list, if the list is empty the reference list is treated as unscoped.
typeobject
Severity
descriptionSeverity represents the severity level of the rule.
idSeverity
properties
displayName
descriptionThe display name of the severity level. Extracted from the meta section of the rule text.
typestring
typeobject
Status
descriptionThe `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors).
idStatus
properties
code
descriptionThe status code, which should be an enum value of google.rpc.Code.
formatint32
typeinteger
details
descriptionA list of messages that carry the error details. There is a common set of message types for APIs to use.
items
additionalProperties
descriptionProperties of the object. Contains field @type with type URL.
typeany
typeobject
typearray
message
descriptionA developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
typestring
typeobject
UdmSearchOperationMetadata
descriptionInformation about a UDM Search operation. This message is used to populate the `metadata` field of `Operation` resources created by UDM Search.
idUdmSearchOperationMetadata
properties
baselineEventsCount
descriptionThe number of events matching the baseline query so far.
formatint32
typeinteger
baselineQuery
descriptionQuery used to search for events.
typestring
baselineTimeRange
$refInterval
descriptionThe time range used for the baseline query [inclusive start time, exclusive end time).
caseInsensitive
descriptionIf true, the search was performed in a case-insensitive manner.
typeboolean
endTime
descriptionThe end time of the operation, if done.
formatgoogle-datetime
typestring
expireTime
descriptionThe time when the operation results expire. This time may change while the operation is in progress. If unset, the results never expire.
formatgoogle-datetime
typestring
filteredEventsCount
descriptionThe number of events matching the snapshot query so far. This is <= `baseline_events_count`. If the snapshot query is empty, this will be equal to `baseline_events_count`.
formatint32
typeinteger
progress
descriptionA value from 0 to 1 representing the progress of the operation.
formatdouble
typenumber
snapshotQuery
descriptionQuery used to filter the baseline query's events.
typestring
snapshotTimeRange
$refInterval
descriptionTime range used to filter the baseline query's events [inclusive start time, exclusive end time). This time range is completely within `baseline_time_range`. If not set, it is assumed to match `baseline_time_range`.
startTime
descriptionThe start time of the operation.
formatgoogle-datetime
typestring
statsRowsCount
descriptionThe total number of rows returned for a stats query.
formatint32
typeinteger
typeobject
UserError
descriptionThis message exists solely to get the `UserErrorReason` enum to appear in the service discovery document.
idUserError
properties
reason
descriptionThe reason for a specific error that should be shown to the app user.
enum
  • USER_ERROR_REASON_UNSPECIFIED
  • RULE_REFERENCES_OUT_OF_SCOPE
  • RULE_ARCHIVED
  • RULE_STALE_VERSION
  • RULE_ACTIVE
  • RULE_RETROHUNT_RUNNING
  • RULE_LIVE
  • RULE_ALREADY_DISABLED
  • EXPENSIVE_RULE_LARGE_WINDOW
  • RULE_LIMITED_PAUSED
  • REFERENCE_LIST_NOT_FOUND
  • UEBA_RULES_NO_SCOPE
  • RULE_TESTING_INTERVAL_TOO_SHORT
  • SEARCH_CSV_FIELDS_NOT_SUPPORTED
  • INVALID_ARGUMENT_FOR_DASHBOARD_FILTER
  • INVALID_CONFIG_FOR_DASHBOARD_IMPORT
  • RETROHUNT_LIMIT_REACHED
enumDescriptions
  • Do not use this default value.
  • The rule text references resources, such as reference lists, that are out of scope for the rule. Example of an ErrorInfo for this reason: { "reason": "RULE_REFERENCES_OUT_OF_SCOPE", "domain": "chronicle.googleapis.com", "metadata": { "reference_lists": "list_name1,list_name2,list_name3,", } }
  • The rule being operated on (saving or setting run frequency) is archived, and so the operation can't be done.
  • The rule version being operated on is not the latest, and so the operation can't be done.
  • The rule can't be archived because it is live (detecting) and a retrohunt is running.
  • The rule can't be archived because a retrohunt is running against it.
  • The rule can't be archived because it is live (detecting).
  • The rule can't be disabled because is is already disabled.
  • The rule's match time window is too large for its current run frequency.
  • The rule can't be enabled because it has been limited or paused because of high resource use.
  • The list being referred to doesn't exist.
  • UEBA rules may not be assigned a data access scope.
  • The rule's match window is longer than the time range it's being tested over. Returns the match window duration and testing interval duration as metadata labeled `match_window_duration` and `testing_interval_duration`, formatted as Go durations. Example ErrorInfo: { "reason": "RULE_TESTING_INTERVAL_TOO_SHORT", "domain": "chronicle.googleapis.com", "metadata": { "match_window_duration": "24h", "testing_interval_duration": "12h", } }
  • The CSV fields are not supported for download. Returns the unsupported fields as metadata labeled `unsupported_fields`. Example ErrorInfo: { "reason": "SEARCH_CSV_FIELDS_NOT_SUPPORTED", "domain": "chronicle.googleapis.com", "metadata": { "unsupported_fields": "udm.about.security_result.variables,udm.network.http.parsed_user_agent.family", } }
  • Invalid argument for dashboard chart filters. Returns the filter name, filter value, operator, and expected type as metadata labeled `filter_name`, `filter_value`, `operator`, and `expected_type`, respectively. Example ErrorInfo: { "reason": "INVALID_ARGUMENT_FOR_DASHBOARD_FILTER", "domain": "chronicle.googleapis.com", "metadata": { "filter_name": "filter_name", "filter_value": "filter_value", "operater": "operator", "expected_type": "expected_type", } }
  • Invalid config for dashboard import. Example ErrorInfo: { "reason": "INVALID_CONFIG_FOR_DASHBOARD_IMPORT", "domain": "chronicle.googleapis.com", }
  • The user has reached the limit of retrohunts that can be run. Returns the retrohunt limit as metadata labeled `retrohunt_limit`. Example ErrorInfo: { "reason": "RETROHUNT_LIMIT_REACHED", "domain": "chronicle.googleapis.com", "metadata": { "retrohunt_limit": "10", } }
typestring
typeobject
Watchlist
descriptionA watchlist is a list of entities that allows for bulk operations over the included entities.
idWatchlist
properties
createTime
descriptionOutput only. Time the watchlist was created.
formatgoogle-datetime
readOnlyTrue
typestring
description
descriptionOptional. Description of the watchlist.
typestring
displayName
descriptionRequired. Display name of the watchlist. Note that it must be at least one character and less than 63 characters (https://google.aip.dev/148).
typestring
entityCount
$refEntityCount
descriptionOutput only. Entity count in the watchlist.
readOnlyTrue
entityPopulationMechanism
$refEntityPopulationMechanism
descriptionRequired. Mechanism to populate entities in the watchlist.
multiplyingFactor
descriptionOptional. Weight applied to the risk score for entities in this watchlist. The default is 1.0 if it is not specified.
formatfloat
typenumber
name
descriptionIdentifier. Resource name of the watchlist. Format: projects/{project}/locations/{location}/instances/{instance}/watchlists/{watchlist}
typestring
updateTime
descriptionOutput only. Time the watchlist was last updated.
formatgoogle-datetime
readOnlyTrue
typestring
watchlistUserPreferences
$refWatchlistUserPreferences
descriptionOptional. User preferences for watchlist configuration.
typeobject
WatchlistUserPreferences
descriptionA collection of user preferences for watchlist UI configuration.
idWatchlistUserPreferences
properties
pinned
descriptionOptional. Whether the watchlist is pinned on the dashboard.
typeboolean
typeobject
prod/asia-southeast1-chronicle-v1alpha
dictionary_item_added
  • root['resources']['projects']['resources']['locations']['resources']['instances']['methods']['delete']
  • root['resources']['projects']['resources']['locations']['resources']['instances']['methods']['undelete']
  • root['resources']['projects']['resources']['locations']['resources']['instances']['resources']['legacy']['methods']['legacyCreateOrUpdateCase']
  • root['resources']['projects']['resources']['locations']['resources']['instances']['resources']['legacy']['methods']['legacyCreateSoarAlert']
  • root['schemas']['GoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStats']
  • root['schemas']['GoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnData']
  • root['schemas']['GoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnSort']
  • root['schemas']['GoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnType']
  • root['schemas']['GoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnTypeList']
  • root['schemas']['GoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnValue']
  • root['schemas']['GoogleCloudStorageEventDrivenSettings']
  • root['schemas']['InstanceUdmSearchResponse']
  • root['schemas']['LegacyCreateOrUpdateCaseRequest']
  • root['schemas']['LegacyCreateSoarAlertRequest']
  • root['schemas']['LegacyFederatedUdmSearchViewResponse']
  • root['schemas']['LegacySoarAlert']
  • root['schemas']['SQSV2AccessKeySecretAuth']
  • root['schemas']['SoarEvent']
  • root['schemas']['UndeleteInstanceRequest']
  • root['schemas']['BackstoryFile']['properties']['symhash']
  • root['schemas']['ColumnMetadata']['properties']['latitude']
  • root['schemas']['ColumnMetadata']['properties']['longitude']
  • root['schemas']['EntityRisk']['properties']['riskWindowHasNewDetections']
  • root['schemas']['Extensions']['properties']['entityRisk']
  • root['schemas']['FeedDetails']['properties']['googleCloudStorageEventDrivenSettings']
  • root['schemas']['Instance']['properties']['customerCode']
  • root['schemas']['Instance']['properties']['deleteTime']
  • root['schemas']['Instance']['properties']['purgeTime']
  • root['schemas']['Instance']['properties']['wipeoutStatus']
  • root['schemas']['SQSAuthV2']['properties']['sqsV2AccessKeySecretAuth']
dictionary_item_removed
  • root['resources']['projects']['resources']['locations']['resources']['instances']['resources']['findings']
  • root['schemas']['FetchSimilarFindingsResponse']
  • root['schemas']['OmniflowAmazonS3Settings']
  • root['schemas']['OmniflowAmazonSQSSettings']
  • root['schemas']['OmniflowGoogleCloudStorageSettings']
  • root['schemas']['OmniflowS3Auth']
  • root['schemas']['FeedDetails']['properties']['omniflowAmazonS3Settings']
  • root['schemas']['FeedDetails']['properties']['omniflowAmazonSqsSettings']
  • root['schemas']['FeedDetails']['properties']['omniflowGcsSettings']
  • root['schemas']['FeedDetails']['properties']['feedSourceType']['enumDeprecated']
  • root['schemas']['FeedSourceTypeSchema']['properties']['feedSourceType']['enumDeprecated']
  • root['schemas']['PackLogType']['properties']['recommendedSourceType']['enumDeprecated']
values_changed
root['resources']['projects']['resources']['locations']['resources']['instances']['methods']['generateCollectionAgentAuth']['parameters']['name']['description']
new_valueRequired. The name of the chronicle instance to generate a collection agent auth json file for. Format: projects/{project_id}/locations/{location}/instances/{instance}
old_valueRequired. The name of the chronicle instance to generate a collection agent auth json file for. Format: projects/{project_id}/locations/{region}/instances/{instance}
root['resources']['projects']['resources']['locations']['resources']['instances']['methods']['generateSoarAuthJwt']['parameters']['name']['description']
new_valueRequired. The name of the chronicle instance to retrieve a report for. Format: projects/{project_id}/locations/{location}/instances/{instance}
old_valueRequired. The name of the chronicle instance to retrieve a report for. Format: projects/{project_id}/locations/{region}/instances/{instance}
root['resources']['projects']['resources']['locations']['resources']['instances']['methods']['generateWorkspaceConnectionToken']['parameters']['name']['description']
new_valueRequired. The name of the chronicle instance to create workspace token for. Format: projects/{project_id}/locations/{location}/instances/{instance}
old_valueRequired. The name of the chronicle instance to create workspace token for. Format: projects/{project_id}/locations/{region}/instances/{instance}
root['resources']['projects']['resources']['locations']['resources']['instances']['methods']['get']['parameters']['name']['description']
new_valueRequired. The name of the instance to retrieve. Format: projects/{project_id}/locations/{location}/instances/{instance}
old_valueRequired. The name of the instance to retrieve. Format: projects/{project_id}/locations/{region}/instances/{instance}
root['resources']['projects']['resources']['locations']['resources']['instances']['methods']['report']['parameters']['name']['description']
new_valueRequired. The name of the chronicle instance to retrieve a report for. Format: projects/{project_id}/locations/{location}/instances/{instance}
old_valueRequired. The name of the chronicle instance to retrieve a report for. Format: projects/{project_id}/locations/{region}/instances/{instance}
root['resources']['projects']['resources']['locations']['resources']['instances']['resources']['legacy']['methods']['legacyBatchGetCases']['parameters']['instance']['description']
new_valueRequired. Chronicle instance this request is sent to. Format: projects/{project}/locations/{location}/instances/{instance}/legacy
old_valueChronicle instance this request is sent to. Format: projects/{project}/locations/{location}/instances/{instance}/legacy
root['revision']
new_value20250310
old_value20250227
root['schemas']['EntityRisk']['description']
new_valueStores information related to the risk score of an entity. Next ID: 15
old_valueStores information related to the risk score of an entity. Next ID: 14
root['schemas']['EntityRisk']['properties']['riskWindowSize']['description']
new_valueRisk window duration for the entity.
old_valueRisk window duration for the Entity.
root['schemas']['Instance']['properties']['name']['description']
new_valueOutput only. The resource name of this instance. Format: projects/{project}/locations/{location}/instances/{instance}
old_valueOutput only. The resource name of this instance. Format: projects/{project}/locations/{region}/instances/{instance}
root['schemas']['SQSAuthV2']['properties']['additionalS3AccessKeySecretAuth']['description']
new_valueRequired. Deprecated. If the S3 objects referred to by the SQS queue require different auth info other than the SQS auth, that can be specified here. Additional S3AccessKeySecret. Required.
old_valueRequired. If the S3 objects referred to by the SQS queue require different auth info other than the SQS auth, that can be specified here. Additional S3AccessKeySecret. Required.
root['schemas']['StatusProto']['properties']['canonicalCode']['description']
new_valuecopybara:strip_begin(b/383363683) copybara:strip_end_and_replace optional int32 canonical_code = 6;
old_valueThe canonical error code (see codes.proto) that most closely corresponds to this status. This may be missing, and in the common case of the generic space, it definitely will be. copybara:strip_begin(b/383363683) copybara:strip_end_and_replace optional int32 canonical_code = 6;
root['schemas']['StatusProto']['properties']['space']['description']
new_valuecopybara:strip_begin(b/383363683) Space to which this status belongs copybara:strip_end_and_replace optional string space = 2; // Space to which this status belongs
old_valueThe following are usually only present when code != 0 Space to which this status belongs copybara:strip_begin(b/383363683) copybara:strip_end_and_replace optional string space = 2;
iterable_item_added
root['schemas']['AnalyticValue']['properties']['eventType']['enum'][103]ENTITY_RISK_CHANGE
root['schemas']['AnalyticValue']['properties']['eventType']['enumDescriptions'][103]An update to an entity risk score. This event type is restricted to events published by Google Securit Operations Risk Analytics.
root['schemas']['EnrichmentDisablementTarget']['properties']['eventType']['enum'][103]ENTITY_RISK_CHANGE
root['schemas']['EnrichmentDisablementTarget']['properties']['eventType']['enumDescriptions'][103]An update to an entity risk score. This event type is restricted to events published by Google Securit Operations Risk Analytics.
root['schemas']['EventTypesSuggestion']['properties']['eventType']['enum'][103]ENTITY_RISK_CHANGE
root['schemas']['EventTypesSuggestion']['properties']['eventType']['enumDescriptions'][103]An update to an entity risk score. This event type is restricted to events published by Google Securit Operations Risk Analytics.
root['schemas']['FeedDetails']['properties']['feedSourceType']['enum'][19]GOOGLE_CLOUD_STORAGE_EVENT_DRIVEN
root['schemas']['FeedDetails']['properties']['feedSourceType']['enumDescriptions'][19]Google Cloud Storage Feed backed by Omniflow STS driven by pubsub events.
root['schemas']['FeedSourceTypeSchema']['properties']['feedSourceType']['enum'][19]GOOGLE_CLOUD_STORAGE_EVENT_DRIVEN
root['schemas']['FeedSourceTypeSchema']['properties']['feedSourceType']['enumDescriptions'][19]Google Cloud Storage Feed backed by Omniflow STS driven by pubsub events.
root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][1412]BLOCKDAEMON_METOMIC
root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][2124]JIT
root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][2125]PROCORE
root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][2126]HP_INC_MFP
root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][2127]MERU_CONTENTKEEPER_PROXY
root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][2128]KPMG_JAPAN_HR
root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][2129]FORD_ADFS_IDP
root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][2130]FORD_BLUE_DNS
root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][2131]TSA_VMS
root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][2132]ALLIANZ_CPAM
root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][2133]HKBK_ASE1_DIGITALGUARDIAN_NDLP
root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][2134]PANORAYS
root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][2135]BBVA_BAEMPRE
root['schemas']['Metadata']['properties']['eventType']['enum'][103]ENTITY_RISK_CHANGE
root['schemas']['Metadata']['properties']['eventType']['enumDescriptions'][103]An update to an entity risk score. This event type is restricted to events published by Google Securit Operations Risk Analytics.
root['schemas']['PackLogType']['properties']['recommendedSourceType']['enum'][19]GOOGLE_CLOUD_STORAGE_EVENT_DRIVEN
root['schemas']['PackLogType']['properties']['recommendedSourceType']['enumDescriptions'][19]Google Cloud Storage Feed backed by Omniflow STS driven by pubsub events.
root['schemas']['RawLog']['properties']['type']['enum'][1412]BLOCKDAEMON_METOMIC
root['schemas']['RawLog']['properties']['type']['enum'][2124]JIT
root['schemas']['RawLog']['properties']['type']['enum'][2125]PROCORE
root['schemas']['RawLog']['properties']['type']['enum'][2126]HP_INC_MFP
root['schemas']['RawLog']['properties']['type']['enum'][2127]MERU_CONTENTKEEPER_PROXY
root['schemas']['RawLog']['properties']['type']['enum'][2128]KPMG_JAPAN_HR
root['schemas']['RawLog']['properties']['type']['enum'][2129]FORD_ADFS_IDP
root['schemas']['RawLog']['properties']['type']['enum'][2130]FORD_BLUE_DNS
root['schemas']['RawLog']['properties']['type']['enum'][2131]TSA_VMS
root['schemas']['RawLog']['properties']['type']['enum'][2132]ALLIANZ_CPAM
root['schemas']['RawLog']['properties']['type']['enum'][2133]HKBK_ASE1_DIGITALGUARDIAN_NDLP
root['schemas']['RawLog']['properties']['type']['enum'][2134]PANORAYS
root['schemas']['RawLog']['properties']['type']['enum'][2135]BBVA_BAEMPRE
root['schemas']['RawLogEventInformation']['properties']['eventType']['enum'][103]ENTITY_RISK_CHANGE
root['schemas']['RawLogEventInformation']['properties']['eventType']['enumDescriptions'][103]An update to an entity risk score. This event type is restricted to events published by Google Securit Operations Risk Analytics.
root['schemas']['SIEventData']['properties']['rawLogType']['enum'][1412]BLOCKDAEMON_METOMIC
root['schemas']['SIEventData']['properties']['rawLogType']['enum'][2124]JIT
root['schemas']['SIEventData']['properties']['rawLogType']['enum'][2125]PROCORE
root['schemas']['SIEventData']['properties']['rawLogType']['enum'][2126]HP_INC_MFP
root['schemas']['SIEventData']['properties']['rawLogType']['enum'][2127]MERU_CONTENTKEEPER_PROXY
root['schemas']['SIEventData']['properties']['rawLogType']['enum'][2128]KPMG_JAPAN_HR
root['schemas']['SIEventData']['properties']['rawLogType']['enum'][2129]FORD_ADFS_IDP
root['schemas']['SIEventData']['properties']['rawLogType']['enum'][2130]FORD_BLUE_DNS
root['schemas']['SIEventData']['properties']['rawLogType']['enum'][2131]TSA_VMS
root['schemas']['SIEventData']['properties']['rawLogType']['enum'][2132]ALLIANZ_CPAM
root['schemas']['SIEventData']['properties']['rawLogType']['enum'][2133]HKBK_ASE1_DIGITALGUARDIAN_NDLP
root['schemas']['SIEventData']['properties']['rawLogType']['enum'][2134]PANORAYS
root['schemas']['SIEventData']['properties']['rawLogType']['enum'][2135]BBVA_BAEMPRE
iterable_item_removed
root['schemas']['FeedDetails']['properties']['feedSourceType']['enum'][14]OMNIFLOW_GOOGLE_CLOUD_STORAGE
root['schemas']['FeedDetails']['properties']['feedSourceType']['enum'][15]OMNIFLOW_AMAZON_S3
root['schemas']['FeedDetails']['properties']['feedSourceType']['enum'][16]OMNIFLOW_AMAZON_SQS
root['schemas']['FeedDetails']['properties']['feedSourceType']['enumDescriptions'][14]
root['schemas']['FeedSourceTypeSchema']['properties']['feedSourceType']['enum'][14]OMNIFLOW_GOOGLE_CLOUD_STORAGE
root['schemas']['FeedSourceTypeSchema']['properties']['feedSourceType']['enum'][15]OMNIFLOW_AMAZON_S3
root['schemas']['FeedSourceTypeSchema']['properties']['feedSourceType']['enum'][16]OMNIFLOW_AMAZON_SQS
root['schemas']['FeedSourceTypeSchema']['properties']['feedSourceType']['enumDescriptions'][14]
root['schemas']['PackLogType']['properties']['recommendedSourceType']['enum'][14]OMNIFLOW_GOOGLE_CLOUD_STORAGE
root['schemas']['PackLogType']['properties']['recommendedSourceType']['enum'][15]OMNIFLOW_AMAZON_S3
root['schemas']['PackLogType']['properties']['recommendedSourceType']['enum'][16]OMNIFLOW_AMAZON_SQS
root['schemas']['PackLogType']['properties']['recommendedSourceType']['enumDescriptions'][14]
prod/asia-southeast1-chronicle-v1beta
values_changed
root['resources']['projects']['resources']['locations']['resources']['instances']['methods']['get']['parameters']['name']['description']
new_valueRequired. The name of the instance to retrieve. Format: projects/{project_id}/locations/{location}/instances/{instance}
old_valueRequired. The name of the instance to retrieve. Format: projects/{project_id}/locations/{region}/instances/{instance}
root['revision']
new_value20250310
old_value20250227
root['schemas']
new_value
AIOverview
descriptionAI generated overview for the search results.
idAIOverview
properties
aiSummary
descriptionAI summary for the search results. Markdown formatted.
typestring
complete
descriptionWhether AI overview generation is complete.
typeboolean
suggestions
descriptionSuggested actions to continue the investigation in chat.
items
$refAction
typearray
typeobject
Action
descriptionAction represents an action that can be performed in the host UI.
idAction
properties
actionType
descriptionOutput only. Type of action.
enum
  • ACTION_TYPE_UNSPECIFIED
  • FOLLOW_UP
  • NAVIGATION
  • EXECUTION
enumDescriptions
  • The action type is unspecified.
  • The action is a follow up action.
  • The action is a navigation action.
  • The action is an execution action.
readOnlyTrue
typestring
displayText
descriptionOutput only. The text that'll be displayed to the user if this is rendered in the UI as a suggested action.
readOnlyTrue
typestring
execution
$refExecution
descriptionMetadata for execution action.
followUp
$refFollowUp
descriptionMetadata for follow up action.
navigation
$refNavigation
descriptionMetadata for navigation action.
useCaseId
descriptionOutput only. The use case ID of the action. It's used internally to identify in which context the action is used.
readOnlyTrue
typestring
typeobject
AlertFieldAggregation
idAlertFieldAggregation
properties
alertCount
formatint32
typeinteger
allValues
items
$refAlertFieldValueCount
typearray
baselineAlertCount
formatint32
typeinteger
bottomValues
items
$refAlertFieldValueCount
typearray
fieldName
typestring
tooManyValues
typeboolean
topValues
items
$refAlertFieldValueCount
typearray
valueCount
formatint32
typeinteger
typeobject
AlertFieldAggregations
idAlertFieldAggregations
properties
fields
items
$refAlertFieldAggregation
typearray
typeobject
AlertFieldValue
idAlertFieldValue
properties
boolValue
typeboolean
bytesValue
formatbyte
typestring
doubleValue
formatdouble
typenumber
enumValue
typestring
floatValue
formatfloat
typenumber
int32Value
formatint32
typeinteger
int64Value
formatint64
typestring
stringValue
typestring
uint32Value
formatuint32
typeinteger
uint64Value
formatuint64
typestring
typeobject
AlertFieldValueCount
idAlertFieldValueCount
properties
alertCount
formatint32
typeinteger
baselineAlertCount
formatint32
typeinteger
value
$refAlertFieldValue
typeobject
AnalystVerdict
descriptionVerdict provided by the human analyst. These fields are used to model Mandiant sources.
idAnalystVerdict
properties
confidenceScore
descriptionConfidence score of the verdict.
formatint32
typeinteger
verdictResponse
descriptionDetails of the verdict.
enum
  • VERDICT_RESPONSE_UNSPECIFIED
  • MALICIOUS
  • BENIGN
enumDescriptions
  • The default verdict response type.
  • VerdictResponse resulted a threat as malicious.
  • VerdictResponse resulted a threat as benign.
typestring
verdictTime
descriptionTimestamp at which the verdict was generated.
formatgoogle-datetime
typestring
typeobject
AnalyticsMetadata
descriptionStores information about an analytics metric used in a rule.
idAnalyticsMetadata
properties
analytic
descriptionName of the analytic.
typestring
typeobject
Annotation
descriptionExtra parameters that don't fit anywhere else, captured as key/value. For example "VendorID/42" in BlackBerry user agents. The following keys are modified with reduced User-Agent and no client hints (go/ua-reduction-ua-string-reference): * "Chrome" (see `browser_version`) * "ChromiumBrowser" (unavailable) * "ChromeWebview" (unavailable) * "OS_VERSION" (see `os`) * "Rest" (unavailable) * "misc" (see `device`)
idAnnotation
properties
key
typestring
value
typestring
typeobject
Artifact
descriptionInformation about an artifact. The artifact can only be an IP.
idArtifact
properties
anonymous
descriptionWhether the VPN tunnels are configured for anonymous browsing or not.
typeboolean
artifactClient
$refArtifactClient
descriptionEntity or software accessing or utilizing network resources.
asOwner
descriptionOwner of the Autonomous System to which the IP address belongs.
typestring
asn
descriptionAutonomous System Number to which the IP address belongs.
formatint64
typestring
firstSeenTime
descriptionFirst seen timestamp of the IP in the customer's environment.
formatgoogle-datetime
typestring
ip
descriptionIP address of the artifact. This field can be used as an entity indicator for an external destination IP entity.
typestring
jarm
descriptionThe JARM hash for the IP address. (https://engineering.salesforce.com/easily-identify-malicious-servers-on-the-internet-with-jarm-e095edac525a).
typestring
lastHttpsCertificate
$refSSLCertificate
descriptionSSL certificate information about the IP address.
lastHttpsCertificateDate
descriptionMost recent date for the certificate in VirusTotal.
formatgoogle-datetime
typestring
lastSeenTime
descriptionLast seen timestamp of the IP address in the customer's environment.
formatgoogle-datetime
typestring
location
$refLocation
descriptionLocation of the Artifact's IP address.
network
$refNetwork
descriptionNetwork information related to the Artifact's IP address.
prevalence
$refPrevalence
descriptionThe prevalence of the artifact within the customer's environment.
regionalInternetRegistry
descriptionRIR (one of the current RIRs: AFRINIC, ARIN, APNIC, LACNIC or RIPE NCC).
typestring
risks
descriptionThis field lists potential risks associated with the network activity.
items
typestring
typearray
tags
descriptionIdentification attributes
items
typestring
typearray
tunnels
descriptionVPN tunnels.
items
$refTunnels
typearray
whois
descriptionWHOIS information as returned from the pertinent WHOIS server.
typestring
whoisDate
descriptionDate of the last update of the WHOIS record in VirusTotal.
formatgoogle-datetime
typestring
typeobject
ArtifactClient
descriptionEntity or software accessing or utilizing network resources.
idArtifactClient
properties
behaviors
descriptionThe behaviors of the client accessing the network.
items
typestring
typearray
proxies
descriptionThe type of proxies used by the client.
items
typestring
typearray
typeobject
Asset
descriptionInformation about a compute asset such as a workstation, laptop, phone, virtual desktop, or VM.
idAsset
properties
assetId
descriptionThe asset ID. Value must contain the ':' character. For example, cs:abcdd23434. This field can be used as an entity indicator for asset entities.
typestring
attribute
$refAttribute
descriptionGeneric entity metadata attributes of the asset.
category
descriptionThe category of the asset (e.g. "End User Asset", "Workstation", "Server").
typestring
creationTime
deprecatedTrue
descriptionTime the asset was created or provisioned. Deprecate: creation_time should be populated in Attribute as generic metadata.
formatgoogle-datetime
typestring
deploymentStatus
descriptionThe deployment status of the asset for device lifecycle purposes.
enum
  • DEPLOYMENT_STATUS_UNSPECIFIED
  • ACTIVE
  • PENDING_DECOMISSION
  • DECOMISSIONED
enumDescriptions
  • Unspecified deployment status.
  • Asset is active, functional and deployed.
  • Asset is pending decommission and no longer deployed.
  • Asset is decommissioned.
typestring
firstDiscoverTime
descriptionTime the asset was first discovered (by asset management/discoverability software).
formatgoogle-datetime
typestring
firstSeenTime
descriptionThe first observed time for an asset. The value is calculated on the basis of the first time the identifier was observed.
formatgoogle-datetime
typestring
hardware
descriptionThe asset hardware specifications.
items
$refHardware
typearray
hostname
descriptionAsset hostname or domain name field. This field can be used as an entity indicator for asset entities.
typestring
ip
descriptionA list of IP addresses associated with an asset. This field can be used as an entity indicator for asset entities.
items
typestring
typearray
labels
deprecatedTrue
descriptionMetadata labels for the asset. Deprecated: labels should be populated in Attribute as generic metadata.
items
$refLabel
typearray
lastBootTime
descriptionTime the asset was last boot started.
formatgoogle-datetime
typestring
lastDiscoverTime
descriptionTime the asset was last discovered (by asset management/discoverability software).
formatgoogle-datetime
typestring
location
$refLocation
descriptionLocation of the asset.
mac
descriptionList of MAC addresses associated with an asset. This field can be used as an entity indicator for asset entities.
items
typestring
typearray
natIp
descriptionList of NAT IP addresses associated with an asset.
items
typestring
typearray
networkDomain
descriptionThe network domain of the asset (e.g. "corp.acme.com")
typestring
platformSoftware
$refPlatformSoftware
descriptionThe asset operating system platform software.
productObjectId
descriptionA vendor-specific identifier to uniquely identify the entity (a GUID or similar). This field can be used as an entity indicator for asset entities.
typestring
software
descriptionThe asset software details.
items
$refSoftware
typearray
systemLastUpdateTime
descriptionTime the asset system or OS was last updated. For all other operations that are not system updates (such as resizing a VM), use Attribute.last_update_time.
formatgoogle-datetime
typestring
type
descriptionThe type of the asset (e.g. workstation or laptop or server).
enum
  • ROLE_UNSPECIFIED
  • WORKSTATION
  • LAPTOP
  • IOT
  • NETWORK_ATTACHED_STORAGE
  • PRINTER
  • SCANNER
  • SERVER
  • TAPE_LIBRARY
  • MOBILE
enumDescriptions
  • Unspecified asset role.
  • A workstation or desktop.
  • A laptop computer.
  • An IOT asset.
  • A network attached storage device.
  • A printer.
  • A scanner.
  • A server.
  • A tape library device.
  • A mobile device such as a mobile phone or PDA.
typestring
vulnerabilities
descriptionVulnerabilities discovered on asset.
items
$refVulnerability
typearray
typeobject
Association
descriptionAssociations represents different metadata about malware and threat actors involved with an IoC.
idAssociation
properties
alias
descriptionDifferent aliases of the threat actor given by different sources.
items
$refAssociationAlias
typearray
associatedActors
descriptionList of associated threat actors for a malware. Not applicable for threat actors.
items
$refAssociation
typearray
countryCode
descriptionCountry from which the threat actor/ malware is originated.
items
typestring
typearray
description
descriptionHuman readable description about the association.
typestring
firstReferenceTime
descriptionFirst time the threat actor was referenced or seen.
formatgoogle-datetime
typestring
id
descriptionUnique association id generated by mandiant.
typestring
industriesAffected
descriptionList of industries the threat actor affects.
items
typestring
typearray
lastReferenceTime
descriptionLast time the threat actor was referenced or seen.
formatgoogle-datetime
typestring
name
descriptionName of the threat actor/malware.
typestring
regionCode
$refLocation
descriptionName of the country, the threat is originating from.
role
descriptionRole of the malware. Not applicable for threat actor.
typestring
sourceCountry
deprecatedTrue
descriptionName of the country the threat originated from.
typestring
sponsorRegion
$refLocation
descriptionSponsor region of the threat actor.
tags
descriptionTags.
items
typestring
typearray
targetedRegions
descriptionTargeted regions.
items
$refLocation
typearray
type
descriptionSignifies the type of association.
enum
  • ASSOCIATION_TYPE_UNSPECIFIED
  • THREAT_ACTOR
  • MALWARE
enumDescriptions
  • The default Association Type.
  • Association type Threat actor.
  • Association type Malware.
typestring
typeobject
AssociationAlias
descriptionAssociation Alias used to represent Mandiant Threat Intelligence.
idAssociationAlias
properties
company
descriptionName of the provider who gave the association's name.
typestring
name
descriptionName of the alias.
typestring
typeobject
AttackDetails
descriptionMITRE ATT&CK details.
idAttackDetails
properties
tactics
descriptionTactics employed.
items
$refTactic
typearray
techniques
descriptionTechniques employed.
items
$refTechnique
typearray
version
descriptionATT&CK version (e.g. 12.1).
typestring
typeobject
Attribute
descriptionAttribute is a container for generic entity attributes including common attributes across core entities (such as, user or asset). For example, Cloud is a generic entity attribute since it can apply to an asset (for example, a VM) or a user (for example, an identity service account).
idAttribute
properties
cloud
$refCloud
descriptionCloud metadata attributes such as project ID, account ID, or organizational hierarchy.
creationTime
descriptionTime the resource or entity was created or provisioned.
formatgoogle-datetime
typestring
labels
descriptionSet of labels for the entity. Should only be used for product labels (for example, Google Cloud resource labels or Azure AD sensitivity labels. Should not be used for arbitrary key-value mappings.
items
$refLabel
typearray
lastUpdateTime
descriptionTime the resource or entity was last updated.
formatgoogle-datetime
typestring
permissions
descriptionSystem permissions for IAM entity (human principal, service account, group).
items
$refPermission
typearray
roles
descriptionSystem IAM roles to be assumed by resources to use the role's permissions for access control.
items
$refRole
typearray
typeobject
Authentication
descriptionThe Authentication extension captures details specific to authentication events. General guidelines for authentication events: * Details about the source of the authentication event (for example, client IP or hostname), should be captured in principal. The principal may be empty if we have no details about the source of the login. * Details about the target of the authentication event (for example, details about the machine that is being logged into or logged out of) should be captured in target. * Some authentication events may involve a third-party. For example, a user logs into a cloud service (for example, Chronicle) via their company's SSO (the event is logged by their SSO solution). In this case, the principal captures information about the user's device, the target captures details about the cloud service they logged into, and the intermediary captures details about the SSO solution.
idAuthentication
properties
authDetails
descriptionThe vendor defined details of the authentication.
typestring
mechanism
descriptionThe authentication mechanism.
items
enum
  • MECHANISM_UNSPECIFIED
  • USERNAME_PASSWORD
  • OTP
  • HARDWARE_KEY
  • LOCAL
  • REMOTE
  • REMOTE_INTERACTIVE
  • MECHANISM_OTHER
  • BADGE_READER
  • NETWORK
  • BATCH
  • SERVICE
  • UNLOCK
  • NETWORK_CLEAR_TEXT
  • NEW_CREDENTIALS
  • INTERACTIVE
  • CACHED_INTERACTIVE
  • CACHED_REMOTE_INTERACTIVE
  • CACHED_UNLOCK
  • BIOMETRIC
  • WEARABLE
enumDescriptions
  • The default mechanism.
  • Username + password authentication.
  • OTP authentication.
  • Hardware key authentication.
  • Local authentication.
  • Remote authentication.
  • RDP, Terminal Services, or VNC.
  • Some other mechanism that is not defined here.
  • Badge reader authentication
  • Network authentication.
  • Batch authentication.
  • Service authentication
  • Direct human-interactive unlock authentication.
  • Network clear text authentication.
  • Authentication with new credentials.
  • Interactive authentication.
  • Interactive authentication using cached credentials.
  • Cached Remote Interactive authentication using cached credentials.
  • Cached Remote Interactive authentication using cached credentials.
  • Biometric device such as a fingerprint reader.
  • Wearable such as an Apple Watch.
typestring
typearray
type
descriptionThe type of authentication.
enum
  • AUTHTYPE_UNSPECIFIED
  • MACHINE
  • SSO
  • VPN
  • PHYSICAL
  • TACACS
enumDescriptions
  • The default type.
  • A machine authentication.
  • An SSO authentication.
  • A VPN authentication.
  • A Physical authentication (e.g. "Badge reader").
  • A TACACS family protocol for networked systems authentication (e.g. TACACS, TACACS+).
typestring
typeobject
AuthorityKeyId
descriptionIdentifies the public key to be used to verify the signature on this certificate or CRL.
idAuthorityKeyId
properties
keyid
descriptionKey hexdump.
typestring
serialNumber
descriptionSerial number hexdump.
typestring
typeobject
BackstoryEntity
descriptionAn Entity provides additional context about an item in a UDM event. For example, a PROCESS_LAUNCH event describes that user 'abc@example.corp' launched process 'shady.exe'. The event does not include information that user 'abc@example.com' is a recently terminated employee who administers a server storing finance data. Information stored in one or more Entities can add this additional context.
idBackstoryEntity
properties
additional
additionalProperties
descriptionProperties of the object.
typeany
descriptionImportant entity data that cannot be adequately represented within the formal sections of the Entity.
typeobject
entity
$refNoun
descriptionNoun in the UDM event that this entity represents.
metadata
$refEntityMetadata
descriptionEntity metadata such as timestamp, product, etc.
metric
$refMetric
descriptionStores statistical metrics about the entity. Used if metadata.entity_type is METRIC.
relations
descriptionOne or more relationships between the entity (a) and other entities, including the relationship type and related entity.
items
$refRelation
typearray
riskScore
$refEntityRisk
descriptionStores information related to the entity's risk score.
typeobject
BackstoryFile
descriptionInformation about a file.
idBackstoryFile
properties
ahash
deprecatedTrue
descriptionDeprecated. Use authentihash instead.
typestring
authentihash
descriptionAuthentihash of the file.
typestring
capabilitiesTags
descriptionCapabilities tags.
items
typestring
typearray
createTime
descriptionTimestamp when the file was created.
formatgoogle-datetime
typestring
embeddedDomains
descriptionEmbedded domains found in the file.
items
typestring
typearray
embeddedIps
descriptionEmbedded IP addresses found in the file.
items
typestring
typearray
embeddedUrls
descriptionEmbedded urls found in the file.
items
typestring
typearray
exifInfo
$refExifInfo
descriptionExif metadata from different file formats extracted by exiftool.
fileMetadata
$refFileMetadata
deprecatedTrue
descriptionMetadata associated with the file. Deprecate FileMetadata in favor of using fields in File.
fileType
descriptionFileType field.
enum
  • FILE_TYPE_UNSPECIFIED
  • FILE_TYPE_PE_EXE
  • FILE_TYPE_PE_DLL
  • FILE_TYPE_MSI
  • FILE_TYPE_NE_EXE
  • FILE_TYPE_NE_DLL
  • FILE_TYPE_DOS_EXE
  • FILE_TYPE_DOS_COM
  • FILE_TYPE_COFF
  • FILE_TYPE_ELF
  • FILE_TYPE_LINUX_KERNEL
  • FILE_TYPE_RPM
  • FILE_TYPE_LINUX
  • FILE_TYPE_MACH_O
  • FILE_TYPE_JAVA_BYTECODE
  • FILE_TYPE_DMG
  • FILE_TYPE_DEB
  • FILE_TYPE_PKG
  • FILE_TYPE_PYC
  • FILE_TYPE_LNK
  • FILE_TYPE_DESKTOP_ENTRY
  • FILE_TYPE_JPEG
  • FILE_TYPE_TIFF
  • FILE_TYPE_GIF
  • FILE_TYPE_PNG
  • FILE_TYPE_BMP
  • FILE_TYPE_GIMP
  • FILE_TYPE_IN_DESIGN
  • FILE_TYPE_PSD
  • FILE_TYPE_TARGA
  • FILE_TYPE_XWD
  • FILE_TYPE_DIB
  • FILE_TYPE_JNG
  • FILE_TYPE_ICO
  • FILE_TYPE_FPX
  • FILE_TYPE_EPS
  • FILE_TYPE_SVG
  • FILE_TYPE_EMF
  • FILE_TYPE_WEBP
  • FILE_TYPE_DWG
  • FILE_TYPE_DXF
  • FILE_TYPE_THREEDS
  • FILE_TYPE_OGG
  • FILE_TYPE_FLC
  • FILE_TYPE_FLI
  • FILE_TYPE_MP3
  • FILE_TYPE_FLAC
  • FILE_TYPE_WAV
  • FILE_TYPE_MIDI
  • FILE_TYPE_AVI
  • FILE_TYPE_MPEG
  • FILE_TYPE_QUICKTIME
  • FILE_TYPE_ASF
  • FILE_TYPE_DIVX
  • FILE_TYPE_FLV
  • FILE_TYPE_WMA
  • FILE_TYPE_WMV
  • FILE_TYPE_RM
  • FILE_TYPE_MOV
  • FILE_TYPE_MP4
  • FILE_TYPE_T3GP
  • FILE_TYPE_WEBM
  • FILE_TYPE_MKV
  • FILE_TYPE_PDF
  • FILE_TYPE_PS
  • FILE_TYPE_DOC
  • FILE_TYPE_DOCX
  • FILE_TYPE_PPT
  • FILE_TYPE_PPTX
  • FILE_TYPE_XLS
  • FILE_TYPE_XLSX
  • FILE_TYPE_RTF
  • FILE_TYPE_PPSX
  • FILE_TYPE_ODP
  • FILE_TYPE_ODS
  • FILE_TYPE_ODT
  • FILE_TYPE_HWP
  • FILE_TYPE_GUL
  • FILE_TYPE_ODF
  • FILE_TYPE_ODG
  • FILE_TYPE_ONE_NOTE
  • FILE_TYPE_OOXML
  • FILE_TYPE_SLK
  • FILE_TYPE_EBOOK
  • FILE_TYPE_LATEX
  • FILE_TYPE_TTF
  • FILE_TYPE_EOT
  • FILE_TYPE_WOFF
  • FILE_TYPE_CHM
  • FILE_TYPE_ZIP
  • FILE_TYPE_GZIP
  • FILE_TYPE_BZIP
  • FILE_TYPE_RZIP
  • FILE_TYPE_DZIP
  • FILE_TYPE_SEVENZIP
  • FILE_TYPE_CAB
  • FILE_TYPE_JAR
  • FILE_TYPE_RAR
  • FILE_TYPE_MSCOMPRESS
  • FILE_TYPE_ACE
  • FILE_TYPE_ARC
  • FILE_TYPE_ARJ
  • FILE_TYPE_ASD
  • FILE_TYPE_BLACKHOLE
  • FILE_TYPE_KGB
  • FILE_TYPE_ZLIB
  • FILE_TYPE_TAR
  • FILE_TYPE_ZST
  • FILE_TYPE_LZFSE
  • FILE_TYPE_PYTHON_WHL
  • FILE_TYPE_PYTHON_PKG
  • FILE_TYPE_MSIX
  • FILE_TYPE_TEXT
  • FILE_TYPE_SCRIPT
  • FILE_TYPE_PHP
  • FILE_TYPE_PYTHON
  • FILE_TYPE_PERL
  • FILE_TYPE_RUBY
  • FILE_TYPE_C
  • FILE_TYPE_CPP
  • FILE_TYPE_JAVA
  • FILE_TYPE_SHELLSCRIPT
  • FILE_TYPE_PASCAL
  • FILE_TYPE_AWK
  • FILE_TYPE_DYALOG
  • FILE_TYPE_FORTRAN
  • FILE_TYPE_JAVASCRIPT
  • FILE_TYPE_POWERSHELL
  • FILE_TYPE_VBA
  • FILE_TYPE_M4
  • FILE_TYPE_OBJETIVEC
  • FILE_TYPE_JMOD
  • FILE_TYPE_MAKEFILE
  • FILE_TYPE_INI
  • FILE_TYPE_CLJ
  • FILE_TYPE_PDB
  • FILE_TYPE_SQL
  • FILE_TYPE_NEKO
  • FILE_TYPE_WER
  • FILE_TYPE_GOLANG
  • FILE_TYPE_M3U
  • FILE_TYPE_BAT
  • FILE_TYPE_MSC
  • FILE_TYPE_RDP
  • FILE_TYPE_SYMBIAN
  • FILE_TYPE_PALMOS
  • FILE_TYPE_WINCE
  • FILE_TYPE_ANDROID
  • FILE_TYPE_IPHONE
  • FILE_TYPE_HTML
  • FILE_TYPE_XML
  • FILE_TYPE_SWF
  • FILE_TYPE_FLA
  • FILE_TYPE_COOKIE
  • FILE_TYPE_TORRENT
  • FILE_TYPE_EMAIL_TYPE
  • FILE_TYPE_OUTLOOK
  • FILE_TYPE_SGML
  • FILE_TYPE_JSON
  • FILE_TYPE_CSV
  • FILE_TYPE_HTA
  • FILE_TYPE_INTERNET_SHORTCUT
  • FILE_TYPE_CAP
  • FILE_TYPE_ISOIMAGE
  • FILE_TYPE_SQUASHFS
  • FILE_TYPE_VHD
  • FILE_TYPE_APPLE
  • FILE_TYPE_MACINTOSH
  • FILE_TYPE_APPLESINGLE
  • FILE_TYPE_APPLEDOUBLE
  • FILE_TYPE_MACINTOSH_HFS
  • FILE_TYPE_APPLE_PLIST
  • FILE_TYPE_MACINTOSH_LIB
  • FILE_TYPE_APPLESCRIPT
  • FILE_TYPE_APPLESCRIPT_COMPILED
  • FILE_TYPE_CRX
  • FILE_TYPE_XPI
  • FILE_TYPE_ROM
  • FILE_TYPE_IPS
  • FILE_TYPE_PEM
  • FILE_TYPE_PGP
  • FILE_TYPE_CRT
enumDescriptions
  • File type is UNSPECIFIED.
  • File type is PE_EXE.
  • Although DLLs are actually portable executables, this value enables the file type to be identified separately. File type is PE_DLL.
  • File type is MSI.
  • File type is NE_EXE.
  • File type is NE_DLL.
  • File type is DOS_EXE.
  • File type is DOS_COM.
  • File type is COFF.
  • File type is ELF.
  • File type is LINUX_KERNEL.
  • File type is RPM.
  • File type is LINUX.
  • File type is MACH_O.
  • File type is JAVA_BYTECODE.
  • File type is DMG.
  • File type is DEB.
  • File type is PKG.
  • File type is PYC.
  • File type is LNK.
  • File type is DESKTOP_ENTRY.
  • File type is JPEG.
  • File type is TIFF.
  • File type is GIF.
  • File type is PNG.
  • File type is BMP.
  • File type is GIMP.
  • File type is Adobe InDesign.
  • File type is PSD. Adobe Photoshop.
  • File type is TARGA.
  • File type is XWD.
  • File type is DIB.
  • File type is JNG.
  • File type is ICO.
  • File type is FPX.
  • File type is EPS.
  • File type is SVG.
  • File type is EMF.
  • File type is WEBP.
  • File type is DWG.
  • File type is DXF.
  • File type is 3DS.
  • File type is OGG.
  • File type is FLC.
  • File type is FLI.
  • File type is MP3.
  • File type is FLAC.
  • File type is WAV.
  • File type is MIDI.
  • File type is AVI.
  • File type is MPEG.
  • File type is QUICKTIME.
  • File type is ASF.
  • File type is DIVX.
  • File type is FLV.
  • File type is WMA.
  • File type is WMV.
  • File type is RM. RealMedia type.
  • File type is MOV.
  • File type is MP4.
  • File type is T3GP.
  • File type is WEBM.
  • File type is MKV.
  • File type is PDF.
  • File type is PS.
  • File type is DOC.
  • File type is DOCX.
  • File type is PPT.
  • File type is PPTX.
  • File type is XLS.
  • File type is XLSX.
  • File type is RTF.
  • File type is PPSX.
  • File type is ODP.
  • File type is ODS.
  • File type is ODT.
  • File type is HWP.
  • File type is GUL.
  • File type is ODF.
  • File type is ODG.
  • File type is ONE_NOTE.
  • File type is OOXML.
  • File type is SLK.
  • File type is EBOOK.
  • File type is LATEX.
  • File type is TTF.
  • File type is EOT.
  • File type is WOFF.
  • File type is CHM.
  • File type is ZIP.
  • File type is GZIP.
  • File type is BZIP.
  • File type is RZIP.
  • File type is DZIP.
  • File type is SEVENZIP.
  • File type is CAB.
  • File type is JAR.
  • File type is RAR.
  • File type is MSCOMPRESS.
  • File type is ACE.
  • File type is ARC.
  • File type is ARJ.
  • File type is ASD.
  • File type is BLACKHOLE.
  • File type is KGB.
  • File type is ZLIB.
  • File type is TAR.
  • File type is ZST.
  • File type is LZFSE.
  • File type is PYTHON_WHL.
  • File type is PYTHON_PKG.
  • File type is MSIX, new Windows app package format.
  • File type is TEXT.
  • File type is SCRIPT.
  • File type is PHP.
  • File type is PYTHON.
  • File type is PERL.
  • File type is RUBY.
  • File type is C.
  • File type is CPP.
  • File type is JAVA.
  • File type is SHELLSCRIPT.
  • File type is PASCAL.
  • File type is AWK.
  • File type is DYALOG.
  • File type is FORTRAN.
  • File type is JAVASCRIPT.
  • File type is POWERSHELL.
  • File type is VBA.
  • File type is M4.
  • File type is OBJETIVEC.
  • File type is JMOD.
  • File type is MAKEFILE.
  • File type is INI.
  • File type is CLJ.
  • File type is PDB.
  • File type is SQL.
  • File type is NEKO.
  • File type is WER.
  • File type is GOLANG.
  • File type is M3U.
  • File type is BAT, Windows .bat/.cmd (old files are tagged as SHELLSCRIPT).
  • File type is MSC, Microsoft Management Console (MMC).
  • File type is RDP, Microsoft Remote Desktop Protocol (RDP) file.
  • File type is SYMBIAN.
  • File type is PALMOS.
  • File type is WINCE.
  • File type is ANDROID.
  • File type is IPHONE.
  • File type is HTML.
  • File type is XML.
  • File type is SWF.
  • File type is FLA.
  • File type is COOKIE.
  • File type is TORRENT.
  • File type is EMAIL_TYPE.
  • File type is OUTLOOK.
  • File type is SGML.
  • File type is JSON.
  • File type is CSV.
  • File type is HTA (HTML Application).
  • File type is MSHTML .url.
  • File type is CAP.
  • File type is ISOIMAGE.
  • File type is SQUASHFS.
  • File type is VHD.
  • File type is APPLE.
  • File type is MACINTOSH.
  • File type is APPLESINGLE.
  • File type is APPLEDOUBLE.
  • File type is MACINTOSH_HFS.
  • File type is APPLE_PLIST.
  • File type is MACINTOSH_LIB.
  • File type is APPLESCRIPT.
  • File type is APPLESCRIPT_COMPILED .
  • File type is CRX.
  • File type is XPI.
  • File type is ROM.
  • File type is IPS.
  • File type is PEM.
  • File type is PGP.
  • File type is CRT.
typestring
firstSeenTime
descriptionTimestamp the file was first seen in the customer's environment.
formatgoogle-datetime
typestring
firstSubmissionTime
descriptionFirst submission time of the file.
formatgoogle-datetime
typestring
fullPath
descriptionThe full path identifying the location of the file on the system. This field can be used as an entity indicator for file entities.
typestring
lastAccessTime
descriptionTimestamp when the file was accessed.
formatgoogle-datetime
typestring
lastAnalysisTime
descriptionTimestamp the file was last analysed.
formatgoogle-datetime
typestring
lastModificationTime
descriptionTimestamp when the file was last updated.
formatgoogle-datetime
typestring
lastSeenTime
descriptionTimestamp the file was last seen in the customer's environment.
formatgoogle-datetime
typestring
lastSubmissionTime
descriptionLast submission time of the file.
formatgoogle-datetime
typestring
mainIcon
$refFavicon
descriptionIcon's relevant hashes.
md5
descriptionThe MD5 hash of the file, as a hex-encoded string. This field can be used as an entity indicator for file entities.
typestring
mimeType
descriptionThe MIME (Multipurpose Internet Mail Extensions) type of the file, for example "PE", "PDF", or "powershell script".
typestring
names
descriptionNames fields.
items
typestring
typearray
ntfs
$refNtfsFileMetadata
descriptionNTFS metadata.
pdfInfo
$refPDFInfo
descriptionInformation about the PDF file structure.
peFile
$refFileMetadataPE
descriptionMetadata about the Portable Executable (PE) file.
prevalence
$refPrevalence
descriptionPrevalence of the file hash in the customer's environment.
securityResult
$refSecurityResult
descriptionGoogle Cloud Threat Intelligence (GCTI) security result for the file including threat context and detection metadata.
sha1
descriptionThe SHA1 hash of the file, as a hex-encoded string. This field can be used as an entity indicator for file entities.
typestring
sha256
descriptionThe SHA256 hash of the file, as a hex-encoded string. This field can be used as an entity indicator for file entities.
typestring
signatureInfo
$refSignatureInfo
descriptionFile signature information extracted from different tools.
size
descriptionThe size of the file in bytes.
formatuint64
typestring
ssdeep
descriptionSsdeep of the file
typestring
statDev
descriptionThe file system identifier to which the object belongs.
formatuint64
typestring
statFlags
descriptionUser defined flags for file.
formatuint32
typeinteger
statInode
descriptionThe file identifier. Unique identifier of object within a file system.
formatuint64
typestring
statMode
descriptionThe mode of the file. A bit string indicating the permissions and privileges of the file.
formatuint64
typestring
statNlink
descriptionNumber of links to file.
formatuint64
typestring
symhash
descriptionSymHash of the file. Used for Mach-O (e.g. MacOS) binaries, to identify similar files based on their symbol table.
typestring
tags
descriptionTags for the file.
items
typestring
typearray
vhash
descriptionVhash of the file.
typestring
typeobject
BoolSequence
descriptionBoolSequence represents a sequence of bools.
idBoolSequence
properties
boolVals
descriptionbool sequence.
items
typeboolean
typearray
typeobject
BytesSequence
descriptionBytesSequence represents a sequence of bytes.
idBytesSequence
properties
bytesVals
descriptionbytes sequence.
items
formatbyte
typestring
typearray
typeobject
CancelOperationRequest
descriptionThe request message for Operations.CancelOperation.
idCancelOperationRequest
properties
typeobject
CertSignature
descriptionCertificate's signature and algorithm.
idCertSignature
properties
signature
descriptionSignature.
typestring
signatureAlgorithm
descriptionAlgorithm.
typestring
typeobject
Certificate
descriptionCertificate information
idCertificate
properties
issuer
descriptionIssuer of the certificate.
typestring
md5
descriptionThe MD5 hash of the certificate, as a hex-encoded string.
typestring
notAfter
descriptionIndicates when the certificate is no longer valid.
formatgoogle-datetime
typestring
notBefore
descriptionIndicates when the certificate is first valid.
formatgoogle-datetime
typestring
serial
descriptionCertificate serial number.
typestring
sha1
descriptionThe SHA1 hash of the certificate, as a hex-encoded string.
typestring
sha256
descriptionThe SHA256 hash of the certificate, as a hex-encoded string.
typestring
subject
descriptionSubject of the certificate.
typestring
version
descriptionCertificate version.
typestring
typeobject
Chip
idChip
properties
text
typestring
type
enum
  • UNSPECIFIED
  • ALERT
  • NETWORK_CONNECTION
  • EDR
  • UNPARSED_RAW_LOG
  • LOGIN_EVENT
  • EMAIL_EVENT
  • GENERIC
  • TELEMETRY
enumDescriptions
typestring
typeobject
Client
descriptionTransport Layer Security (TLS) information associated with the client (for example, Certificate or JA3 hash).
idClient
properties
certificate
$refCertificate
descriptionClient certificate.
ja3
descriptionJA3 hash from the TLS ClientHello, as a hex-encoded string.
typestring
serverName
descriptionHost name of the server, that the client is connecting to.
typestring
supportedCiphers
descriptionCiphers supported by the client during client hello.
items
typestring
typearray
typeobject
Cloud
descriptionMetadata related to the cloud environment.
idCloud
properties
availabilityZone
descriptionThe cloud environment availability zone (different from region which is location.name).
typestring
environment
descriptionThe Cloud environment.
enum
  • UNSPECIFIED_CLOUD_ENVIRONMENT
  • GOOGLE_CLOUD_PLATFORM
  • AMAZON_WEB_SERVICES
  • MICROSOFT_AZURE
enumDescriptions
  • Default.
  • Google Cloud Platform.
  • Amazon Web Services.
  • Microsoft Azure.
typestring
project
$refResource
deprecatedTrue
descriptionThe cloud environment project information. Deprecated: Use Resource.resource_ancestors
vpc
$refResource
deprecatedTrue
descriptionThe cloud environment VPC. Deprecated.
typeobject
Collection
descriptionCollection represents a container of objects (such as events, entity context metadata, detection finding metadata) and state (such as investigation details). BEGIN GOOGLE-INTERNAL See go/udm:collections for additional details. END GOOGLE-INTERNAL An example use case for Collection is to model a detection and investigation from detection finding metadata to investigative state collected in the course of the investigation. For more complex investigation and response workflows a Collection could represent an incident consisting of multiple child findings or incidents. This can be expanded on to model remediation elements of a full detection and response workflow. NEXT TAG: 20
idCollection
properties
caseName
descriptionThe resource name of the Case that this collection belongs to. Example: projects/{project id}/locations/{region}/chronicle/cases/{internal_case_id}
typestring
collectionElements
descriptionConstituent elements of the collection. Each element shares an association that groups it together and is a component of the overall collection. For example, a detection collection may have several constituent elements that each share a correlation association that together represent a particular pattern or behavior.
items
$refElement
typearray
createdTime
descriptionTime the collection was created.
formatgoogle-datetime
typestring
dataAccessScope
descriptionThe resource name of the DataAccessScope of this collection. BEGIN GOOGLE-INTERNAL We may change this name based on the final resource design of the scope. END GOOGLE-INTERNAL
typestring
detection
descriptionDetection metadata for findings that represent detections, can include rule details, machine learning model metadata, and indicators implicated in the detection (using the .about field).
items
$refSecurityResult
typearray
detectionTime
descriptionTimestamp within the time_window related to the time of the collection_elements. For Rule Detections, this timestamp is the end of the the time_window for multi-event rules or the time of the event for single event rules. For late-arriving events that trigger new alerts, the detection_time will be the event time of the event.
formatgoogle-datetime
typestring
feedbackHistory
descriptionThe history of feedback submitted by analysts for this finding, in descending order by timestamp. This field is limited to the most recent 1000 feedback events. The primary feedback will also be included in this list.
items
$refFeedback
typearray
feedbackSummary
$refFeedback
descriptionThe current primary analyst feedback. This does not include the history of feedback given, which may be supplied in `feedback`.
id
descriptionUnique ID for the collection. The ID is specific to the type of collection. For example, with rule detections this is the detection ID.
typestring
idNamespace
descriptionThe ID namespace used for the Collection.
enum
  • NORMALIZED_TELEMETRY
  • RAW_TELEMETRY
  • RULE_DETECTIONS
  • UPPERCASE
  • MACHINE_INTELLIGENCE
  • SECURITY_COMMAND_CENTER
  • UNSPECIFIED
  • SOAR_ALERT
  • VIRUS_TOTAL
enumDescriptions
  • Ingested and Normalized telemetry events
  • Ingested Raw telemetry
  • Chronicle Rules engine
  • Uppercase
  • DSML - Machine Intelligence
  • A normalized telemetry event from Google Security Command Center.
  • Unspecified Namespace
  • An alert coming from other SIEMs via Chronicle SOAR.
  • VirusTotal.
typestring
investigation
$refInvestigation
descriptionConsolidated investigation details (categorization, status, etc) typically for collections that begin as detection findings and then evolve with analyst action and feedback into investigations around the detection output.
lastUpdatedTime
descriptionTime the collection was last updated.
formatgoogle-datetime
typestring
responsePlatformInfo
$refResponsePlatformInfo
descriptionAlert related info of this same alert in customer's SOAR platform.
soarAlert
descriptionA boolean field indicating that the alert is present in SOAR.
typeboolean
soarAlertMetadata
$refSoarAlertMetadata
descriptionMetadata fields of alerts coming from other SIEM systems via SOAR.
tags
descriptionTags set by UC/DSML/RE for the Finding during creation.
items
typestring
typearray
timeWindow
$refInterval
descriptionTime interval that the collection represents.
type
descriptionWhat the collection represents.
enum
  • COLLECTION_TYPE_UNSPECIFIED
  • TELEMETRY_ALERT
  • GCTI_FINDING
  • UPPERCASE_ALERT
  • RULE_DETECTION
  • MACHINE_INTELLIGENCE_ALERT
  • SOAR_ALERT
enumDescriptions
  • An unspecified collection type.
  • An alert reported in customer telemetry.
  • A finding from the Uppercase team.
  • A detection found by applying a rule.
  • An alert generated by Chronicle machine learning models.
  • An alert coming from other SIEMs via Chronicle SOAR.
typestring
typeobject
ColumnNames
idColumnNames
properties
names
items
typestring
typearray
typeobject
CompilationDiagnostic
descriptionCompilationDiagnostic represents a compilation diagnostic generated during a rule's compilation, such as a compilation error or a compilation warning.
idCompilationDiagnostic
properties
message
descriptionOutput only. The diagnostic message.
readOnlyTrue
typestring
position
$refCompilationPosition
descriptionOutput only. The approximate position in the rule text associated with the compilation diagnostic. Compilation Position may be empty.
readOnlyTrue
severity
descriptionOutput only. The severity of a rule's compilation diagnostic.
enum
  • SEVERITY_UNSPECIFIED
  • WARNING
  • ERROR
enumDescriptions
  • An unspecified severity level.
  • A compilation warning.
  • A compilation error.
readOnlyTrue
typestring
uri
descriptionOutput only. Link to documentation that describes a diagnostic in more detail.
readOnlyTrue
typestring
typeobject
CompilationPosition
descriptionCompilationPosition represents the location of a compilation diagnostic in rule text.
idCompilationPosition
properties
endColumn
descriptionOutput only. End column number, beginning at 1.
formatint32
readOnlyTrue
typeinteger
endLine
descriptionOutput only. End line number, beginning at 1.
formatint32
readOnlyTrue
typeinteger
startColumn
descriptionOutput only. Start column number, beginning at 1.
formatint32
readOnlyTrue
typeinteger
startLine
descriptionOutput only. Start line number, beginning at 1.
formatint32
readOnlyTrue
typeinteger
typeobject
CreateParserExtensionMetadata
descriptionOperation metadata for creating a parser extension.
idCreateParserExtensionMetadata
properties
state
descriptionThe state of the parser extension creation process.
enum
  • STATE_UNSPECIFIED
  • NEW
  • VALIDATING
  • LIVE
  • REJECTED
  • INTERNAL_ERROR
  • VALIDATED
  • ARCHIVED
enumDescriptions
  • The state for this parser extension was not specified.
  • The parser extension has been newly submitted and is waiting to be validated.
  • The parser extension is currently going through the validation pipeline.
  • The parser extension is live in production. Only configs that have successfully passed the validation stage will be set to LIVE.
  • Validation completed, but the parser extension was rejected with errors.
  • An error occurred when processing this parser extension.
  • Extension is validated.
  • Extension is archived and is no more being used.
typestring
stateLastChangedTime
descriptionThe time the config state was last changed.
formatgoogle-datetime
typestring
validationErrors
descriptionAny validation error while validating the extension, this have cap of size 10
items
typestring
typearray
validationReport
descriptionThe validation report generated during validation of the parser extension.
typestring
typeobject
CreateParserMetadata
descriptionOperation metadata for creating a parser.
idCreateParserMetadata
properties
stage
descriptionThe validation stage of the parser creation process.
enum
  • VALIDATION_STAGE_UNSPECIFIED
  • NEW
  • VALIDATING
  • PASSED
  • FAILED
  • DELETE_CANDIDATE
enumDescriptions
  • The validation stage is not specified.
  • The custom parser is submitted for validation.
  • The custom parser is currently going through the validation pipeline
  • The custom parser has successfully passed the validation.
  • The custom parser has failed validation.
  • The parser is no good, It is available for auto deletion.
typestring
validationReport
descriptionThe validation report generated during validation of the parser.
typestring
typeobject
DNSRecord
descriptionDNS record.
idDNSRecord
properties
expire
descriptionExpire.
formatgoogle-duration
typestring
minimum
descriptionMinimum.
formatgoogle-duration
typestring
priority
descriptionPriority.
formatint64
typestring
refresh
descriptionRefresh.
formatgoogle-duration
typestring
retry
descriptionRetry.
formatint64
typestring
rname
descriptionRname.
typestring
serial
descriptionSerial.
formatint64
typestring
ttl
descriptionTime to live.
formatgoogle-duration
typestring
type
descriptionType.
typestring
value
descriptionValue.
typestring
typeobject
DataAccessIngestionLabel
idDataAccessIngestionLabel
properties
key
descriptionThe key.
typestring
value
descriptionThe value.
typestring
typeobject
DataAccessLabel
descriptionA DataAccessLabel is a label on events to define user access to data.
idDataAccessLabel
properties
author
descriptionOutput only. The user who created the data access label.
readOnlyTrue
typestring
createTime
descriptionOutput only. The time at which the data access label was created.
formatgoogle-datetime
readOnlyTrue
typestring
description
descriptionOptional. A description of the data access label for a human reader.
typestring
displayName
descriptionOutput only. The short name displayed for the label as it appears on event data.
readOnlyTrue
typestring
lastEditor
descriptionOutput only. The user who last updated the data access label.
readOnlyTrue
typestring
name
descriptionRequired. The unique resource name of the data access label.
typestring
udmQuery
descriptionA UDM query over event data.
typestring
updateTime
descriptionOutput only. The time at which the data access label was last updated.
formatgoogle-datetime
readOnlyTrue
typestring
typeobject
DataAccessLabelReference
descriptionReference object to a data access label.
idDataAccessLabelReference
properties
assetNamespace
descriptionThe asset namespace configured in the forwarder of the customer's events.
typestring
dataAccessLabel
descriptionThe name of the data access label.
typestring
displayName
descriptionOutput only. The display name of the label. Data access label and log types's name will match the display name of the resource. The asset namespace will match the namespace itself. The ingestion key value pair will match the key of the tuple.
readOnlyTrue
typestring
ingestionLabel
$refIngestionLabel
descriptionThe ingestion label configured in the forwarder of the customer's events.
logType
descriptionThe name of the log type.
typestring
typeobject
DataAccessLabels
idDataAccessLabels
properties
allowScopedAccess
descriptionAre the labels ready for scoped access
typeboolean
customLabels
descriptionAll the complex labels (UDM search syntax based).
items
typestring
typearray
ingestionKvLabels
descriptionAll the ingestion labels (key/value pairs).
items
$refDataAccessIngestionLabel
typearray
ingestionLabels
deprecatedTrue
descriptionAll the ingestion labels.
items
typestring
typearray
logTypes
descriptionAll the LogType labels.
items
typestring
typearray
namespaces
descriptionAll the namespaces.
items
typestring
typearray
typeobject
DataAccessScope
descriptionA DataAccessScope is a boolean expression of data access labels used to restrict access to data for users.
idDataAccessScope
properties
allowAll
descriptionOptional. Whether or not the scope allows all labels, allow_all and allowed_data_access_labels are mutually exclusive and one of them must be present. denied_data_access_labels can still be used along with allow_all. When combined with denied_data_access_labels, access will be granted to all data that doesn't have labels mentioned in denied_data_access_labels. E.g.: A customer with scope with denied labels A and B and allow_all will be able to see all data except data labeled with A and data labeled with B and data with labels A and B.
typeboolean
allowedDataAccessLabels
descriptionOptional. The allowed labels for the scope. Either allow_all or allowed_data_access_labels needs to be provided. When provided, there has to be at least one label allowed for the scope to be valid. The logical operator for evaluation of the allowed labels is OR. E.g.: A customer with scope with allowed labels A and B will be able to see data with labeled with A or B or (A and B).
items
$refDataAccessLabelReference
typearray
author
descriptionOutput only. The user who created the data access scope.
readOnlyTrue
typestring
createTime
descriptionOutput only. The time at which the data access scope was created.
formatgoogle-datetime
readOnlyTrue
typestring
deniedDataAccessLabels
descriptionOptional. The denied labels for the scope. The logical operator for evaluation of the denied labels is AND. E.g.: A customer with scope with denied labels A and B won't be able to see data labeled with A and data labeled with B and data with labels A and B.
items
$refDataAccessLabelReference
typearray
description
descriptionOptional. A description of the data access scope for a human reader.
typestring
displayName
descriptionOutput only. The name to be used for display to customers of the data access scope.
readOnlyTrue
typestring
lastEditor
descriptionOutput only. The user who last updated the data access scope.
readOnlyTrue
typestring
name
descriptionRequired. The unique full name of the data access scope. The name should comply with https://google.aip.dev/122 standards.
typestring
updateTime
descriptionOutput only. The time at which the data access scope was last updated.
formatgoogle-datetime
readOnlyTrue
typestring
typeobject
Date
descriptionRepresents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values. * A month and day, with a zero year (for example, an anniversary). * A year on its own, with a zero month and a zero day. * A year and month, with a zero day (for example, a credit card expiration date). Related types: * google.type.TimeOfDay * google.type.DateTime * google.protobuf.Timestamp
idDate
properties
day
descriptionDay of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.
formatint32
typeinteger
month
descriptionMonth of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.
formatint32
typeinteger
year
descriptionYear of the date. Must be from 1 to 9999, or 0 to specify a date without a year.
formatint32
typeinteger
typeobject
Detections
idDetections
properties
baselineAlertsCount
formatint32
typeinteger
complete
typeboolean
detectionFieldAggregations
$refAlertFieldAggregations
detections
items
$refCollection
typearray
filteredAlertsCount
formatint32
typeinteger
tooManyDetections
typeboolean
validSnapshotQuery
typeboolean
typeobject
Dhcp
descriptionDHCP information.
idDhcp
properties
chaddr
descriptionClient hardware address (chaddr).
typestring
ciaddr
descriptionClient IP address (ciaddr).
typestring
clientHostname
descriptionClient hostname. See RFC2132, section 3.14.
typestring
clientIdentifier
descriptionClient identifier. See RFC2132, section 9.14. Note: Make sure to update the client_identifier_string field as well if you update this field.
formatbyte
typestring
clientIdentifierString
descriptionClient identifier as string. See RFC2132, section 9.14. This field holds the string value of the client_identifier.
typestring
file
descriptionBoot image filename.
typestring
flags
descriptionFlags.
formatuint32
typeinteger
giaddr
descriptionRelay agent IP address (giaddr).
typestring
hlen
descriptionHardware address length.
formatuint32
typeinteger
hops
descriptionHardware ops.
formatuint32
typeinteger
htype
descriptionHardware address type.
formatuint32
typeinteger
leaseTimeSeconds
descriptionLease time in seconds. See RFC2132, section 9.2.
formatuint32
typeinteger
opcode
descriptionThe BOOTP op code.
enum
  • UNKNOWN_OPCODE
  • BOOTREQUEST
  • BOOTREPLY
enumDescriptions
  • Default opcode.
  • Request.
  • Reply.
typestring
options
descriptionList of DHCP options.
items
$refOption
typearray
requestedAddress
descriptionRequested IP address. See RFC2132, section 9.1.
typestring
seconds
descriptionSeconds elapsed since client began address acquisition/renewal process.
formatuint32
typeinteger
siaddr
descriptionIP address of the next bootstrap server.
typestring
sname
descriptionServer name that the client wishes to boot from.
typestring
transactionId
descriptionTransaction ID.
formatuint32
typeinteger
type
descriptionDHCP message type.
enum
  • UNKNOWN_MESSAGE_TYPE
  • DISCOVER
  • OFFER
  • REQUEST
  • DECLINE
  • ACK
  • NAK
  • RELEASE
  • INFORM
  • WIN_DELETED
  • WIN_EXPIRED
enumDescriptions
  • Default message type.
  • DHCPDISCOVER.
  • DHCPOFFER.
  • DHCPREQUEST.
  • DHCPDECLINE.
  • DHCPACK.
  • DHCPNAK.
  • DHCPRELEASE.
  • DHCPINFORM.
  • Microsoft Windows DHCP "lease deleted".
  • Microsoft Windows DHCP "lease expired".
typestring
yiaddr
descriptionYour IP address (yiaddr).
typestring
typeobject
Dns
descriptionDNS information.
idDns
properties
additional
descriptionA list of additional domain name servers that can be used to verify the answer to the domain.
items
$refResourceRecord
typearray
answers
descriptionA list of answers to the domain name query.
items
$refResourceRecord
typearray
authoritative
descriptionOther DNS header flags. See RFC1035, section 4.1.1.
typeboolean
authority
descriptionA list of domain name servers which verified the answers to the domain name queries.
items
$refResourceRecord
typearray
id
descriptionDNS query id.
formatuint32
typeinteger
opcode
descriptionThe DNS OpCode used to specify the type of DNS query (for example, QUERY, IQUERY, or STATUS).
formatuint32
typeinteger
questions
descriptionA list of domain protocol message questions.
items
$refQuestion
typearray
recursionAvailable
descriptionWhether a recursive DNS lookup is available.
typeboolean
recursionDesired
descriptionWhether a recursive DNS lookup is desired.
typeboolean
response
descriptionSet to true if the event is a DNS response. See QR field from RFC1035.
typeboolean
responseCode
descriptionResponse code. See RCODE from RFC1035.
formatuint32
typeinteger
truncated
descriptionWhether the DNS response was truncated.
typeboolean
typeobject
Domain
descriptionInformation about a domain.
idDomain
properties
admin
$refUser
descriptionParsed contact information for the administrative contact for the domain.
auditUpdateTime
descriptionAudit updated time.
formatgoogle-datetime
typestring
billing
$refUser
descriptionParsed contact information for the billing contact of the domain.
categories
descriptionCategories assign to the domain as retrieved from VirusTotal.
items
typestring
typearray
contactEmail
descriptionContact email address.
typestring
creationTime
descriptionDomain creation time.
formatgoogle-datetime
typestring
expirationTime
descriptionExpiration time.
formatgoogle-datetime
typestring
favicon
$refFavicon
descriptionIncludes difference hash and MD5 hash of the domain's favicon.
firstSeenTime
descriptionFirst seen timestamp of the domain in the customer's environment.
formatgoogle-datetime
typestring
ianaRegistrarId
descriptionIANA Registrar ID. See https://www.iana.org/assignments/registrar-ids/registrar-ids.xhtml
formatint32
typeinteger
jarm
descriptionDomain's JARM hash.
typestring
lastDnsRecords
descriptionDomain's DNS records from the last scan.
items
$refDNSRecord
typearray
lastDnsRecordsTime
descriptionDate when the DNS records list was retrieved by VirusTotal.
formatgoogle-datetime
typestring
lastHttpsCertificate
$refSSLCertificate
descriptionSSL certificate object retrieved last time the domain was analyzed.
lastHttpsCertificateTime
descriptionWhen the certificate was retrieved by VirusTotal.
formatgoogle-datetime
typestring
lastSeenTime
descriptionLast seen timestamp of the domain in the customer's environment.
formatgoogle-datetime
typestring
name
descriptionThe domain name. This field can be used as an entity indicator for Domain entities.
typestring
nameServer
descriptionRepeated list of name servers.
items
typestring
typearray
popularityRanks
descriptionDomain's position in popularity ranks such as Alexa, Quantcast, Statvoo, etc
items
$refPopularityRank
typearray
prevalence
$refPrevalence
descriptionThe prevalence of the domain within the customer's environment.
privateRegistration
descriptionIndicates whether the domain appears to be using a private registration service to mask the owner's contact information.
typeboolean
registrant
$refUser
descriptionParsed contact information for the registrant of the domain.
registrar
descriptionRegistrar name . FOr example, "Wild West Domains, Inc. (R120-LROR)", "GoDaddy.com, LLC", or "PDR LTD. D/B/A PUBLICDOMAINREGISTRY.COM".
typestring
registryDataRawText
descriptionRegistry Data raw text.
formatbyte
typestring
status
descriptionDomain status. See https://www.icann.org/resources/pages/epp-status-codes-2014-06-16-en for meanings of possible values
typestring
tags
descriptionList of representative attributes.
items
typestring
typearray
tech
$refUser
descriptionParsed contact information for the technical contact for the domain
updateTime
descriptionLast updated time.
formatgoogle-datetime
typestring
whoisRecordRawText
descriptionWHOIS raw text.
formatbyte
typestring
whoisServer
descriptionWhois server name.
typestring
whoisTime
descriptionDate of the last update of the WHOIS record.
formatgoogle-datetime
typestring
zone
$refUser
descriptionParsed contact information for the zone.
typeobject
DoubleSequence
descriptionDoubleSequence represents a sequence of doubles.
idDoubleSequence
properties
doubleVals
descriptiondouble sequence.
items
formatdouble
typenumber
typearray
typeobject
EC
descriptionEC public key information.
idEC
properties
oid
descriptionCurve name.
typestring
pub
descriptionPublic key hexdump.
typestring
typeobject
Element
descriptionNEXT TAG: 5
idElement
properties
association
$refSecurityResult
descriptionMetadata that provides the relevant association for the references in the element. For a detection, this can be the correlated aspect of the references that contributed to the overall detection. For example, may include sub-rule condition, machine learning model metadata, and/or indicators implicated in this component of the detection (using the .about field).
label
descriptionA name that labels the entire references group.
typestring
references
descriptionReferences to model primatives including events and entities that share a common association. Even though a reference can have both UDM and entity, a collection of references (of a single element) will only have one type of message in it (either UDM / Entity).
items
$refReference
typearray
referencesSampled
descriptionCopied from the detection event_sample.too_many_event_samples field. If true, the number of references will be capped at the sample limit (set at rule service). This is applicable to both UDM references and Entity references.
typeboolean
typeobject
Email
descriptionEmail info.
idEmail
properties
bcc
descriptionA list of 'bcc' addresses.
items
typestring
typearray
bounceAddress
descriptionThe envelope from address. https://en.wikipedia.org/wiki/Bounce_address
typestring
cc
descriptionA list of 'cc' addresses.
items
typestring
typearray
from
descriptionThe 'from' address.
typestring
mailId
descriptionThe mail (or message) ID.
typestring
replyTo
descriptionThe 'reply to' address.
typestring
subject
descriptionThe subject line(s) of the email.
items
typestring
typearray
to
descriptionA list of 'to' addresses.
items
typestring
typearray
typeobject
Empty
descriptionA generic empty message that you can re-use to avoid defining duplicated empty messages in your APIs. A typical example is to use it as the request or the response type of an API method. For instance: service Foo { rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty); }
idEmpty
properties
typeobject
EntityChangedCountTimelineBucket
idEntityChangedCountTimelineBucket
properties
entityChangedInfo
items
$refEntityChangedInfo
typearray
totalChangedEntitiesCount
formatint32
typeinteger
typeobject
EntityChangedInfo
idEntityChangedInfo
properties
artifacts
$refFieldAndValue
entityCount
formatint32
typeinteger
typeobject
EntityCount
descriptionCount of different types of entities in the watchlist.
idEntityCount
properties
asset
descriptionOutput only. Count of asset type entities in the watchlist.
formatint32
readOnlyTrue
typeinteger
user
descriptionOutput only. Count of user type entities in the watchlist.
formatint32
readOnlyTrue
typeinteger
typeobject
EntityMetadata
descriptionInformation about the Entity and the product where the entity was created. Next Tag: 17
idEntityMetadata
properties
collectedTimestamp
descriptionGMT timestamp when the entity information was collected by the vendor's local collection infrastructure.
formatgoogle-datetime
typestring
creationTimestamp
descriptionGMT timestamp when the entity described by the product_entity_id was created on the system where data was collected.
formatgoogle-datetime
typestring
description
descriptionHuman-readable description of the entity.
typestring
entityType
descriptionEntity type. If an entity has multiple possible types, this specifies the most specific type.
enum
  • UNKNOWN_ENTITYTYPE
  • ASSET
  • USER
  • GROUP
  • RESOURCE
  • IP_ADDRESS
  • FILE
  • DOMAIN_NAME
  • URL
  • MUTEX
  • METRIC
enumDescriptions
  • @hide_from_doc
  • An asset, such as workstation, laptop, phone, virtual machine, etc.
  • User.
  • Group.
  • Resource.
  • An external IP address.
  • A file.
  • A domain.
  • A url.
  • A mutex.
  • A metric.
typestring
eventMetadata
$refMetadata
descriptionMetadata field from the event.
extracted
additionalProperties
descriptionProperties of the object.
typeany
descriptionFlattened fields extracted from the log.
typeobject
feed
descriptionVendor feed name for a threat indicator feed.
typestring
interval
$refInterval
descriptionValid existence time range for the version of the entity represented by this entity data.
productEntityId
descriptionA vendor-specific identifier that uniquely identifies the entity (e.g. a GUID, LDAP, OID, or similar).
typestring
productName
descriptionProduct name that produced the entity information.
typestring
productVersion
descriptionVersion of the product that produced the entity information.
typestring
sourceLabels
descriptionEntity source metadata labels.
items
$refLabel
typearray
sourceType
descriptionThe source of the entity.
enum
  • SOURCE_TYPE_UNSPECIFIED
  • ENTITY_CONTEXT
  • DERIVED_CONTEXT
  • GLOBAL_CONTEXT
enumDescriptions
  • Default source type
  • Entities ingested from customers (e.g. AD_CONTEXT, DLP_CONTEXT)
  • Entities derived from customer data such as prevalence, artifact first/last seen, or asset/user first seen stats.
  • Global contextual entities such as WHOIS or Safe Browsing.
typestring
structuredFields
additionalProperties
descriptionProperties of the object.
typeany
deprecatedTrue
descriptionStructured fields extracted from the log.
typeobject
threat
descriptionMetadata provided by a threat intelligence feed that identified the entity as malicious.
items
$refSecurityResult
typearray
vendorName
descriptionVendor name of the product that produced the entity information.
typestring
typeobject
EntityPopulationMechanism
descriptionMechanism to populate entities in the watchlist.
idEntityPopulationMechanism
properties
manual
$refManual
descriptionOptional. Entities are added manually.
typeobject
EntityRisk
descriptionStores information related to the risk score of an entity. Next ID: 15
idEntityRisk
properties
DEPRECATEDRiskScore
deprecatedTrue
descriptionDeprecated risk score.
formatint32
typeinteger
detailUri
descriptionLink to the Google Security Operations UI with information about the entity risk score. If the SecOps instance has multiple frontend paths configured, this will be a relative path that can be used to construct the full URL.
typestring
detectionsCount
descriptionNumber of detections that make up the risk score within the time window.
formatint32
typeinteger
firstDetectionTime
descriptionTimestamp of the first detection within the specified time window. This field is empty when there are no detections.
formatgoogle-datetime
typestring
lastDetectionTime
descriptionTimestamp of the last detection within the specified time window. This field is empty when there are no detections.
formatgoogle-datetime
typestring
lastResetTime
descriptionTimestamp for UEBA risk score reset based deduplication. Used specifically for risk based meta rules.
formatgoogle-datetime
typestring
normalizedRiskScore
descriptionNormalized risk score for the entity. This value is between 0-1000.
formatint32
typeinteger
rawRiskDelta
$refRiskDelta
descriptionRepresents the change in raw risk score for an entity between the end of the previous time window and the end of the current time window.
riskDelta
$refRiskDelta
descriptionRepresents the change in risk score for an entity between the end of the previous time window and the end of the current time window.
riskScore
descriptionRaw risk score for the entity.
formatfloat
typenumber
riskVersion
descriptionVersion of the risk score calculation algorithm.
typestring
riskWindow
$refInterval
descriptionTime window used when computing the risk score for an entity, for example 24 hours or 7 days.
riskWindowHasNewDetections
descriptionWhether there are new detections for the risk window.
typeboolean
riskWindowSize
descriptionRisk window duration for the entity.
formatgoogle-duration
typestring
typeobject
ErrorMessage
idErrorMessage
properties
errorText
typestring
type
enum
  • UNDEFINED_ERROR_TYPE
  • INVALID_QUERY_TYPE
  • INVALID_FIELD_PATH_TYPE
  • UNCLOSED_BRACKET_TYPE
  • BACKEND_ERROR_TYPE
  • UNCLOSED_QUOTES_TYPE
  • QUERY_TOO_LARGE_TYPE
enumDescriptions
typestring
typeobject
EventCountTimeline
idEventCountTimeline
properties
buckets
items
$refEventCountTimelineBucket
typearray
sizeOfBucketMs
formatint64
typestring
typeobject
EventCountTimelineBucket
idEventCountTimelineBucket
properties
alertCount
formatint32
typeinteger
baselineAlertCount
formatint32
typeinteger
baselineEventCount
formatint32
typeinteger
baselineTimedEntityCount
formatint32
typeinteger
entityChangedCount
$refEntityChangedCountTimelineBucket
eventCount
formatint32
typeinteger
filteredTimedEntityCount
formatint32
typeinteger
typeobject
Execution
descriptionExecution can be used to store metadata required for what action the UI should execute.
idExecution
properties
metadata
additionalProperties
typestring
descriptionOutput only. The payload to use when executing the action.
readOnlyTrue
typeobject
typeobject
ExifInfo
descriptionExif information.
idExifInfo
properties
company
descriptioncompany name.
typestring
compilationTime
descriptionCompilation time.
formatgoogle-datetime
typestring
entryPoint
descriptionentry point.
formatint64
typestring
fileDescription
descriptiondescription of a file.
typestring
originalFile
descriptionoriginal file name.
typestring
product
descriptionproduct name.
typestring
typeobject
Extension
descriptionCertificate's extensions.
idExtension
properties
authorityKeyId
$refAuthorityKeyId
descriptionIdentifies the public key to be used to verify the signature on this certificate or CRL.
ca
descriptionWhether the subject acts as a certificate authority (CA) or not.
typeboolean
caInfoAccess
descriptionAuthority information access locations are URLs that are added to a certificate in its authority information access extension.
typestring
certTemplateNameDc
descriptionBMP data value "DomainController". See MS Q291010.
typestring
certificatePolicies
descriptionDifferent certificate policies will relate to different applications which may use the certified key.
typestring
crlDistributionPoints
descriptionCRL distribution points to which a certificate user should refer to ascertain if the certificate has been revoked.
typestring
extendedKeyUsage
descriptionOne or more purposes for which the certified public key may be used, in addition to or in place of the basic purposes indicated in the key usage extension field.
typestring
keyUsage
descriptionThe purpose for which the certified public key is used.
typestring
netscapeCertComment
descriptionUsed to include free-form text comments inside certificates.
typestring
netscapeCertificate
descriptionIdentify whether the certificate subject is an SSL client, an SSL server, or a CA.
typeboolean
oldAuthorityKeyId
descriptionWhether the certificate has an old authority key identifier extension.
typeboolean
peLogotype
descriptionWhether the certificate includes a logotype.
typeboolean
subjectAlternativeName
descriptionContains one or more alternative names, using any of a variety of name forms, for the entity that is bound by the CA to the certified public key.
typestring
subjectKeyId
descriptionIdentifies the public key being certified.
typestring
typeobject
Extensions
descriptionExtensions to a UDM event.
idExtensions
properties
auth
$refAuthentication
descriptionAn authentication extension.
entityRisk
$refEntityRisk
descriptionAn entity risk change extension.
vulns
$refVulnerabilities
descriptionA vulnerability extension.
typeobject
Favicon
descriptionDifference hash and MD5 hash of the domain's favicon.
idFavicon
properties
dhash
descriptionDifference hash.
typestring
rawMd5
descriptionFavicon's MD5 hash.
typestring
typeobject
Feedback
idFeedback
properties
comment
descriptionOptional.
typestring
confidenceScore
formatint32
typeinteger
createdTime
formatgoogle-datetime
typestring
disregarded
typeboolean
idpUserId
typestring
priority
descriptionOptional.
enum
  • PRIORITY_UNSPECIFIED
  • PRIORITY_INFO
  • PRIORITY_LOW
  • PRIORITY_MEDIUM
  • PRIORITY_HIGH
  • PRIORITY_CRITICAL
enumDescriptions
  • Default priority level.
  • Informational priority.
  • Low priority.
  • Medium priority.
  • High priority.
  • Critical priority.
typestring
priorityDisplay
descriptionOptional.
typestring
reason
descriptionOptional.
enum
  • REASON_UNSPECIFIED
  • REASON_NOT_MALICIOUS
  • REASON_MALICIOUS
  • REASON_MAINTENANCE
enumDescriptions
  • Default reason.
  • Case or Alert not malicious.
  • Case or Alert is malicious.
  • Case or Alert is under maintenance.
typestring
reputation
enum
  • REPUTATION_UNSPECIFIED
  • USEFUL
  • NOT_USEFUL
enumDescriptions
  • An unspecified reputation.
  • A categorization of the finding as useful.
  • A categorization of the finding as not useful.
typestring
riskScore
formatint32
typeinteger
rootCause
descriptionOptional.
typestring
severity
formatint32
typeinteger
severityDisplay
descriptionOptional.
typestring
status
descriptionOptional.
enum
  • STATUS_UNSPECIFIED
  • NEW
  • REVIEWED
  • CLOSED
  • OPEN
enumDescriptions
  • Unspecified finding status.
  • New finding.
  • When a finding has feedback.
  • When an analyst closes an finding.
  • Open. Used to indicate that a Case / Alert is open.
typestring
verdict
enum
  • VERDICT_UNSPECIFIED
  • TRUE_POSITIVE
  • FALSE_POSITIVE
enumDescriptions
  • An unspecified verdict.
  • A categorization of the finding as a "true positive".
  • A categorization of the finding as a "false positive".
typestring
typeobject
FieldAndValue
idFieldAndValue
properties
entityNamespace
typestring
fieldPath
typestring
kvalueType
enum
  • UNKNOWN
  • COLLECTOR_ID
  • EVENT_SHARD
  • ASSET_IP_ADDRESS
  • MAC
  • HOSTNAME
  • PRODUCT_SPECIFIC_ID
  • NAMESPACE
  • DOMAIN_NAME
  • RESOLVED_IP_ADDRESS
  • STEMMED_DOMAIN_NAME
  • PROCESS_ID
  • FULL_COMMAND_LINE
  • FILE_NAME
  • FILE_PATH
  • HASH_MD5
  • HASH_SHA256
  • HASH_SHA1
  • RAW_PID
  • PARENT_PROCESS_ID
  • EMAIL
  • USERNAME
  • WINDOWS_SID
  • EMPLOYEE_ID
  • PRODUCT_OBJECT_ID
  • USER_DISPLAY_NAME
  • CLOUD_RESOURCE_NAME
  • REGISTRY_KEY
  • REGISTRY_VALUE_DATA
  • REGISTRY_VALUE_NAME
enumDescriptions
typestring
value
typestring
typeobject
FileMetadata
descriptionMetadata about a file. Place metadata about different file types here, for example data from the Microsoft Windows VersionInfo block or digital signer details. Use a different sub-message per file type.
idFileMetadata
properties
pe
$refPeFileMetadata
deprecatedTrue
descriptionMetadata for Microsoft Windows PE files. Deprecate PeFileMetadata in favor of single File proto.
typeobject
FileMetadataCodesign
descriptionFile metadata from the codesign utility.
idFileMetadataCodesign
properties
compilationTime
descriptionCode sign timestamp
formatgoogle-datetime
typestring
format
descriptionCode sign format.
typestring
id
descriptionCode sign identifier.
typestring
teamId
descriptionThe assigned team identifier of the developer who signed the application.
typestring
typeobject
FileMetadataImports
descriptionFile metadata imports.
idFileMetadataImports
properties
functions
descriptionFunction field.
items
typestring
typearray
library
descriptionLibrary field.
typestring
typeobject
FileMetadataPE
descriptionMetadata about the Portable Executable (PE) file.
idFileMetadataPE
properties
compilationExiftoolTime
descriptioninfo.exiftool.TimeStamp.
formatgoogle-datetime
typestring
compilationTime
descriptioninfo.pe-timestamp.
formatgoogle-datetime
typestring
entryPoint
descriptioninfo.pe-entry-point.
formatint64
typestring
entryPointExiftool
descriptioninfo.exiftool.EntryPoint.
formatint64
typestring
imphash
descriptionImphash of the file.
typestring
imports
descriptionFilemetadataImports fields.
items
$refFileMetadataImports
typearray
resource
descriptionFilemetadataPeResourceInfo fields.
items
$refFileMetadataPeResourceInfo
typearray
resourcesLanguageCount
deprecatedTrue
descriptionDeprecated: use resources_language_count_str.
items
$refStringToInt64MapEntry
typearray
resourcesLanguageCountStr
descriptionNumber of resources by language. Example: NEUTRAL: 20, ENGLISH US: 10
items
$refLabel
typearray
resourcesTypeCount
deprecatedTrue
descriptionDeprecated: use resources_type_count_str.
items
$refStringToInt64MapEntry
typearray
resourcesTypeCountStr
descriptionNumber of resources by resource type. Example: RT_ICON: 10, RT_DIALOG: 5
items
$refLabel
typearray
section
descriptionFilemetadataSection fields.
items
$refFileMetadataSection
typearray
signatureInfo
$refFileMetadataSignatureInfo
deprecatedTrue
descriptionFilemetadataSignatureInfo field. deprecated, user File.signature_info instead.
typeobject
FileMetadataPeResourceInfo
descriptionFile metadata for PE resource.
idFileMetadataPeResourceInfo
properties
entropy
descriptionEntropy of the resource.
formatdouble
typenumber
fileType
descriptionFile type. Note that this value may not match any of the well-known type identifiers defined in the ResourceType enum.
typestring
filetypeMagic
descriptionType of resource content, as identified by the magic Python module.
typestring
languageCode
descriptionHuman-readable version of the language and sublanguage identifiers, as defined in the Microsoft Windows PE specification. Examples: | Language | Sublanguage | Field value | | LANG_NEUTRAL | SUBLANG_NEUTRAL | NEUTRAL | | LANG_FRENCH | - | FRENCH | | LANG_ENGLISH | SUBLANG_ENGLISH US | ENGLISH US |
typestring
sha256Hex
descriptionSHA256_hex field..
typestring
typeobject
FileMetadataSection
descriptionFile metadata section.
idFileMetadataSection
properties
entropy
descriptionEntropy of the section.
formatdouble
typenumber
md5Hex
descriptionMD5 hex of the file.
typestring
name
descriptionName of the section.
typestring
rawSizeBytes
descriptionRaw file size in bytes.
formatint64
typestring
virtualSizeBytes
descriptionVirtual file size in bytes.
formatint64
typestring
typeobject
FileMetadataSignatureInfo
descriptionSignature information.
idFileMetadataSignatureInfo
properties
signer
deprecatedTrue
descriptionDeprecated: use signers field.
items
typestring
typearray
signers
descriptionFile metadata signer information. The order of the signers matters. Each element is a higher level authority, being the last the root authority.
items
$refSignerInfo
typearray
verificationMessage
descriptionStatus of the certificate. Valid values are "Signed", "Unsigned" or a description of the certificate anomaly, if found.
typestring
verified
descriptionTrue if verification_message == "Signed"
typeboolean
x509
descriptionList of certificates.
items
$refX509
typearray
typeobject
FilterProperties
idFilterProperties
properties
hidden
typeboolean
stringProperties
additionalProperties
$refStringValues
typeobject
typeobject
FindingVariable
descriptionA structure that holds the value and associated metadata for values extracted while producing a Finding.
idFindingVariable
properties
boolSeq
$refBoolSequence
descriptionThe value in boolsequence format.
boolVal
descriptionThe value in boolean format.
typeboolean
bytesSeq
$refBytesSequence
descriptionThe value in bytessequence format.
bytesVal
descriptionThe value in bytes format.
formatbyte
typestring
doubleSeq
$refDoubleSequence
descriptionThe value in doublesequence format.
doubleVal
descriptionThe value in double format.
formatdouble
typenumber
int64Seq
$refInt64Sequence
descriptionThe value in int64sequence format.
int64Val
descriptionThe value in int64 format.
formatint64
typestring
nullVal
descriptionWhether the value is null.
typeboolean
sourcePath
descriptionThe UDM field path for the field which this value was derived from. Example: `principal.user.username`
typestring
stringSeq
$refStringSequence
descriptionThe value in stringsequence format.
stringVal
descriptionThe value in string format. Enum values are returned as strings.
typestring
type
descriptionThe type of the variable.
enum
  • TYPE_UNSPECIFIED
  • MATCH
  • OUTCOME
enumDescriptions
  • An unspecified variable type.
  • A variable coming from the match conditions.
  • A variable representing significant data that was found in the detection logic.
typestring
uint64Seq
$refUint64Sequence
descriptionThe value in uint64sequence format.
uint64Val
descriptionThe value in uint64 format.
formatuint64
typestring
value
descriptionThe value in string form.
typestring
typeobject
FollowUp
descriptionFollowUp can be used to store metadata required to send a follow up message by the UI.
idFollowUp
properties
followUp
descriptionOutput only. The text to use as input when generating the follow up message.
readOnlyTrue
typestring
typeobject
Ftp
descriptionFTP info.
idFtp
properties
command
descriptionThe FTP command.
typestring
typeobject
FunctionResponse
idFunctionResponse
properties
rows
items
$refFunctionResponseRow
typearray
tooManyRows
typeboolean
typeobject
FunctionResponseRow
idFunctionResponseRow
properties
values
items
$refUdmFieldValue
typearray
typeobject
GoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStats
descriptionLINT.IfChange(stats_data) Stats results when the query is for statistics NEXT TAG = 6;
idGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStats
properties
dataQueryExpression
descriptionExpression that represent the subset of the requested query used to filter data. The expression will be used to enable features such as drill-down from stats results to UDM events. In that case, the new query will be composed by this expression and the expression related to a stats result.
typestring
results
descriptionResult rows that are queried.
items
$refGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnData
typearray
sortOrder
descriptionIndicates the columns used for sorting and the order in which they are sorted. If no ORDER section is specified in the query, this will be empty.
items
$refGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnSort
typearray
tooManyResults
descriptionIf true, there are too many results to return and some have been omitted.
typeboolean
totalResults
descriptionThe total number of results returned.
formatint32
typeinteger
typeobject
GoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnData
descriptionRepresents a single column in the set of columns returned as the stats query result.
idGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnData
properties
column
descriptionUsed to store column names.
typestring
filterExpression
descriptionExpression used to compose a query for filtering/drill-downs related to the data in this column.
typestring
filterable
descriptionTo identify if the column can be used for filtering/drill-downs.
typeboolean
values
descriptionTo store store column data.
items
$refGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnType
typearray
typeobject
GoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnSort
descriptionContains the column name and which direction the column is sorted (ascending or descenging).
idGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnSort
properties
descending
descriptionWhether the column is sorted in descending order (ascending by default);
typeboolean
name
descriptionName of the column.
typestring
typeobject
GoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnType
descriptionSingular vs list of values in a column.
idGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnType
properties
list
$refGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnTypeList
descriptionList of values in a column e.g. IPs
value
$refGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnValue
descriptionSingle value in a column.
typeobject
GoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnTypeList
descriptionStore list of values in a column.
idGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnTypeList
properties
values
descriptionList of values in one cell of the column.
items
$refGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnValue
typearray
typeobject
GoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnValue
descriptionValue of the column based on data type
idGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnValue
properties
boolVal
descriptionBoolean value.
typeboolean
bytesVal
descriptionBytes value.
formatbyte
typestring
dateVal
$refDate
descriptionDate values.
doubleVal
descriptionDouble value.
formatdouble
typenumber
int64Val
descriptionInteger value (signed).
formatint64
typestring
nullVal
descriptionTrue if the value is NULL.
typeboolean
protoVal
additionalProperties
descriptionProperties of the object. Contains field @type with type URL.
typeany
descriptionFor any proto values that are not any of the above.
typeobject
stringVal
descriptionString value. Enum values are returned as strings.
typestring
timestampVal
descriptionTimestamp values.
formatgoogle-datetime
typestring
uint64Val
descriptionUn-signed integer value.
formatuint64
typestring
typeobject
Group
descriptionInformation about an organizational group.
idGroup
properties
attribute
$refAttribute
descriptionGeneric entity metadata attributes of the group.
creationTime
deprecatedTrue
descriptionGroup creation time. Deprecated: creation_time should be populated in Attribute as generic metadata.
formatgoogle-datetime
typestring
emailAddresses
descriptionEmail addresses of the group.
items
typestring
typearray
groupDisplayName
descriptionGroup display name. e.g. "Finance".
typestring
productObjectId
descriptionProduct globally unique user object identifier, such as an LDAP Object Identifier.
typestring
windowsSid
descriptionMicrosoft Windows SID of the group.
typestring
typeobject
GroupAggregationByField
idGroupAggregationByField
properties
baselineEventCount
formatint32
typeinteger
eventCount
formatint32
typeinteger
fieldName
typestring
fieldValue
$refUdmFieldValue
fields
items
$refUdmFieldAggregation
typearray
valueCount
formatint32
typeinteger
typeobject
Hardware
descriptionHardware specification details for a resource, including both physical and virtual hardware.
idHardware
properties
cpuClockSpeed
descriptionClock speed of the hardware CPU in MHz.
formatuint64
typestring
cpuMaxClockSpeed
descriptionMaximum possible clock speed of the hardware CPU in MHz.
formatuint64
typestring
cpuModel
descriptionModel description of the hardware CPU (e.g. "2.8 GHz Quad-Core Intel Core i5").
typestring
cpuNumberCores
descriptionNumber of CPU cores.
formatuint64
typestring
cpuPlatform
descriptionPlatform of the hardware CPU (e.g. "Intel Broadwell").
typestring
manufacturer
descriptionHardware manufacturer.
typestring
model
descriptionHardware model.
typestring
ram
descriptionAmount of the hardware ramdom access memory (RAM) in Mb.
formatuint64
typestring
serialNumber
descriptionHardware serial number.
typestring
typeobject
Http
descriptionSpecify the full URL of the HTTP request within "target". Also specify any uploaded or downloaded file information within "source" or "target".
idHttp
properties
method
descriptionThe HTTP request method (e.g. "GET", "POST", "PATCH", "DELETE").
typestring
parsedUserAgent
$refUserAgentProto
descriptionThe parsed user_agent string.
referralUrl
descriptionThe URL for the HTTP referer.
typestring
responseCode
descriptionThe response status code, for example 200, 302, 404, or 500.
formatint32
typeinteger
userAgent
descriptionThe User-Agent request header which includes the application type, operating system, software vendor or software version of the requesting software user agent.
typestring
typeobject
Id
descriptionIdentifier to identify a UDM object like a UDM event, Entity, Collection. The full identifier for persistence is created by setting the 32 most significant bits as the Id.Namespace enum and the rest according to go/udm:ids. This is a convenience wrapper to define the id space enum values and provide an easy interface for RPCs, most persistence use cases should use a denormalized form. See go/udm:ids for background and details.
idId
properties
id
descriptionFull raw ID.
formatbyte
typestring
namespace
descriptionNamespace the id belongs to.
enum
  • NORMALIZED_TELEMETRY
  • RAW_TELEMETRY
  • RULE_DETECTIONS
  • UPPERCASE
  • MACHINE_INTELLIGENCE
  • SECURITY_COMMAND_CENTER
  • UNSPECIFIED
  • SOAR_ALERT
  • VIRUS_TOTAL
enumDescriptions
  • Ingested and Normalized telemetry events
  • Ingested Raw telemetry
  • Chronicle Rules engine
  • Uppercase
  • DSML - Machine Intelligence
  • A normalized telemetry event from Google Security Command Center.
  • Unspecified Namespace
  • An alert coming from other SIEMs via Chronicle SOAR.
  • VirusTotal.
typestring
stringId
descriptionSome ids are stored as strings that are not able to be translated to bytes, so store these separately. Ex. detection id of the form de_aaaaaaaa-aaaa...
typestring
typeobject
IngestionLabel
descriptionRepresentation of an ingestion label type.
idIngestionLabel
properties
ingestionLabelKey
descriptionRequired. The key of the ingestion label. Always required.
typestring
ingestionLabelValue
descriptionOptional. The value of the ingestion label. Optional. An object with no provided value and some key provided would match against the given key and ANY value.
typestring
typeobject
InputsUsed
descriptionInputsUsed is a convenience field that tells us which sources of events (if any) were used in the rule. NEXT TAG: 4
idInputsUsed
properties
usesDetection
descriptionOptional. Whether the rule queries detections.
typeboolean
usesEntity
descriptionOptional. Whether the rule queries entity events.
typeboolean
usesUdm
descriptionOptional. Whether the rule queries UDM events.
typeboolean
typeobject
Instance
descriptionA Instance represents an instantiation of the Instance product.
idInstance
properties
name
descriptionOutput only. The resource name of this instance. Format: projects/{project}/locations/{location}/instances/{instance}
readOnlyTrue
typestring
typeobject
InstanceUdmSearchResponse
idInstanceUdmSearchResponse
properties
baselineEventsCount
formatint32
typeinteger
complete
typeboolean
detections
$refDetections
filteredEventsCount
formatint32
typeinteger
instanceId
typestring
prevalence
$refUdmPrevalenceResponse
progress
formatdouble
typenumber
runtimeErrors
$refRuntimeError
timeline
$refEventCountTimeline
tooManyEvents
typeboolean
typeobject
Int64Sequence
descriptionInt64Sequence represents a sequence of int64s.
idInt64Sequence
properties
int64Vals
descriptionint64 sequence.
items
formatint64
typestring
typearray
typeobject
Interval
descriptionRepresents a time interval, encoded as a Timestamp start (inclusive) and a Timestamp end (exclusive). The start must be less than or equal to the end. When the start equals the end, the interval is empty (matches no time). When both start and end are unspecified, the interval matches any time.
idInterval
properties
endTime
descriptionOptional. Exclusive end of the interval. If specified, a Timestamp matching this interval will have to be before the end.
formatgoogle-datetime
typestring
startTime
descriptionOptional. Inclusive start of the interval. If specified, a Timestamp matching this interval will have to be the same or after the start.
formatgoogle-datetime
typestring
typeobject
Investigation
descriptionRepresents the aggregated state of an investigation such as categorization, severity, and status. Can be expanded to include analyst assignment details and more.
idInvestigation
properties
comments
descriptionComment added by the Analyst.
items
typestring
typearray
priority
descriptionPriority of the Alert or Finding set by analyst.
enum
  • PRIORITY_UNSPECIFIED
  • PRIORITY_INFO
  • PRIORITY_LOW
  • PRIORITY_MEDIUM
  • PRIORITY_HIGH
  • PRIORITY_CRITICAL
enumDescriptions
  • Default priority level.
  • Informational priority.
  • Low priority.
  • Medium priority.
  • High priority.
  • Critical priority.
typestring
reason
descriptionReason for closing the Case or Alert.
enum
  • REASON_UNSPECIFIED
  • REASON_NOT_MALICIOUS
  • REASON_MALICIOUS
  • REASON_MAINTENANCE
enumDescriptions
  • Default reason.
  • Case or Alert not malicious.
  • Case or Alert is malicious.
  • Case or Alert is under maintenance.
typestring
reputation
descriptionDescribes whether a finding was useful or not-useful.
enum
  • REPUTATION_UNSPECIFIED
  • USEFUL
  • NOT_USEFUL
enumDescriptions
  • An unspecified reputation.
  • A categorization of the finding as useful.
  • A categorization of the finding as not useful.
typestring
riskScore
descriptionRisk score for a finding set by an analyst.
formatuint32
typeinteger
rootCause
descriptionRoot cause of the Alert or Finding set by analyst.
typestring
severityScore
descriptionSeverity score for a finding set by an analyst.
formatuint32
typeinteger
status
descriptionDescribes the workflow status of a finding.
enum
  • STATUS_UNSPECIFIED
  • NEW
  • REVIEWED
  • CLOSED
  • OPEN
enumDescriptions
  • Unspecified finding status.
  • New finding.
  • When a finding has feedback.
  • When an analyst closes an finding.
  • Open. Used to indicate that a Case / Alert is open.
typestring
verdict
descriptionDescribes reason a finding investigation was resolved.
enum
  • VERDICT_UNSPECIFIED
  • TRUE_POSITIVE
  • FALSE_POSITIVE
enumDescriptions
  • An unspecified verdict.
  • A categorization of the finding as a "true positive".
  • A categorization of the finding as a "false positive".
typestring
typeobject
IoCStats
descriptionInformation about the threat intelligence source. These fields are used to model Mandiant sources.
idIoCStats
properties
benignCount
descriptionCount of responses where the IoC was identified as benign.
formatint32
typeinteger
firstLevelSource
descriptionName of first level IoC source, for example Mandiant or a third-party.
typestring
iocStatsType
descriptionDescribes the source of the IoCStat.
enum
  • UNSPECIFIED_IOC_STATS_TYPE
  • MANDIANT_SOURCES
  • THIRD_PARTY_SOURCES
  • THREAT_INTELLIGENCE_IOC_STATS
enumDescriptions
  • IoCStat source is unidentified.
  • IoCStat is from a Mandiant Source.
  • IoCStat is from a third-party source.
  • IoCStat is from a threat intelligence feed.
typestring
maliciousCount
descriptionCount of responses where the IoC was identified as malicious.
formatint32
typeinteger
quality
descriptionLevel of confidence in the IoC mapping extracted from the source.
enum
  • UNKNOWN_CONFIDENCE
  • LOW_CONFIDENCE
  • MEDIUM_CONFIDENCE
  • HIGH_CONFIDENCE
enumDescriptions
  • The default confidence level.
  • Low confidence.
  • Medium confidence.
  • High confidence.
typestring
responseCount
descriptionTotal number of response from the source.
formatint32
typeinteger
secondLevelSource
descriptionName of the second-level IoC source, for example Crowdsourced Threat Analysis or Knowledge Graph.
typestring
sourceCount
descriptionNumber of sources from which information was extracted.
formatint32
typeinteger
typeobject
Label
descriptionKey value labels.
idLabel
properties
key
descriptionThe key.
typestring
rbacEnabled
descriptionIndicates whether this label can be used for Data RBAC
typeboolean
source
descriptionWhere the label is derived from.
typestring
value
descriptionThe value.
typestring
typeobject
LatLng
descriptionAn object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges.
idLatLng
properties
latitude
descriptionThe latitude in degrees. It must be in the range [-90.0, +90.0].
formatdouble
typenumber
longitude
descriptionThe longitude in degrees. It must be in the range [-180.0, +180.0].
formatdouble
typenumber
typeobject
LegacyFederatedUdmSearchViewResponse
descriptionResponse to a Federated UDM Search query. This will be used by StreamSearchOperation RPC to return the results of a federated search operation.
idLegacyFederatedUdmSearchViewResponse
properties
activityTimeline
$refEventCountTimeline
descriptionTimeline of event counts broken into hourly/daily buckets to identify activity.
aiOverview
$refAIOverview
descriptionLINT.ThenChange( //depot/google3/google/cloud/chronicle/v1main/dashboard_query.proto:data_sources, //depot/google3/googlex/security/malachite/proto/udm_search.proto:data_sources ) AI generated overview for the search results. Only populated if the AI features are enabled for the customer and generate_ai_overview is set to true in the request.
baselineEventsCount
descriptionThe number of events in the baseline query.
formatint32
typeinteger
complete
descriptionStreaming for this response is done. There will be no additional updates.
typeboolean
dataSources
descriptionDatasource of the query and results in case of a statistics query
items
enum
  • SEARCH_DATA_SOURCE_UNSPECIFIED
  • SEARCH_UDM
  • SEARCH_ENTITY
  • SEARCH_RULE_DETECTIONS
  • SEARCH_RULESETS
enumDescriptions
  • Unspecified data source.
  • Events
  • Entities
  • To be used for detections data source.
  • To be used for ruleset with detections datasource.
typestring
typearray
detectionFieldAggregations
$refAlertFieldAggregations
descriptionList of detection fields with aggregated values. This enabled filtering in the Alerts panel for federated search.
events
$refUdmEventList
descriptionList of UDM events. NOTE: After complete is set to true, the `UdmEventList` message will be omitted from the response. The latest message should be used as reference. If the `UdmEventList` message is returned again, then it should replace the previous value.
fieldAggregations
$refUdmFieldAggregations
descriptionList of UDM fields with aggregated values.
filteredEventsCount
descriptionThe number of events in the snapshot that match the snapshot_query. This is <= `baseline_events_count`. If the snapshot query is empty this will be equivalent to `baseline_events_count`.
formatint32
typeinteger
groupedFieldAggregations
$refUdmFieldAggregations
descriptionList of grouped fields with aggregated values.
instanceAggregations
$refUdmFieldAggregations
descriptionInstance aggregations for the search results. Provides information on the number of events per instance for the aggregations panel in the UI. This allows users to easily drill-down into the individual instances.
instanceUdmSearchResponses
descriptionAll the instance specific UDM search responses.
items
$refInstanceUdmSearchResponse
typearray
operation
descriptionThe name of the operation resource representing the UDM Search operation. This can be passed to `StreamSearchOperation` to fetch stored results or stream the results of an in-progress operation. The metadata type of the operation is `UdmSearchMetadata`. The response type is `LegacyFetchUdmSearchViewResponse`. Format: projects/{project}/locations/{location}/instances/{instance}/operations/{operation}
typestring
progress
descriptionProgress of the query represented as a double between 0 and 1.
formatdouble
typenumber
queryValidationErrors
descriptionParse error for the baseline_query and/or the snapshot_query.
items
$refErrorMessage
typearray
runtimeErrors
descriptionRuntime errors.
items
$refRuntimeError
typearray
stats
$refGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStats
descriptionStats results when the query is for statistics
statsFunctionParameterValidationErrorMessage
descriptionIf the request's stats_function_parameter` is invalid, this field will contain the detailed error message.
typestring
statsFunctionResponse
$refFunctionResponse
descriptionResult for statistical function.
timeline
$refEventCountTimeline
descriptionTimeline of event counts broken into buckets. This populates the trend-over-time chart in the UI.
tooLargeResponse
descriptionIf true, the response to be returned to the UI is too large and some events have been omitted.
typeboolean
tooManyEvents
descriptionIf true, there are too many events to return and some have been omitted.
typeboolean
validBaselineQuery
descriptionIndicates whether the request baseline_query is a valid structured query or not. If not, `query_validation_errors` will include the parse error.
typeboolean
validSnapshotQuery
descriptionIndicates whether the request baseline and snapshot queries are valid. If not, `query_validation_errors` will include the parse error.
typeboolean
typeobject
ListDataAccessLabelsResponse
descriptionResponse message for ListDataAccessLabels.
idListDataAccessLabelsResponse
properties
dataAccessLabels
descriptionList of data access labels.
items
$refDataAccessLabel
typearray
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
typeobject
ListDataAccessScopesResponse
descriptionResponse message for ListDataAccessScopes.
idListDataAccessScopesResponse
properties
dataAccessScopes
descriptionList of data access scopes.
items
$refDataAccessScope
typearray
globalDataAccessScopeGranted
descriptionWhether or not global scope is granted to the user.
typeboolean
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
typeobject
ListOperationsResponse
descriptionThe response message for Operations.ListOperations.
idListOperationsResponse
properties
nextPageToken
descriptionThe standard List next-page token.
typestring
operations
descriptionA list of operations that matches the specified filter in the request.
items
$refOperation
typearray
typeobject
ListReferenceListsResponse
descriptionA response to a request for a list of reference lists.
idListReferenceListsResponse
properties
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
referenceLists
descriptionThe reference lists. Ordered in ascending alphabetical order by name.
items
$refReferenceList
typearray
typeobject
ListRetrohuntsResponse
descriptionResponse message for ListRetrohunts method.
idListRetrohuntsResponse
properties
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
retrohunts
descriptionThe retrohunts from the specified rule.
items
$refRetrohunt
typearray
typeobject
ListRuleDeploymentsResponse
descriptionResponse message for ListRuleDeployments.
idListRuleDeploymentsResponse
properties
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
ruleDeployments
descriptionThe rule deployments from all rules.
items
$refRuleDeployment
typearray
typeobject
ListRuleRevisionsResponse
descriptionResponse message for ListRuleRevisions method.
idListRuleRevisionsResponse
properties
nextPageToken
descriptionA token that can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
rules
descriptionThe revisions of the rule.
items
$refRule
typearray
typeobject
ListRulesResponse
descriptionResponse message for ListRules method.
idListRulesResponse
properties
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
rules
descriptionThe rules from the specified instance.
items
$refRule
typearray
typeobject
ListWatchlistsResponse
descriptionResponse message for listing watchlists.
idListWatchlistsResponse
properties
nextPageToken
descriptionOptional. A token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
watchlists
descriptionOptional. The watchlists from the specified instance.
items
$refWatchlist
typearray
typeobject
Location
descriptionInformation about a location.
idLocation
properties
city
descriptionThe city.
typestring
countryOrRegion
descriptionThe country or region.
typestring
deskName
descriptionDesk name or individual location, typically for an employee in an office. (e.g. "IN-BLR-BCPC-11-1121D").
typestring
floorName
descriptionFloor name, number or a combination of the two for a building. (e.g. "1-A").
typestring
name
descriptionCustom location name (e.g. building or site name like "London Office"). For cloud environments, this is the region (e.g. "us-west2").
typestring
regionCoordinates
$refLatLng
descriptionCoordinates for the associated region. See https://cloud.google.com/vision/docs/reference/rest/v1/LatLng for a description of the fields.
regionLatitude
deprecatedTrue
descriptionDeprecated: use region_coordinates.
formatfloat
typenumber
regionLongitude
deprecatedTrue
descriptionDeprecated: use region_coordinates.
formatfloat
typenumber
state
descriptionThe state.
typestring
typeobject
Manual
descriptionEntities are added manually.
idManual
properties
typeobject
Measure
descriptionDescribes the precomputed measure.
idMeasure
properties
aggregateFunction
descriptionFunction used to calculate the aggregated measure.
enum
  • AGGREGATE_FUNCTION_UNSPECIFIED
  • MIN
  • MAX
  • COUNT
  • SUM
  • AVG
  • STDDEV
enumDescriptions
  • Default value.
  • Minimum.
  • Maximum.
  • Count.
  • Sum.
  • Average.
  • Standard Deviation.
typestring
value
descriptionValue of the aggregated measure.
formatdouble
typenumber
typeobject
Metadata
descriptionGeneral information associated with a UDM event.
idMetadata
properties
baseLabels
$refDataAccessLabels
descriptionData access labels on the base event.
collectedTimestamp
descriptionThe GMT timestamp when the event was collected by the vendor's local collection infrastructure.
formatgoogle-datetime
typestring
description
descriptionA human-readable unparsable description of the event.
typestring
enrichmentLabels
$refDataAccessLabels
descriptionData access labels from all the contextual events used to enrich the base event.
enrichmentState
descriptionThe enrichment state.
enum
  • ENRICHMENT_STATE_UNSPECIFIED
  • ENRICHED
  • UNENRICHED
enumDescriptions
  • Unspecified.
  • The event has been enriched by Chronicle.
  • The event has not been enriched by Chronicle.
typestring
eventTimestamp
descriptionThe GMT timestamp when the event was generated.
formatgoogle-datetime
typestring
eventType
descriptionThe event type. If an event has multiple possible types, this specifies the most specific type.
enum
  • EVENTTYPE_UNSPECIFIED
  • PROCESS_UNCATEGORIZED
  • PROCESS_LAUNCH
  • PROCESS_INJECTION
  • PROCESS_PRIVILEGE_ESCALATION
  • PROCESS_TERMINATION
  • PROCESS_OPEN
  • PROCESS_MODULE_LOAD
  • REGISTRY_UNCATEGORIZED
  • REGISTRY_CREATION
  • REGISTRY_MODIFICATION
  • REGISTRY_DELETION
  • SETTING_UNCATEGORIZED
  • SETTING_CREATION
  • SETTING_MODIFICATION
  • SETTING_DELETION
  • MUTEX_UNCATEGORIZED
  • MUTEX_CREATION
  • FILE_UNCATEGORIZED
  • FILE_CREATION
  • FILE_DELETION
  • FILE_MODIFICATION
  • FILE_READ
  • FILE_COPY
  • FILE_OPEN
  • FILE_MOVE
  • FILE_SYNC
  • USER_UNCATEGORIZED
  • USER_LOGIN
  • USER_LOGOUT
  • USER_CREATION
  • USER_CHANGE_PASSWORD
  • USER_CHANGE_PERMISSIONS
  • USER_STATS
  • USER_BADGE_IN
  • USER_DELETION
  • USER_RESOURCE_CREATION
  • USER_RESOURCE_UPDATE_CONTENT
  • USER_RESOURCE_UPDATE_PERMISSIONS
  • USER_COMMUNICATION
  • USER_RESOURCE_ACCESS
  • USER_RESOURCE_DELETION
  • GROUP_UNCATEGORIZED
  • GROUP_CREATION
  • GROUP_DELETION
  • GROUP_MODIFICATION
  • EMAIL_UNCATEGORIZED
  • EMAIL_TRANSACTION
  • EMAIL_URL_CLICK
  • NETWORK_UNCATEGORIZED
  • NETWORK_FLOW
  • NETWORK_CONNECTION
  • NETWORK_FTP
  • NETWORK_DHCP
  • NETWORK_DNS
  • NETWORK_HTTP
  • NETWORK_SMTP
  • STATUS_UNCATEGORIZED
  • STATUS_HEARTBEAT
  • STATUS_STARTUP
  • STATUS_SHUTDOWN
  • STATUS_UPDATE
  • SCAN_UNCATEGORIZED
  • SCAN_FILE
  • SCAN_PROCESS_BEHAVIORS
  • SCAN_PROCESS
  • SCAN_HOST
  • SCAN_VULN_HOST
  • SCAN_VULN_NETWORK
  • SCAN_NETWORK
  • SCHEDULED_TASK_UNCATEGORIZED
  • SCHEDULED_TASK_CREATION
  • SCHEDULED_TASK_DELETION
  • SCHEDULED_TASK_ENABLE
  • SCHEDULED_TASK_DISABLE
  • SCHEDULED_TASK_MODIFICATION
  • SYSTEM_AUDIT_LOG_UNCATEGORIZED
  • SYSTEM_AUDIT_LOG_WIPE
  • SERVICE_UNSPECIFIED
  • SERVICE_CREATION
  • SERVICE_DELETION
  • SERVICE_START
  • SERVICE_STOP
  • SERVICE_MODIFICATION
  • GENERIC_EVENT
  • RESOURCE_CREATION
  • RESOURCE_DELETION
  • RESOURCE_PERMISSIONS_CHANGE
  • RESOURCE_READ
  • RESOURCE_WRITTEN
  • DEVICE_FIRMWARE_UPDATE
  • DEVICE_CONFIG_UPDATE
  • DEVICE_PROGRAM_UPLOAD
  • DEVICE_PROGRAM_DOWNLOAD
  • ANALYST_UPDATE_VERDICT
  • ANALYST_UPDATE_REPUTATION
  • ANALYST_UPDATE_SEVERITY_SCORE
  • ANALYST_UPDATE_STATUS
  • ANALYST_ADD_COMMENT
  • ANALYST_UPDATE_PRIORITY
  • ANALYST_UPDATE_ROOT_CAUSE
  • ANALYST_UPDATE_REASON
  • ANALYST_UPDATE_RISK_SCORE
  • ENTITY_RISK_CHANGE
enumDeprecated
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • True
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • True
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • True
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
enumDescriptions
  • Default event type
  • Activity related to a process which does not match any other event types.
  • Process launch.
  • Process injecting into another process.
  • Process privilege escalation.
  • Process termination.
  • Process being opened.
  • Process loading a module.
  • Registry event which does not match any of the other event types.
  • Registry creation.
  • Registry modification.
  • Registry deletion.
  • Settings-related event which does not match any of the other event types.
  • Setting creation.
  • Setting modification.
  • Setting deletion.
  • Any mutex event other than creation.
  • Mutex creation.
  • File event which does not match any of the other event types.
  • File created.
  • File deleted.
  • File modified.
  • File read.
  • File copied. Used for file copies, for example, to a thumb drive.
  • File opened.
  • File moved or renamed.
  • File synced (for example, Google Drive, Dropbox, backup).
  • User activity which does not match any of the other event types.
  • User login.
  • User logout.
  • User creation.
  • User password change event.
  • Change in user permissions.
  • Deprecated. Used to update user info for an LDAP dump.
  • User physically badging into a location.
  • User deletion.
  • User creating a virtual resource. This is equivalent to RESOURCE_CREATION.
  • User updating content of a virtual resource. This is equivalent to RESOURCE_WRITTEN.
  • User updating permissions of a virtual resource. This is equivalent to RESOURCE_PERMISSIONS_CHANGE.
  • User initiating communication through a medium (for example, video).
  • User accessing a virtual resource. This is equivalent to RESOURCE_READ.
  • User deleting a virtual resource. This is equivalent to RESOURCE_DELETION.
  • A group activity that does not fall into one of the other event types.
  • A group creation.
  • A group deletion.
  • A group modification.
  • Email messages
  • An email transaction.
  • Deprecated: use NETWORK_HTTP instead. An email URL click event.
  • A network event that does not fit into one of the other event types.
  • Aggregated flow stats like netflow.
  • Network connection details like from a FW.
  • FTP telemetry.
  • DHCP payload.
  • DNS payload.
  • HTTP telemetry.
  • SMTP telemetry.
  • A status message that does not fit into one of the other event types.
  • Heartbeat indicating product is alive.
  • An agent startup.
  • An agent shutdown.
  • A software or fingerprint update.
  • Scan item that does not fit into one of the other event types.
  • A file scan.
  • Scan process behaviors. Please use SCAN_PROCESS instead.
  • Scan process.
  • Scan results from scanning an entire host device for threats/sensitive documents.
  • Vulnerability scan logs about host vulnerabilities (e.g., out of date software) and network vulnerabilities (e.g., unprotected service detected via a network scan).
  • Vulnerability scan logs about network vulnerabilities.
  • Scan network for suspicious activity
  • Scheduled task event that does not fall into one of the other event types.
  • Scheduled task creation.
  • Scheduled task deletion.
  • Scheduled task being enabled.
  • Scheduled task being disabled.
  • Scheduled task being modified.
  • A system audit log event that is not a wipe.
  • A system audit log wipe.
  • Service event that does not fit into one of the other event types.
  • A service creation.
  • A service deletion.
  • A service start.
  • A service stop.
  • A service modification.
  • Operating system events that are not described by any of the other event types. Might include uncategorized Microsoft Windows event logs.
  • The resource was created/provisioned. This is equivalent to USER_RESOURCE_CREATION.
  • The resource was deleted/deprovisioned. This is equivalent to USER_RESOURCE_DELETION.
  • The resource had it's permissions or ACLs updated. This is equivalent to USER_RESOURCE_UPDATE_PERMISSIONS.
  • The resource was read. This is equivalent to USER_RESOURCE_ACCESS.
  • The resource was written to. This is equivalent to USER_RESOURCE_UPDATE_CONTENT.
  • Firmware update.
  • Configuration update.
  • A program or application uploaded to a device.
  • A program or application downloaded to a device.
  • Analyst update about the Verdict (such as true positive, false positive, or disregard) of a finding.
  • Analyst update about the Reputation (such as useful or not useful) of a finding.
  • Analyst update about the Severity score (0-100) of a finding.
  • Analyst update about the finding status.
  • Analyst addition of a comment for a finding.
  • Analyst update about the priority (such as low, medium, or high) for a finding.
  • Analyst update about the root cause for a finding.
  • Analyst update about the reason (such as malicious or not malicious) for a finding.
  • Analyst update about the risk score (0-100) of a finding.
  • An update to an entity risk score. This event type is restricted to events published by Google Securit Operations Risk Analytics.
typestring
id
descriptionID of the UDM event. Can be used for raw and normalized event retrieval.
formatbyte
typestring
ingestedTimestamp
descriptionThe GMT timestamp when the event was ingested (received) by Chronicle.
formatgoogle-datetime
typestring
ingestionLabels
descriptionUser-configured ingestion metadata labels.
items
$refLabel
typearray
logType
descriptionThe string value of log type.
typestring
productDeploymentId
descriptionThe deployment identifier assigned by the vendor for a product deployment.
typestring
productEventType
descriptionA short, descriptive, human-readable, product-specific event name or type (e.g. "Scanned X", "User account created", "process_start").
typestring
productLogId
descriptionA vendor-specific event identifier to uniquely identify the event (e.g. a GUID).
typestring
productName
descriptionThe name of the product.
typestring
productVersion
descriptionThe version of the product.
typestring
structuredFields
additionalProperties
descriptionProperties of the object.
typeany
deprecatedTrue
descriptionFlattened fields extracted from the log.
typeobject
tags
$refTags
descriptionTags added by Chronicle after an event is parsed. It is an error to populate this field from within a parser.
urlBackToProduct
descriptionA URL that takes the user to the source product console for this event.
typestring
vendorName
descriptionThe name of the product vendor.
typestring
typeobject
Metric
descriptionStores precomputed aggregated analytic data for an entity.
idMetric
properties
dimensions
descriptionAll group by clauses used to calculate the metric.
items
enum
  • DIMENSION_UNSPECIFIED
  • PRINCIPAL_DEVICE
  • TARGET_USER
  • TARGET_DEVICE
  • PRINCIPAL_USER
  • TARGET_IP
  • PRINCIPAL_FILE_HASH
  • PRINCIPAL_COUNTRY
  • SECURITY_CATEGORY
  • NETWORK_ASN
  • CLIENT_CERTIFICATE_HASH
  • DNS_QUERY_TYPE
  • DNS_DOMAIN
  • HTTP_USER_AGENT
  • EVENT_TYPE
  • PRODUCT_NAME
  • PRODUCT_EVENT_TYPE
  • PARENT_FOLDER_PATH
  • TARGET_RESOURCE_NAME
  • PRINCIPAL_APPLICATION
  • TARGET_APPLICATION
  • EMAIL_TO_ADDRESS
  • EMAIL_FROM_ADDRESS
  • MAIL_ID
  • PRINCIPAL_IP
  • SECURITY_ACTION
  • SECURITY_RULE_ID
  • TARGET_NETWORK_ORGANIZATION_NAME
  • PRINCIPAL_NETWORK_ORGANIZATION_NAME
  • PRINCIPAL_PROCESS_FILE_PATH
  • PRINCIPAL_PROCESS_FILE_HASH
  • SECURITY_RESULT_RULE_NAME
  • TARGET_RESOURCE_LABEL_KEY
  • VENDOR_NAME
  • TARGET_RESOURCE_TYPE
  • TARGET_LOCATION_NAME
enumDescriptions
  • Default
  • Principal Device
  • Target User
  • Target Device
  • Principal User
  • Target IP
  • Principal File Hash
  • Principal Country
  • Security Category
  • Network ASN
  • Client Certificate Hash
  • DNS Query Type
  • DNS Domain
  • HTTP User Agent
  • Event Type
  • Product Name
  • Product Event Type
  • Parent Folder Path
  • Target resource Name
  • Principal Application.
  • Target Application.
  • Email To Address.
  • Email From Address.
  • Mail Id.
  • Principal IP.
  • Security Action.
  • Security Rule Id.
  • Target Network Organization name.
  • Principal Network Organization name.
  • Principal Process File Path.
  • Principal Process File SHA256 Hash.
  • Security Result rule name.
  • Target Resource label key.
  • Vendor name.
  • Target Resource type.
  • Target Location name.
typestring
typearray
exportWindow
descriptionExport window for which the metric was exported.
formatint64
typestring
firstSeen
descriptionTimestamp of the first time the entity was seen in the environment.
formatgoogle-datetime
typestring
lastSeen
descriptionTime stamp of the last time last time the entity was seen in the environment.
formatgoogle-datetime
typestring
metricName
descriptionName of the analytic.
enum
  • METRIC_NAME_UNSPECIFIED
  • NETWORK_BYTES_INBOUND
  • NETWORK_BYTES_OUTBOUND
  • NETWORK_BYTES_TOTAL
  • AUTH_ATTEMPTS_SUCCESS
  • AUTH_ATTEMPTS_FAIL
  • AUTH_ATTEMPTS_TOTAL
  • DNS_BYTES_OUTBOUND
  • NETWORK_FLOWS_INBOUND
  • NETWORK_FLOWS_OUTBOUND
  • NETWORK_FLOWS_TOTAL
  • DNS_QUERIES_SUCCESS
  • DNS_QUERIES_FAIL
  • DNS_QUERIES_TOTAL
  • FILE_EXECUTIONS_SUCCESS
  • FILE_EXECUTIONS_FAIL
  • FILE_EXECUTIONS_TOTAL
  • HTTP_QUERIES_SUCCESS
  • HTTP_QUERIES_FAIL
  • HTTP_QUERIES_TOTAL
  • WORKSPACE_EMAILS_SENT_TOTAL
  • WORKSPACE_TOTAL_DOWNLOAD_ACTIONS
  • WORKSPACE_TOTAL_CHANGE_ACTIONS
  • WORKSPACE_AUTH_ATTEMPTS_TOTAL
  • WORKSPACE_NETWORK_BYTES_OUTBOUND
  • WORKSPACE_NETWORK_BYTES_TOTAL
  • ALERT_EVENT_NAME_COUNT
  • RESOURCE_CREATION_TOTAL
  • RESOURCE_CREATION_SUCCESS
  • RESOURCE_READ_SUCCESS
  • RESOURCE_READ_FAIL
  • RESOURCE_DELETION_SUCCESS
enumDescriptions
  • Default
  • Total received network bytes.
  • Total network sent bytes.
  • Total network sent bytes and received bytes.
  • Successful authentication attempts.
  • Failed authentication attempts.
  • Total authentication attempts.
  • Total number of sent bytes for DNS events.
  • Total number of events having non-null received bytes.
  • Total number of events having non-null sent bytes.
  • Total events having non-null sent or received bytes.
  • DNS query success count - Number of events with response_code = 0.
  • Number of events with response_code != 0.
  • Total number of DNS queries made.
  • Number of successfule file executions.
  • Number of failed file executions.
  • Total number file executions.
  • Number of successful HTTP queries.
  • Number of failed HTTP queries.
  • Total number of HTTP queries.
  • Total number of emails sent in Google Workspace.
  • Total number of download actions in Google Workspace.
  • Total number of change actions in Google Workspace.
  • Total number of authentication attempts in Google Workspace.
  • Number of outbound network bytes (total sent) in Google Workspace.
  • Total number of network bytes (both sent and received) in Google Workspace.
  • Track number of alerts fired by EDR/SENTINEL/MICROSOFT_GRAPH.
  • First-time analytic tracking successful resource creations.
  • Volume-based analytic tracking successful resource creations.
  • Volume-based analytic tracking successful resource reads.
  • Volume-based analytic tracking failed resource reads.
  • Volume-based analytic tracking successful resource deletions.
typestring
sumMeasure
$refMeasure
descriptionSum of all precomputed measures for the given metric.
totalEvents
descriptionTotal number of events used to calculate the given precomputed metric.
formatint64
typestring
typeobject
Navigation
descriptionNavigation can be used to store the metadata required to navigate the user to a new URL.
idNavigation
properties
targetUri
descriptionOutput only. The URI to redirect the user to.
readOnlyTrue
typestring
typeobject
Network
descriptionA network event.
idNetwork
properties
applicationProtocol
descriptionThe application protocol.
enum
  • UNKNOWN_APPLICATION_PROTOCOL
  • AFP
  • APPC
  • AMQP
  • ATOM
  • BEEP
  • BITCOIN
  • BIT_TORRENT
  • CFDP
  • CIP
  • COAP
  • COTP
  • DCERPC
  • DDS
  • DEVICE_NET
  • DHCP
  • DICOM
  • DNP3
  • DNS
  • E_DONKEY
  • ENRP
  • FAST_TRACK
  • FINGER
  • FREENET
  • FTAM
  • GOOSE
  • GOPHER
  • GRPC
  • HL7
  • H323
  • HTTP
  • HTTPS
  • IEC104
  • IRCP
  • KADEMLIA
  • KRB5
  • LDAP
  • LPD
  • MIME
  • MMS
  • MODBUS
  • MQTT
  • NETCONF
  • NFS
  • NIS
  • NNTP
  • NTCIP
  • NTP
  • OSCAR
  • PNRP
  • PTP
  • QUIC
  • RDP
  • RELP
  • RIP
  • RLOGIN
  • RPC
  • RTMP
  • RTP
  • RTPS
  • RTSP
  • SAP
  • SDP
  • SIP
  • SLP
  • SMB
  • SMTP
  • SNMP
  • SNTP
  • SSH
  • SSMS
  • STYX
  • SV
  • TCAP
  • TDS
  • TOR
  • TSP
  • VTP
  • WHOIS
  • WEB_DAV
  • X400
  • X500
  • XMPP
enumDescriptions
  • The default application protocol.
  • Apple Filing Protocol.
  • Advanced Program-to-Program Communication.
  • Advanced Message Queuing Protocol.
  • Publishing Protocol.
  • Block Extensible Exchange Protocol.
  • Crypto currency protocol.
  • Peer-to-peer file sharing.
  • Coherent File Distribution Protocol.
  • Common Industrial Protocol.
  • Constrained Application Protocol.
  • Connection Oriented Transport Protocol.
  • DCE/RPC.
  • Data Distribution Service.
  • Automation industry protocol.
  • DHCP.
  • Digital Imaging and Communications in Medicine Protocol.
  • Distributed Network Protocol 3 (DNP3)
  • DNS.
  • Classic file sharing protocol.
  • Endpoint Handlespace Redundancy Protocol.
  • Filesharing peer-to-peer protocol.
  • User Information Protocol.
  • Censorship resistant peer-to-peer network.
  • File Transfer Access and Management.
  • GOOSE Protocol.
  • Gopher protocol.
  • gRPC Remote Procedure Call.
  • Health Level Seven.
  • Packet-based multimedia communications system.
  • HTTP.
  • HTTPS.
  • IEC 60870-5-104 (IEC 104) Protocol.
  • Internet Relay Chat Protocol.
  • Peer-to-peer hashtables.
  • Kerberos 5.
  • Lightweight Directory Access Protocol.
  • Line Printer Daemon Protocol.
  • Multipurpose Internet Mail Extensions and Secure MIME.
  • Multimedia Messaging Service.
  • Serial communications protocol.
  • Message Queuing Telemetry Transport.
  • Network Configuration.
  • Network File System.
  • Network Information Service.
  • Network News Transfer Protocol.
  • National Transportation Communications for Intelligent Transportation System.
  • Network Time Protocol.
  • AOL Instant Messenger Protocol.
  • Peer Name Resolution Protocol.
  • Precision Time Protocol.
  • QUIC.
  • Remote Desktop Protocol.
  • Reliable Event Logging Protocol.
  • Routing Information Protocol.
  • Remote Login in UNIX Systems.
  • Remote Procedure Call.
  • Real Time Messaging Protocol.
  • Real-time Transport Protocol.
  • Real Time Publish Subscribe.
  • Real Time Streaming Protocol.
  • Session Announcement Protocol.
  • Session Description Protocol.
  • Session Initiation Protocol.
  • Service Location Protocol.
  • Server Message Block.
  • Simple Mail Transfer Protocol.
  • Simple Network Management Protocol.
  • Simple Network Time Protocol.
  • Secure Shell.
  • Secure SMS Messaging Protocol.
  • Styx/9P - Plan 9 from Bell Labs distributed file system protocol.
  • Sampled Values Protocol.
  • Transaction Capabilities Application Part.
  • Tabular Data Stream.
  • Anonymity network.
  • Time Stamp Protocol.
  • Virtual Terminal Protocol.
  • Remote Directory Access Protocol.
  • Web Distributed Authoring and Versioning.
  • Message Handling Service Protocol.
  • Directory Access Protocol (DAP).
  • Extensible Messaging and Presence Protocol.
typestring
applicationProtocolVersion
descriptionThe version of the application protocol. e.g. "1.1, 2.0"
typestring
asn
descriptionAutonomous system number.
typestring
carrierName
descriptionCarrier identification.
typestring
communityId
descriptionCommunity ID network flow value.
typestring
dhcp
$refDhcp
descriptionDHCP info.
direction
descriptionThe direction of network traffic.
enum
  • UNKNOWN_DIRECTION
  • INBOUND
  • OUTBOUND
  • BROADCAST
enumDescriptions
  • The default direction.
  • An inbound request.
  • An outbound request.
  • A broadcast.
typestring
dns
$refDns
descriptionDNS info.
dnsDomain
descriptionDNS domain name.
typestring
email
$refEmail
descriptionEmail info for the sender/recipient.
ftp
$refFtp
descriptionFTP info.
http
$refHttp
descriptionHTTP info.
ipProtocol
descriptionThe IP protocol.
enum
  • UNKNOWN_IP_PROTOCOL
  • ICMP
  • IGMP
  • TCP
  • UDP
  • IP6IN4
  • GRE
  • ESP
  • ICMP6
  • EIGRP
  • ETHERIP
  • PIM
  • VRRP
  • SCTP
enumDescriptions
  • The default protocol.
  • ICMP.
  • IGMP
  • TCP.
  • UDP.
  • IPv6 Encapsulation
  • Generic Routing Encapsulation
  • Encapsulating Security Payload
  • ICMPv6
  • Enhanced Interior Gateway Routing
  • Ethernet-within-IP Encapsulation
  • Protocol Independent Multicast
  • Virtual Router Redundancy Protocol
  • Stream Control Transmission Protocol
typestring
ipSubnetRange
descriptionAssociated human-readable IP subnet range (e.g. 10.1.2.0/24).
typestring
organizationName
descriptionOrganization name (e.g Google).
typestring
parentSessionId
descriptionThe ID of the parent network session.
typestring
receivedBytes
descriptionThe number of bytes received.
formatuint64
typestring
receivedPackets
descriptionThe number of packets received.
formatint64
typestring
sentBytes
descriptionThe number of bytes sent.
formatuint64
typestring
sentPackets
descriptionThe number of packets sent.
formatint64
typestring
sessionDuration
descriptionThe duration of the session as the number of seconds and nanoseconds. For seconds, network.session_duration.seconds, the type is a 64-bit integer. For nanoseconds, network.session_duration.nanos, the type is a 32-bit integer.
formatgoogle-duration
typestring
sessionId
descriptionThe ID of the network session.
typestring
smtp
$refSmtp
descriptionSMTP info. Store fields specific to SMTP not covered by Email.
tls
$refTls
descriptionTLS info.
typeobject
Noun
descriptionThe Noun type is used to represent the different entities in an event: principal, src, target, observer, intermediary, and about. It stores attributes known about the entity. For example, if the entity is a device with multiple IP or MAC addresses, it stores the IP and MAC addresses that are relevant to the event.
idNoun
properties
administrativeDomain
descriptionDomain which the device belongs to (for example, the Microsoft Windows domain).
typestring
application
descriptionThe name of an application or service. Some SSO solutions only capture the name of a target application such as "Atlassian" or "Chronicle".
typestring
artifact
$refArtifact
descriptionInformation about an artifact.
asset
$refAsset
descriptionInformation about the asset.
assetId
descriptionThe asset ID. This field can be used as an entity indicator for asset entities.
typestring
cloud
$refCloud
deprecatedTrue
descriptionCloud metadata. Deprecated: cloud should be populated in entity Attribute as generic metadata (e.g. asset.attribute.cloud).
domain
$refDomain
descriptionInformation about the domain.
email
descriptionEmail address. Only filled in for security_result.about
typestring
file
$refBackstoryFile
descriptionInformation about the file.
group
$refGroup
descriptionInformation about the group.
hostname
descriptionClient hostname or domain name field. Hostname also doubles as the domain for remote entities. This field can be used as an entity indicator for asset entities.
typestring
investigation
$refInvestigation
descriptionAnalyst feedback/investigation for alerts.
ip
descriptionA list of IP addresses associated with a network connection. This field can be used as an entity indicator for asset entities.
items
typestring
typearray
ipGeoArtifact
descriptionEnriched geographic information corresponding to an IP address. Specifically, location and network data.
items
$refArtifact
typearray
ipLocation
deprecatedTrue
descriptionDeprecated: use ip_geo_artifact.location instead.
items
$refLocation
typearray
labels
deprecatedTrue
descriptionLabels are key-value pairs. For example: key = "env", value = "prod". Deprecated: labels should be populated in entity Attribute as generic metadata (e.g. user.attribute.labels).
items
$refLabel
typearray
location
$refLocation
descriptionPhysical location. For cloud environments, set the region in location.name.
mac
descriptionList of MAC addresses associated with a device. This field can be used as an entity indicator for asset entities.
items
typestring
typearray
namespace
descriptionNamespace which the device belongs to, such as "AD forest". Uses for this field include Microsoft Windows AD forest, the name of subsidiary, or the name of acquisition. This field can be used along with an asset indicator to identify an asset.
typestring
natIp
descriptionA list of NAT translated IP addresses associated with a network connection.
items
typestring
typearray
natPort
descriptionNAT external network port number when a specific network connection is described within an event.
formatint32
typeinteger
network
$refNetwork
descriptionNetwork details, including sub-messages with details on each protocol (for example, DHCP, DNS, or HTTP).
objectReference
$refId
descriptionFinding to which the Analyst updated the feedback.
platform
descriptionPlatform.
enum
  • UNKNOWN_PLATFORM
  • WINDOWS
  • MAC
  • LINUX
  • GCP
  • AWS
  • AZURE
  • IOS
  • ANDROID
  • CHROME_OS
enumDeprecated
  • False
  • False
  • False
  • False
  • True
  • True
  • True
  • False
  • False
  • False
enumDescriptions
  • Default value.
  • Microsoft Windows.
  • macOS.
  • Linux.
  • Deprecated: see cloud.environment.
  • Deprecated: see cloud.environment.
  • Deprecated: see cloud.environment.
  • IOS
  • Android
  • Chrome OS
typestring
platformPatchLevel
descriptionPlatform patch level. For example, "Build 17134.48"
typestring
platformVersion
descriptionPlatform version. For example, "Microsoft Windows 1803".
typestring
port
descriptionSource or destination network port number when a specific network connection is described within an event.
formatint32
typeinteger
process
$refProcess
descriptionInformation about the process.
processAncestors
descriptionInformation about the process's ancestors ordered from immediate ancestor (parent process) to root. Note: process_ancestors is only populated when data is exported to BigQuery since recursive fields (e.g. process.parent_process) are not supported by BigQuery.
items
$refProcess
typearray
registry
$refRegistry
descriptionRegistry information.
resource
$refResource
descriptionInformation about the resource (e.g. scheduled task, calendar entry). This field should not be used for files, registry, or processes because these objects are already part of Noun.
resourceAncestors
descriptionInformation about the resource's ancestors ordered from immediate ancestor (starting with parent resource).
items
$refResource
typearray
securityResult
descriptionA list of security results.
items
$refSecurityResult
typearray
url
descriptionThe URL.
typestring
urlMetadata
$refUrl
descriptionInformation about the URL.
user
$refUser
descriptionInformation about the user.
userManagementChain
descriptionInformation about the user's management chain (reporting hierarchy). Note: user_management_chain is only populated when data is exported to BigQuery since recursive fields (e.g. user.managers) are not supported by BigQuery.
items
$refUser
typearray
typeobject
NtfsFileMetadata
descriptionNTFS-specific file metadata.
idNtfsFileMetadata
properties
changeTime
descriptionNTFS MFT entry changed timestamp.
formatgoogle-datetime
typestring
filenameAccessTime
descriptionNTFS $FILE_NAME attribute accessed timestamp.
formatgoogle-datetime
typestring
filenameChangeTime
descriptionNTFS $FILE_NAME attribute changed timestamp.
formatgoogle-datetime
typestring
filenameCreateTime
descriptionNTFS $FILE_NAME attribute created timestamp.
formatgoogle-datetime
typestring
filenameModifyTime
descriptionNTFS $FILE_NAME attribute modified timestamp.
formatgoogle-datetime
typestring
typeobject
Operation
descriptionThis resource represents a long-running operation that is the result of a network API call.
idOperation
properties
done
descriptionIf the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available.
typeboolean
error
$refStatus
descriptionThe error result of the operation in case of failure or cancellation.
metadata
additionalProperties
descriptionProperties of the object. Contains field @type with type URL.
typeany
descriptionService-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any.
typeobject
name
descriptionThe server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`.
typestring
response
additionalProperties
descriptionProperties of the object. Contains field @type with type URL.
typeany
descriptionThe normal, successful response of the operation. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`.
typeobject
typeobject
Option
descriptionDHCP options.
idOption
properties
code
descriptionCode. See RFC1533.
formatuint32
typeinteger
data
descriptionData.
formatbyte
typestring
typeobject
PDFInfo
descriptionInformation about the PDF file structure. See https://developers.virustotal.com/reference/pdf_info
idPDFInfo
properties
acroform
descriptionNumber of /AcroForm tags found in the PDF.
formatint64
typestring
autoaction
descriptionNumber of /AA tags found in the PDF.
formatint64
typestring
embeddedFile
descriptionNumber of /EmbeddedFile tags found in the PDF.
formatint64
typestring
encrypted
descriptionWhether the document is encrypted or not. This is defined by the /Encrypt tag.
formatint64
typestring
endobjCount
descriptionNumber of object definitions (endobj keyword).
formatint64
typestring
endstreamCount
descriptionNumber of defined stream objects (stream keyword).
formatint64
typestring
flash
descriptionNumber of /RichMedia tags found in the PDF.
formatint64
typestring
header
descriptionPDF version.
typestring
javascript
descriptionNumber of /JavaScript tags found in the PDF file. Should be the same as the js field in normal scenarios.
formatint64
typestring
jbig2Compression
descriptionNumber of /JBIG2Decode tags found in the PDF.
formatint64
typestring
js
descriptionNumber of /JS tags found in the PDF file. Should be the same as javascript field in normal scenarios.
formatint64
typestring
launchActionCount
descriptionNumber of /Launch tags found in the PDF file.
formatint64
typestring
objCount
descriptionNumber of objects definitions (obj keyword).
formatint64
typestring
objectStreamCount
descriptionNumber of object streams.
formatint64
typestring
openaction
descriptionNumber of /OpenAction tags found in the PDF.
formatint64
typestring
pageCount
descriptionNumber of pages in the PDF.
formatint64
typestring
startxref
descriptionNumber of startxref keywords in the PDF.
formatint64
typestring
streamCount
descriptionNumber of defined stream objects (stream keyword).
formatint64
typestring
suspiciousColors
descriptionNumber of colors expressed with more than 3 bytes (CVE-2009-3459).
formatint64
typestring
trailer
descriptionNumber of trailer keywords in the PDF.
formatint64
typestring
xfa
descriptionNumber of \XFA tags found in the PDF.
formatint64
typestring
xref
descriptionNumber of xref keywords in the PDF.
formatint64
typestring
typeobject
PeFileMetadata
descriptionMetadata about a Microsoft Windows Portable Executable.
idPeFileMetadata
properties
importHash
descriptionHash of PE imports.
typestring
typeobject
Permission
descriptionSystem permission for resource access and modification.
idPermission
properties
description
descriptionDescription of the permission (e.g. 'Ability to update detect rules').
typestring
name
descriptionName of the permission (e.g. chronicle.analyst.updateRule).
typestring
type
descriptionType of the permission.
enum
  • UNKNOWN_PERMISSION_TYPE
  • ADMIN_WRITE
  • ADMIN_READ
  • DATA_WRITE
  • DATA_READ
enumDescriptions
  • Default permission type.
  • Administrator write permission.
  • Administrator read permission.
  • Data resource access write permission.
  • Data resource access read permission.
typestring
typeobject
PlatformSoftware
descriptionPlatform software information about an operating system.
idPlatformSoftware
properties
platform
descriptionThe platform operating system.
enum
  • UNKNOWN_PLATFORM
  • WINDOWS
  • MAC
  • LINUX
  • GCP
  • AWS
  • AZURE
  • IOS
  • ANDROID
  • CHROME_OS
enumDeprecated
  • False
  • False
  • False
  • False
  • True
  • True
  • True
  • False
  • False
  • False
enumDescriptions
  • Default value.
  • Microsoft Windows.
  • macOS.
  • Linux.
  • Deprecated: see cloud.environment.
  • Deprecated: see cloud.environment.
  • Deprecated: see cloud.environment.
  • IOS
  • Android
  • Chrome OS
typestring
platformPatchLevel
descriptionThe platform software patch level ( e.g. "Build 17134.48", "SP1").
typestring
platformVersion
descriptionThe platform software version ( e.g. "Microsoft Windows 1803").
typestring
typeobject
PopularityRank
descriptionDomain's position in popularity ranks for sources such as Alexa, Quantcast, or Statvoo.
idPopularityRank
properties
giver
descriptionName of the rank serial number hexdump.
typestring
ingestionTime
descriptionTimestamp when the rank was ingested.
formatgoogle-datetime
typestring
rank
descriptionRank position.
formatint64
typestring
typeobject
Prevalence
descriptionThe prevalence of a resource within the customer's environment. This measures how common it is for assets to access the resource.
idPrevalence
properties
dayCount
descriptionThe number of days over which rolling_max is calculated.
formatint32
typeinteger
dayMax
descriptionThe max prevalence score in a day interval window.
formatint32
typeinteger
dayMaxSubDomains
descriptionThe max prevalence score in a day interval window across sub-domains. This field is only valid for domains.
formatint32
typeinteger
rollingMax
descriptionThe maximum number of assets per day accessing the resource over the trailing day_count days.
formatint32
typeinteger
rollingMaxSubDomains
descriptionThe maximum number of assets per day accessing the domain along with sub-domains over the trailing day_count days. This field is only valid for domains.
formatint32
typeinteger
typeobject
Process
descriptionInformation about a process.
idProcess
properties
accessMask
descriptionA bit mask representing the level of access.
formatuint64
typestring
commandLine
descriptionThe command line command that created the process. This field can be used as an entity indicator for process entities.
typestring
commandLineHistory
descriptionThe command line history of the process.
items
typestring
typearray
egid
descriptionThe effective group ID of the process.
typestring
euid
descriptionThe effective user ID of the process.
typestring
file
$refBackstoryFile
descriptionInformation about the file in use by the process.
integrityLevelRid
descriptionThe Microsoft Windows integrity level relative ID (RID) of the process.
formatuint64
typestring
parentPid
deprecatedTrue
descriptionThe ID of the parent process. Deprecated: use parent_process.pid instead.
typestring
parentProcess
$refProcess
descriptionInformation about the parent process.
pgid
descriptionThe identifier that points to the process group ID leader.
typestring
pid
descriptionThe process ID. This field can be used as an entity indicator for process entities.
typestring
productSpecificParentProcessId
deprecatedTrue
descriptionA product specific id for the parent process. Please use parent_process.product_specific_process_id instead.
typestring
productSpecificProcessId
descriptionA product specific process id.
typestring
rgid
descriptionThe real group ID of the process.
typestring
ruid
descriptionThe real user ID of the process.
typestring
sessionLeaderPid
descriptionThe process ID of the session leader process.
typestring
tokenElevationType
descriptionThe elevation type of the process on Microsoft Windows. This determines if any privileges are removed when UAC is enabled.
enum
  • UNKNOWN
  • TYPE_1
  • TYPE_2
  • TYPE_3
enumDescriptions
  • An undetermined token type.
  • A full token with no privileges removed or groups disabled.
  • An elevated token with no privileges removed or groups disabled. Used when running as administrator.
  • A limited token with administrative privileges removed and administrative groups disabled.
typestring
tty
descriptionThe teletype terminal which the command was executed within.
typestring
typeobject
ProviderMLVerdict
descriptionDeprecated. MLVerdict result provided from threat providers, like Mandiant. These fields are used to model Mandiant sources.
idProviderMLVerdict
properties
benignCount
descriptionCount of responses where this IoC was marked benign.
formatint32
typeinteger
confidenceScore
descriptionConfidence score of the verdict.
formatint32
typeinteger
maliciousCount
descriptionCount of responses where this IoC was marked malicious.
formatint32
typeinteger
mandiantSources
descriptionList of mandiant sources from which the verdict was generated.
items
$refSource
typearray
sourceProvider
descriptionSource provider giving the ML verdict.
typestring
thirdPartySources
descriptionList of third-party sources from which the verdict was generated.
items
$refSource
typearray
typeobject
PublicKey
descriptionSubject public key info.
idPublicKey
properties
algorithm
descriptionAny of "RSA", "DSA" or "EC". Indicates the algorithm used to generate the certificate.
typestring
rsa
$refRSA
descriptionRSA public key information.
typeobject
Question
descriptionDNS Questions. See RFC1035, section 4.1.2.
idQuestion
properties
class
descriptionThe code specifying the class of the query.
formatuint32
typeinteger
name
descriptionThe domain name.
typestring
prevalence
$refPrevalence
descriptionThe prevalence of the domain within the customer's environment.
type
descriptionThe code specifying the type of the query.
formatuint32
typeinteger
typeobject
RSA
descriptionRSA public key information.
idRSA
properties
exponent
descriptionKey exponent hexdump.
typestring
keySize
descriptionKey size.
formatint64
typestring
modulus
descriptionKey modulus hexdump.
typestring
typeobject
Reference
descriptionReference to model primatives including event and entity. As support is added for fast retrieval of objects by identifiers, this will be expanded to include ID references rather than full object copies. BEGIN GOOGLE-INTERNAL See go/udm:ids for additional details. END GOOGLE-INTERNAL
idReference
properties
entity
$refBackstoryEntity
descriptionEntity being referenced. End one-of
event
$refUDM
descriptionOnly one of event or entity will be populated for a single reference. Start one-of Event being referenced.
id
$refId
descriptionId being referenced. This field will also be populated for both event and entity with the event id. For detections, only this field will be populated.
typeobject
ReferenceList
descriptionA reference list. Reference lists are user-defined lists of values which users can use in multiple Rules.
idReferenceList
properties
description
descriptionRequired. A user-provided description of the reference list.
typestring
displayName
descriptionOutput only. The unique display name of the reference list.
readOnlyTrue
typestring
entries
descriptionRequired. The entries of the reference list. When listed, they are returned in the order that was specified at creation or update. The combined size of the values of the reference list may not exceed 6MB. This is returned only when the view is REFERENCE_LIST_VIEW_FULL.
items
$refReferenceListEntry
typearray
name
descriptionOutput only. The resource name of the reference list. Format: projects/{project}/locations/{location}/instances/{instance}/referenceLists/{reference_list}
readOnlyTrue
typestring
revisionCreateTime
descriptionOutput only. The timestamp when the reference list was last updated.
formatgoogle-datetime
readOnlyTrue
typestring
ruleAssociationsCount
descriptionOutput only. The count of self-authored rules using the reference list.
formatint32
readOnlyTrue
typeinteger
rules
descriptionOutput only. The resource names for the associated self-authored Rules that use this reference list. This is returned only when the view is REFERENCE_LIST_VIEW_FULL.
items
typestring
readOnlyTrue
typearray
scopeInfo
$refScopeInfo
descriptionOutput only. The scope info of the reference list. During reference list creation, if this field is not set, the reference list without scopes (an unscoped list) will be created for an unscoped user. For a scoped user, this field must be set. During reference list update, if scope_info is requested to be updated, this field must be set.
readOnlyTrue
syntaxType
descriptionRequired. The syntax type indicating how list entries should be validated.
enum
  • REFERENCE_LIST_SYNTAX_TYPE_UNSPECIFIED
  • REFERENCE_LIST_SYNTAX_TYPE_PLAIN_TEXT_STRING
  • REFERENCE_LIST_SYNTAX_TYPE_REGEX
  • REFERENCE_LIST_SYNTAX_TYPE_CIDR
enumDescriptions
  • Defaults to REFERENCE_LIST_SYNTAX_TYPE_PLAIN_TEXT_STRING.
  • List contains plain text patterns.
  • List contains only Regular Expression patterns.
  • List contains only CIDR patterns.
typestring
typeobject
ReferenceListEntry
descriptionAn entry in a reference list.
idReferenceListEntry
properties
value
descriptionRequired. The value of the entry. Maximum length is 512 characters.
typestring
typeobject
ReferenceListScope
descriptionReferenceListScope specifies the list of scope names of the reference list.
idReferenceListScope
properties
scopeNames
descriptionOptional. The list of scope names of the reference list. The scope names should be full resource names and should be of the format: "projects/{project}/locations/{location}/instances/{instance}/dataAccessScopes/{scope_name}".
items
typestring
typearray
typeobject
Registry
descriptionInformation about a registry key or value.
idRegistry
properties
registryKey
descriptionRegistry key associated with an application or system component (e.g., HKEY_, HKCU\Environment...).
typestring
registryValueData
descriptionData associated with a registry value (e.g. %USERPROFILE%\Local Settings\Temp).
typestring
registryValueName
descriptionName of the registry value associated with an application or system component (e.g. TEMP).
typestring
registryValueType
descriptionType of the registry value.
enum
  • TYPE_UNSPECIFIED
  • NONE
  • SZ
  • EXPAND_SZ
  • BINARY
  • DWORD
  • DWORD_LITTLE_ENDIAN
  • DWORD_BIG_ENDIAN
  • LINK
  • MULTI_SZ
  • RESOURCE_LIST
  • QWORD
  • QWORD_LITTLE_ENDIAN
enumDescriptions
  • Default registry value type used when the type is unknown.
  • The registry value is not set and only the key exists.
  • A null-terminated string.
  • A null-terminated string that contains unexpanded references to environment variables
  • Binary data in any form.
  • A 32-bit number.
  • A 32-bit number in little-endian format.
  • A 32-bit number in big-endian format.
  • A null-terminated Unicode string that contains the target path of a symbolic link.
  • A sequence of null-terminated strings, terminated by an empty string
  • A device driver resource list.
  • A 64-bit number.
  • A 64-bit number in little-endian format.
typestring
typeobject
Relation
descriptionDefines the relationship between the entity (a) and another entity (b).
idRelation
properties
direction
descriptionDirectionality of relationship between primary entity (a) and the related entity (b).
enum
  • DIRECTIONALITY_UNSPECIFIED
  • BIDIRECTIONAL
  • UNIDIRECTIONAL
enumDescriptions
  • Default value.
  • Modeled in both directions. Primary entity (a) to related entity (b) and related entity (b) to primary entity (a).
  • Modeled in a single direction. Primary entity (a) to related entity (b).
typestring
entity
$refNoun
descriptionEntity (b) that the primary entity (a) is related to.
entityLabel
descriptionLabel to identify the Noun of the relation.
enum
  • ENTITY_LABEL_UNSPECIFIED
  • PRINCIPAL
  • TARGET
  • OBSERVER
  • SRC
  • NETWORK
  • SECURITY_RESULT
  • INTERMEDIARY
enumDescriptions
  • Default value.
  • The Noun represents a principal type object.
  • The Noun represents a target type object.
  • The Noun represents an observer type object.
  • The Noun represents src type object.
  • The Noun represents a network type object.
  • The Noun represents a SecurityResult object.
  • The Noun represents an intermediary type object.
typestring
entityType
descriptionType of the related entity (b) in this relationship.
enum
  • UNKNOWN_ENTITYTYPE
  • ASSET
  • USER
  • GROUP
  • RESOURCE
  • IP_ADDRESS
  • FILE
  • DOMAIN_NAME
  • URL
  • MUTEX
  • METRIC
enumDescriptions
  • @hide_from_doc
  • An asset, such as workstation, laptop, phone, virtual machine, etc.
  • User.
  • Group.
  • Resource.
  • An external IP address.
  • A file.
  • A domain.
  • A url.
  • A mutex.
  • A metric.
typestring
relationship
descriptionType of relationship.
enum
  • RELATIONSHIP_UNSPECIFIED
  • OWNS
  • ADMINISTERS
  • MEMBER
  • EXECUTES
  • DOWNLOADED_FROM
  • CONTACTS
enumDescriptions
  • Default value
  • Related entity is owned by the primary entity (e.g. user owns device asset).
  • Related entity is administered by the primary entity (e.g. user administers a group).
  • Primary entity is a member of the related entity (e.g. user is a member of a group).
  • Primary entity may have executed the related entity.
  • Primary entity may have been downloaded from the related entity.
  • Primary entity contacts the related entity.
typestring
uid
descriptionUID of the relationship.
formatbyte
typestring
typeobject
Resource
descriptionInformation about a resource such as a task, Cloud Storage bucket, database, disk, logical policy, or something similar.
idResource
properties
attribute
$refAttribute
descriptionGeneric entity metadata attributes of the resource.
id
deprecatedTrue
descriptionDeprecated: Use resource.name or resource.product_object_id.
typestring
name
descriptionThe full name of the resource. For example, Google Cloud: //cloudresourcemanager.googleapis.com/projects/wombat-123, and AWS: arn:aws:iam::123456789012:user/johndoe.
typestring
parent
deprecatedTrue
descriptionThe parent of the resource. For a database table, the parent is the database. For a storage object, the bucket name. Deprecated: use resource_ancestors.name.
typestring
productObjectId
descriptionA vendor-specific identifier to uniquely identify the entity (a GUID, OID, or similar) This field can be used as an entity indicator for a Resource entity.
typestring
resourceSubtype
descriptionResource sub-type (e.g. "BigQuery", "Bigtable").
typestring
resourceType
descriptionResource type.
enum
  • UNSPECIFIED
  • MUTEX
  • TASK
  • PIPE
  • DEVICE
  • FIREWALL_RULE
  • MAILBOX_FOLDER
  • VPC_NETWORK
  • VIRTUAL_MACHINE
  • STORAGE_BUCKET
  • STORAGE_OBJECT
  • DATABASE
  • TABLE
  • CLOUD_PROJECT
  • CLOUD_ORGANIZATION
  • SERVICE_ACCOUNT
  • ACCESS_POLICY
  • CLUSTER
  • SETTING
  • DATASET
  • BACKEND_SERVICE
  • POD
  • CONTAINER
  • FUNCTION
  • RUNTIME
  • IP_ADDRESS
  • DISK
  • VOLUME
  • IMAGE
  • SNAPSHOT
  • REPOSITORY
  • CREDENTIAL
  • LOAD_BALANCER
  • GATEWAY
  • SUBNET
  • USER
enumDescriptions
  • Default type.
  • Mutex.
  • Task.
  • Named pipe.
  • Device.
  • Firewall rule.
  • Mailbox folder.
  • VPC Network.
  • Virtual machine.
  • Storage bucket.
  • Storage object.
  • Database.
  • Data table.
  • Cloud project.
  • Cloud organization.
  • Service account.
  • Access policy.
  • Cluster.
  • Settings.
  • Dataset.
  • Endpoint that receive traffic from a load balancer or proxy.
  • Pod, which is a collection of containers. Often used in Kubernetes.
  • Container.
  • Cloud function.
  • Runtime.
  • IP address.
  • Disk.
  • Volume.
  • Machine image.
  • Snapshot.
  • Repository.
  • Credential, e.g. access keys, ssh keys, tokens, certificates.
  • Load balancer.
  • Gateway.
  • Subnet.
  • User.
typestring
type
deprecatedTrue
descriptionDeprecated: use resource_type instead.
typestring
typeobject
ResourceRecord
descriptionDNS Resource Records. See RFC1035, section 4.1.3.
idResourceRecord
properties
binaryData
descriptionThe raw bytes of any non-UTF8 strings that might be included as part of a DNS response.
formatbyte
typestring
class
descriptionThe code specifying the class of the resource record.
formatuint32
typeinteger
data
descriptionThe payload or response to the DNS question for all responses encoded in UTF-8 format
typestring
name
descriptionThe name of the owner of the resource record.
typestring
ttl
descriptionThe time interval for which the resource record can be cached before the source of the information should again be queried.
formatuint32
typeinteger
type
descriptionThe code specifying the type of the resource record.
formatuint32
typeinteger
typeobject
ResponsePlatformInfo
descriptionRelated info of an Alert in customer's SOAR platform.
idResponsePlatformInfo
properties
alertId
descriptionId of the alert in SOAR product.
typestring
responsePlatformType
descriptionType of SOAR product.
enum
  • RESPONSE_PLATFORM_TYPE_UNSPECIFIED
  • RESPONSE_PLATFORM_TYPE_SIEMPLIFY
enumDescriptions
  • Response platform not specified.
  • Siemplify
typestring
typeobject
Retrohunt
descriptionRetrohunt is an execution of a Rule over a time range in the past.
idRetrohunt
properties
executionInterval
$refInterval
descriptionOutput only. The start and end time of the retrohunt execution. If the retrohunt is not yet finished, the end time of the interval will not be populated.
readOnlyTrue
name
descriptionThe resource name of the retrohunt. Retrohunt is the child of a rule revision. {rule} in the format below is structured as {rule_id@revision_id}. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}/retrohunts/{retrohunt}
typestring
processInterval
$refInterval
descriptionRequired. The start and end time of the event time range this retrohunt processes.
progressPercentage
descriptionOutput only. Percent progress of the retrohunt towards completion, from 0.00 to 100.00.
formatfloat
readOnlyTrue
typenumber
state
descriptionOutput only. The state of the retrohunt.
enum
  • STATE_UNSPECIFIED
  • RUNNING
  • DONE
  • CANCELLED
  • FAILED
enumDescriptions
  • Unspecified or unknown retrohunt state.
  • Running state.
  • Done state.
  • Cancelled state.
  • Failed state.
readOnlyTrue
typestring
typeobject
RetrohuntMetadata
descriptionOperation Metadata for Retrohunts.
idRetrohuntMetadata
properties
executionInterval
$refInterval
descriptionThe start and end time of the retrohunt execution. If the retrohunt is not yet finished, the end time of the interval will not be filled.
progressPercentage
descriptionPercent progress of the retrohunt towards completion, from 0.00 to 100.00.
formatfloat
typenumber
retrohunt
descriptionThe name of the retrohunt. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}/retrohunts/{retrohunt}
typestring
typeobject
RiskDelta
descriptionDescribes the difference in risk score between two points in time.
idRiskDelta
properties
previousRangeEndTime
descriptionEnd time of the previous time window.
formatgoogle-datetime
typestring
previousRiskScore
descriptionRisk score from previous risk window
formatint32
typeinteger
riskScoreDelta
descriptionDifference in the normalized risk score from the previous recorded value.
formatint32
typeinteger
riskScoreNumericDelta
descriptionNumeric change between current and previous risk score
formatint32
typeinteger
typeobject
Role
descriptionSystem role for resource access and modification.
idRole
properties
description
descriptionSystem role description for user.
typestring
name
descriptionSystem role name for user.
typestring
type
descriptionSystem role type for well known roles.
enum
  • TYPE_UNSPECIFIED
  • ADMINISTRATOR
  • SERVICE_ACCOUNT
enumDescriptions
  • Default user role.
  • Product administrator with elevated privileges.
  • System service account for automated privilege access.
typestring
typeobject
Rule
descriptionThe Rule resource represents a user-created rule. NEXT TAG: 21
idRule
properties
allowedRunFrequencies
descriptionOutput only. The run frequencies that are allowed for the rule. Populated in BASIC view and FULL view.
items
enum
  • RUN_FREQUENCY_UNSPECIFIED
  • LIVE
  • HOURLY
  • DAILY
enumDescriptions
  • The run frequency is unspecified/unknown.
  • Executes in real time.
  • Executes once per hour.
  • Executes once per day.
typestring
readOnlyTrue
typearray
author
descriptionOutput only. The author of the rule. Extracted from the meta section of text. Populated in BASIC view and FULL view.
readOnlyTrue
typestring
compilationDiagnostics
descriptionOutput only. A list of a rule's corresponding compilation diagnostic messages such as compilation errors and compilation warnings. Populated in FULL view.
items
$refCompilationDiagnostic
readOnlyTrue
typearray
compilationState
descriptionOutput only. The current compilation state of the rule. Populated in FULL view.
enum
  • COMPILATION_STATE_UNSPECIFIED
  • SUCCEEDED
  • FAILED
enumDescriptions
  • The compilation state is unspecified/unknown.
  • The Rule can successfully compile.
  • The Rule cannot successfully compile. This is possible if a backwards-incompatible change was made to the compiler.
readOnlyTrue
typestring
createTime
descriptionOutput only. The timestamp of when the rule was created. Populated in FULL view.
formatgoogle-datetime
readOnlyTrue
typestring
dataTables
descriptionOutput only. Resource names of the data tables used in this rule.
items
typestring
readOnlyTrue
typearray
displayName
descriptionOutput only. Display name of the rule. Populated in BASIC view and FULL view.
readOnlyTrue
typestring
etag
descriptionThe etag for this rule. If this is provided on update, the request will succeed if and only if it matches the server-computed value, and will fail with an ABORTED error otherwise. Populated in BASIC view and FULL view.
typestring
inputsUsed
$refInputsUsed
descriptionOutput only. The set of inputs used in the rule. For example, if the rule uses $e.principal.hostname, then the uses_udm field will be true.
readOnlyTrue
metadata
additionalProperties
typestring
descriptionOutput only. Additional metadata specified in the meta section of text. Populated in FULL view.
readOnlyTrue
typeobject
name
descriptionFull resource name for the rule. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}
typestring
nearRealTimeLiveRuleEligible
descriptionOutput only. Indicate the rule can run in near real time live rule. If this is true, the rule uses the near real time live rule when the run frequency is set to LIVE.
readOnlyTrue
typeboolean
referenceLists
descriptionOutput only. Resource names of the reference lists used in this rule. Populated in FULL view.
items
typestring
readOnlyTrue
typearray
revisionCreateTime
descriptionOutput only. The timestamp of when the rule revision was created. Populated in FULL, REVISION_METADATA_ONLY views.
formatgoogle-datetime
readOnlyTrue
typestring
revisionId
descriptionOutput only. The revision ID of the rule. A new revision is created whenever the rule text is changed in any way. Format: v_{10 digits}_{9 digits} Populated in REVISION_METADATA_ONLY view and FULL view.
readOnlyTrue
typestring
scope
descriptionResource name of the DataAccessScope bound to this rule. Populated in BASIC view and FULL view. If reference lists are used in the rule, validations will be performed against this scope to ensure that the reference lists are compatible with both the user's and the rule's scopes. The scope should be in the format: "projects/{project}/locations/{location}/instances/{instance}/dataAccessScopes/{scope}".
typestring
severity
$refSeverity
descriptionOutput only. The severity of the rule as specified in the meta section of text. Populated in BASIC view and FULL view.
readOnlyTrue
text
descriptionThe YARA-L content of the rule. Populated in FULL view.
typestring
type
descriptionOutput only. User-facing type of the rule. Extracted from the events section of rule text. Populated in BASIC view and FULL view.
enum
  • RULE_TYPE_UNSPECIFIED
  • SINGLE_EVENT
  • MULTI_EVENT
enumDescriptions
  • The rule type is unspecified/unknown.
  • Rule checks for the existence of a single event.
  • Rule checks for correlation between multiple events
readOnlyTrue
typestring
typeobject
RuleDeployment
descriptionThe RuleDeployment resource represents the deployment state of a Rule.
idRuleDeployment
properties
alerting
descriptionWhether detections resulting from this deployment should be considered alerts.
typeboolean
archiveTime
descriptionOutput only. The timestamp when the rule deployment archive state was last set to true. If the rule deployment's current archive state is not set to true, the field will be empty.
formatgoogle-datetime
readOnlyTrue
typestring
archived
descriptionThe archive state of the rule deployment. Cannot be set to true unless enabled is set to false. If set to true, alerting will automatically be set to false. If currently set to true, enabled, alerting, and run_frequency cannot be updated.
typeboolean
consumerRules
descriptionOutput only. The names of the associated/chained consumer rules. Rules are considered consumers of this rule if their rule text explicitly filters on this rule's ruleid. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}
items
typestring
readOnlyTrue
typearray
enabled
descriptionWhether the rule is currently deployed continuously against incoming data.
typeboolean
executionState
descriptionOutput only. The execution state of the rule deployment.
enum
  • EXECUTION_STATE_UNSPECIFIED
  • DEFAULT
  • LIMITED
  • PAUSED
enumDescriptions
  • Unspecified or unknown execution state.
  • Default execution state.
  • Rules in limited state may not have their executions guaranteed.
  • Paused rules are not executed at all.
readOnlyTrue
typestring
lastAlertStatusChangeTime
descriptionOutput only. The timestamp when the rule deployment alert state was lastly changed. This is filled regardless of the current alert state. E.g. if the current alert status is false, this timestamp will be the timestamp when the alert status was changed to false.
formatgoogle-datetime
readOnlyTrue
typestring
name
descriptionRequired. The resource name of the rule deployment. Note that RuleDeployment is a child of the overall Rule, not any individual revision, so the resource ID segment for the Rule resource must not reference a specific revision. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}/deployment
typestring
producerRules
descriptionOutput only. The names of the associated/chained producer rules. Rules are considered producers for this rule if this rule explicitly filters on their ruleid. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}
items
typestring
readOnlyTrue
typearray
runFrequency
descriptionThe run frequency of the rule deployment.
enum
  • RUN_FREQUENCY_UNSPECIFIED
  • LIVE
  • HOURLY
  • DAILY
enumDescriptions
  • The run frequency is unspecified/unknown.
  • Executes in real time.
  • Executes once per hour.
  • Executes once per day.
typestring
typeobject
RuntimeError
idRuntimeError
properties
errorText
typestring
timeRange
$refInterval
typeobject
SSLCertificate
descriptionSSL certificate.
idSSLCertificate
properties
certExtensions
additionalProperties
descriptionProperties of the object.
typeany
descriptionCertificate's extensions.
typeobject
certSignature
$refCertSignature
descriptionCertificate's signature and algorithm.
ec
$refEC
descriptionEC public key information.
extension
$refExtension
deprecatedTrue
description(DEPRECATED) certificate's extension.
firstSeenTime
descriptionDate the certificate was first retrieved by VirusTotal.
formatgoogle-datetime
typestring
issuer
$refSubject
descriptionCertificate's issuer data.
publicKey
$refPublicKey
descriptionPublic key information.
serialNumber
descriptionCertificate's serial number hexdump.
typestring
signatureAlgorithm
descriptionAlgorithm used for the signature (for example, "sha1RSA").
typestring
size
descriptionCertificate content length.
formatint64
typestring
subject
$refSubject
descriptionCertificate's subject data.
thumbprint
descriptionCertificate's content SHA1 hash.
typestring
thumbprintSha256
descriptionCertificate's content SHA256 hash.
typestring
validity
$refValidity
descriptionCertificate's validity period.
version
descriptionCertificate version (typically "V1", "V2" or "V3").
typestring
typeobject
ScopeInfo
descriptionScopeInfo specifies the scope info of the reference list.
idScopeInfo
properties
referenceListScope
$refReferenceListScope
descriptionRequired. The list of scope names of the reference list, if the list is empty the reference list is treated as unscoped.
typeobject
SearchDataTableColumnInfo
idSearchDataTableColumnInfo
properties
isDefault
typeboolean
originalColumn
typestring
typeobject
SearchDataTableInfo
idSearchDataTableInfo
properties
columnInfo
items
$refSearchDataTableColumnInfo
typearray
dataTable
typestring
typeobject
SearchDataTableRow
idSearchDataTableRow
properties
column
typestring
value
typestring
typeobject
SearchDataTableRowInfo
idSearchDataTableRowInfo
properties
dataTable
typestring
rows
items
$refSearchDataTableRow
typearray
typeobject
SecurityResult
descriptionSecurity related metadata for the event. A security result might be something like "virus detected and quarantined," "malicious connection blocked," or "sensitive data included in document foo.doc." Each security result, of which there may be more than one, may either pertain to the whole event, or to a specific object or device referenced in the event (e.g. a malicious file that was detected, or a sensitive document sent as an email attachment). For security results that apply to a particular object referenced in the event, the security_results message MUST contain details about the implicated object (such as process, user, IP, domain, URL, IP, or email address) in the about field. For security results that apply to the entire event (e.g. SPAM found in this email), the about field must remain empty.
idSecurityResult
properties
about
$refNoun
descriptionIf the security result is about a specific entity (Noun), add it here. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
action
descriptionActions taken for this event. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
items
enum
  • UNKNOWN_ACTION
  • ALLOW
  • BLOCK
  • ALLOW_WITH_MODIFICATION
  • QUARANTINE
  • FAIL
  • CHALLENGE
enumDescriptions
  • The default action.
  • Allowed.
  • Blocked.
  • Strip, modify something (e.g. File or email was disinfected or rewritten and still forwarded).
  • Put somewhere for later analysis (does NOT imply block).
  • Failed (e.g. the event was allowed but failed).
  • Challenged (e.g. the user was challenged by a Captcha, 2FA).
typestring
typearray
actionDetails
descriptionThe detail of the action taken as provided by the vendor. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
typestring
alertState
descriptionThe alerting types of this security result. This is primarily set for rule-generated detections and alerts.
enum
  • UNSPECIFIED
  • NOT_ALERTING
  • ALERTING
enumDescriptions
  • The security result type is not known.
  • The security result is not an alert.
  • The security result is an alert.
typestring
analyticsMetadata
descriptionStores metadata about each risk analytic metric the rule uses. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
items
$refAnalyticsMetadata
typearray
associations
descriptionAssociations related to the threat. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
items
$refAssociation
typearray
attackDetails
$refAttackDetails
descriptionMITRE ATT&CK details. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
campaigns
descriptionCampaigns using this IOC threat. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
items
typestring
typearray
category
descriptionThe security category. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
items
enum
  • UNKNOWN_CATEGORY
  • SOFTWARE_MALICIOUS
  • SOFTWARE_SUSPICIOUS
  • SOFTWARE_PUA
  • NETWORK_MALICIOUS
  • NETWORK_SUSPICIOUS
  • NETWORK_CATEGORIZED_CONTENT
  • NETWORK_DENIAL_OF_SERVICE
  • NETWORK_RECON
  • NETWORK_COMMAND_AND_CONTROL
  • ACL_VIOLATION
  • AUTH_VIOLATION
  • EXPLOIT
  • DATA_EXFILTRATION
  • DATA_AT_REST
  • DATA_DESTRUCTION
  • TOR_EXIT_NODE
  • MAIL_SPAM
  • MAIL_PHISHING
  • MAIL_SPOOFING
  • POLICY_VIOLATION
  • SOCIAL_ENGINEERING
  • PHISHING
enumDescriptions
  • The default category.
  • Malware, spyware, rootkit.
  • Below the conviction threshold; probably bad.
  • Potentially Unwanted App (such as adware).
  • Includes C&C or network exploit.
  • Suspicious activity, such as potential reverse tunnel.
  • Non-security related: URL has category like gambling or porn.
  • DoS, DDoS.
  • Port scan detected by an IDS, probing of web app.
  • If we know this is a C&C channel.
  • Unauthorized access attempted, including attempted access to files, web services, processes, web objects, etc.
  • Authentication failed (e.g. bad password or bad 2-factor authentication).
  • Exploit: For all manner of exploits including attempted overflows, bad protocol encodings, ROP, SQL injection, etc. For both network and host- based exploits.
  • DLP: Sensitive data transmission, copy to thumb drive.
  • DLP: Sensitive data found at rest in a scan.
  • Attempt to destroy/delete data.
  • TOR Exit Nodes.
  • Spam email, message, etc.
  • Phishing email, chat messages, etc.
  • Spoofed source email address, etc.
  • Security-related policy violation (e.g. firewall/proxy/HIPS rule violated, NAC block action).
  • Threats which manipulate to break normal security procedures.
  • Phishing pages, pops, https phishing etc.
typestring
typearray
categoryDetails
descriptionFor vendor-specific categories. For web categorization, put type in here such as "gambling" or "porn". This field is not populated when the SecurityResult appears in a finding (a detection or alert).
items
typestring
typearray
confidence
descriptionThe confidence level of the result as estimated by the product. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
enum
  • UNKNOWN_CONFIDENCE
  • LOW_CONFIDENCE
  • MEDIUM_CONFIDENCE
  • HIGH_CONFIDENCE
enumDescriptions
  • The default confidence level.
  • Low confidence.
  • Medium confidence.
  • High confidence.
typestring
confidenceDetails
descriptionAdditional detail with regards to the confidence of a security event as estimated by the product vendor. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
typestring
confidenceScore
descriptionThe confidence score of the security result. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
formatfloat
typenumber
description
descriptionA human-readable description (e.g. "user password was wrong"). This can be more detailed than the summary.
typestring
detectionDepth
descriptionThe depth of the detection chain. Applies only to composite detections.
formatint64
typestring
detectionFields
descriptionAn ordered list of values, that represent fields in detections for a security finding. This list represents mapping of names of requested entities to their values (the security result matched variables). This is only populated when the SecurityResult appears in a finding (a detection or alert).
items
$refLabel
typearray
firstDiscoveredTime
descriptionFirst time the IoC threat was discovered in the provider. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
formatgoogle-datetime
typestring
lastDiscoveredTime
descriptionLast time the IoC was seen in the provider data. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
formatgoogle-datetime
typestring
lastUpdatedTime
descriptionLast time the IoC threat was updated in the provider. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
formatgoogle-datetime
typestring
outcomes
descriptionA list of outcomes that represent the results of this security finding. This list represents a mapping of names of the requested outcomes, to a stringified version of their values. This is only populated when the SecurityResult appears in a finding (a detection or alert).
items
$refLabel
typearray
priority
descriptionThe priority of the result. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
enum
  • UNKNOWN_PRIORITY
  • LOW_PRIORITY
  • MEDIUM_PRIORITY
  • HIGH_PRIORITY
enumDescriptions
  • Default priority level.
  • Low priority.
  • Medium priority.
  • High priority.
typestring
priorityDetails
descriptionVendor-specific information about the security result priority. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
typestring
reports
descriptionReports that reference this IOC threat. These are the report IDs. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
items
typestring
typearray
riskScore
descriptionThe risk score of the security result.
formatfloat
typenumber
ruleAuthor
descriptionAuthor of the security rule. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
typestring
ruleId
descriptionA vendor-specific ID for a rule, varying by observer type (e.g. "08123", "5d2b44d0-5ef6-40f5-a704-47d61d3babbe").
typestring
ruleLabels
descriptionA list of rule labels that can't be captured by the other fields in security result (e.g. "reference : AnotherRule", "contributor : John"). This is primarily set in rule-generated detections and alerts.
items
$refLabel
typearray
ruleName
descriptionName of the security rule (e.g. "BlockInboundToOracle").
typestring
ruleSet
descriptionThe curated detection's rule set identifier. (for example, "windows-threats") This is primarily set in rule-generated detections and alerts.
typestring
ruleSetDisplayName
descriptionThe curated detections rule set display name. This is primarily set in rule-generated detections and alerts.
typestring
ruleType
descriptionThe type of security rule.
typestring
ruleVersion
descriptionVersion of the security rule. (e.g. "v1.1", "00001", "1604709794", "2020-11-16T23:04:19+00:00"). Note that rule versions are source-dependant and lexical ordering should not be assumed.
typestring
rulesetCategoryDisplayName
descriptionThe curated detection rule set category display name. (for example, if rule_set_display_name is "CDIR SCC Enhanced Exfiltration", the rule_set_category is "Cloud Threats"). This is primarily set in rule-generated detections and alerts.
typestring
severity
descriptionThe severity of the result.
enum
  • UNKNOWN_SEVERITY
  • INFORMATIONAL
  • ERROR
  • NONE
  • LOW
  • MEDIUM
  • HIGH
  • CRITICAL
enumDescriptions
  • The default severity level.
  • Info severity.
  • An error.
  • No malicious result.
  • Low-severity malicious result.
  • Medium-severity malicious result.
  • High-severity malicious result.
  • Critical-severity malicious result.
typestring
severityDetails
descriptionVendor-specific severity. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
typestring
summary
descriptionA short human-readable summary (e.g. "failed login occurred")
typestring
threatFeedName
descriptionVendor feed name for a threat indicator feed. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
typestring
threatId
descriptionVendor-specific ID for a threat. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
typestring
threatIdNamespace
descriptionThe attribute threat_id_namespace qualifies threat_id with an id namespace to get an unique id. The attribute threat_id by itself is not unique across Chronicle as it is a vendor specific id. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
enum
  • NORMALIZED_TELEMETRY
  • RAW_TELEMETRY
  • RULE_DETECTIONS
  • UPPERCASE
  • MACHINE_INTELLIGENCE
  • SECURITY_COMMAND_CENTER
  • UNSPECIFIED
  • SOAR_ALERT
  • VIRUS_TOTAL
enumDescriptions
  • Ingested and Normalized telemetry events
  • Ingested Raw telemetry
  • Chronicle Rules engine
  • Uppercase
  • DSML - Machine Intelligence
  • A normalized telemetry event from Google Security Command Center.
  • Unspecified Namespace
  • An alert coming from other SIEMs via Chronicle SOAR.
  • VirusTotal.
typestring
threatName
descriptionA vendor-assigned classification common across multiple customers (for example, "W32/File-A", "Slammer"). This field is not populated when the SecurityResult appears in a finding (a detection or alert).
typestring
threatStatus
descriptionCurrent status of the threat This field is not populated when the SecurityResult appears in a finding (a detection or alert).
enum
  • THREAT_STATUS_UNSPECIFIED
  • ACTIVE
  • CLEARED
  • FALSE_POSITIVE
enumDescriptions
  • Default threat status
  • Active threat.
  • Cleared threat.
  • False positive.
typestring
threatVerdict
descriptionGCTI threat verdict on the security result entity. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
enum
  • THREAT_VERDICT_UNSPECIFIED
  • UNDETECTED
  • SUSPICIOUS
  • MALICIOUS
enumDescriptions
  • Unspecified threat verdict level.
  • Undetected threat verdict level.
  • Suspicious threat verdict level.
  • Malicious threat verdict level.
typestring
urlBackToProduct
descriptionURL that takes the user to the source product console for this event. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
typestring
variables
additionalProperties
$refFindingVariable
descriptionA list of outcomes and match variables that represent the results of this security finding. This list represents a mapping of names of the requested outcomes or match variables, to their values. This is only populated when the SecurityResult appears in a finding (a detection or alert).
typeobject
verdict
$refVerdict
deprecatedTrue
descriptionVerdict about the IoC from the provider. This field is now deprecated. Use VerdictInfo instead.
verdictInfo
descriptionVerdict information about the IoC from the provider. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
items
$refVerdictInfo
typearray
typeobject
Server
descriptionTransport Layer Security (TLS) information associated with the server (for example, Certificate or JA3 hash).
idServer
properties
certificate
$refCertificate
descriptionServer certificate.
ja3s
descriptionJA3 hash from the TLS ServerHello, as a hex-encoded string.
typestring
typeobject
Severity
descriptionSeverity represents the severity level of the rule.
idSeverity
properties
displayName
descriptionThe display name of the severity level. Extracted from the meta section of the rule text.
typestring
typeobject
SignatureInfo
descriptionFile signature information extracted from different tools.
idSignatureInfo
properties
codesign
$refFileMetadataCodesign
descriptionSignature information extracted from the codesign utility.
sigcheck
$refFileMetadataSignatureInfo
descriptionSignature information extracted from the sigcheck tool.
typeobject
SignerInfo
descriptionFile metadata related to the signer information.
idSignerInfo
properties
certIssuer
descriptionCompany that issued the certificate.
typestring
name
descriptionCommon name of the signers/certificate. The order of the signers matters. Each element is a higher level authority, the last being the root authority.
typestring
status
descriptionIt can say "Valid" or state the problem with the certificate if any (e.g. "This certificate or one of the certificates in the certificate chain is not time valid.").
typestring
validUsage
descriptionIndicates which situations the certificate is valid for (e.g. "Code Signing").
typestring
typeobject
Smtp
descriptionSMTP info. See RFC 2821.
idSmtp
properties
helo
descriptionThe client's 'HELO'/'EHLO' string.
typestring
isTls
descriptionIf the connection switched to TLS.
typeboolean
isWebmail
descriptionIf the message was sent via a webmail client.
typeboolean
mailFrom
descriptionThe client's 'MAIL FROM' string.
typestring
messagePath
descriptionThe message's path (extracted from the headers).
typestring
rcptTo
descriptionThe client's 'RCPT TO' string(s).
items
typestring
typearray
serverResponse
descriptionThe server's response(s) to the client.
items
typestring
typearray
typeobject
SoarAlertMetadata
descriptionMetadata fields of alerts coming from other SIEM systems.
idSoarAlertMetadata
properties
alertId
descriptionAlert ID in the source SIEM system.
typestring
product
descriptionName of the product the alert is coming from.
typestring
sourceRule
descriptionName of the rule triggering the alert in the source SIEM.
typestring
sourceSystem
descriptionName of the Source SIEM system.
typestring
sourceSystemTicketId
descriptionTicket id for the alert in the source system.
typestring
sourceSystemUri
descriptionUrl to the source SIEM system.
typestring
vendor
descriptionName of the vendor.
typestring
typeobject
Software
descriptionInformation about a software package or application.
idSoftware
properties
description
descriptionThe description of the software.
typestring
name
descriptionThe name of the software.
typestring
permissions
descriptionSystem permissions granted to the software. For example, "android.permission.WRITE_EXTERNAL_STORAGE"
items
$refPermission
typearray
vendorName
descriptionThe name of the software vendor.
typestring
version
descriptionThe version of the software.
typestring
typeobject
Source
descriptionDeprecated. Information about the threat intelligence source. These fields are used to model Mandiant sources.
idSource
properties
benignCount
descriptionCount of responses where this IoC was marked benign.
formatint32
typeinteger
maliciousCount
descriptionCount of responses where this IoC was marked malicious.
formatint32
typeinteger
name
descriptionName of the IoC source.
typestring
quality
descriptionQuality of the IoC mapping extracted from the source.
enum
  • UNKNOWN_CONFIDENCE
  • LOW_CONFIDENCE
  • MEDIUM_CONFIDENCE
  • HIGH_CONFIDENCE
enumDescriptions
  • The default confidence level.
  • Low confidence.
  • Medium confidence.
  • High confidence.
typestring
responseCount
descriptionTotal response count from this source.
formatint32
typeinteger
sourceCount
descriptionNumber of sources from which intelligence was extracted.
formatint32
typeinteger
threatIntelligenceSources
descriptionDifferent threat intelligence sources from which IoC info was extracted.
items
$refSource
typearray
typeobject
Status
descriptionThe `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors).
idStatus
properties
code
descriptionThe status code, which should be an enum value of google.rpc.Code.
formatint32
typeinteger
details
descriptionA list of messages that carry the error details. There is a common set of message types for APIs to use.
items
additionalProperties
descriptionProperties of the object. Contains field @type with type URL.
typeany
typeobject
typearray
message
descriptionA developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
typestring
typeobject
StringSequence
descriptionStringSequence represents a sequence of string.
idStringSequence
properties
stringVals
descriptionstring sequence.
items
typestring
typearray
typeobject
StringToInt64MapEntry
idStringToInt64MapEntry
properties
key
descriptionKey field.
typestring
value
descriptionValue field.
formatint64
typestring
typeobject
StringValue
idStringValue
properties
displayValue
typestring
rawValue
typestring
typeobject
StringValues
idStringValues
properties
values
items
$refStringValue
typearray
typeobject
Subject
descriptionSubject data.
idSubject
properties
commonName
descriptionCN: CommonName.
typestring
countryName
descriptionC: Country name.
typestring
locality
descriptionL: Locality.
typestring
organization
descriptionO: Organization.
typestring
organizationalUnit
descriptionOU: OrganizationalUnit.
typestring
stateOrProvinceName
descriptionST: StateOrProvinceName.
typestring
typeobject
Tactic
descriptionTactic information related to an attack or threat.
idTactic
properties
id
descriptionTactic ID (e.g. "TA0043").
typestring
name
descriptionTactic Name (e.g. "Reconnaissance")
typestring
typeobject
Tags
descriptionTags are event metadata which is set by examining event contents post-parsing. For example, a UDM event may be assigned a tenant_id based on certain customer-defined parameters.
idTags
properties
dataTapConfigName
descriptionA list of sink name values defined in DataTap configurations.
items
typestring
typearray
tenantId
descriptionA list of subtenant ids that this event belongs to.
items
formatbyte
typestring
typearray
typeobject
Technique
descriptionTechnique information related to an attack or threat.
idTechnique
properties
id
descriptionTechnique ID (e.g. "T1595").
typestring
name
descriptionTechnique Name (e.g. "Active Scanning").
typestring
subtechniqueId
descriptionSubtechnique ID (e.g. "T1595.001").
typestring
subtechniqueName
descriptionSubtechnique Name (e.g. "Scanning IP Blocks").
typestring
typeobject
TimeOff
descriptionSystem record for leave/time-off from a Human Capital Management (HCM) system.
idTimeOff
properties
description
descriptionDescription of the leave if available (e.g. 'Vacation').
typestring
interval
$refInterval
descriptionInterval duration of the leave.
typeobject
Tls
descriptionTransport Layer Security (TLS) information.
idTls
properties
cipher
descriptionCipher used during the connection.
typestring
client
$refClient
descriptionCertificate information for the client certificate.
curve
descriptionElliptical curve used for a given cipher.
typestring
established
descriptionIndicates whether the TLS negotiation was successful.
typeboolean
nextProtocol
descriptionProtocol to be used for tunnel.
typestring
resumed
descriptionIndicates whether the TLS connection was resumed from a previous TLS negotiation.
typeboolean
server
$refServer
descriptionCertificate information for the server certificate.
version
descriptionTLS version.
typestring
versionProtocol
descriptionProtocol.
typestring
typeobject
Tracker
descriptionURL Tracker.
idTracker
properties
id
descriptionTracker ID, if available.
typestring
timestamp
descriptionTracker ingestion date.
formatgoogle-datetime
typestring
tracker
descriptionTracker name.
typestring
url
descriptionTracker script URL.
typestring
typeobject
Tunnels
descriptionVPN tunnels.
idTunnels
properties
provider
descriptionThe provider of the VPN tunnels being used.
typestring
type
descriptionThe type of the VPN tunnels.
typestring
typeobject
UDM
descriptionA Unified Data Model event.
idUDM
properties
about
descriptionRepresents entities referenced by the event that are not otherwise described in principal, src, target, intermediary or observer. For example, it could be used to track email file attachments, domains/URLs/IPs embedded within an email body, and DLLs that are loaded during a PROCESS_LAUNCH event.
items
$refNoun
typearray
additional
additionalProperties
descriptionProperties of the object.
typeany
descriptionAny important vendor-specific event data that cannot be adequately represented within the formal sections of the UDM model.
typeobject
extensions
$refExtensions
descriptionAll other first-class, event-specific metadata goes in this message. Do not place protocol metadata in Extensions; put it in Network.
extracted
additionalProperties
descriptionProperties of the object.
typeany
descriptionFlattened fields extracted from the log.
typeobject
intermediary
descriptionRepresents details on one or more intermediate entities processing activity described in the event. This includes device details about a proxy server or SMTP relay server. If an active event (that has a principal and possibly target) passes through any intermediaries, they're added here. Intermediaries can impact the overall action, for example blocking or modifying an ongoing request. A rule of thumb here is that 'principal', 'target', and description of the initial action should be the same regardless of the intermediary or its action. A successful network connection from A->B should look the same in principal/target/intermediary as one blocked by firewall C: principal: A, target: B (intermediary: C).
items
$refNoun
typearray
metadata
$refMetadata
descriptionEvent metadata such as timestamp, source product, etc.
network
$refNetwork
descriptionAll network details go here, including sub-messages with details on each protocol (for example, DHCP, DNS, or HTTP).
observer
$refNoun
descriptionRepresents an observer entity (for example, a packet sniffer or network-based vulnerability scanner), which is not a direct intermediary, but which observes and reports on the event in question.
principal
$refNoun
descriptionRepresents the acting entity that originates the activity described in the event. The principal must include at least one machine detail (hostname, MACs, IPs, port, product-specific identifiers like an EDR asset ID) or user detail (for example, username), and optionally include process details. It must NOT include any of the following fields: email, files, registry keys or values.
securityResult
descriptionA list of security results.
items
$refSecurityResult
typearray
src
$refNoun
descriptionRepresents a source entity being acted upon by the participant along with the device or process context for the source object (the machine where the source object resides). For example, if user U copies file A on machine X to file B on machine Y, both file A and machine X would be specified in the src portion of the UDM event.
target
$refNoun
descriptionRepresents a target entity being referenced by the event or an object on the target entity. For example, in a firewall connection from device A to device B, A is described as the principal and B is described as the target. For a process injection by process C into target process D, process C is described as the principal and process D is described as the target.
typeobject
UdmColumnList
idUdmColumnList
properties
values
items
$refUdmColumnValue
typearray
typeobject
UdmColumnType
idUdmColumnType
properties
list
$refUdmColumnList
value
$refUdmColumnValue
typeobject
UdmColumnValue
idUdmColumnValue
properties
boolVal
typeboolean
bytesVal
formatbyte
typestring
dateVal
$refDate
doubleVal
formatdouble
typenumber
int64Val
formatint64
typestring
nullVal
typeboolean
protoVal
additionalProperties
descriptionProperties of the object. Contains field @type with type URL.
typeany
typeobject
stringVal
typestring
timestampVal
formatgoogle-datetime
typestring
uint64Val
formatuint64
typestring
typeobject
UdmEventInfo
idUdmEventInfo
properties
alertNumber
formatint32
typeinteger
annotations
items
enum
  • ANNOTATION_UNSPECIFIED
  • ANNOTATION_ALERT
enumDescriptions
typestring
typearray
chip
$refChip
deprecatedTrue
connectedComponentLabel
descriptionOptional.
formatbyte
typestring
datatableRowInfo
items
$refSearchDataTableRowInfo
typearray
detections
items
$refCollection
typearray
displayName
deprecatedTrue
typestring
entity
$refBackstoryEntity
event
$refUDM
eventLogToken
typestring
filterProperties
$refFilterProperties
deprecatedTrue
outcomes
items
$refUdmColumnType
typearray
tenantId
descriptionOptional.
typestring
uid
formatbyte
typestring
typeobject
UdmEventList
idUdmEventList
properties
columnNames
$refColumnNames
complete
typeboolean
datatableInfo
items
$refSearchDataTableInfo
typearray
events
items
$refUdmEventInfo
typearray
progress
formatdouble
typenumber
tooManyEvents
typeboolean
typeobject
UdmFieldAggregation
idUdmFieldAggregation
properties
aggregationType
enum
  • UNSPECIFIED_FIELD_AGGREGATION_TYPE
  • UDM_FIELD_AGGREGATION_TYPE
  • ENTITY_FIELD_AGGREGATION_TYPE
enumDescriptions
typestring
allValues
items
$refUdmValueCount
typearray
baselineEventCount
formatint32
typeinteger
bottomValues
items
$refUdmValueCount
typearray
eventCount
formatint32
typeinteger
fieldName
typestring
tooManyValues
typeboolean
topValues
items
$refUdmValueCount
typearray
valueCount
formatint32
typeinteger
typeobject
UdmFieldAggregations
idUdmFieldAggregations
properties
complete
typeboolean
fields
items
$refUdmFieldAggregation
typearray
groupByFields
items
$refGroupAggregationByField
typearray
typeobject
UdmFieldValue
idUdmFieldValue
properties
boolValue
typeboolean
bytesValue
formatbyte
typestring
doubleValue
formatdouble
typenumber
enumValue
typestring
floatValue
formatfloat
typenumber
int32Value
formatint32
typeinteger
int64Value
formatint64
typestring
isNull
typeboolean
stringValue
typestring
timestampValue
formatgoogle-datetime
typestring
uint32Value
formatuint32
typeinteger
uint64Value
formatuint64
typestring
typeobject
UdmPrevalence
idUdmPrevalence
properties
artifacts
items
$refFieldAndValue
typearray
prevalence
formatint32
typeinteger
typeobject
UdmPrevalenceBucket
idUdmPrevalenceBucket
properties
prevalence
items
$refUdmPrevalence
typearray
typeobject
UdmPrevalenceResponse
idUdmPrevalenceResponse
properties
buckets
items
$refUdmPrevalenceBucket
typearray
partialPrevalence
typeboolean
typeobject
UdmSearchOperationMetadata
descriptionInformation about a UDM Search operation. This message is used to populate the `metadata` field of `Operation` resources created by UDM Search.
idUdmSearchOperationMetadata
properties
baselineEventsCount
descriptionThe number of events matching the baseline query so far.
formatint32
typeinteger
baselineQuery
descriptionQuery used to search for events.
typestring
baselineTimeRange
$refInterval
descriptionThe time range used for the baseline query [inclusive start time, exclusive end time).
caseInsensitive
descriptionIf true, the search was performed in a case-insensitive manner.
typeboolean
endTime
descriptionThe end time of the operation, if done.
formatgoogle-datetime
typestring
expireTime
descriptionThe time when the operation results expire. This time may change while the operation is in progress. If unset, the results never expire.
formatgoogle-datetime
typestring
filteredEventsCount
descriptionThe number of events matching the snapshot query so far. This is <= `baseline_events_count`. If the snapshot query is empty, this will be equal to `baseline_events_count`.
formatint32
typeinteger
progress
descriptionA value from 0 to 1 representing the progress of the operation.
formatdouble
typenumber
snapshotQuery
descriptionQuery used to filter the baseline query's events.
typestring
snapshotTimeRange
$refInterval
descriptionTime range used to filter the baseline query's events [inclusive start time, exclusive end time). This time range is completely within `baseline_time_range`. If not set, it is assumed to match `baseline_time_range`.
startTime
descriptionThe start time of the operation.
formatgoogle-datetime
typestring
statsRowsCount
descriptionThe total number of rows returned for a stats query.
formatint32
typeinteger
typeobject
UdmValueCount
idUdmValueCount
properties
baselineEventCount
formatint32
typeinteger
eventCount
formatint32
typeinteger
value
$refUdmFieldValue
typeobject
Uint64Sequence
descriptionUint64Sequence represents a sequence of uint64s.
idUint64Sequence
properties
uint64Vals
descriptionuint64 sequence.
items
formatuint64
typestring
typearray
typeobject
Url
descriptionUrl.
idUrl
properties
categories
descriptionCategorisation done by VirusTotal partners.
items
typestring
typearray
favicon
$refFavicon
descriptionDifference hash and MD5 hash of the URL's.
htmlMeta
additionalProperties
descriptionProperties of the object.
typeany
descriptionMeta tags (only for URLs downloading HTML).
typeobject
lastFinalUrl
descriptionIf the original URL redirects, where does it end.
typestring
lastHttpResponseCode
descriptionHTTP response code of the last response.
formatint32
typeinteger
lastHttpResponseContentLength
descriptionLength in bytes of the content received.
formatint64
typestring
lastHttpResponseContentSha256
descriptionURL response body's SHA256 hash.
typestring
lastHttpResponseCookies
additionalProperties
descriptionProperties of the object.
typeany
descriptionWebsite's cookies.
typeobject
lastHttpResponseHeaders
additionalProperties
descriptionProperties of the object.
typeany
descriptionHeaders and values of the last HTTP response.
typeobject
tags
descriptionTags.
items
typestring
typearray
title
descriptionWebpage title.
typestring
trackers
descriptionTrackers found in the URL in a historical manner.
items
$refTracker
typearray
url
descriptionURL.
typestring
typeobject
User
descriptionInformation about a user.
idUser
properties
accountExpirationTime
descriptionUser account expiration timestamp.
formatgoogle-datetime
typestring
accountLockoutTime
descriptionUser account lockout timestamp.
formatgoogle-datetime
typestring
accountType
descriptionType of user account (for example, service, domain, or cloud). This is somewhat aligned to: https://attack.mitre.org/techniques/T1078/
enum
  • ACCOUNT_TYPE_UNSPECIFIED
  • DOMAIN_ACCOUNT_TYPE
  • LOCAL_ACCOUNT_TYPE
  • CLOUD_ACCOUNT_TYPE
  • SERVICE_ACCOUNT_TYPE
  • DEFAULT_ACCOUNT_TYPE
enumDescriptions
  • Default user account type.
  • A human account part of some domain in directory services.
  • A local machine account.
  • A SaaS service account type (such as Slack or GitHub).
  • A non-human account for data access.
  • A system built in default account.
typestring
attribute
$refAttribute
descriptionGeneric entity metadata attributes of the user.
companyName
descriptionUser job company name.
typestring
department
descriptionUser job department
items
typestring
typearray
emailAddresses
descriptionEmail addresses of the user. This field can be used as an entity indicator for user entities.
items
typestring
typearray
employeeId
descriptionHuman capital management identifier. This field can be used as an entity indicator for user entities.
typestring
firstName
descriptionFirst name of the user (e.g. "John").
typestring
firstSeenTime
descriptionThe first observed time for a user. The value is calculated on the basis of the first time the identifier was observed.
formatgoogle-datetime
typestring
groupIdentifiers
descriptionProduct object identifiers of the group(s) the user belongs to A vendor-specific identifier to uniquely identify the group(s) the user belongs to (a GUID, LDAP OID, or similar).
items
typestring
typearray
groupid
deprecatedTrue
descriptionThe ID of the group that the user belongs to. Deprecated in favor of the repeated group_identifiers field.
typestring
hireDate
descriptionUser job employment hire date.
formatgoogle-datetime
typestring
lastBadPasswordAttemptTime
descriptionUser last bad password attempt timestamp.
formatgoogle-datetime
typestring
lastLoginTime
descriptionUser last login timestamp.
formatgoogle-datetime
typestring
lastName
descriptionLast name of the user (e.g. "Locke").
typestring
lastPasswordChangeTime
descriptionUser last password change timestamp.
formatgoogle-datetime
typestring
managers
descriptionUser job manager(s).
items
$refUser
typearray
middleName
descriptionMiddle name of the user.
typestring
officeAddress
$refLocation
descriptionUser job office location.
passwordExpirationTime
descriptionUser password expiration timestamp.
formatgoogle-datetime
typestring
personalAddress
$refLocation
descriptionPersonal address of the user.
phoneNumbers
descriptionPhone numbers for the user.
items
typestring
typearray
productObjectId
descriptionA vendor-specific identifier to uniquely identify the entity (e.g. a GUID, LDAP, OID, or similar). This field can be used as an entity indicator for user entities.
typestring
roleDescription
deprecatedTrue
descriptionSystem role description for user. Deprecated: use attribute.roles.
typestring
roleName
deprecatedTrue
descriptionSystem role name for user. Deprecated: use attribute.roles.
typestring
terminationDate
descriptionUser job employment termination date.
formatgoogle-datetime
typestring
timeOff
descriptionUser time off leaves from active work.
items
$refTimeOff
typearray
title
descriptionUser job title.
typestring
userAuthenticationStatus
descriptionSystem authentication status for user.
enum
  • UNKNOWN_AUTHENTICATION_STATUS
  • ACTIVE
  • SUSPENDED
  • NO_ACTIVE_CREDENTIALS
  • DELETED
enumDescriptions
  • The default authentication status.
  • The authentication method is in active state.
  • The authentication method is in suspended/disabled state.
  • The authentication method has no active credentials.
  • The authentication method has been deleted.
typestring
userDisplayName
descriptionThe display name of the user (e.g. "John Locke").
typestring
userRole
deprecatedTrue
descriptionSystem role for user. Deprecated: use attribute.roles.
enum
  • UNKNOWN_ROLE
  • ADMINISTRATOR
  • SERVICE_ACCOUNT
enumDeprecated
  • False
  • False
  • True
enumDescriptions
  • Default user role.
  • Product administrator with elevated privileges.
  • System service account for automated privilege access. Deprecated: not a role, instead set User.account_type.
typestring
userid
descriptionThe ID of the user. This field can be used as an entity indicator for user entities.
typestring
windowsSid
descriptionThe Microsoft Windows SID of the user. This field can be used as an entity indicator for user entities.
typestring
typeobject
UserAgentProto
idUserAgentProto
properties
annotation
items
$refAnnotation
typearray
browser
descriptionProduct brand within the family: Firefox, Netscape, Camino etc.. Or Earth, Windows-Media-Player etc.. for non-browser user agents.
typestring
browserEngineVersion
descriptionVersion of the rendering engine e.g. "8.01" for "Opera/8.01"
typestring
browserVersion
descriptionMinor and lower versions unavailable with reduced User-Agent and no client hints (go/ua-reduction-ua-string-reference).
typestring
carrier
descriptionMobile specific: name of mobile carrier
typestring
device
description(Usually) Mobile specific: name of hardware device, may or may not contain the full model name. e.g. iPhone, Palm750, SPH-M800. Reduced to "K" for Android devices with reduced User-Agent and no client hints (go/ua-reduction-ua-string-reference).
typestring
deviceVersion
description(Usually) Mobile specific: version of hardware device Unavailable with reduced User-Agent and no client hints (go/ua-reduction-ua-string-reference).
typestring
family
descriptionUser agent family captures the type of browser/app at a high-level e.g. MSIE, Gecko, Safari etc..
enum
  • USER_DEFINED
  • MSIE
  • GECKO
  • APPLEWEBKIT
  • OPERA
  • KHTML
  • OTHER
  • APPLE
  • BLACKBERRY
  • DOCOMO
  • GOOGLE
  • OPENWAVE
  • POLARIS
  • OBIGO
  • TELECA
  • MICROSOFT
  • NOKIA
  • NETFRONT
  • SEMC
  • SMIT
  • KOREAN
  • CLIENT_HINTS
enumDescriptions
  • Used to represent new families supported by user-defined parsers
  • Desktop user agent families
  • WebKit based browsers e.g. Safari
  • e.g. Konqueror
  • Mobile and non-browser user agent families UA's w/o enough data to fit into a family
  • Apple apps e.g. YouTube on iPhone
  • Google Earth, Sketchup, UpdateChecker etc...
  • UP.Browser
  • Windows Media Player, RSS platform etc...
  • Sony Ericsson Mobile Communications
  • SKT, LGT
  • Constructed from UA-CH instead of UserAgent string.
typestring
googleToolbarVersion
descriptionVersion number of GoogleToolbar, if installed. Applies only to MSIE and Firefox at this time.
typestring
javaConfiguration
descriptionMobile specific: e.g. Configuration/CLDC-1.1
typestring
javaConfigurationVersion
typestring
javaProfile
descriptionMobile specific: e.g. Profile/MIDP-2.0
typestring
javaProfileVersion
typestring
locale
descriptionLocale in which the browser is running as country code and optionally language pair. Unavailable with reduced User-Agent and no client hints (go/ua-reduction-ua-string-reference).
typestring
messaging
descriptionMobile specific: e.g. MMP/2.0
typestring
messagingVersion
typestring
os
descriptionFull name of the operating system e.g. "Darwin/9.7.0", "Android 1.5", "Windows 98" Version is reduced, and other data might also be missing, for reduced User-Agent and no client hints (go/ua-reduction-ua-string-reference).
typestring
osVariant
descriptionExtra qualifier for the OS e.g. "(i386)", "Build/CUPCAKE", "PalmSource/Palm-D061" Unavailable with reduced User-Agent and no client hints (go/ua-reduction-ua-string-reference).
typestring
platform
descriptionThe platform describes the environment in which the browser or app runs. For desktop user agents, Platform is a string describing the OS family e.g. Windows, Macintosh, Linux. For mobile user agents, Platform either describes the OS family (if available) or the hardware maker. e.g. Linux, or HTC, LG, Palm.
typestring
security
descriptionSecurity level reported by user agent, either U, I or N. Unavailable with reduced User-Agent and no client hints (go/ua-reduction-ua-string-reference).
typestring
subFamily
descriptionSub-family identifies individual regexps when a family has more than 1. This is used to generate the right UA string from a protobuf. Examples in the AppleWebKit family: Chrome and Safari. Can also be an arbitrary identifier.
typestring
typeobject
UserError
descriptionThis message exists solely to get the `UserErrorReason` enum to appear in the service discovery document.
idUserError
properties
reason
descriptionThe reason for a specific error that should be shown to the app user.
enum
  • USER_ERROR_REASON_UNSPECIFIED
  • RULE_REFERENCES_OUT_OF_SCOPE
  • RULE_ARCHIVED
  • RULE_STALE_VERSION
  • RULE_ACTIVE
  • RULE_RETROHUNT_RUNNING
  • RULE_LIVE
  • RULE_ALREADY_DISABLED
  • EXPENSIVE_RULE_LARGE_WINDOW
  • RULE_LIMITED_PAUSED
  • REFERENCE_LIST_NOT_FOUND
  • UEBA_RULES_NO_SCOPE
  • RULE_TESTING_INTERVAL_TOO_SHORT
  • SEARCH_CSV_FIELDS_NOT_SUPPORTED
  • INVALID_ARGUMENT_FOR_DASHBOARD_FILTER
  • INVALID_CONFIG_FOR_DASHBOARD_IMPORT
  • RETROHUNT_LIMIT_REACHED
enumDescriptions
  • Do not use this default value.
  • The rule text references resources, such as reference lists, that are out of scope for the rule. Example of an ErrorInfo for this reason: { "reason": "RULE_REFERENCES_OUT_OF_SCOPE", "domain": "chronicle.googleapis.com", "metadata": { "reference_lists": "list_name1,list_name2,list_name3,", } }
  • The rule being operated on (saving or setting run frequency) is archived, and so the operation can't be done.
  • The rule version being operated on is not the latest, and so the operation can't be done.
  • The rule can't be archived because it is live (detecting) and a retrohunt is running.
  • The rule can't be archived because a retrohunt is running against it.
  • The rule can't be archived because it is live (detecting).
  • The rule can't be disabled because is is already disabled.
  • The rule's match time window is too large for its current run frequency.
  • The rule can't be enabled because it has been limited or paused because of high resource use.
  • The list being referred to doesn't exist.
  • UEBA rules may not be assigned a data access scope.
  • The rule's match window is longer than the time range it's being tested over. Returns the match window duration and testing interval duration as metadata labeled `match_window_duration` and `testing_interval_duration`, formatted as Go durations. Example ErrorInfo: { "reason": "RULE_TESTING_INTERVAL_TOO_SHORT", "domain": "chronicle.googleapis.com", "metadata": { "match_window_duration": "24h", "testing_interval_duration": "12h", } }
  • The CSV fields are not supported for download. Returns the unsupported fields as metadata labeled `unsupported_fields`. Example ErrorInfo: { "reason": "SEARCH_CSV_FIELDS_NOT_SUPPORTED", "domain": "chronicle.googleapis.com", "metadata": { "unsupported_fields": "udm.about.security_result.variables,udm.network.http.parsed_user_agent.family", } }
  • Invalid argument for dashboard chart filters. Returns the filter name, filter value, operator, and expected type as metadata labeled `filter_name`, `filter_value`, `operator`, and `expected_type`, respectively. Example ErrorInfo: { "reason": "INVALID_ARGUMENT_FOR_DASHBOARD_FILTER", "domain": "chronicle.googleapis.com", "metadata": { "filter_name": "filter_name", "filter_value": "filter_value", "operater": "operator", "expected_type": "expected_type", } }
  • Invalid config for dashboard import. Example ErrorInfo: { "reason": "INVALID_CONFIG_FOR_DASHBOARD_IMPORT", "domain": "chronicle.googleapis.com", }
  • The user has reached the limit of retrohunts that can be run. Returns the retrohunt limit as metadata labeled `retrohunt_limit`. Example ErrorInfo: { "reason": "RETROHUNT_LIMIT_REACHED", "domain": "chronicle.googleapis.com", "metadata": { "retrohunt_limit": "10", } }
typestring
typeobject
Validity
descriptionDefines certificate's validity period.
idValidity
properties
expiryTime
descriptionExpiry date.
formatgoogle-datetime
typestring
issueTime
descriptionIssue date.
formatgoogle-datetime
typestring
typeobject
Verdict
descriptionDeprecated. Encapsulates the threat verdict provided by human analysts and ML models. These fields are used to model Mandiant sources.
idVerdict
properties
analystVerdict
$refAnalystVerdict
descriptionHuman analyst verdict provided by sources like Mandiant.
neighbourInfluence
descriptionDescribes the neighbour influence of the verdict.
typestring
responseCount
descriptionTotal response count across all sources.
formatint32
typeinteger
sourceCount
descriptionNumber of sources from which intelligence was extracted.
formatint32
typeinteger
verdict
$refProviderMLVerdict
descriptionML Verdict provided by sources like Mandiant.
typeobject
VerdictInfo
descriptionDescribes the threat verdict provided by human analysts and machine learning models. These fields are used to model Mandiant sources.
idVerdictInfo
properties
benignCount
descriptionCount of responses where this IoC was marked as benign.
formatint32
typeinteger
categoryDetails
descriptionTags related to the verdict.
typestring
confidenceScore
descriptionConfidence score of the verdict.
formatint32
typeinteger
globalCustomerCount
descriptionGlobal customer count over the last 30 days
formatint32
typeinteger
globalHitsCount
descriptionGlobal hit count over the last 30 days.
formatint32
typeinteger
iocStats
descriptionList of IoCStats from which the verdict was generated.
items
$refIoCStats
typearray
maliciousCount
descriptionCount of responses where this IoC was marked as malicious.
formatint32
typeinteger
neighbourInfluence
descriptionDescribes the near neighbor influence of the verdict.
typestring
pwn
descriptionWhether one or more Mandiant incident response customers had this indicator in their environment.
typeboolean
pwnFirstTaggedTime
descriptionThe timestamp of the first time a pwn was associated to this entity.
formatgoogle-datetime
typestring
responseCount
descriptionTotal response count across all sources.
formatint32
typeinteger
sourceCount
descriptionNumber of sources from which intelligence was extracted.
formatint32
typeinteger
sourceProvider
descriptionSource provider giving the machine learning verdict.
typestring
verdictResponse
descriptionDetails about the verdict.
enum
  • VERDICT_RESPONSE_UNSPECIFIED
  • MALICIOUS
  • BENIGN
enumDescriptions
  • The default verdict response type.
  • VerdictResponse resulted a threat as malicious.
  • VerdictResponse resulted a threat as benign.
typestring
verdictTime
descriptionTimestamp when the verdict was generated.
formatgoogle-datetime
typestring
verdictType
descriptionType of verdict.
enum
  • VERDICT_TYPE_UNSPECIFIED
  • PROVIDER_ML_VERDICT
  • ANALYST_VERDICT
enumDescriptions
  • Verdict category not specified.
  • MLVerdict result provided from threat providers, like Mandiant. These fields are used to model Mandiant sources.
  • Verdict provided by the human analyst. These fields are used to model Mandiant sources.
typestring
typeobject
Vulnerabilities
descriptionThe Vulnerabilities extension captures details on observed/detected vulnerabilities.
idVulnerabilities
properties
vulnerabilities
descriptionA list of vulnerabilities.
items
$refVulnerability
typearray
typeobject
Vulnerability
descriptionA vulnerability.
idVulnerability
properties
about
$refNoun
descriptionIf the vulnerability is about a specific noun (e.g. executable), then add it here.
cveDescription
descriptionCommon Vulnerabilities and Exposures Description. https://cve.mitre.org/about/faqs.html#what_is_cve_record
typestring
cveId
descriptionCommon Vulnerabilities and Exposures Id. https://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures https://cve.mitre.org/about/faqs.html#what_is_cve_id
typestring
cvssBaseScore
descriptionCVSS Base Score in the range of 0.0 to 10.0. Useful for sorting.
formatfloat
typenumber
cvssVector
descriptionVector of CVSS properties (e.g. "AV:L/AC:H/Au:N/C:N/I:P/A:C") Can be linked to via: https://nvd.nist.gov/vuln-metrics/cvss/v2-calculator
typestring
cvssVersion
descriptionVersion of CVSS Vector/Score.
typestring
description
descriptionDescription of the vulnerability.
typestring
firstFound
descriptionProducts that maintain a history of vuln scans should populate first_found with the time that a scan first detected the vulnerability on this asset.
formatgoogle-datetime
typestring
lastFound
descriptionProducts that maintain a history of vuln scans should populate last_found with the time that a scan last detected the vulnerability on this asset.
formatgoogle-datetime
typestring
name
descriptionName of the vulnerability (e.g. "Unsupported OS Version detected").
typestring
scanEndTime
descriptionIf the vulnerability was discovered during an asset scan, then this field should be populated with the time the scan ended. This field can be left unset if the end time is not available or not applicable.
formatgoogle-datetime
typestring
scanStartTime
descriptionIf the vulnerability was discovered during an asset scan, then this field should be populated with the time the scan started. This field can be left unset if the start time is not available or not applicable.
formatgoogle-datetime
typestring
severity
descriptionThe severity of the vulnerability.
enum
  • UNKNOWN_SEVERITY
  • LOW
  • MEDIUM
  • HIGH
  • CRITICAL
enumDescriptions
  • The default severity level.
  • Low severity.
  • Medium severity.
  • High severity.
  • Critical severity.
typestring
severityDetails
descriptionVendor-specific severity
typestring
vendor
descriptionVendor of scan that discovered vulnerability.
typestring
vendorKnowledgeBaseArticleId
descriptionVendor specific knowledge base article (e.g. "KBXXXXXX" from Microsoft). https://en.wikipedia.org/wiki/Microsoft_Knowledge_Base https://access.redhat.com/knowledgebase
typestring
vendorVulnerabilityId
descriptionVendor specific vulnerability id (e.g. Microsoft security bulletin id).
typestring
typeobject
Watchlist
descriptionA watchlist is a list of entities that allows for bulk operations over the included entities.
idWatchlist
properties
createTime
descriptionOutput only. Time the watchlist was created.
formatgoogle-datetime
readOnlyTrue
typestring
description
descriptionOptional. Description of the watchlist.
typestring
displayName
descriptionRequired. Display name of the watchlist. Note that it must be at least one character and less than 63 characters (https://google.aip.dev/148).
typestring
entityCount
$refEntityCount
descriptionOutput only. Entity count in the watchlist.
readOnlyTrue
entityPopulationMechanism
$refEntityPopulationMechanism
descriptionRequired. Mechanism to populate entities in the watchlist.
multiplyingFactor
descriptionOptional. Weight applied to the risk score for entities in this watchlist. The default is 1.0 if it is not specified.
formatfloat
typenumber
name
descriptionIdentifier. Resource name of the watchlist. Format: projects/{project}/locations/{location}/instances/{instance}/watchlists/{watchlist}
typestring
updateTime
descriptionOutput only. Time the watchlist was last updated.
formatgoogle-datetime
readOnlyTrue
typestring
watchlistUserPreferences
$refWatchlistUserPreferences
descriptionOptional. User preferences for watchlist configuration.
typeobject
WatchlistUserPreferences
descriptionA collection of user preferences for watchlist UI configuration.
idWatchlistUserPreferences
properties
pinned
descriptionOptional. Whether the watchlist is pinned on the dashboard.
typeboolean
typeobject
X509
descriptionFile certificate.
idX509
properties
algorithm
descriptionCertificate algorithm.
typestring
certIssuer
descriptionIssuer of the certificate.
typestring
name
descriptionCertificate name.
typestring
serialNumber
descriptionCertificate serial number.
typestring
thumbprint
descriptionCertificate thumbprint.
typestring
typeobject
old_value
CancelOperationRequest
descriptionThe request message for Operations.CancelOperation.
idCancelOperationRequest
properties
typeobject
CompilationDiagnostic
descriptionCompilationDiagnostic represents a compilation diagnostic generated during a rule's compilation, such as a compilation error or a compilation warning.
idCompilationDiagnostic
properties
message
descriptionOutput only. The diagnostic message.
readOnlyTrue
typestring
position
$refCompilationPosition
descriptionOutput only. The approximate position in the rule text associated with the compilation diagnostic. Compilation Position may be empty.
readOnlyTrue
severity
descriptionOutput only. The severity of a rule's compilation diagnostic.
enum
  • SEVERITY_UNSPECIFIED
  • WARNING
  • ERROR
enumDescriptions
  • An unspecified severity level.
  • A compilation warning.
  • A compilation error.
readOnlyTrue
typestring
uri
descriptionOutput only. Link to documentation that describes a diagnostic in more detail.
readOnlyTrue
typestring
typeobject
CompilationPosition
descriptionCompilationPosition represents the location of a compilation diagnostic in rule text.
idCompilationPosition
properties
endColumn
descriptionOutput only. End column number, beginning at 1.
formatint32
readOnlyTrue
typeinteger
endLine
descriptionOutput only. End line number, beginning at 1.
formatint32
readOnlyTrue
typeinteger
startColumn
descriptionOutput only. Start column number, beginning at 1.
formatint32
readOnlyTrue
typeinteger
startLine
descriptionOutput only. Start line number, beginning at 1.
formatint32
readOnlyTrue
typeinteger
typeobject
CreateParserExtensionMetadata
descriptionOperation metadata for creating a parser extension.
idCreateParserExtensionMetadata
properties
state
descriptionThe state of the parser extension creation process.
enum
  • STATE_UNSPECIFIED
  • NEW
  • VALIDATING
  • LIVE
  • REJECTED
  • INTERNAL_ERROR
  • VALIDATED
  • ARCHIVED
enumDescriptions
  • The state for this parser extension was not specified.
  • The parser extension has been newly submitted and is waiting to be validated.
  • The parser extension is currently going through the validation pipeline.
  • The parser extension is live in production. Only configs that have successfully passed the validation stage will be set to LIVE.
  • Validation completed, but the parser extension was rejected with errors.
  • An error occurred when processing this parser extension.
  • Extension is validated.
  • Extension is archived and is no more being used.
typestring
stateLastChangedTime
descriptionThe time the config state was last changed.
formatgoogle-datetime
typestring
validationErrors
descriptionAny validation error while validating the extension, this have cap of size 10
items
typestring
typearray
validationReport
descriptionThe validation report generated during validation of the parser extension.
typestring
typeobject
CreateParserMetadata
descriptionOperation metadata for creating a parser.
idCreateParserMetadata
properties
stage
descriptionThe validation stage of the parser creation process.
enum
  • VALIDATION_STAGE_UNSPECIFIED
  • NEW
  • VALIDATING
  • PASSED
  • FAILED
  • DELETE_CANDIDATE
enumDescriptions
  • The validation stage is not specified.
  • The custom parser is submitted for validation.
  • The custom parser is currently going through the validation pipeline
  • The custom parser has successfully passed the validation.
  • The custom parser has failed validation.
  • The parser is no good, It is available for auto deletion.
typestring
validationReport
descriptionThe validation report generated during validation of the parser.
typestring
typeobject
DataAccessLabel
descriptionA DataAccessLabel is a label on events to define user access to data.
idDataAccessLabel
properties
author
descriptionOutput only. The user who created the data access label.
readOnlyTrue
typestring
createTime
descriptionOutput only. The time at which the data access label was created.
formatgoogle-datetime
readOnlyTrue
typestring
description
descriptionOptional. A description of the data access label for a human reader.
typestring
displayName
descriptionOutput only. The short name displayed for the label as it appears on event data.
readOnlyTrue
typestring
lastEditor
descriptionOutput only. The user who last updated the data access label.
readOnlyTrue
typestring
name
descriptionRequired. The unique resource name of the data access label.
typestring
udmQuery
descriptionA UDM query over event data.
typestring
updateTime
descriptionOutput only. The time at which the data access label was last updated.
formatgoogle-datetime
readOnlyTrue
typestring
typeobject
DataAccessLabelReference
descriptionReference object to a data access label.
idDataAccessLabelReference
properties
assetNamespace
descriptionThe asset namespace configured in the forwarder of the customer's events.
typestring
dataAccessLabel
descriptionThe name of the data access label.
typestring
displayName
descriptionOutput only. The display name of the label. Data access label and log types's name will match the display name of the resource. The asset namespace will match the namespace itself. The ingestion key value pair will match the key of the tuple.
readOnlyTrue
typestring
ingestionLabel
$refIngestionLabel
descriptionThe ingestion label configured in the forwarder of the customer's events.
logType
descriptionThe name of the log type.
typestring
typeobject
DataAccessScope
descriptionA DataAccessScope is a boolean expression of data access labels used to restrict access to data for users.
idDataAccessScope
properties
allowAll
descriptionOptional. Whether or not the scope allows all labels, allow_all and allowed_data_access_labels are mutually exclusive and one of them must be present. denied_data_access_labels can still be used along with allow_all. When combined with denied_data_access_labels, access will be granted to all data that doesn't have labels mentioned in denied_data_access_labels. E.g.: A customer with scope with denied labels A and B and allow_all will be able to see all data except data labeled with A and data labeled with B and data with labels A and B.
typeboolean
allowedDataAccessLabels
descriptionOptional. The allowed labels for the scope. Either allow_all or allowed_data_access_labels needs to be provided. When provided, there has to be at least one label allowed for the scope to be valid. The logical operator for evaluation of the allowed labels is OR. E.g.: A customer with scope with allowed labels A and B will be able to see data with labeled with A or B or (A and B).
items
$refDataAccessLabelReference
typearray
author
descriptionOutput only. The user who created the data access scope.
readOnlyTrue
typestring
createTime
descriptionOutput only. The time at which the data access scope was created.
formatgoogle-datetime
readOnlyTrue
typestring
deniedDataAccessLabels
descriptionOptional. The denied labels for the scope. The logical operator for evaluation of the denied labels is AND. E.g.: A customer with scope with denied labels A and B won't be able to see data labeled with A and data labeled with B and data with labels A and B.
items
$refDataAccessLabelReference
typearray
description
descriptionOptional. A description of the data access scope for a human reader.
typestring
displayName
descriptionOutput only. The name to be used for display to customers of the data access scope.
readOnlyTrue
typestring
lastEditor
descriptionOutput only. The user who last updated the data access scope.
readOnlyTrue
typestring
name
descriptionRequired. The unique full name of the data access scope. The name should comply with https://google.aip.dev/122 standards.
typestring
updateTime
descriptionOutput only. The time at which the data access scope was last updated.
formatgoogle-datetime
readOnlyTrue
typestring
typeobject
Empty
descriptionA generic empty message that you can re-use to avoid defining duplicated empty messages in your APIs. A typical example is to use it as the request or the response type of an API method. For instance: service Foo { rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty); }
idEmpty
properties
typeobject
EntityCount
descriptionCount of different types of entities in the watchlist.
idEntityCount
properties
asset
descriptionOutput only. Count of asset type entities in the watchlist.
formatint32
readOnlyTrue
typeinteger
user
descriptionOutput only. Count of user type entities in the watchlist.
formatint32
readOnlyTrue
typeinteger
typeobject
EntityPopulationMechanism
descriptionMechanism to populate entities in the watchlist.
idEntityPopulationMechanism
properties
manual
$refManual
descriptionOptional. Entities are added manually.
typeobject
IngestionLabel
descriptionRepresentation of an ingestion label type.
idIngestionLabel
properties
ingestionLabelKey
descriptionRequired. The key of the ingestion label. Always required.
typestring
ingestionLabelValue
descriptionOptional. The value of the ingestion label. Optional. An object with no provided value and some key provided would match against the given key and ANY value.
typestring
typeobject
InputsUsed
descriptionInputsUsed is a convenience field that tells us which sources of events (if any) were used in the rule. NEXT TAG: 4
idInputsUsed
properties
usesDetection
descriptionOptional. Whether the rule queries detections.
typeboolean
usesEntity
descriptionOptional. Whether the rule queries entity events.
typeboolean
usesUdm
descriptionOptional. Whether the rule queries UDM events.
typeboolean
typeobject
Instance
descriptionA Instance represents an instantiation of the Instance product.
idInstance
properties
name
descriptionOutput only. The resource name of this instance. Format: projects/{project}/locations/{region}/instances/{instance}
readOnlyTrue
typestring
typeobject
Interval
descriptionRepresents a time interval, encoded as a Timestamp start (inclusive) and a Timestamp end (exclusive). The start must be less than or equal to the end. When the start equals the end, the interval is empty (matches no time). When both start and end are unspecified, the interval matches any time.
idInterval
properties
endTime
descriptionOptional. Exclusive end of the interval. If specified, a Timestamp matching this interval will have to be before the end.
formatgoogle-datetime
typestring
startTime
descriptionOptional. Inclusive start of the interval. If specified, a Timestamp matching this interval will have to be the same or after the start.
formatgoogle-datetime
typestring
typeobject
ListDataAccessLabelsResponse
descriptionResponse message for ListDataAccessLabels.
idListDataAccessLabelsResponse
properties
dataAccessLabels
descriptionList of data access labels.
items
$refDataAccessLabel
typearray
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
typeobject
ListDataAccessScopesResponse
descriptionResponse message for ListDataAccessScopes.
idListDataAccessScopesResponse
properties
dataAccessScopes
descriptionList of data access scopes.
items
$refDataAccessScope
typearray
globalDataAccessScopeGranted
descriptionWhether or not global scope is granted to the user.
typeboolean
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
typeobject
ListOperationsResponse
descriptionThe response message for Operations.ListOperations.
idListOperationsResponse
properties
nextPageToken
descriptionThe standard List next-page token.
typestring
operations
descriptionA list of operations that matches the specified filter in the request.
items
$refOperation
typearray
typeobject
ListReferenceListsResponse
descriptionA response to a request for a list of reference lists.
idListReferenceListsResponse
properties
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
referenceLists
descriptionThe reference lists. Ordered in ascending alphabetical order by name.
items
$refReferenceList
typearray
typeobject
ListRetrohuntsResponse
descriptionResponse message for ListRetrohunts method.
idListRetrohuntsResponse
properties
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
retrohunts
descriptionThe retrohunts from the specified rule.
items
$refRetrohunt
typearray
typeobject
ListRuleDeploymentsResponse
descriptionResponse message for ListRuleDeployments.
idListRuleDeploymentsResponse
properties
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
ruleDeployments
descriptionThe rule deployments from all rules.
items
$refRuleDeployment
typearray
typeobject
ListRuleRevisionsResponse
descriptionResponse message for ListRuleRevisions method.
idListRuleRevisionsResponse
properties
nextPageToken
descriptionA token that can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
rules
descriptionThe revisions of the rule.
items
$refRule
typearray
typeobject
ListRulesResponse
descriptionResponse message for ListRules method.
idListRulesResponse
properties
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
rules
descriptionThe rules from the specified instance.
items
$refRule
typearray
typeobject
ListWatchlistsResponse
descriptionResponse message for listing watchlists.
idListWatchlistsResponse
properties
nextPageToken
descriptionOptional. A token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
watchlists
descriptionOptional. The watchlists from the specified instance.
items
$refWatchlist
typearray
typeobject
Manual
descriptionEntities are added manually.
idManual
properties
typeobject
Operation
descriptionThis resource represents a long-running operation that is the result of a network API call.
idOperation
properties
done
descriptionIf the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available.
typeboolean
error
$refStatus
descriptionThe error result of the operation in case of failure or cancellation.
metadata
additionalProperties
descriptionProperties of the object. Contains field @type with type URL.
typeany
descriptionService-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any.
typeobject
name
descriptionThe server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`.
typestring
response
additionalProperties
descriptionProperties of the object. Contains field @type with type URL.
typeany
descriptionThe normal, successful response of the operation. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`.
typeobject
typeobject
ReferenceList
descriptionA reference list. Reference lists are user-defined lists of values which users can use in multiple Rules.
idReferenceList
properties
description
descriptionRequired. A user-provided description of the reference list.
typestring
displayName
descriptionOutput only. The unique display name of the reference list.
readOnlyTrue
typestring
entries
descriptionRequired. The entries of the reference list. When listed, they are returned in the order that was specified at creation or update. The combined size of the values of the reference list may not exceed 6MB. This is returned only when the view is REFERENCE_LIST_VIEW_FULL.
items
$refReferenceListEntry
typearray
name
descriptionOutput only. The resource name of the reference list. Format: projects/{project}/locations/{location}/instances/{instance}/referenceLists/{reference_list}
readOnlyTrue
typestring
revisionCreateTime
descriptionOutput only. The timestamp when the reference list was last updated.
formatgoogle-datetime
readOnlyTrue
typestring
ruleAssociationsCount
descriptionOutput only. The count of self-authored rules using the reference list.
formatint32
readOnlyTrue
typeinteger
rules
descriptionOutput only. The resource names for the associated self-authored Rules that use this reference list. This is returned only when the view is REFERENCE_LIST_VIEW_FULL.
items
typestring
readOnlyTrue
typearray
scopeInfo
$refScopeInfo
descriptionOutput only. The scope info of the reference list. During reference list creation, if this field is not set, the reference list without scopes (an unscoped list) will be created for an unscoped user. For a scoped user, this field must be set. During reference list update, if scope_info is requested to be updated, this field must be set.
readOnlyTrue
syntaxType
descriptionRequired. The syntax type indicating how list entries should be validated.
enum
  • REFERENCE_LIST_SYNTAX_TYPE_UNSPECIFIED
  • REFERENCE_LIST_SYNTAX_TYPE_PLAIN_TEXT_STRING
  • REFERENCE_LIST_SYNTAX_TYPE_REGEX
  • REFERENCE_LIST_SYNTAX_TYPE_CIDR
enumDescriptions
  • Defaults to REFERENCE_LIST_SYNTAX_TYPE_PLAIN_TEXT_STRING.
  • List contains plain text patterns.
  • List contains only Regular Expression patterns.
  • List contains only CIDR patterns.
typestring
typeobject
ReferenceListEntry
descriptionAn entry in a reference list.
idReferenceListEntry
properties
value
descriptionRequired. The value of the entry. Maximum length is 512 characters.
typestring
typeobject
ReferenceListScope
descriptionReferenceListScope specifies the list of scope names of the reference list.
idReferenceListScope
properties
scopeNames
descriptionOptional. The list of scope names of the reference list. The scope names should be full resource names and should be of the format: "projects/{project}/locations/{location}/instances/{instance}/dataAccessScopes/{scope_name}".
items
typestring
typearray
typeobject
Retrohunt
descriptionRetrohunt is an execution of a Rule over a time range in the past.
idRetrohunt
properties
executionInterval
$refInterval
descriptionOutput only. The start and end time of the retrohunt execution. If the retrohunt is not yet finished, the end time of the interval will not be populated.
readOnlyTrue
name
descriptionThe resource name of the retrohunt. Retrohunt is the child of a rule revision. {rule} in the format below is structured as {rule_id@revision_id}. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}/retrohunts/{retrohunt}
typestring
processInterval
$refInterval
descriptionRequired. The start and end time of the event time range this retrohunt processes.
progressPercentage
descriptionOutput only. Percent progress of the retrohunt towards completion, from 0.00 to 100.00.
formatfloat
readOnlyTrue
typenumber
state
descriptionOutput only. The state of the retrohunt.
enum
  • STATE_UNSPECIFIED
  • RUNNING
  • DONE
  • CANCELLED
  • FAILED
enumDescriptions
  • Unspecified or unknown retrohunt state.
  • Running state.
  • Done state.
  • Cancelled state.
  • Failed state.
readOnlyTrue
typestring
typeobject
RetrohuntMetadata
descriptionOperation Metadata for Retrohunts.
idRetrohuntMetadata
properties
executionInterval
$refInterval
descriptionThe start and end time of the retrohunt execution. If the retrohunt is not yet finished, the end time of the interval will not be filled.
progressPercentage
descriptionPercent progress of the retrohunt towards completion, from 0.00 to 100.00.
formatfloat
typenumber
retrohunt
descriptionThe name of the retrohunt. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}/retrohunts/{retrohunt}
typestring
typeobject
Rule
descriptionThe Rule resource represents a user-created rule. NEXT TAG: 21
idRule
properties
allowedRunFrequencies
descriptionOutput only. The run frequencies that are allowed for the rule. Populated in BASIC view and FULL view.
items
enum
  • RUN_FREQUENCY_UNSPECIFIED
  • LIVE
  • HOURLY
  • DAILY
enumDescriptions
  • The run frequency is unspecified/unknown.
  • Executes in real time.
  • Executes once per hour.
  • Executes once per day.
typestring
readOnlyTrue
typearray
author
descriptionOutput only. The author of the rule. Extracted from the meta section of text. Populated in BASIC view and FULL view.
readOnlyTrue
typestring
compilationDiagnostics
descriptionOutput only. A list of a rule's corresponding compilation diagnostic messages such as compilation errors and compilation warnings. Populated in FULL view.
items
$refCompilationDiagnostic
readOnlyTrue
typearray
compilationState
descriptionOutput only. The current compilation state of the rule. Populated in FULL view.
enum
  • COMPILATION_STATE_UNSPECIFIED
  • SUCCEEDED
  • FAILED
enumDescriptions
  • The compilation state is unspecified/unknown.
  • The Rule can successfully compile.
  • The Rule cannot successfully compile. This is possible if a backwards-incompatible change was made to the compiler.
readOnlyTrue
typestring
createTime
descriptionOutput only. The timestamp of when the rule was created. Populated in FULL view.
formatgoogle-datetime
readOnlyTrue
typestring
dataTables
descriptionOutput only. Resource names of the data tables used in this rule.
items
typestring
readOnlyTrue
typearray
displayName
descriptionOutput only. Display name of the rule. Populated in BASIC view and FULL view.
readOnlyTrue
typestring
etag
descriptionThe etag for this rule. If this is provided on update, the request will succeed if and only if it matches the server-computed value, and will fail with an ABORTED error otherwise. Populated in BASIC view and FULL view.
typestring
inputsUsed
$refInputsUsed
descriptionOutput only. The set of inputs used in the rule. For example, if the rule uses $e.principal.hostname, then the uses_udm field will be true.
readOnlyTrue
metadata
additionalProperties
typestring
descriptionOutput only. Additional metadata specified in the meta section of text. Populated in FULL view.
readOnlyTrue
typeobject
name
descriptionFull resource name for the rule. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}
typestring
nearRealTimeLiveRuleEligible
descriptionOutput only. Indicate the rule can run in near real time live rule. If this is true, the rule uses the near real time live rule when the run frequency is set to LIVE.
readOnlyTrue
typeboolean
referenceLists
descriptionOutput only. Resource names of the reference lists used in this rule. Populated in FULL view.
items
typestring
readOnlyTrue
typearray
revisionCreateTime
descriptionOutput only. The timestamp of when the rule revision was created. Populated in FULL, REVISION_METADATA_ONLY views.
formatgoogle-datetime
readOnlyTrue
typestring
revisionId
descriptionOutput only. The revision ID of the rule. A new revision is created whenever the rule text is changed in any way. Format: v_{10 digits}_{9 digits} Populated in REVISION_METADATA_ONLY view and FULL view.
readOnlyTrue
typestring
scope
descriptionResource name of the DataAccessScope bound to this rule. Populated in BASIC view and FULL view. If reference lists are used in the rule, validations will be performed against this scope to ensure that the reference lists are compatible with both the user's and the rule's scopes. The scope should be in the format: "projects/{project}/locations/{location}/instances/{instance}/dataAccessScopes/{scope}".
typestring
severity
$refSeverity
descriptionOutput only. The severity of the rule as specified in the meta section of text. Populated in BASIC view and FULL view.
readOnlyTrue
text
descriptionThe YARA-L content of the rule. Populated in FULL view.
typestring
type
descriptionOutput only. User-facing type of the rule. Extracted from the events section of rule text. Populated in BASIC view and FULL view.
enum
  • RULE_TYPE_UNSPECIFIED
  • SINGLE_EVENT
  • MULTI_EVENT
enumDescriptions
  • The rule type is unspecified/unknown.
  • Rule checks for the existence of a single event.
  • Rule checks for correlation between multiple events
readOnlyTrue
typestring
typeobject
RuleDeployment
descriptionThe RuleDeployment resource represents the deployment state of a Rule.
idRuleDeployment
properties
alerting
descriptionWhether detections resulting from this deployment should be considered alerts.
typeboolean
archiveTime
descriptionOutput only. The timestamp when the rule deployment archive state was last set to true. If the rule deployment's current archive state is not set to true, the field will be empty.
formatgoogle-datetime
readOnlyTrue
typestring
archived
descriptionThe archive state of the rule deployment. Cannot be set to true unless enabled is set to false. If set to true, alerting will automatically be set to false. If currently set to true, enabled, alerting, and run_frequency cannot be updated.
typeboolean
consumerRules
descriptionOutput only. The names of the associated/chained consumer rules. Rules are considered consumers of this rule if their rule text explicitly filters on this rule's ruleid. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}
items
typestring
readOnlyTrue
typearray
enabled
descriptionWhether the rule is currently deployed continuously against incoming data.
typeboolean
executionState
descriptionOutput only. The execution state of the rule deployment.
enum
  • EXECUTION_STATE_UNSPECIFIED
  • DEFAULT
  • LIMITED
  • PAUSED
enumDescriptions
  • Unspecified or unknown execution state.
  • Default execution state.
  • Rules in limited state may not have their executions guaranteed.
  • Paused rules are not executed at all.
readOnlyTrue
typestring
lastAlertStatusChangeTime
descriptionOutput only. The timestamp when the rule deployment alert state was lastly changed. This is filled regardless of the current alert state. E.g. if the current alert status is false, this timestamp will be the timestamp when the alert status was changed to false.
formatgoogle-datetime
readOnlyTrue
typestring
name
descriptionRequired. The resource name of the rule deployment. Note that RuleDeployment is a child of the overall Rule, not any individual revision, so the resource ID segment for the Rule resource must not reference a specific revision. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}/deployment
typestring
producerRules
descriptionOutput only. The names of the associated/chained producer rules. Rules are considered producers for this rule if this rule explicitly filters on their ruleid. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}
items
typestring
readOnlyTrue
typearray
runFrequency
descriptionThe run frequency of the rule deployment.
enum
  • RUN_FREQUENCY_UNSPECIFIED
  • LIVE
  • HOURLY
  • DAILY
enumDescriptions
  • The run frequency is unspecified/unknown.
  • Executes in real time.
  • Executes once per hour.
  • Executes once per day.
typestring
typeobject
ScopeInfo
descriptionScopeInfo specifies the scope info of the reference list.
idScopeInfo
properties
referenceListScope
$refReferenceListScope
descriptionRequired. The list of scope names of the reference list, if the list is empty the reference list is treated as unscoped.
typeobject
Severity
descriptionSeverity represents the severity level of the rule.
idSeverity
properties
displayName
descriptionThe display name of the severity level. Extracted from the meta section of the rule text.
typestring
typeobject
Status
descriptionThe `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors).
idStatus
properties
code
descriptionThe status code, which should be an enum value of google.rpc.Code.
formatint32
typeinteger
details
descriptionA list of messages that carry the error details. There is a common set of message types for APIs to use.
items
additionalProperties
descriptionProperties of the object. Contains field @type with type URL.
typeany
typeobject
typearray
message
descriptionA developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
typestring
typeobject
UdmSearchOperationMetadata
descriptionInformation about a UDM Search operation. This message is used to populate the `metadata` field of `Operation` resources created by UDM Search.
idUdmSearchOperationMetadata
properties
baselineEventsCount
descriptionThe number of events matching the baseline query so far.
formatint32
typeinteger
baselineQuery
descriptionQuery used to search for events.
typestring
baselineTimeRange
$refInterval
descriptionThe time range used for the baseline query [inclusive start time, exclusive end time).
caseInsensitive
descriptionIf true, the search was performed in a case-insensitive manner.
typeboolean
endTime
descriptionThe end time of the operation, if done.
formatgoogle-datetime
typestring
expireTime
descriptionThe time when the operation results expire. This time may change while the operation is in progress. If unset, the results never expire.
formatgoogle-datetime
typestring
filteredEventsCount
descriptionThe number of events matching the snapshot query so far. This is <= `baseline_events_count`. If the snapshot query is empty, this will be equal to `baseline_events_count`.
formatint32
typeinteger
progress
descriptionA value from 0 to 1 representing the progress of the operation.
formatdouble
typenumber
snapshotQuery
descriptionQuery used to filter the baseline query's events.
typestring
snapshotTimeRange
$refInterval
descriptionTime range used to filter the baseline query's events [inclusive start time, exclusive end time). This time range is completely within `baseline_time_range`. If not set, it is assumed to match `baseline_time_range`.
startTime
descriptionThe start time of the operation.
formatgoogle-datetime
typestring
statsRowsCount
descriptionThe total number of rows returned for a stats query.
formatint32
typeinteger
typeobject
UserError
descriptionThis message exists solely to get the `UserErrorReason` enum to appear in the service discovery document.
idUserError
properties
reason
descriptionThe reason for a specific error that should be shown to the app user.
enum
  • USER_ERROR_REASON_UNSPECIFIED
  • RULE_REFERENCES_OUT_OF_SCOPE
  • RULE_ARCHIVED
  • RULE_STALE_VERSION
  • RULE_ACTIVE
  • RULE_RETROHUNT_RUNNING
  • RULE_LIVE
  • RULE_ALREADY_DISABLED
  • EXPENSIVE_RULE_LARGE_WINDOW
  • RULE_LIMITED_PAUSED
  • REFERENCE_LIST_NOT_FOUND
  • UEBA_RULES_NO_SCOPE
  • RULE_TESTING_INTERVAL_TOO_SHORT
  • SEARCH_CSV_FIELDS_NOT_SUPPORTED
  • INVALID_ARGUMENT_FOR_DASHBOARD_FILTER
  • INVALID_CONFIG_FOR_DASHBOARD_IMPORT
  • RETROHUNT_LIMIT_REACHED
enumDescriptions
  • Do not use this default value.
  • The rule text references resources, such as reference lists, that are out of scope for the rule. Example of an ErrorInfo for this reason: { "reason": "RULE_REFERENCES_OUT_OF_SCOPE", "domain": "chronicle.googleapis.com", "metadata": { "reference_lists": "list_name1,list_name2,list_name3,", } }
  • The rule being operated on (saving or setting run frequency) is archived, and so the operation can't be done.
  • The rule version being operated on is not the latest, and so the operation can't be done.
  • The rule can't be archived because it is live (detecting) and a retrohunt is running.
  • The rule can't be archived because a retrohunt is running against it.
  • The rule can't be archived because it is live (detecting).
  • The rule can't be disabled because is is already disabled.
  • The rule's match time window is too large for its current run frequency.
  • The rule can't be enabled because it has been limited or paused because of high resource use.
  • The list being referred to doesn't exist.
  • UEBA rules may not be assigned a data access scope.
  • The rule's match window is longer than the time range it's being tested over. Returns the match window duration and testing interval duration as metadata labeled `match_window_duration` and `testing_interval_duration`, formatted as Go durations. Example ErrorInfo: { "reason": "RULE_TESTING_INTERVAL_TOO_SHORT", "domain": "chronicle.googleapis.com", "metadata": { "match_window_duration": "24h", "testing_interval_duration": "12h", } }
  • The CSV fields are not supported for download. Returns the unsupported fields as metadata labeled `unsupported_fields`. Example ErrorInfo: { "reason": "SEARCH_CSV_FIELDS_NOT_SUPPORTED", "domain": "chronicle.googleapis.com", "metadata": { "unsupported_fields": "udm.about.security_result.variables,udm.network.http.parsed_user_agent.family", } }
  • Invalid argument for dashboard chart filters. Returns the filter name, filter value, operator, and expected type as metadata labeled `filter_name`, `filter_value`, `operator`, and `expected_type`, respectively. Example ErrorInfo: { "reason": "INVALID_ARGUMENT_FOR_DASHBOARD_FILTER", "domain": "chronicle.googleapis.com", "metadata": { "filter_name": "filter_name", "filter_value": "filter_value", "operater": "operator", "expected_type": "expected_type", } }
  • Invalid config for dashboard import. Example ErrorInfo: { "reason": "INVALID_CONFIG_FOR_DASHBOARD_IMPORT", "domain": "chronicle.googleapis.com", }
  • The user has reached the limit of retrohunts that can be run. Returns the retrohunt limit as metadata labeled `retrohunt_limit`. Example ErrorInfo: { "reason": "RETROHUNT_LIMIT_REACHED", "domain": "chronicle.googleapis.com", "metadata": { "retrohunt_limit": "10", } }
typestring
typeobject
Watchlist
descriptionA watchlist is a list of entities that allows for bulk operations over the included entities.
idWatchlist
properties
createTime
descriptionOutput only. Time the watchlist was created.
formatgoogle-datetime
readOnlyTrue
typestring
description
descriptionOptional. Description of the watchlist.
typestring
displayName
descriptionRequired. Display name of the watchlist. Note that it must be at least one character and less than 63 characters (https://google.aip.dev/148).
typestring
entityCount
$refEntityCount
descriptionOutput only. Entity count in the watchlist.
readOnlyTrue
entityPopulationMechanism
$refEntityPopulationMechanism
descriptionRequired. Mechanism to populate entities in the watchlist.
multiplyingFactor
descriptionOptional. Weight applied to the risk score for entities in this watchlist. The default is 1.0 if it is not specified.
formatfloat
typenumber
name
descriptionIdentifier. Resource name of the watchlist. Format: projects/{project}/locations/{location}/instances/{instance}/watchlists/{watchlist}
typestring
updateTime
descriptionOutput only. Time the watchlist was last updated.
formatgoogle-datetime
readOnlyTrue
typestring
watchlistUserPreferences
$refWatchlistUserPreferences
descriptionOptional. User preferences for watchlist configuration.
typeobject
WatchlistUserPreferences
descriptionA collection of user preferences for watchlist UI configuration.
idWatchlistUserPreferences
properties
pinned
descriptionOptional. Whether the watchlist is pinned on the dashboard.
typeboolean
typeobject
prod/asia-southeast1-connectgateway-
values_changed
root['revision']
new_value20250310
old_value20250303
prod/asia-southeast1-connectgateway-v1
values_changed
root['revision']
new_value20250310
old_value20250303
prod/asia-southeast1-connectgateway-v1beta1
values_changed
root['revision']
new_value20250310
old_value20250303
prod/asia-southeast1-containerfilesystem-
values_changed
root['revision']
new_value20250307
old_value20250221
prod/asia-southeast1-containerfilesystem-v1
values_changed
root['revision']
new_value20250307
old_value20250221
prod/auditrecording-pa-
values_changed
root['revision']
new_value20250309
old_value20250302
root['schemas']['GoogleInternalApiAuditrecordingV1NongoogleprodUiContext']['properties']['contextId']['enumDescriptions'][243]
new_valueUser disconnects medical records from a certain healthcare provider from syncing with Fitbit. (http://screen/8ePocZyJ9BgVSGC)
old_valueUser disconnects their medical record from Fitbit (http://screen/8ePocZyJ9BgVSGC)
iterable_item_added
root['schemas']['GoogleInternalApiAuditrecordingV1NongoogleprodEvent']['properties']['name']['enum'][172]FITBIT_CONSENT_PHR_DEMOGRAPHIC_CONFIRMATION
root['schemas']['GoogleInternalApiAuditrecordingV1NongoogleprodEvent']['properties']['name']['enum'][277]GOOGLE_HOME_LABS_CONSENT
root['schemas']['GoogleInternalApiAuditrecordingV1NongoogleprodEvent']['properties']['name']['enum'][524]TRAVEL_REENGAGEMENT_HOTEL_PROPERTY_TRACKING_CHANGED
root['schemas']['GoogleInternalApiAuditrecordingV1NongoogleprodEvent']['properties']['name']['enumDescriptions'][172]An event for the Fitbit+Gaia consent CONSENT_ID_PHR_DEMOGRAPHIC_CONFIRMATION reported via UCS/FCS.
root['schemas']['GoogleInternalApiAuditrecordingV1NongoogleprodEvent']['properties']['name']['enumDescriptions'][277]The user has agreed to Google Home Labs go/labs-tos-ari
root['schemas']['GoogleInternalApiAuditrecordingV1NongoogleprodEvent']['properties']['name']['enumDescriptions'][524]User has changed their hotel property tracking (enabled/disabled).
root['schemas']['GoogleInternalApiAuditrecordingV1NongoogleprodUiContext']['properties']['contextId']['enum'][242]FITBIT_ANDROID_PHR_DEMOGRAPHIC_CONFIRMATION
root['schemas']['GoogleInternalApiAuditrecordingV1NongoogleprodUiContext']['properties']['contextId']['enum'][243]FITBIT_ANDROID_PHR_DEMOGRAPHIC_CONFIRMATION_DISCONNECTING
root['schemas']['GoogleInternalApiAuditrecordingV1NongoogleprodUiContext']['properties']['contextId']['enum'][713]PAISA_MERCHANT_FLUTTER_BUSINESS_CLASSIFICATION_HOMEPAGE_BOTTOM_SHEET_SCREEN
root['schemas']['GoogleInternalApiAuditrecordingV1NongoogleprodUiContext']['properties']['contextId']['enum'][922]TRAVEL_REENGAGEMENT_WEB_MAYFLOWER_PROPERTY_TRACKING_TOGGLE
root['schemas']['GoogleInternalApiAuditrecordingV1NongoogleprodUiContext']['properties']['contextId']['enum'][1066]YOUTUBE_MUSIC_ANDROID_STATS_RENEWAL_PROMOTION
root['schemas']['GoogleInternalApiAuditrecordingV1NongoogleprodUiContext']['properties']['contextId']['enum'][1079]YOUTUBE_MUSIC_IOS_STATS_RENEWAL_PROMOTION
root['schemas']['GoogleInternalApiAuditrecordingV1NongoogleprodUiContext']['properties']['contextId']['enumDescriptions'][242]User confirms that their demographic information matches healthcare provider records for the incoming medical record being synced to Fitbit. (http://screen/QbJ6NAzAYCFxGWx)
root['schemas']['GoogleInternalApiAuditrecordingV1NongoogleprodUiContext']['properties']['contextId']['enumDescriptions'][245]User disconnects all their medical record from syncing with Fitbit (http://screen/8BNCYZP6LgYfeaH)
root['schemas']['GoogleInternalApiAuditrecordingV1NongoogleprodUiContext']['properties']['contextId']['enumDescriptions'][713]User going through the Paisa Merchant Business Classification Home Page bottom sheet screen in Flutter app.
root['schemas']['GoogleInternalApiAuditrecordingV1NongoogleprodUiContext']['properties']['contextId']['enumDescriptions'][921]Hotel market tracking toggle in Mayflower listview.
root['schemas']['GoogleInternalApiAuditrecordingV1NongoogleprodUiContext']['properties']['contextId']['enumDescriptions'][922]Hotel property tracking toggle in Mayflower placesheet.
root['schemas']['GoogleInternalApiAuditrecordingV1NongoogleprodUiContext']['properties']['contextId']['enumDescriptions'][1066]User is presented with consent text for renewing their public stats consent via Nitrate promotion on the Android YTM client.
root['schemas']['GoogleInternalApiAuditrecordingV1NongoogleprodUiContext']['properties']['contextId']['enumDescriptions'][1079]User is presented with consent text for renewing their public stats consent via Nitrate promotion on the iOS YTM client.
prod/auditrecording-pa-v1
values_changed
root['revision']
new_value20250309
old_value20250302
root['schemas']['GoogleInternalApiAuditrecordingV1NongoogleprodUiContext']['properties']['contextId']['enumDescriptions'][243]
new_valueUser disconnects medical records from a certain healthcare provider from syncing with Fitbit. (http://screen/8ePocZyJ9BgVSGC)
old_valueUser disconnects their medical record from Fitbit (http://screen/8ePocZyJ9BgVSGC)
iterable_item_added
root['schemas']['GoogleInternalApiAuditrecordingV1NongoogleprodEvent']['properties']['name']['enum'][172]FITBIT_CONSENT_PHR_DEMOGRAPHIC_CONFIRMATION
root['schemas']['GoogleInternalApiAuditrecordingV1NongoogleprodEvent']['properties']['name']['enum'][277]GOOGLE_HOME_LABS_CONSENT
root['schemas']['GoogleInternalApiAuditrecordingV1NongoogleprodEvent']['properties']['name']['enum'][524]TRAVEL_REENGAGEMENT_HOTEL_PROPERTY_TRACKING_CHANGED
root['schemas']['GoogleInternalApiAuditrecordingV1NongoogleprodEvent']['properties']['name']['enumDescriptions'][172]An event for the Fitbit+Gaia consent CONSENT_ID_PHR_DEMOGRAPHIC_CONFIRMATION reported via UCS/FCS.
root['schemas']['GoogleInternalApiAuditrecordingV1NongoogleprodEvent']['properties']['name']['enumDescriptions'][277]The user has agreed to Google Home Labs go/labs-tos-ari
root['schemas']['GoogleInternalApiAuditrecordingV1NongoogleprodEvent']['properties']['name']['enumDescriptions'][524]User has changed their hotel property tracking (enabled/disabled).
root['schemas']['GoogleInternalApiAuditrecordingV1NongoogleprodUiContext']['properties']['contextId']['enum'][242]FITBIT_ANDROID_PHR_DEMOGRAPHIC_CONFIRMATION
root['schemas']['GoogleInternalApiAuditrecordingV1NongoogleprodUiContext']['properties']['contextId']['enum'][243]FITBIT_ANDROID_PHR_DEMOGRAPHIC_CONFIRMATION_DISCONNECTING
root['schemas']['GoogleInternalApiAuditrecordingV1NongoogleprodUiContext']['properties']['contextId']['enum'][713]PAISA_MERCHANT_FLUTTER_BUSINESS_CLASSIFICATION_HOMEPAGE_BOTTOM_SHEET_SCREEN
root['schemas']['GoogleInternalApiAuditrecordingV1NongoogleprodUiContext']['properties']['contextId']['enum'][922]TRAVEL_REENGAGEMENT_WEB_MAYFLOWER_PROPERTY_TRACKING_TOGGLE
root['schemas']['GoogleInternalApiAuditrecordingV1NongoogleprodUiContext']['properties']['contextId']['enum'][1066]YOUTUBE_MUSIC_ANDROID_STATS_RENEWAL_PROMOTION
root['schemas']['GoogleInternalApiAuditrecordingV1NongoogleprodUiContext']['properties']['contextId']['enum'][1079]YOUTUBE_MUSIC_IOS_STATS_RENEWAL_PROMOTION
root['schemas']['GoogleInternalApiAuditrecordingV1NongoogleprodUiContext']['properties']['contextId']['enumDescriptions'][242]User confirms that their demographic information matches healthcare provider records for the incoming medical record being synced to Fitbit. (http://screen/QbJ6NAzAYCFxGWx)
root['schemas']['GoogleInternalApiAuditrecordingV1NongoogleprodUiContext']['properties']['contextId']['enumDescriptions'][245]User disconnects all their medical record from syncing with Fitbit (http://screen/8BNCYZP6LgYfeaH)
root['schemas']['GoogleInternalApiAuditrecordingV1NongoogleprodUiContext']['properties']['contextId']['enumDescriptions'][713]User going through the Paisa Merchant Business Classification Home Page bottom sheet screen in Flutter app.
root['schemas']['GoogleInternalApiAuditrecordingV1NongoogleprodUiContext']['properties']['contextId']['enumDescriptions'][921]Hotel market tracking toggle in Mayflower listview.
root['schemas']['GoogleInternalApiAuditrecordingV1NongoogleprodUiContext']['properties']['contextId']['enumDescriptions'][922]Hotel property tracking toggle in Mayflower placesheet.
root['schemas']['GoogleInternalApiAuditrecordingV1NongoogleprodUiContext']['properties']['contextId']['enumDescriptions'][1066]User is presented with consent text for renewing their public stats consent via Nitrate promotion on the Android YTM client.
root['schemas']['GoogleInternalApiAuditrecordingV1NongoogleprodUiContext']['properties']['contextId']['enumDescriptions'][1079]User is presented with consent text for renewing their public stats consent via Nitrate promotion on the iOS YTM client.
prod/autofill-
values_changed
root['revision']
new_value20250312
old_value20250310
prod/autofill-v1
values_changed
root['revision']
new_value20250312
old_value20250310
prod/automotivemaps-
dictionary_item_added
  • root['schemas']['GoogleMapsAutomotivemapsV1Wgs84Coordinate']['properties']['altitudeMeters']
  • root['schemas']['GoogleMapsAutomotivemapsV1Wgs84Coordinate']['properties']['ellipsoidAltitudeMeters']['deprecated']
values_changed
root['revision']
new_value20250310
old_value20250303
root['schemas']['GoogleMapsAutomotivemapsV1Wgs84Coordinate']['properties']['ellipsoidAltitudeMeters']['description']
new_valueOptional. Altitude in meters relative to the WGS84 ellipsoid. The ellipsoid is used instead of the geoid because there is only one WGS84 ellipsoid but several potential geoids to be used. The geoid is left to the partner. Note that this may mean that geoid heights could be measured in km in some places. (Mt. Everest is ~9km above sea level.) Positive numbers indicate higher altitude, negative numbers indicate lower altitude. Deprecated: Use altitude_meters instead.
old_valueOptional. Altitude in meters relative to the WGS84 ellipsoid. The ellipsoid is used instead of the geoid because there is only one WGS84 ellipsoid but several potential geoids to be used. The geoid is left to the partner. Note that this may mean that geoid heights could be measured in km in some places. (Mt. Everest is ~9km above sea level.) Positive numbers indicate higher altitude, negative numbers indicate lower altitude.
prod/automotivemaps-v1
dictionary_item_added
  • root['schemas']['GoogleMapsAutomotivemapsV1Wgs84Coordinate']['properties']['altitudeMeters']
  • root['schemas']['GoogleMapsAutomotivemapsV1Wgs84Coordinate']['properties']['ellipsoidAltitudeMeters']['deprecated']
values_changed
root['revision']
new_value20250310
old_value20250303
root['schemas']['GoogleMapsAutomotivemapsV1Wgs84Coordinate']['properties']['ellipsoidAltitudeMeters']['description']
new_valueOptional. Altitude in meters relative to the WGS84 ellipsoid. The ellipsoid is used instead of the geoid because there is only one WGS84 ellipsoid but several potential geoids to be used. The geoid is left to the partner. Note that this may mean that geoid heights could be measured in km in some places. (Mt. Everest is ~9km above sea level.) Positive numbers indicate higher altitude, negative numbers indicate lower altitude. Deprecated: Use altitude_meters instead.
old_valueOptional. Altitude in meters relative to the WGS84 ellipsoid. The ellipsoid is used instead of the geoid because there is only one WGS84 ellipsoid but several potential geoids to be used. The geoid is left to the partner. Note that this may mean that geoid heights could be measured in km in some places. (Mt. Everest is ~9km above sea level.) Positive numbers indicate higher altitude, negative numbers indicate lower altitude.
prod/autopush-keep-pa-
dictionary_item_added
  • root['schemas']['GetNoteInfoResponse']['properties']['type']['enumDeprecated']
  • root['schemas']['Note']['properties']['quillNote']['deprecated']
values_changed
root['revision']
new_value20250313
old_value20250216
root['schemas']['Note']['properties']['quillNote']['description']
new_valueA quillNote is a note with an empty message.
old_valueA quillNote is a note with an empty message.
prod/autopush-keep-pa-v1
dictionary_item_added
  • root['schemas']['GetNoteInfoResponse']['properties']['type']['enumDeprecated']
  • root['schemas']['Note']['properties']['quillNote']['deprecated']
values_changed
root['revision']
new_value20250313
old_value20250216
root['schemas']['Note']['properties']['quillNote']['description']
new_valueA quillNote is a note with an empty message.
old_valueA quillNote is a note with an empty message.
prod/autopush-notes-pa.sandbox-
dictionary_item_added
  • root['schemas']['DownSync']['properties']['derivedNoteAttributes']['deprecated']
  • root['schemas']['DownSync']['properties']['derivedNoteAttributes']['description']
  • root['schemas']['DownSyncWriteResult']['properties']['missingEmbeddedImages']['deprecated']
  • root['schemas']['DownSyncWriteResult']['properties']['status']['enumDeprecated']
  • root['schemas']['Node']['properties']['clientChanges']['properties']['commandMetadata']['properties']['imageIdMap']['deprecated']
  • root['schemas']['Node']['properties']['serverChanges']['properties']['images']['deprecated']
  • root['schemas']['UpSync']['properties']['requestHeader']['properties']['modelOptions']['properties']['note']['properties']['commandEncoding']['deprecated']
  • root['schemas']['UpSync']['properties']['requestHeader']['properties']['modelOptions']['properties']['quill']['deprecated']
  • root['schemas']['UpSync']['properties']['requestHeader']['properties']['modelOptions']['properties']['quill']['properties']['commandEncoding']['deprecated']
  • root['schemas']['UserInfo']['properties']['remindersMigrationData']['properties']['deletedRemindersOverLimitsCount']
  • root['schemas']['UserInfo']['properties']['remindersMigrationData']['properties']['deletedRemindersTasksDisabledCount']
  • root['schemas']['UserInfo']['properties']['remindersMigrationData']['properties']['locationRemindersOnEnteringPhase1Count']
  • root['schemas']['UserInfo']['properties']['remindersMigrationData']['properties']['migratedLocationRemindersCount']
  • root['schemas']['UserInfo']['properties']['remindersMigrationData']['properties']['deletedRemindersCount']['deprecated']
dictionary_item_removed
  • root['schemas']['Node']['properties']['sharerEmail']
values_changed
root['revision']
new_value20250313
old_value20250216
root['schemas']['DownSyncWriteResult']['properties']['missingEmbeddedImages']['description']
new_valueThe embedded images referenced by the uploaded commands for which the corresponding data was not found by the server. Clients are expected to re-upload these images before issuing a new sync request.
old_valueThe embedded images referenced by the uploaded commands for which the corresponding data was not found by the server. Clients are expected to re-upload these images before issuing a new sync request. This field is only populated when the status is set to MISSING_EMBEDDED_IMAGE.
root['schemas']['Node']['properties']['clientChanges']['properties']['commandMetadata']['properties']['imageIdMap']['description']
new_valueFor images referenced by the model, maps images' client IDs to server IDs.
old_valueFor images referenced by the model, maps images' client IDs to server IDs.
root['schemas']['Node']['properties']['serverChanges']['properties']['images']['description']
new_valueMetadata on images referenced by the model.
old_valueMetadata on images referenced by the model. This will include all images upon initial sync (no changes) and only images referenced by changes when changes exist.
root['schemas']['UserInfo']['properties']['remindersMigrationData']['properties']['deletedRemindersCount']['description']
new_valueDeprecated: The cumulative count of reminders deleted.
old_valueThe cumulative count of reminders deleted.
root['schemas']['DownSyncWriteResult']['properties']['status']['enumDescriptions'][2]
new_valueThe uploaded commands refer to embedded images that have not yet been uploaded. Clients are expected to recover from this error by re-uploading the image before issuing a new sync request.
old_valueThe uploaded commands refer to embedded images that have not yet been uploaded. Clients are expected to recover from this error by re-uploading the image before issuing a new sync request.
prod/autopush-notes-pa.sandbox-v1
dictionary_item_added
  • root['schemas']['DownSync']['properties']['derivedNoteAttributes']['deprecated']
  • root['schemas']['DownSync']['properties']['derivedNoteAttributes']['description']
  • root['schemas']['DownSyncWriteResult']['properties']['missingEmbeddedImages']['deprecated']
  • root['schemas']['DownSyncWriteResult']['properties']['status']['enumDeprecated']
  • root['schemas']['Node']['properties']['clientChanges']['properties']['commandMetadata']['properties']['imageIdMap']['deprecated']
  • root['schemas']['Node']['properties']['serverChanges']['properties']['images']['deprecated']
  • root['schemas']['UpSync']['properties']['requestHeader']['properties']['modelOptions']['properties']['note']['properties']['commandEncoding']['deprecated']
  • root['schemas']['UpSync']['properties']['requestHeader']['properties']['modelOptions']['properties']['quill']['deprecated']
  • root['schemas']['UpSync']['properties']['requestHeader']['properties']['modelOptions']['properties']['quill']['properties']['commandEncoding']['deprecated']
  • root['schemas']['UserInfo']['properties']['remindersMigrationData']['properties']['deletedRemindersOverLimitsCount']
  • root['schemas']['UserInfo']['properties']['remindersMigrationData']['properties']['deletedRemindersTasksDisabledCount']
  • root['schemas']['UserInfo']['properties']['remindersMigrationData']['properties']['locationRemindersOnEnteringPhase1Count']
  • root['schemas']['UserInfo']['properties']['remindersMigrationData']['properties']['migratedLocationRemindersCount']
  • root['schemas']['UserInfo']['properties']['remindersMigrationData']['properties']['deletedRemindersCount']['deprecated']
dictionary_item_removed
  • root['schemas']['Node']['properties']['sharerEmail']
values_changed
root['revision']
new_value20250313
old_value20250216
root['schemas']['DownSyncWriteResult']['properties']['missingEmbeddedImages']['description']
new_valueThe embedded images referenced by the uploaded commands for which the corresponding data was not found by the server. Clients are expected to re-upload these images before issuing a new sync request.
old_valueThe embedded images referenced by the uploaded commands for which the corresponding data was not found by the server. Clients are expected to re-upload these images before issuing a new sync request. This field is only populated when the status is set to MISSING_EMBEDDED_IMAGE.
root['schemas']['Node']['properties']['clientChanges']['properties']['commandMetadata']['properties']['imageIdMap']['description']
new_valueFor images referenced by the model, maps images' client IDs to server IDs.
old_valueFor images referenced by the model, maps images' client IDs to server IDs.
root['schemas']['Node']['properties']['serverChanges']['properties']['images']['description']
new_valueMetadata on images referenced by the model.
old_valueMetadata on images referenced by the model. This will include all images upon initial sync (no changes) and only images referenced by changes when changes exist.
root['schemas']['UserInfo']['properties']['remindersMigrationData']['properties']['deletedRemindersCount']['description']
new_valueDeprecated: The cumulative count of reminders deleted.
old_valueThe cumulative count of reminders deleted.
root['schemas']['DownSyncWriteResult']['properties']['status']['enumDescriptions'][2]
new_valueThe uploaded commands refer to embedded images that have not yet been uploaded. Clients are expected to recover from this error by re-uploading the image before issuing a new sync request.
old_valueThe uploaded commands refer to embedded images that have not yet been uploaded. Clients are expected to recover from this error by re-uploading the image before issuing a new sync request.
prod/autopush-notifications-pa.sandbox-
dictionary_item_added
  • root['schemas']['GmmNotifications__GmmClientGunsExtension']['properties']['inboxCapabilities']
  • root['schemas']['NotificationsBackendCommonMessage_AndroidMessageHint_NotificationBehavior']['properties']['silentOnReplacement']
  • root['schemas']['NotificationsBackendCommonMessage__IosMessageHint']['properties']['silentOnReplacement']
  • root['schemas']['NotificationsFrontendData_RenderContext_DeviceInfo']['properties']['iosSdkGeneration']
  • root['schemas']['PhotosEffects__HdrGainmapEffectParams']['properties']['gainMapEditStrategy']
  • root['schemas']['PhotosEffects__HdrGainmapEffectParams']['properties']['gainmapState']['description']
values_changed
root['revision']
new_value20250314
old_value20250311
root['schemas']['NotificationsBackendCommonMessage__IosMessageHint']['description']
new_valueIosMessageHint can be included with the GenericMessage proto to achieve customizations of the generic message specifically for iOS devices. Any fields in IosMessageHint that overlap with fields in GenericMessage will be resolved in favor of the IosMessageHint. Next ID: 36
old_valueIosMessageHint can be included with the GenericMessage proto to achieve customizations of the generic message specifically for iOS devices. Any fields in IosMessageHint that overlap with fields in GenericMessage will be resolved in favor of the IosMessageHint. Next ID: 35
root['schemas']['Proto2Bridge__MessageSet']['description']
new_valueLINT.ThenChange( //depot/google3/third_party/protobuf/github/src/google/protobuf/bridge/message_set.proto ) This is proto2's version of MessageSet.
old_valueThis is proto2's version of MessageSet.
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enumDescriptions'][274]
new_valuego/follow related Pickers. String-only pickers.
old_valuego/follow related Pickers.
iterable_item_added
root['schemas']['GaiaData__AccountNotificationEvent']['properties']['eventType']['enum'][304]OAUTH_TOKEN_EXPIRATION_NOTIFICATION_UNICORN_EMAIL
root['schemas']['GaiaData__AccountNotificationEvent']['properties']['eventType']['enumDescriptions'][304]Send email notifications to Unicorn users to notify them about their expiring app access.
root['schemas']['GoogleLogsTapandpayAndroid__DynamicAidRegistrationEvent']['properties']['registrationReason']['enum'][13]ACCOUNT_CHANGED
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enum'][277]UPSELL_CREATOR_PICKER
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enum'][609]WEBKICK_UGC_CONTENT
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enumDescriptions'][276]Creator Picker
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enumDescriptions'][278]Sports team picker
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enumDescriptions'][609]Need bundle type for UGC content in Discover. go/discover-ugc-content-retrieval
root['schemas']['Sidekick__SemanticProperties']['properties']['cardCategory']['enum'][903]CONTENT_EXPLORATION_WEB
root['schemas']['Sidekick__SemanticProperties']['properties']['cardCategory']['enum'][1071]HOME_STACK_UTILITY_FOLLOW_MANAGEMENT
root['schemas']['Sidekick__SemanticProperties']['properties']['cardCategory']['enum'][1072]COMMUNITY_DISCUSSIONS
root['schemas']['Sidekick__SemanticProperties']['properties']['cardCategory']['enum'][1474]WEBKICK_INTEREST_UGC
root['schemas']['Sidekick__SemanticProperties']['properties']['cardCategory']['enum'][1539]DEPRECATED_UCP_DELAYED_NOTES_CREATION_PROMPT_CARD
root['schemas']['Sidekick__SemanticProperties']['properties']['cardCategory']['enumDescriptions'][1474]Next available Cardmaker tag: 60078
iterable_item_removed
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enum'][543]UCP_DELAYED_NOTES_CREATION_PROMPT_CARD
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enumDescriptions'][543]Need bundle type for Modern Creators & Formats (go/mcf-pulse) delayed notes creation prompt card. go/link-notes-delayed-creation-in-discover-dd.
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enumDescriptions'][549]Need bundle type for upselling a query picker to users more likely to follow queries.
root['schemas']['Sidekick__SemanticProperties']['properties']['cardCategory']['enum'][1000]UCP_DELAYED_NOTES_CREATION_PROMPT_CARD
prod/autopush-notifications-pa.sandbox-v1
dictionary_item_added
  • root['schemas']['GmmNotifications__GmmClientGunsExtension']['properties']['inboxCapabilities']
  • root['schemas']['NotificationsBackendCommonMessage_AndroidMessageHint_NotificationBehavior']['properties']['silentOnReplacement']
  • root['schemas']['NotificationsBackendCommonMessage__IosMessageHint']['properties']['silentOnReplacement']
  • root['schemas']['NotificationsFrontendData_RenderContext_DeviceInfo']['properties']['iosSdkGeneration']
  • root['schemas']['PhotosEffects__HdrGainmapEffectParams']['properties']['gainMapEditStrategy']
  • root['schemas']['PhotosEffects__HdrGainmapEffectParams']['properties']['gainmapState']['description']
values_changed
root['revision']
new_value20250314
old_value20250311
root['schemas']['NotificationsBackendCommonMessage__IosMessageHint']['description']
new_valueIosMessageHint can be included with the GenericMessage proto to achieve customizations of the generic message specifically for iOS devices. Any fields in IosMessageHint that overlap with fields in GenericMessage will be resolved in favor of the IosMessageHint. Next ID: 36
old_valueIosMessageHint can be included with the GenericMessage proto to achieve customizations of the generic message specifically for iOS devices. Any fields in IosMessageHint that overlap with fields in GenericMessage will be resolved in favor of the IosMessageHint. Next ID: 35
root['schemas']['Proto2Bridge__MessageSet']['description']
new_valueLINT.ThenChange( //depot/google3/third_party/protobuf/github/src/google/protobuf/bridge/message_set.proto ) This is proto2's version of MessageSet.
old_valueThis is proto2's version of MessageSet.
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enumDescriptions'][274]
new_valuego/follow related Pickers. String-only pickers.
old_valuego/follow related Pickers.
iterable_item_added
root['schemas']['GaiaData__AccountNotificationEvent']['properties']['eventType']['enum'][304]OAUTH_TOKEN_EXPIRATION_NOTIFICATION_UNICORN_EMAIL
root['schemas']['GaiaData__AccountNotificationEvent']['properties']['eventType']['enumDescriptions'][304]Send email notifications to Unicorn users to notify them about their expiring app access.
root['schemas']['GoogleLogsTapandpayAndroid__DynamicAidRegistrationEvent']['properties']['registrationReason']['enum'][13]ACCOUNT_CHANGED
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enum'][277]UPSELL_CREATOR_PICKER
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enum'][609]WEBKICK_UGC_CONTENT
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enumDescriptions'][276]Creator Picker
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enumDescriptions'][278]Sports team picker
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enumDescriptions'][609]Need bundle type for UGC content in Discover. go/discover-ugc-content-retrieval
root['schemas']['Sidekick__SemanticProperties']['properties']['cardCategory']['enum'][903]CONTENT_EXPLORATION_WEB
root['schemas']['Sidekick__SemanticProperties']['properties']['cardCategory']['enum'][1071]HOME_STACK_UTILITY_FOLLOW_MANAGEMENT
root['schemas']['Sidekick__SemanticProperties']['properties']['cardCategory']['enum'][1072]COMMUNITY_DISCUSSIONS
root['schemas']['Sidekick__SemanticProperties']['properties']['cardCategory']['enum'][1474]WEBKICK_INTEREST_UGC
root['schemas']['Sidekick__SemanticProperties']['properties']['cardCategory']['enum'][1539]DEPRECATED_UCP_DELAYED_NOTES_CREATION_PROMPT_CARD
root['schemas']['Sidekick__SemanticProperties']['properties']['cardCategory']['enumDescriptions'][1474]Next available Cardmaker tag: 60078
iterable_item_removed
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enum'][543]UCP_DELAYED_NOTES_CREATION_PROMPT_CARD
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enumDescriptions'][543]Need bundle type for Modern Creators & Formats (go/mcf-pulse) delayed notes creation prompt card. go/link-notes-delayed-creation-in-discover-dd.
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enumDescriptions'][549]Need bundle type for upselling a query picker to users more likely to follow queries.
root['schemas']['Sidekick__SemanticProperties']['properties']['cardCategory']['enum'][1000]UCP_DELAYED_NOTES_CREATION_PROMPT_CARD
prod/autopush-proddata-notifications-pa.sandbox-
dictionary_item_added
  • root['schemas']['GmmNotifications__GmmClientGunsExtension']['properties']['inboxCapabilities']
  • root['schemas']['NotificationsBackendCommonMessage_AndroidMessageHint_NotificationBehavior']['properties']['silentOnReplacement']
  • root['schemas']['NotificationsBackendCommonMessage__IosMessageHint']['properties']['silentOnReplacement']
  • root['schemas']['NotificationsFrontendData_RenderContext_DeviceInfo']['properties']['iosSdkGeneration']
  • root['schemas']['PhotosEffects__HdrGainmapEffectParams']['properties']['gainMapEditStrategy']
  • root['schemas']['PhotosEffects__HdrGainmapEffectParams']['properties']['gainmapState']['description']
values_changed
root['revision']
new_value20250314
old_value20250311
root['schemas']['NotificationsBackendCommonMessage__IosMessageHint']['description']
new_valueIosMessageHint can be included with the GenericMessage proto to achieve customizations of the generic message specifically for iOS devices. Any fields in IosMessageHint that overlap with fields in GenericMessage will be resolved in favor of the IosMessageHint. Next ID: 36
old_valueIosMessageHint can be included with the GenericMessage proto to achieve customizations of the generic message specifically for iOS devices. Any fields in IosMessageHint that overlap with fields in GenericMessage will be resolved in favor of the IosMessageHint. Next ID: 35
root['schemas']['Proto2Bridge__MessageSet']['description']
new_valueLINT.ThenChange( //depot/google3/third_party/protobuf/github/src/google/protobuf/bridge/message_set.proto ) This is proto2's version of MessageSet.
old_valueThis is proto2's version of MessageSet.
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enumDescriptions'][274]
new_valuego/follow related Pickers. String-only pickers.
old_valuego/follow related Pickers.
iterable_item_added
root['schemas']['GaiaData__AccountNotificationEvent']['properties']['eventType']['enum'][304]OAUTH_TOKEN_EXPIRATION_NOTIFICATION_UNICORN_EMAIL
root['schemas']['GaiaData__AccountNotificationEvent']['properties']['eventType']['enumDescriptions'][304]Send email notifications to Unicorn users to notify them about their expiring app access.
root['schemas']['GoogleLogsTapandpayAndroid__DynamicAidRegistrationEvent']['properties']['registrationReason']['enum'][13]ACCOUNT_CHANGED
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enum'][277]UPSELL_CREATOR_PICKER
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enum'][609]WEBKICK_UGC_CONTENT
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enumDescriptions'][276]Creator Picker
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enumDescriptions'][278]Sports team picker
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enumDescriptions'][609]Need bundle type for UGC content in Discover. go/discover-ugc-content-retrieval
root['schemas']['Sidekick__SemanticProperties']['properties']['cardCategory']['enum'][903]CONTENT_EXPLORATION_WEB
root['schemas']['Sidekick__SemanticProperties']['properties']['cardCategory']['enum'][1071]HOME_STACK_UTILITY_FOLLOW_MANAGEMENT
root['schemas']['Sidekick__SemanticProperties']['properties']['cardCategory']['enum'][1072]COMMUNITY_DISCUSSIONS
root['schemas']['Sidekick__SemanticProperties']['properties']['cardCategory']['enum'][1474]WEBKICK_INTEREST_UGC
root['schemas']['Sidekick__SemanticProperties']['properties']['cardCategory']['enum'][1539]DEPRECATED_UCP_DELAYED_NOTES_CREATION_PROMPT_CARD
root['schemas']['Sidekick__SemanticProperties']['properties']['cardCategory']['enumDescriptions'][1474]Next available Cardmaker tag: 60078
iterable_item_removed
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enum'][543]UCP_DELAYED_NOTES_CREATION_PROMPT_CARD
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enumDescriptions'][543]Need bundle type for Modern Creators & Formats (go/mcf-pulse) delayed notes creation prompt card. go/link-notes-delayed-creation-in-discover-dd.
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enumDescriptions'][549]Need bundle type for upselling a query picker to users more likely to follow queries.
root['schemas']['Sidekick__SemanticProperties']['properties']['cardCategory']['enum'][1000]UCP_DELAYED_NOTES_CREATION_PROMPT_CARD
prod/autopush-proddata-notifications-pa.sandbox-v1
dictionary_item_added
  • root['schemas']['GmmNotifications__GmmClientGunsExtension']['properties']['inboxCapabilities']
  • root['schemas']['NotificationsBackendCommonMessage_AndroidMessageHint_NotificationBehavior']['properties']['silentOnReplacement']
  • root['schemas']['NotificationsBackendCommonMessage__IosMessageHint']['properties']['silentOnReplacement']
  • root['schemas']['NotificationsFrontendData_RenderContext_DeviceInfo']['properties']['iosSdkGeneration']
  • root['schemas']['PhotosEffects__HdrGainmapEffectParams']['properties']['gainMapEditStrategy']
  • root['schemas']['PhotosEffects__HdrGainmapEffectParams']['properties']['gainmapState']['description']
values_changed
root['revision']
new_value20250314
old_value20250311
root['schemas']['NotificationsBackendCommonMessage__IosMessageHint']['description']
new_valueIosMessageHint can be included with the GenericMessage proto to achieve customizations of the generic message specifically for iOS devices. Any fields in IosMessageHint that overlap with fields in GenericMessage will be resolved in favor of the IosMessageHint. Next ID: 36
old_valueIosMessageHint can be included with the GenericMessage proto to achieve customizations of the generic message specifically for iOS devices. Any fields in IosMessageHint that overlap with fields in GenericMessage will be resolved in favor of the IosMessageHint. Next ID: 35
root['schemas']['Proto2Bridge__MessageSet']['description']
new_valueLINT.ThenChange( //depot/google3/third_party/protobuf/github/src/google/protobuf/bridge/message_set.proto ) This is proto2's version of MessageSet.
old_valueThis is proto2's version of MessageSet.
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enumDescriptions'][274]
new_valuego/follow related Pickers. String-only pickers.
old_valuego/follow related Pickers.
iterable_item_added
root['schemas']['GaiaData__AccountNotificationEvent']['properties']['eventType']['enum'][304]OAUTH_TOKEN_EXPIRATION_NOTIFICATION_UNICORN_EMAIL
root['schemas']['GaiaData__AccountNotificationEvent']['properties']['eventType']['enumDescriptions'][304]Send email notifications to Unicorn users to notify them about their expiring app access.
root['schemas']['GoogleLogsTapandpayAndroid__DynamicAidRegistrationEvent']['properties']['registrationReason']['enum'][13]ACCOUNT_CHANGED
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enum'][277]UPSELL_CREATOR_PICKER
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enum'][609]WEBKICK_UGC_CONTENT
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enumDescriptions'][276]Creator Picker
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enumDescriptions'][278]Sports team picker
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enumDescriptions'][609]Need bundle type for UGC content in Discover. go/discover-ugc-content-retrieval
root['schemas']['Sidekick__SemanticProperties']['properties']['cardCategory']['enum'][903]CONTENT_EXPLORATION_WEB
root['schemas']['Sidekick__SemanticProperties']['properties']['cardCategory']['enum'][1071]HOME_STACK_UTILITY_FOLLOW_MANAGEMENT
root['schemas']['Sidekick__SemanticProperties']['properties']['cardCategory']['enum'][1072]COMMUNITY_DISCUSSIONS
root['schemas']['Sidekick__SemanticProperties']['properties']['cardCategory']['enum'][1474]WEBKICK_INTEREST_UGC
root['schemas']['Sidekick__SemanticProperties']['properties']['cardCategory']['enum'][1539]DEPRECATED_UCP_DELAYED_NOTES_CREATION_PROMPT_CARD
root['schemas']['Sidekick__SemanticProperties']['properties']['cardCategory']['enumDescriptions'][1474]Next available Cardmaker tag: 60078
iterable_item_removed
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enum'][543]UCP_DELAYED_NOTES_CREATION_PROMPT_CARD
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enumDescriptions'][543]Need bundle type for Modern Creators & Formats (go/mcf-pulse) delayed notes creation prompt card. go/link-notes-delayed-creation-in-discover-dd.
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enumDescriptions'][549]Need bundle type for upselling a query picker to users more likely to follow queries.
root['schemas']['Sidekick__SemanticProperties']['properties']['cardCategory']['enum'][1000]UCP_DELAYED_NOTES_CREATION_PROMPT_CARD
prod/autopush-qual-playground-notifications-pa.sandbox-
dictionary_item_added
  • root['schemas']['GmmNotifications__GmmClientGunsExtension']['properties']['inboxCapabilities']
  • root['schemas']['NotificationsBackendCommonMessage_AndroidMessageHint_NotificationBehavior']['properties']['silentOnReplacement']
  • root['schemas']['NotificationsBackendCommonMessage__IosMessageHint']['properties']['silentOnReplacement']
  • root['schemas']['NotificationsFrontendData_RenderContext_DeviceInfo']['properties']['iosSdkGeneration']
  • root['schemas']['PhotosEffects__HdrGainmapEffectParams']['properties']['gainMapEditStrategy']
  • root['schemas']['PhotosEffects__HdrGainmapEffectParams']['properties']['gainmapState']['description']
values_changed
root['revision']
new_value20250313
old_value20250311
root['schemas']['NotificationsBackendCommonMessage__IosMessageHint']['description']
new_valueIosMessageHint can be included with the GenericMessage proto to achieve customizations of the generic message specifically for iOS devices. Any fields in IosMessageHint that overlap with fields in GenericMessage will be resolved in favor of the IosMessageHint. Next ID: 36
old_valueIosMessageHint can be included with the GenericMessage proto to achieve customizations of the generic message specifically for iOS devices. Any fields in IosMessageHint that overlap with fields in GenericMessage will be resolved in favor of the IosMessageHint. Next ID: 35
root['schemas']['Proto2Bridge__MessageSet']['description']
new_valueLINT.ThenChange( //depot/google3/third_party/protobuf/github/src/google/protobuf/bridge/message_set.proto ) This is proto2's version of MessageSet.
old_valueThis is proto2's version of MessageSet.
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enumDescriptions'][274]
new_valuego/follow related Pickers. String-only pickers.
old_valuego/follow related Pickers.
iterable_item_added
root['schemas']['GaiaData__AccountNotificationEvent']['properties']['eventType']['enum'][304]OAUTH_TOKEN_EXPIRATION_NOTIFICATION_UNICORN_EMAIL
root['schemas']['GaiaData__AccountNotificationEvent']['properties']['eventType']['enumDescriptions'][304]Send email notifications to Unicorn users to notify them about their expiring app access.
root['schemas']['GoogleLogsTapandpayAndroid__DynamicAidRegistrationEvent']['properties']['registrationReason']['enum'][13]ACCOUNT_CHANGED
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enum'][277]UPSELL_CREATOR_PICKER
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enum'][609]WEBKICK_UGC_CONTENT
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enumDescriptions'][276]Creator Picker
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enumDescriptions'][278]Sports team picker
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enumDescriptions'][609]Need bundle type for UGC content in Discover. go/discover-ugc-content-retrieval
root['schemas']['Sidekick__SemanticProperties']['properties']['cardCategory']['enum'][903]CONTENT_EXPLORATION_WEB
root['schemas']['Sidekick__SemanticProperties']['properties']['cardCategory']['enum'][1071]HOME_STACK_UTILITY_FOLLOW_MANAGEMENT
root['schemas']['Sidekick__SemanticProperties']['properties']['cardCategory']['enum'][1072]COMMUNITY_DISCUSSIONS
root['schemas']['Sidekick__SemanticProperties']['properties']['cardCategory']['enum'][1474]WEBKICK_INTEREST_UGC
root['schemas']['Sidekick__SemanticProperties']['properties']['cardCategory']['enum'][1539]DEPRECATED_UCP_DELAYED_NOTES_CREATION_PROMPT_CARD
root['schemas']['Sidekick__SemanticProperties']['properties']['cardCategory']['enumDescriptions'][1474]Next available Cardmaker tag: 60078
iterable_item_removed
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enum'][543]UCP_DELAYED_NOTES_CREATION_PROMPT_CARD
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enumDescriptions'][543]Need bundle type for Modern Creators & Formats (go/mcf-pulse) delayed notes creation prompt card. go/link-notes-delayed-creation-in-discover-dd.
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enumDescriptions'][549]Need bundle type for upselling a query picker to users more likely to follow queries.
root['schemas']['Sidekick__SemanticProperties']['properties']['cardCategory']['enum'][1000]UCP_DELAYED_NOTES_CREATION_PROMPT_CARD
prod/autopush-qual-playground-notifications-pa.sandbox-v1
dictionary_item_added
  • root['schemas']['GmmNotifications__GmmClientGunsExtension']['properties']['inboxCapabilities']
  • root['schemas']['NotificationsBackendCommonMessage_AndroidMessageHint_NotificationBehavior']['properties']['silentOnReplacement']
  • root['schemas']['NotificationsBackendCommonMessage__IosMessageHint']['properties']['silentOnReplacement']
  • root['schemas']['NotificationsFrontendData_RenderContext_DeviceInfo']['properties']['iosSdkGeneration']
  • root['schemas']['PhotosEffects__HdrGainmapEffectParams']['properties']['gainMapEditStrategy']
  • root['schemas']['PhotosEffects__HdrGainmapEffectParams']['properties']['gainmapState']['description']
values_changed
root['revision']
new_value20250313
old_value20250311
root['schemas']['NotificationsBackendCommonMessage__IosMessageHint']['description']
new_valueIosMessageHint can be included with the GenericMessage proto to achieve customizations of the generic message specifically for iOS devices. Any fields in IosMessageHint that overlap with fields in GenericMessage will be resolved in favor of the IosMessageHint. Next ID: 36
old_valueIosMessageHint can be included with the GenericMessage proto to achieve customizations of the generic message specifically for iOS devices. Any fields in IosMessageHint that overlap with fields in GenericMessage will be resolved in favor of the IosMessageHint. Next ID: 35
root['schemas']['Proto2Bridge__MessageSet']['description']
new_valueLINT.ThenChange( //depot/google3/third_party/protobuf/github/src/google/protobuf/bridge/message_set.proto ) This is proto2's version of MessageSet.
old_valueThis is proto2's version of MessageSet.
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enumDescriptions'][274]
new_valuego/follow related Pickers. String-only pickers.
old_valuego/follow related Pickers.
iterable_item_added
root['schemas']['GaiaData__AccountNotificationEvent']['properties']['eventType']['enum'][304]OAUTH_TOKEN_EXPIRATION_NOTIFICATION_UNICORN_EMAIL
root['schemas']['GaiaData__AccountNotificationEvent']['properties']['eventType']['enumDescriptions'][304]Send email notifications to Unicorn users to notify them about their expiring app access.
root['schemas']['GoogleLogsTapandpayAndroid__DynamicAidRegistrationEvent']['properties']['registrationReason']['enum'][13]ACCOUNT_CHANGED
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enum'][277]UPSELL_CREATOR_PICKER
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enum'][609]WEBKICK_UGC_CONTENT
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enumDescriptions'][276]Creator Picker
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enumDescriptions'][278]Sports team picker
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enumDescriptions'][609]Need bundle type for UGC content in Discover. go/discover-ugc-content-retrieval
root['schemas']['Sidekick__SemanticProperties']['properties']['cardCategory']['enum'][903]CONTENT_EXPLORATION_WEB
root['schemas']['Sidekick__SemanticProperties']['properties']['cardCategory']['enum'][1071]HOME_STACK_UTILITY_FOLLOW_MANAGEMENT
root['schemas']['Sidekick__SemanticProperties']['properties']['cardCategory']['enum'][1072]COMMUNITY_DISCUSSIONS
root['schemas']['Sidekick__SemanticProperties']['properties']['cardCategory']['enum'][1474]WEBKICK_INTEREST_UGC
root['schemas']['Sidekick__SemanticProperties']['properties']['cardCategory']['enum'][1539]DEPRECATED_UCP_DELAYED_NOTES_CREATION_PROMPT_CARD
root['schemas']['Sidekick__SemanticProperties']['properties']['cardCategory']['enumDescriptions'][1474]Next available Cardmaker tag: 60078
iterable_item_removed
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enum'][543]UCP_DELAYED_NOTES_CREATION_PROMPT_CARD
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enumDescriptions'][543]Need bundle type for Modern Creators & Formats (go/mcf-pulse) delayed notes creation prompt card. go/link-notes-delayed-creation-in-discover-dd.
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enumDescriptions'][549]Need bundle type for upselling a query picker to users more likely to follow queries.
root['schemas']['Sidekick__SemanticProperties']['properties']['cardCategory']['enum'][1000]UCP_DELAYED_NOTES_CREATION_PROMPT_CARD
prod/blobcomments-pa-
values_changed
root['revision']
new_value20250310
old_value20250227
prod/blobcomments-pa-v1
values_changed
root['revision']
new_value20250310
old_value20250227
prod/buildeventservice-
values_changed
root['revision']
new_value20250311
old_value20250307
prod/buildeventservice-v1
values_changed
root['revision']
new_value20250311
old_value20250307
prod/carddav-
values_changed
root['revision']
new_value20250312
old_value20250309
prod/carddav-v1
values_changed
root['revision']
new_value20250312
old_value20250309
prod/chromedevicetoken-
values_changed
root['revision']
new_value20250312
old_value20250309
prod/chromedevicetoken-v1
values_changed
root['revision']
new_value20250312
old_value20250309
prod/clientauthconfig-
values_changed
root['revision']
new_value20250309
old_value20250302
iterable_item_added
root['schemas']['Client']['properties']['accountRestrictionService']['enum'][692]P11_VALLEY_APP
root['schemas']['Client']['properties']['accountRestrictionService']['enum'][1152]RETIRED_NOMNI_APP
root['schemas']['Client']['properties']['accountRestrictionService']['enum'][1602]OMNILAB_PARTNER_LAB_API
root['schemas']['Client']['properties']['accountRestrictionService']['enum'][1603]UX_ACCELERATION_API
root['schemas']['Client']['properties']['accountRestrictionService']['enumDescriptions'][1602]OmniLab Partner Lab Private API First Party Auth scope for google3/googledata/gaia/mint/apiscopes/omnilab/partner_lab.cfg Design: go/oem-pantheon-backend-impl Contact: omnilab-test-infra-team@google.com, omnilab-cx-team@google.com
root['schemas']['Client']['properties']['accountRestrictionService']['enumDescriptions'][1603]UX Acceleration API Backend for go/ux-acceleration First Party Auth scope for google3/googledata/gaia/mint/apiscopes/uxacceleration/uxacceleration.cfg Contact: gdt-uxa-team@google.com
iterable_item_removed
root['schemas']['Client']['properties']['accountRestrictionService']['enum'][1151]NOMNI_APP
prod/clientauthconfig-v1
values_changed
root['revision']
new_value20250309
old_value20250302
iterable_item_added
root['schemas']['Client']['properties']['accountRestrictionService']['enum'][692]P11_VALLEY_APP
root['schemas']['Client']['properties']['accountRestrictionService']['enum'][1152]RETIRED_NOMNI_APP
root['schemas']['Client']['properties']['accountRestrictionService']['enum'][1602]OMNILAB_PARTNER_LAB_API
root['schemas']['Client']['properties']['accountRestrictionService']['enum'][1603]UX_ACCELERATION_API
root['schemas']['Client']['properties']['accountRestrictionService']['enumDescriptions'][1602]OmniLab Partner Lab Private API First Party Auth scope for google3/googledata/gaia/mint/apiscopes/omnilab/partner_lab.cfg Design: go/oem-pantheon-backend-impl Contact: omnilab-test-infra-team@google.com, omnilab-cx-team@google.com
root['schemas']['Client']['properties']['accountRestrictionService']['enumDescriptions'][1603]UX Acceleration API Backend for go/ux-acceleration First Party Auth scope for google3/googledata/gaia/mint/apiscopes/uxacceleration/uxacceleration.cfg Contact: gdt-uxa-team@google.com
iterable_item_removed
root['schemas']['Client']['properties']['accountRestrictionService']['enum'][1151]NOMNI_APP
prod/cloudaicompanion-
values_changed
root['revision']
new_value20250309
old_value20250302
prod/cloudaicompanion-v1
dictionary_item_added
  • root['resources']['projects']['resources']['locations']['resources']['dataSharingWithGoogleSettings']['resources']['settingBindings']['methods']['patch']
values_changed
root['revision']
new_value20250309
old_value20250302
prod/cloudaicompanion-v1alpha
values_changed
root['revision']
new_value20250309
old_value20250302
prod/cloudaicompanion-v1beta
values_changed
root['revision']
new_value20250309
old_value20250302
prod/cloudchannel-pa-
values_changed
root['revision']
new_value20250311
old_value20250308
prod/cloudchannel-pa-v1
values_changed
root['revision']
new_value20250311
old_value20250308
prod/cloudchannel-pa-v1alpha1
values_changed
root['resources']['opportunities']['methods']['patch']['parameters']['name']['description']
new_valueIdentifier. Resource name of an Opportunity in the form: opportunities/{opportunity_id}. Available in Limited view.
old_valueIdentifier. Resource name of an Opportunity in the form: opportunities/{opportunity_id}.
root['revision']
new_value20250311
old_value20250308
root['schemas']['GoogleCloudChannelV1alpha1CustomerDetails']['properties']['domain']['description']
new_valueRequired. Customer's primary website domain. Available in Limited view.
old_valueRequired. Customer's primary website domain.
root['schemas']['GoogleCloudChannelV1alpha1CustomerDetails']['properties']['organizationName']['description']
new_valueRequired. Name of the Customer Organization. Available in Limited view.
old_valueRequired. Name of the Customer Organization.
root['schemas']['GoogleCloudChannelV1alpha1CustomerInfo']['properties']['customerDetails']['description']
new_valueRequired. Firm details needed for creating a new customer or for mapping to an existing customer. Available in Limited view.
old_valueRequired. Firm details needed for creating a new customer or for mapping to an existing customer.
root['schemas']['GoogleCloudChannelV1alpha1Opportunity']['properties']['customerDisplayName']['description']
new_valueOutput only. Customer display name that the Opportunity is associated with. This maps to the Vector Account name. Available in Limited view.
old_valueOutput only. Customer display name that the Opportunity is associated with. This maps to the Vector Account name.
root['schemas']['GoogleCloudChannelV1alpha1Opportunity']['properties']['customerInfo']['description']
new_valueRequired. Information of the end customer used for matching to an existing customer account or for creating a new one. Required for Creating an Opportunity. Can't be edited after the Opportunity is Accepted. Available in Limited view.
old_valueRequired. Information of the end customer used for matching to an existing customer account or for creating a new one. Required for Creating an Opportunity. Can't be edited after the Opportunity is Accepted.
root['schemas']['GoogleCloudChannelV1alpha1Opportunity']['properties']['name']['description']
new_valueIdentifier. Resource name of an Opportunity in the form: opportunities/{opportunity_id}. Available in Limited view.
old_valueIdentifier. Resource name of an Opportunity in the form: opportunities/{opportunity_id}.
root['schemas']['GoogleCloudChannelV1alpha1Opportunity']['properties']['opportunityInfo']['description']
new_valueRequired. Information about the Opportunity provided during deal submission. Required for Creating an Opportunity. Available in Limited view.
old_valueRequired. Information about the Opportunity provided during deal submission. Required for Creating an Opportunity.
root['schemas']['GoogleCloudChannelV1alpha1Opportunity']['properties']['opportunityTeamMembers']['description']
new_valueOutput only. Information on the Partner users with access to the Opportunity. Present only after the Opportunity is Accepted. Unset otherwise. Can't be edited. Available in Limited view. Only lists the Partner Development Manager (PDM) roles in Limited view.
old_valueOutput only. Information on the Partner users with access to the Opportunity. Present only after the Opportunity is Accepted. Unset otherwise. Can't be edited.
root['schemas']['GoogleCloudChannelV1alpha1Opportunity']['properties']['owner']['description']
new_valueOutput only. Name of the Google FSR who owns the Opportunity. Available in Limited view.
old_valueOutput only. Name of the Google FSR who owns the Opportunity.
root['schemas']['GoogleCloudChannelV1alpha1Opportunity']['properties']['ownerEmail']['description']
new_valueOutput only. Email of the Google FSR who owns the Opportunity. Available in Limited view.
old_valueOutput only. Email of the Google FSR who owns the Opportunity.
root['schemas']['GoogleCloudChannelV1alpha1Opportunity']['properties']['partnerInfo']['description']
new_valueOptional. Opportunity information related to the sourcing Partner. Present only after the Opportunity is Accepted. Unset otherwise. Can be edited. Available in Limited view.
old_valueOptional. Opportunity information related to the sourcing Partner. Present only after the Opportunity is Accepted. Unset otherwise. Can be edited.
root['schemas']['GoogleCloudChannelV1alpha1Opportunity']['properties']['referenceOpportunityId']['description']
new_valueOutput only. Opportunity ID in the Partner Advantage Portal. This ID is meant for mapping the Opportunities to the old system, and has a 1 to 1 mapping with the opportunities in this Service. Available in Limited view.
old_valueOutput only. Opportunity ID in the Partner Advantage Portal. This ID is meant for mapping the Opportunities to the old system, and has a 1 to 1 mapping with the opportunities in this Service.
root['schemas']['GoogleCloudChannelV1alpha1Opportunity']['properties']['salesCycle']['description']
new_valueOptional. Information related to the Sales cycle. Present only after the Opportunity is Accepted. Unset otherwise. Can be edited. Available in Limited view.
old_valueOptional. Information related to the Sales cycle. Present only after the Opportunity is Accepted. Unset otherwise. Can be edited.
root['schemas']['GoogleCloudChannelV1alpha1Opportunity']['properties']['source']['description']
new_valueOutput only. Represents if the Opportunity was created by Google or by Partner. Available in Limited view.
old_valueOutput only. Represents if the Opportunity was created by Google or by Partner.
root['schemas']['GoogleCloudChannelV1alpha1Opportunity']['properties']['stage']['description']
new_valueThe sales stage that the Opportunity is in. New Opportunities are created in Stage 0. Can only be updated after the Opportunity is ACCEPTED. Can't be updated to CLOSED. Available in Limited view.
old_valueThe sales stage that the Opportunity is in. New Opportunities are created in Stage 0. Can only be updated after the Opportunity is ACCEPTED. Can't be updated to CLOSED.
root['schemas']['GoogleCloudChannelV1alpha1Opportunity']['properties']['state']['description']
new_valueOptional. State the Opportunity is in. Client can only set the state to DRAFT or SUBMITTED. Default: DRAFT. Available in Limited view.
old_valueOptional. State the Opportunity is in. Client can only set the state to DRAFT or SUBMITTED. Default: DRAFT.
root['schemas']['GoogleCloudChannelV1alpha1Opportunity']['properties']['stateDescription']['description']
new_valueOutput only. Contains the reason if the Opportunity was not accepted. Available in Limited view.
old_valueOutput only. Contains the reason if the Opportunity was not accepted.
root['schemas']['GoogleCloudChannelV1alpha1OpportunityInfo']['properties']['description']['description']
new_valueOptional. Opportunity description. Available in Limited view.
old_valueOptional. Opportunity description.
root['schemas']['GoogleCloudChannelV1alpha1OpportunityInfo']['properties']['displayName']['description']
new_valueOptional. Display name for the Opportunity. Available in Limited view.
old_valueOptional. Display name for the Opportunity.
root['schemas']['GoogleCloudChannelV1alpha1OpportunityTeamMember']['properties']['accessLevel']['description']
new_valueOutput only. Access Level. Available in Limited view.
old_valueOutput only. Access Level.
root['schemas']['GoogleCloudChannelV1alpha1OpportunityTeamMember']['properties']['email']['description']
new_valueOutput only. Email. Available in Limited view.
old_valueOutput only. Email.
root['schemas']['GoogleCloudChannelV1alpha1OpportunityTeamMember']['properties']['name']['description']
new_valueOutput only. Name. Available in Limited view.
old_valueOutput only. Name.
root['schemas']['GoogleCloudChannelV1alpha1SalesCycle']['properties']['closeDate']['description']
new_valueOutput only. For open opportunities, this is the expected close date. For closed opportunities, this is the contract signed date Available in Limited view.
old_valueOutput only. For open opportunities, this is the expected close date. For closed opportunities, this is the contract signed date
prod/cloudchannel-pa-v2
values_changed
root['revision']
new_value20250311
old_value20250308
prod/cloudcode-pa-
values_changed
root['revision']
new_value20250309
old_value20250311
iterable_item_added
root['schemas']['ClientMetadata']['properties']['pluginType']['enum'][5]PANTHEON
root['schemas']['ClientMetadata']['properties']['pluginType']['enumDescriptions'][5]API calls coming from Pantheon and Coliseum.
prod/cloudcode-pa-v1
values_changed
root['revision']
new_value20250309
old_value20250311
prod/cloudcode-pa-v1internal
values_changed
root['revision']
new_value20250309
old_value20250311
iterable_item_added
root['schemas']['ClientMetadata']['properties']['pluginType']['enum'][5]PANTHEON
root['schemas']['ClientMetadata']['properties']['pluginType']['enumDescriptions'][5]API calls coming from Pantheon and Coliseum.
prod/cloudcommerceconsumerprocurement-
values_changed
root['revision']
new_value20250309
old_value20250302
prod/cloudcommerceconsumerprocurement-v1
values_changed
root['revision']
new_value20250309
old_value20250302
prod/cloudcommerceconsumerprocurement-v1alpha1
values_changed
root['revision']
new_value20250309
old_value20250302
prod/cloudcommerceinventory-pa-
values_changed
root['revision']
new_value20250309
old_value20250302
prod/cloudcommerceinventory-pa-v0
values_changed
root['revision']
new_value20250309
old_value20250302
prod/cloudcommerceinventoryconsumer-pa-
values_changed
root['revision']
new_value20250309
old_value20250302
prod/cloudcommerceinventoryconsumer-pa-v0
values_changed
root['revision']
new_value20250309
old_value20250302
prod/cloudcommerceprocurement-pa-
values_changed
root['revision']
new_value20250309
old_value20250302
prod/cloudcommerceprocurement-pa-v1
values_changed
root['revision']
new_value20250309
old_value20250302
prod/cloudmarketplace-
values_changed
root['revision']
new_value20250308
old_value20250301
root['schemas']['UiContext']['properties']['contextId']['enumDescriptions'][243]
new_valueUser disconnects medical records from a certain healthcare provider from syncing with Fitbit. (http://screen/8ePocZyJ9BgVSGC)
old_valueUser disconnects their medical record from Fitbit (http://screen/8ePocZyJ9BgVSGC)
iterable_item_added
root['schemas']['UiContext']['properties']['contextId']['enum'][242]FITBIT_ANDROID_PHR_DEMOGRAPHIC_CONFIRMATION
root['schemas']['UiContext']['properties']['contextId']['enum'][243]FITBIT_ANDROID_PHR_DEMOGRAPHIC_CONFIRMATION_DISCONNECTING
root['schemas']['UiContext']['properties']['contextId']['enum'][713]PAISA_MERCHANT_FLUTTER_BUSINESS_CLASSIFICATION_HOMEPAGE_BOTTOM_SHEET_SCREEN
root['schemas']['UiContext']['properties']['contextId']['enum'][922]TRAVEL_REENGAGEMENT_WEB_MAYFLOWER_PROPERTY_TRACKING_TOGGLE
root['schemas']['UiContext']['properties']['contextId']['enum'][1066]YOUTUBE_MUSIC_ANDROID_STATS_RENEWAL_PROMOTION
root['schemas']['UiContext']['properties']['contextId']['enum'][1079]YOUTUBE_MUSIC_IOS_STATS_RENEWAL_PROMOTION
root['schemas']['UiContext']['properties']['contextId']['enumDescriptions'][242]User confirms that their demographic information matches healthcare provider records for the incoming medical record being synced to Fitbit. (http://screen/QbJ6NAzAYCFxGWx)
root['schemas']['UiContext']['properties']['contextId']['enumDescriptions'][245]User disconnects all their medical record from syncing with Fitbit (http://screen/8BNCYZP6LgYfeaH)
root['schemas']['UiContext']['properties']['contextId']['enumDescriptions'][713]User going through the Paisa Merchant Business Classification Home Page bottom sheet screen in Flutter app.
root['schemas']['UiContext']['properties']['contextId']['enumDescriptions'][921]Hotel market tracking toggle in Mayflower listview.
root['schemas']['UiContext']['properties']['contextId']['enumDescriptions'][922]Hotel property tracking toggle in Mayflower placesheet.
root['schemas']['UiContext']['properties']['contextId']['enumDescriptions'][1066]User is presented with consent text for renewing their public stats consent via Nitrate promotion on the Android YTM client.
root['schemas']['UiContext']['properties']['contextId']['enumDescriptions'][1079]User is presented with consent text for renewing their public stats consent via Nitrate promotion on the iOS YTM client.
prod/cloudmarketplace-v1test
values_changed
root['revision']
new_value20250308
old_value20250301
root['schemas']['UiContext']['properties']['contextId']['enumDescriptions'][243]
new_valueUser disconnects medical records from a certain healthcare provider from syncing with Fitbit. (http://screen/8ePocZyJ9BgVSGC)
old_valueUser disconnects their medical record from Fitbit (http://screen/8ePocZyJ9BgVSGC)
iterable_item_added
root['schemas']['UiContext']['properties']['contextId']['enum'][242]FITBIT_ANDROID_PHR_DEMOGRAPHIC_CONFIRMATION
root['schemas']['UiContext']['properties']['contextId']['enum'][243]FITBIT_ANDROID_PHR_DEMOGRAPHIC_CONFIRMATION_DISCONNECTING
root['schemas']['UiContext']['properties']['contextId']['enum'][713]PAISA_MERCHANT_FLUTTER_BUSINESS_CLASSIFICATION_HOMEPAGE_BOTTOM_SHEET_SCREEN
root['schemas']['UiContext']['properties']['contextId']['enum'][922]TRAVEL_REENGAGEMENT_WEB_MAYFLOWER_PROPERTY_TRACKING_TOGGLE
root['schemas']['UiContext']['properties']['contextId']['enum'][1066]YOUTUBE_MUSIC_ANDROID_STATS_RENEWAL_PROMOTION
root['schemas']['UiContext']['properties']['contextId']['enum'][1079]YOUTUBE_MUSIC_IOS_STATS_RENEWAL_PROMOTION
root['schemas']['UiContext']['properties']['contextId']['enumDescriptions'][242]User confirms that their demographic information matches healthcare provider records for the incoming medical record being synced to Fitbit. (http://screen/QbJ6NAzAYCFxGWx)
root['schemas']['UiContext']['properties']['contextId']['enumDescriptions'][245]User disconnects all their medical record from syncing with Fitbit (http://screen/8BNCYZP6LgYfeaH)
root['schemas']['UiContext']['properties']['contextId']['enumDescriptions'][713]User going through the Paisa Merchant Business Classification Home Page bottom sheet screen in Flutter app.
root['schemas']['UiContext']['properties']['contextId']['enumDescriptions'][921]Hotel market tracking toggle in Mayflower listview.
root['schemas']['UiContext']['properties']['contextId']['enumDescriptions'][922]Hotel property tracking toggle in Mayflower placesheet.
root['schemas']['UiContext']['properties']['contextId']['enumDescriptions'][1066]User is presented with consent text for renewing their public stats consent via Nitrate promotion on the Android YTM client.
root['schemas']['UiContext']['properties']['contextId']['enumDescriptions'][1079]User is presented with consent text for renewing their public stats consent via Nitrate promotion on the iOS YTM client.
prod/cloudmarketplaceadmin-
values_changed
root['revision']
new_value20250308
old_value20250301
prod/cloudmarketplaceadmin-v1test
values_changed
root['revision']
new_value20250308
old_value20250301
prod/cloudmarketplacepartner-
values_changed
root['revision']
new_value20250308
old_value20250301
prod/cloudmarketplacepartner-v2test
values_changed
root['revision']
new_value20250308
old_value20250301
prod/cloudnumberregistry-
values_changed
root['revision']
new_value20250305
old_value20250226
prod/cloudnumberregistry-v1alpha
values_changed
root['revision']
new_value20250305
old_value20250226
prod/cloudsupport-pa-
values_changed
root['revision']
new_value20250313
old_value20250305
prod/cloudsupport-pa-v1
values_changed
root['revision']
new_value20250313
old_value20250305
prod/cloudsupportinfra-
values_changed
root['revision']
new_value20250312
old_value20250304
prod/cloudsupportinfra-v1
values_changed
root['revision']
new_value20250312
old_value20250304
prod/cloudsupportinfra-v1alpha1
values_changed
root['revision']
new_value20250312
old_value20250304
prod/cloudvideosearch-
values_changed
root['revision']
new_value20250307
old_value20250228
prod/cloudvideosearch-v1
values_changed
root['revision']
new_value20250307
old_value20250228
prod/commerceoffercatalog-
values_changed
root['revision']
new_value20250309
old_value20250302
root['schemas']['GoogleCloudBillingOffercatalogV1alphaOfferTerm']['properties']['offerTermTimes']['description']
new_valueA list of the term boundaries on the offer. This is only relevant for subscription-based private offers. The first entry is considered the start of the first term, and the last entry is considered the end of the last term. The in-between entries are only present in the case of auto renewals. For a replacement offer, the first entry is one of the following: If the existing offer has been renewed, it is the most recent renewal time; Otherwise, it is the same as the first entry of offer_term_times of the existing offer. For offers that start upon customer acceptance, these entries will not exist until the offer is purchased, because it is impossible to know the actual start time without the purchase. Examples: * Standard interval offers with renewal, term = 2 months: 01/04 (offer start time) 03/04 (end time without renewal, which is the start of the first renewal) 05/04 (end time after renewal) * Standard interval offers without renewal, term = 2 months: 01/04 (offer start time), 03/04 (offer end time) * Custom interval offers: 01/04 (offer start time), 09/06 (offer end time) More explanations and examples can be found in go/merged-prepay-additional-design. This field will be populated at best effort and not 100% accurate for legacy postpay private offers, it should be only used for the variable revenue share feature project.
old_valueA list of the term boundaries on the offer. This is only relevant for subscription-based private offers. The first entry is considered the start of the first term, and the last entry is considered the end of the last term. The in-between entries are only present in the case of auto renewals. For a replacement offer, the first entry is one of the following: If the existing offer has been renewed, it is the most recent renewal time; Otherwise, it is the same as the first entry of offer_term_times of the existing offer. For offers that start upon customer acceptance, these entries will not exist until the offer is purchased, because it is impossible to know the actual start time without the purchase. Examples: * Standard interval offers with renewal, term = 2 months: 01/04 (offer start time) 03/04 (end time without renewal, which is the start of the first renewal) 05/04 (end time after renewal) * Standard interval offers without renewal, term = 2 months: 01/04 (offer start time), 03/04 (offer end time) * Custom interval offers: 01/04 (offer start time), 09/06 (offer end time) More explanations and examples can be found in go/merged-prepay-additional-design.
prod/commerceoffercatalog-v1alpha
values_changed
root['revision']
new_value20250309
old_value20250302
root['schemas']['GoogleCloudBillingOffercatalogV1alphaOfferTerm']['properties']['offerTermTimes']['description']
new_valueA list of the term boundaries on the offer. This is only relevant for subscription-based private offers. The first entry is considered the start of the first term, and the last entry is considered the end of the last term. The in-between entries are only present in the case of auto renewals. For a replacement offer, the first entry is one of the following: If the existing offer has been renewed, it is the most recent renewal time; Otherwise, it is the same as the first entry of offer_term_times of the existing offer. For offers that start upon customer acceptance, these entries will not exist until the offer is purchased, because it is impossible to know the actual start time without the purchase. Examples: * Standard interval offers with renewal, term = 2 months: 01/04 (offer start time) 03/04 (end time without renewal, which is the start of the first renewal) 05/04 (end time after renewal) * Standard interval offers without renewal, term = 2 months: 01/04 (offer start time), 03/04 (offer end time) * Custom interval offers: 01/04 (offer start time), 09/06 (offer end time) More explanations and examples can be found in go/merged-prepay-additional-design. This field will be populated at best effort and not 100% accurate for legacy postpay private offers, it should be only used for the variable revenue share feature project.
old_valueA list of the term boundaries on the offer. This is only relevant for subscription-based private offers. The first entry is considered the start of the first term, and the last entry is considered the end of the last term. The in-between entries are only present in the case of auto renewals. For a replacement offer, the first entry is one of the following: If the existing offer has been renewed, it is the most recent renewal time; Otherwise, it is the same as the first entry of offer_term_times of the existing offer. For offers that start upon customer acceptance, these entries will not exist until the offer is purchased, because it is impossible to know the actual start time without the purchase. Examples: * Standard interval offers with renewal, term = 2 months: 01/04 (offer start time) 03/04 (end time without renewal, which is the start of the first renewal) 05/04 (end time after renewal) * Standard interval offers without renewal, term = 2 months: 01/04 (offer start time), 03/04 (offer end time) * Custom interval offers: 01/04 (offer start time), 09/06 (offer end time) More explanations and examples can be found in go/merged-prepay-additional-design.
prod/commercepricemanagement-
values_changed
root['revision']
new_value20250309
old_value20250302
root['schemas']['GoogleCloudBillingCommercepricemanagementV1alphaOfferTerm']['properties']['offerTermTimes']['description']
new_valueOutput only. A list of the term boundaries on the offer. This is only relevant for subscription-based private offers. The first entry is considered the start of the first term, and the last entry is considered the end of the last term. The in-between entries are only present in the case of auto renewals. For a replacement offer, the first entry is one of the following: If the existing offer has been renewed, it is the most recent renewal time; Otherwise, it is the same as the first entry of offer_term_times of the existing offer. For offers that start upon customer acceptance, these entries will not exist until the offer is purchased, because it is impossible to know the actual start time without the purchase. Examples: * Standard interval offers with renewal, term = 2 months: 01/04 (offer start time) 03/04 (end time without renewal, which is the start of the first renewal) 05/04 (end time after renewal) * Standard interval offers without renewal, term = 2 months: 01/04 (offer start time), 03/04 (offer end time) * Custom interval offers: 01/04 (offer start time), 09/06 (offer end time) More explanations and examples can be found in go/merged-prepay-additional-design. This field will be populated at best effort and not 100% accurate for legacy postpay private offers, it should be only used for the variable revenue share feature project.
old_valueOutput only. A list of the term boundaries on the offer. This is only relevant for subscription-based private offers. The first entry is considered the start of the first term, and the last entry is considered the end of the last term. The in-between entries are only present in the case of auto renewals. For a replacement offer, the first entry is one of the following: If the existing offer has been renewed, it is the most recent renewal time; Otherwise, it is the same as the first entry of offer_term_times of the existing offer. For offers that start upon customer acceptance, these entries will not exist until the offer is purchased, because it is impossible to know the actual start time without the purchase. Examples: * Standard interval offers with renewal, term = 2 months: 01/04 (offer start time) 03/04 (end time without renewal, which is the start of the first renewal) 05/04 (end time after renewal) * Standard interval offers without renewal, term = 2 months: 01/04 (offer start time), 03/04 (offer end time) * Custom interval offers: 01/04 (offer start time), 09/06 (offer end time) More explanations and examples can be found in go/merged-prepay-additional-design.
prod/commercepricemanagement-v1
values_changed
root['revision']
new_value20250309
old_value20250302
prod/commercepricemanagement-v1alpha
values_changed
root['revision']
new_value20250309
old_value20250302
root['schemas']['GoogleCloudBillingCommercepricemanagementV1alphaOfferTerm']['properties']['offerTermTimes']['description']
new_valueOutput only. A list of the term boundaries on the offer. This is only relevant for subscription-based private offers. The first entry is considered the start of the first term, and the last entry is considered the end of the last term. The in-between entries are only present in the case of auto renewals. For a replacement offer, the first entry is one of the following: If the existing offer has been renewed, it is the most recent renewal time; Otherwise, it is the same as the first entry of offer_term_times of the existing offer. For offers that start upon customer acceptance, these entries will not exist until the offer is purchased, because it is impossible to know the actual start time without the purchase. Examples: * Standard interval offers with renewal, term = 2 months: 01/04 (offer start time) 03/04 (end time without renewal, which is the start of the first renewal) 05/04 (end time after renewal) * Standard interval offers without renewal, term = 2 months: 01/04 (offer start time), 03/04 (offer end time) * Custom interval offers: 01/04 (offer start time), 09/06 (offer end time) More explanations and examples can be found in go/merged-prepay-additional-design. This field will be populated at best effort and not 100% accurate for legacy postpay private offers, it should be only used for the variable revenue share feature project.
old_valueOutput only. A list of the term boundaries on the offer. This is only relevant for subscription-based private offers. The first entry is considered the start of the first term, and the last entry is considered the end of the last term. The in-between entries are only present in the case of auto renewals. For a replacement offer, the first entry is one of the following: If the existing offer has been renewed, it is the most recent renewal time; Otherwise, it is the same as the first entry of offer_term_times of the existing offer. For offers that start upon customer acceptance, these entries will not exist until the offer is purchased, because it is impossible to know the actual start time without the purchase. Examples: * Standard interval offers with renewal, term = 2 months: 01/04 (offer start time) 03/04 (end time without renewal, which is the start of the first renewal) 05/04 (end time after renewal) * Standard interval offers without renewal, term = 2 months: 01/04 (offer start time), 03/04 (offer end time) * Custom interval offers: 01/04 (offer start time), 09/06 (offer end time) More explanations and examples can be found in go/merged-prepay-additional-design.
prod/configdelivery-
values_changed
root['revision']
new_value20250305
old_value20250226
prod/configdelivery-v1alpha
values_changed
root['revision']
new_value20250305
old_value20250226
prod/connectgateway-
values_changed
root['revision']
new_value20250310
old_value20250303
prod/connectgateway-v1
values_changed
root['revision']
new_value20250310
old_value20250303
prod/connectgateway-v1beta1
values_changed
root['revision']
new_value20250310
old_value20250303
prod/containersecurity-
values_changed
root['revision']
new_value20250306
old_value20250227
prod/containersecurity-v1
values_changed
root['revision']
new_value20250306
old_value20250227
prod/containersecurity-v1beta
values_changed
root['revision']
new_value20250306
old_value20250227
prod/containersecurity-v1main
values_changed
root['revision']
new_value20250306
old_value20250227
prod/content-actions-
values_changed
root['revision']
new_value20250313
old_value20250310
prod/content-actions-v2
values_changed
root['revision']
new_value20250313
old_value20250310
prod/content-actions-v2alpha
values_changed
root['revision']
new_value20250313
old_value20250310
prod/content-actions-v3
values_changed
root['revision']
new_value20250313
old_value20250310
prod/content-alkaliauth-pa-
values_changed
root['revision']
new_value20250311
old_value20250225
prod/content-alkaliauth-pa-v1
values_changed
root['revision']
new_value20250311
old_value20250225
prod/content-alkalilearn-pa-
values_changed
root['revision']
new_value20250311
old_value20250308
prod/content-alkalilearn-pa-v1
values_changed
root['revision']
new_value20250311
old_value20250308
prod/content-alkalilearn-pa-v2
values_changed
root['revision']
new_value20250311
old_value20250308
prod/content-alkalimetricsink-pa-
values_changed
root['revision']
new_value20250313
old_value20250306
iterable_item_added
root['schemas']['EventMetric']['properties']['metricType']['enum'][14]LARGEST_CONTENTFUL_PAINT
root['schemas']['EventMetric']['properties']['metricType']['enum'][15]LARGEST_CONTENTFUL_PAINT_SPA
root['schemas']['EventMetric']['properties']['metricType']['enumDescriptions'][14]Largest Contentful Paint
root['schemas']['EventMetric']['properties']['metricType']['enumDescriptions'][15]Largest Contentful Paint Transition
prod/content-alkalimetricsink-pa-v1
values_changed
root['revision']
new_value20250313
old_value20250306
iterable_item_added
root['schemas']['EventMetric']['properties']['metricType']['enum'][14]LARGEST_CONTENTFUL_PAINT
root['schemas']['EventMetric']['properties']['metricType']['enum'][15]LARGEST_CONTENTFUL_PAINT_SPA
root['schemas']['EventMetric']['properties']['metricType']['enumDescriptions'][14]Largest Contentful Paint
root['schemas']['EventMetric']['properties']['metricType']['enumDescriptions'][15]Largest Contentful Paint Transition
prod/content-autofill-
values_changed
root['revision']
new_value20250312
old_value20250310
prod/content-autofill-v1
values_changed
root['revision']
new_value20250312
old_value20250310
prod/content-cloudchannel-pa-
values_changed
root['revision']
new_value20250311
old_value20250308
prod/content-cloudchannel-pa-v1
values_changed
root['revision']
new_value20250311
old_value20250308
prod/content-cloudchannel-pa-v1alpha1
values_changed
root['resources']['opportunities']['methods']['patch']['parameters']['name']['description']
new_valueIdentifier. Resource name of an Opportunity in the form: opportunities/{opportunity_id}. Available in Limited view.
old_valueIdentifier. Resource name of an Opportunity in the form: opportunities/{opportunity_id}.
root['revision']
new_value20250311
old_value20250308
root['schemas']['GoogleCloudChannelV1alpha1CustomerDetails']['properties']['domain']['description']
new_valueRequired. Customer's primary website domain. Available in Limited view.
old_valueRequired. Customer's primary website domain.
root['schemas']['GoogleCloudChannelV1alpha1CustomerDetails']['properties']['organizationName']['description']
new_valueRequired. Name of the Customer Organization. Available in Limited view.
old_valueRequired. Name of the Customer Organization.
root['schemas']['GoogleCloudChannelV1alpha1CustomerInfo']['properties']['customerDetails']['description']
new_valueRequired. Firm details needed for creating a new customer or for mapping to an existing customer. Available in Limited view.
old_valueRequired. Firm details needed for creating a new customer or for mapping to an existing customer.
root['schemas']['GoogleCloudChannelV1alpha1Opportunity']['properties']['customerDisplayName']['description']
new_valueOutput only. Customer display name that the Opportunity is associated with. This maps to the Vector Account name. Available in Limited view.
old_valueOutput only. Customer display name that the Opportunity is associated with. This maps to the Vector Account name.
root['schemas']['GoogleCloudChannelV1alpha1Opportunity']['properties']['customerInfo']['description']
new_valueRequired. Information of the end customer used for matching to an existing customer account or for creating a new one. Required for Creating an Opportunity. Can't be edited after the Opportunity is Accepted. Available in Limited view.
old_valueRequired. Information of the end customer used for matching to an existing customer account or for creating a new one. Required for Creating an Opportunity. Can't be edited after the Opportunity is Accepted.
root['schemas']['GoogleCloudChannelV1alpha1Opportunity']['properties']['name']['description']
new_valueIdentifier. Resource name of an Opportunity in the form: opportunities/{opportunity_id}. Available in Limited view.
old_valueIdentifier. Resource name of an Opportunity in the form: opportunities/{opportunity_id}.
root['schemas']['GoogleCloudChannelV1alpha1Opportunity']['properties']['opportunityInfo']['description']
new_valueRequired. Information about the Opportunity provided during deal submission. Required for Creating an Opportunity. Available in Limited view.
old_valueRequired. Information about the Opportunity provided during deal submission. Required for Creating an Opportunity.
root['schemas']['GoogleCloudChannelV1alpha1Opportunity']['properties']['opportunityTeamMembers']['description']
new_valueOutput only. Information on the Partner users with access to the Opportunity. Present only after the Opportunity is Accepted. Unset otherwise. Can't be edited. Available in Limited view. Only lists the Partner Development Manager (PDM) roles in Limited view.
old_valueOutput only. Information on the Partner users with access to the Opportunity. Present only after the Opportunity is Accepted. Unset otherwise. Can't be edited.
root['schemas']['GoogleCloudChannelV1alpha1Opportunity']['properties']['owner']['description']
new_valueOutput only. Name of the Google FSR who owns the Opportunity. Available in Limited view.
old_valueOutput only. Name of the Google FSR who owns the Opportunity.
root['schemas']['GoogleCloudChannelV1alpha1Opportunity']['properties']['ownerEmail']['description']
new_valueOutput only. Email of the Google FSR who owns the Opportunity. Available in Limited view.
old_valueOutput only. Email of the Google FSR who owns the Opportunity.
root['schemas']['GoogleCloudChannelV1alpha1Opportunity']['properties']['partnerInfo']['description']
new_valueOptional. Opportunity information related to the sourcing Partner. Present only after the Opportunity is Accepted. Unset otherwise. Can be edited. Available in Limited view.
old_valueOptional. Opportunity information related to the sourcing Partner. Present only after the Opportunity is Accepted. Unset otherwise. Can be edited.
root['schemas']['GoogleCloudChannelV1alpha1Opportunity']['properties']['referenceOpportunityId']['description']
new_valueOutput only. Opportunity ID in the Partner Advantage Portal. This ID is meant for mapping the Opportunities to the old system, and has a 1 to 1 mapping with the opportunities in this Service. Available in Limited view.
old_valueOutput only. Opportunity ID in the Partner Advantage Portal. This ID is meant for mapping the Opportunities to the old system, and has a 1 to 1 mapping with the opportunities in this Service.
root['schemas']['GoogleCloudChannelV1alpha1Opportunity']['properties']['salesCycle']['description']
new_valueOptional. Information related to the Sales cycle. Present only after the Opportunity is Accepted. Unset otherwise. Can be edited. Available in Limited view.
old_valueOptional. Information related to the Sales cycle. Present only after the Opportunity is Accepted. Unset otherwise. Can be edited.
root['schemas']['GoogleCloudChannelV1alpha1Opportunity']['properties']['source']['description']
new_valueOutput only. Represents if the Opportunity was created by Google or by Partner. Available in Limited view.
old_valueOutput only. Represents if the Opportunity was created by Google or by Partner.
root['schemas']['GoogleCloudChannelV1alpha1Opportunity']['properties']['stage']['description']
new_valueThe sales stage that the Opportunity is in. New Opportunities are created in Stage 0. Can only be updated after the Opportunity is ACCEPTED. Can't be updated to CLOSED. Available in Limited view.
old_valueThe sales stage that the Opportunity is in. New Opportunities are created in Stage 0. Can only be updated after the Opportunity is ACCEPTED. Can't be updated to CLOSED.
root['schemas']['GoogleCloudChannelV1alpha1Opportunity']['properties']['state']['description']
new_valueOptional. State the Opportunity is in. Client can only set the state to DRAFT or SUBMITTED. Default: DRAFT. Available in Limited view.
old_valueOptional. State the Opportunity is in. Client can only set the state to DRAFT or SUBMITTED. Default: DRAFT.
root['schemas']['GoogleCloudChannelV1alpha1Opportunity']['properties']['stateDescription']['description']
new_valueOutput only. Contains the reason if the Opportunity was not accepted. Available in Limited view.
old_valueOutput only. Contains the reason if the Opportunity was not accepted.
root['schemas']['GoogleCloudChannelV1alpha1OpportunityInfo']['properties']['description']['description']
new_valueOptional. Opportunity description. Available in Limited view.
old_valueOptional. Opportunity description.
root['schemas']['GoogleCloudChannelV1alpha1OpportunityInfo']['properties']['displayName']['description']
new_valueOptional. Display name for the Opportunity. Available in Limited view.
old_valueOptional. Display name for the Opportunity.
root['schemas']['GoogleCloudChannelV1alpha1OpportunityTeamMember']['properties']['accessLevel']['description']
new_valueOutput only. Access Level. Available in Limited view.
old_valueOutput only. Access Level.
root['schemas']['GoogleCloudChannelV1alpha1OpportunityTeamMember']['properties']['email']['description']
new_valueOutput only. Email. Available in Limited view.
old_valueOutput only. Email.
root['schemas']['GoogleCloudChannelV1alpha1OpportunityTeamMember']['properties']['name']['description']
new_valueOutput only. Name. Available in Limited view.
old_valueOutput only. Name.
root['schemas']['GoogleCloudChannelV1alpha1SalesCycle']['properties']['closeDate']['description']
new_valueOutput only. For open opportunities, this is the expected close date. For closed opportunities, this is the contract signed date Available in Limited view.
old_valueOutput only. For open opportunities, this is the expected close date. For closed opportunities, this is the contract signed date
prod/content-cloudchannel-pa-v2
values_changed
root['revision']
new_value20250311
old_value20250308
prod/content-cloudcommerceinventoryconsumer-pa-
values_changed
root['revision']
new_value20250309
old_value20250302
prod/content-cloudcommerceinventoryconsumer-pa-v0
values_changed
root['revision']
new_value20250309
old_value20250302
prod/content-daily-cloudsearch-
values_changed
root['revision']
new_value20250313
old_value20250311
prod/content-daily-cloudsearch-v1
values_changed
root['revision']
new_value20250313
old_value20250311
prod/content-dynamicmail-pa-
values_changed
root['revision']
new_value20250309
old_value20250304
prod/content-dynamicmail-pa-v2
values_changed
root['revision']
new_value20250309
old_value20250304
prod/content-fit-
values_changed
root['revision']
new_value20250312
old_value20250310
prod/content-fit-v2beta1
values_changed
root['revision']
new_value20250312
old_value20250310
prod/content-keep-pa-
dictionary_item_added
  • root['schemas']['GetNoteInfoResponse']['properties']['type']['enumDeprecated']
  • root['schemas']['Note']['properties']['quillNote']['deprecated']
values_changed
root['revision']
new_value20250304
old_value20250207
root['schemas']['Note']['properties']['quillNote']['description']
new_valueA quillNote is a note with an empty message.
old_valueA quillNote is a note with an empty message.
prod/content-keep-pa-v1
dictionary_item_added
  • root['schemas']['GetNoteInfoResponse']['properties']['type']['enumDeprecated']
  • root['schemas']['Note']['properties']['quillNote']['deprecated']
values_changed
root['revision']
new_value20250304
old_value20250207
root['schemas']['Note']['properties']['quillNote']['description']
new_valueA quillNote is a note with an empty message.
old_valueA quillNote is a note with an empty message.
prod/content-notes-pa-
dictionary_item_added
  • root['schemas']['DownSync']['properties']['derivedNoteAttributes']['deprecated']
  • root['schemas']['DownSync']['properties']['derivedNoteAttributes']['description']
  • root['schemas']['DownSyncWriteResult']['properties']['missingEmbeddedImages']['deprecated']
  • root['schemas']['DownSyncWriteResult']['properties']['status']['enumDeprecated']
  • root['schemas']['Node']['properties']['clientChanges']['properties']['commandMetadata']['properties']['imageIdMap']['deprecated']
  • root['schemas']['Node']['properties']['serverChanges']['properties']['images']['deprecated']
  • root['schemas']['UpSync']['properties']['requestHeader']['properties']['modelOptions']['properties']['note']['properties']['commandEncoding']['deprecated']
  • root['schemas']['UpSync']['properties']['requestHeader']['properties']['modelOptions']['properties']['quill']['deprecated']
  • root['schemas']['UpSync']['properties']['requestHeader']['properties']['modelOptions']['properties']['quill']['properties']['commandEncoding']['deprecated']
values_changed
root['revision']
new_value20250304
old_value20250210
root['schemas']['DownSyncWriteResult']['properties']['missingEmbeddedImages']['description']
new_valueThe embedded images referenced by the uploaded commands for which the corresponding data was not found by the server. Clients are expected to re-upload these images before issuing a new sync request.
old_valueThe embedded images referenced by the uploaded commands for which the corresponding data was not found by the server. Clients are expected to re-upload these images before issuing a new sync request. This field is only populated when the status is set to MISSING_EMBEDDED_IMAGE.
root['schemas']['Node']['properties']['clientChanges']['properties']['commandMetadata']['properties']['imageIdMap']['description']
new_valueFor images referenced by the model, maps images' client IDs to server IDs.
old_valueFor images referenced by the model, maps images' client IDs to server IDs.
root['schemas']['Node']['properties']['serverChanges']['properties']['images']['description']
new_valueMetadata on images referenced by the model.
old_valueMetadata on images referenced by the model. This will include all images upon initial sync (no changes) and only images referenced by changes when changes exist.
root['schemas']['DownSyncWriteResult']['properties']['status']['enumDescriptions'][2]
new_valueThe uploaded commands refer to embedded images that have not yet been uploaded. Clients are expected to recover from this error by re-uploading the image before issuing a new sync request.
old_valueThe uploaded commands refer to embedded images that have not yet been uploaded. Clients are expected to recover from this error by re-uploading the image before issuing a new sync request.
prod/content-notes-pa-v1
dictionary_item_added
  • root['schemas']['DownSync']['properties']['derivedNoteAttributes']['deprecated']
  • root['schemas']['DownSync']['properties']['derivedNoteAttributes']['description']
  • root['schemas']['DownSyncWriteResult']['properties']['missingEmbeddedImages']['deprecated']
  • root['schemas']['DownSyncWriteResult']['properties']['status']['enumDeprecated']
  • root['schemas']['Node']['properties']['clientChanges']['properties']['commandMetadata']['properties']['imageIdMap']['deprecated']
  • root['schemas']['Node']['properties']['serverChanges']['properties']['images']['deprecated']
  • root['schemas']['UpSync']['properties']['requestHeader']['properties']['modelOptions']['properties']['note']['properties']['commandEncoding']['deprecated']
  • root['schemas']['UpSync']['properties']['requestHeader']['properties']['modelOptions']['properties']['quill']['deprecated']
  • root['schemas']['UpSync']['properties']['requestHeader']['properties']['modelOptions']['properties']['quill']['properties']['commandEncoding']['deprecated']
values_changed
root['revision']
new_value20250304
old_value20250210
root['schemas']['DownSyncWriteResult']['properties']['missingEmbeddedImages']['description']
new_valueThe embedded images referenced by the uploaded commands for which the corresponding data was not found by the server. Clients are expected to re-upload these images before issuing a new sync request.
old_valueThe embedded images referenced by the uploaded commands for which the corresponding data was not found by the server. Clients are expected to re-upload these images before issuing a new sync request. This field is only populated when the status is set to MISSING_EMBEDDED_IMAGE.
root['schemas']['Node']['properties']['clientChanges']['properties']['commandMetadata']['properties']['imageIdMap']['description']
new_valueFor images referenced by the model, maps images' client IDs to server IDs.
old_valueFor images referenced by the model, maps images' client IDs to server IDs.
root['schemas']['Node']['properties']['serverChanges']['properties']['images']['description']
new_valueMetadata on images referenced by the model.
old_valueMetadata on images referenced by the model. This will include all images upon initial sync (no changes) and only images referenced by changes when changes exist.
root['schemas']['DownSyncWriteResult']['properties']['status']['enumDescriptions'][2]
new_valueThe uploaded commands refer to embedded images that have not yet been uploaded. Clients are expected to recover from this error by re-uploading the image before issuing a new sync request.
old_valueThe uploaded commands refer to embedded images that have not yet been uploaded. Clients are expected to recover from this error by re-uploading the image before issuing a new sync request.
prod/content-partners-pa-
values_changed
root['revision']
new_value20250311
old_value20250305
prod/content-partners-pa-v1
values_changed
root['revision']
new_value20250311
old_value20250305
prod/content-partners-pa-v2
values_changed
root['revision']
new_value20250311
old_value20250305
prod/content-quantum-
values_changed
root['revision']
new_value20250311
old_value20250309
prod/content-quantum-v1alpha1
values_changed
root['revision']
new_value20250311
old_value20250309
prod/content-resultstore-
values_changed
root['revision']
new_value20250311
old_value20250307
prod/content-resultstore-v2
values_changed
root['revision']
new_value20250311
old_value20250307
prod/content-takeout-pa-
values_changed
root['revision']
new_value20250310
old_value20250227
prod/content-takeout-pa-v1
values_changed
root['revision']
new_value20250310
old_value20250227
prod/content-takeout-pa-v2
values_changed
root['revision']
new_value20250310
old_value20250227
prod/content-tasks-pa-
values_changed
root['revision']
new_value20250311
old_value20250307
prod/content-tasks-pa-v1
values_changed
root['revision']
new_value20250311
old_value20250307
prod/contentmanager-
values_changed
root['revision']
new_value20250312
old_value20250305
iterable_item_added
root['schemas']['FieldRelationshipDescriptorContext']['properties']['frdIdentifier']['enum'][66]IDENTIFIER_ADS_JOINT_BUSINESS_PLAN_ID
root['schemas']['FieldRelationshipDescriptorContext']['properties']['frdIdentifier']['enum'][154]IDENTIFIER_ADVERTISER_SERVICE_CATEGORY
root['schemas']['FieldRelationshipDescriptorContext']['properties']['frdIdentifier']['enum'][277]IDENTIFIER_CASES_WHATSAPP_CONSENT
root['schemas']['FieldRelationshipDescriptorContext']['properties']['frdIdentifier']['enum'][372]IDENTIFIER_CS_TEAM_ID
root['schemas']['FieldRelationshipDescriptorContext']['properties']['frdIdentifier']['enum'][727]IDENTIFIER_MENU_OF_SERVICE_ORDER_ID
root['schemas']['FieldRelationshipDescriptorContext']['properties']['frdIdentifier']['enumDescriptions'][66]b/400713111
root['schemas']['FieldRelationshipDescriptorContext']['properties']['frdIdentifier']['enumDescriptions'][154]b/399143770
root['schemas']['FieldRelationshipDescriptorContext']['properties']['frdIdentifier']['enumDescriptions'][277]b/397762924
root['schemas']['FieldRelationshipDescriptorContext']['properties']['frdIdentifier']['enumDescriptions'][372]b/399076775
root['schemas']['FieldRelationshipDescriptorContext']['properties']['frdIdentifier']['enumDescriptions'][727]b/399143094
root['schemas']['FieldRelationshipDescriptorValue']['properties']['frdIdentifier']['enum'][66]IDENTIFIER_ADS_JOINT_BUSINESS_PLAN_ID
root['schemas']['FieldRelationshipDescriptorValue']['properties']['frdIdentifier']['enum'][154]IDENTIFIER_ADVERTISER_SERVICE_CATEGORY
root['schemas']['FieldRelationshipDescriptorValue']['properties']['frdIdentifier']['enum'][277]IDENTIFIER_CASES_WHATSAPP_CONSENT
root['schemas']['FieldRelationshipDescriptorValue']['properties']['frdIdentifier']['enum'][372]IDENTIFIER_CS_TEAM_ID
root['schemas']['FieldRelationshipDescriptorValue']['properties']['frdIdentifier']['enum'][727]IDENTIFIER_MENU_OF_SERVICE_ORDER_ID
root['schemas']['FieldRelationshipDescriptorValue']['properties']['frdIdentifier']['enumDescriptions'][66]b/400713111
root['schemas']['FieldRelationshipDescriptorValue']['properties']['frdIdentifier']['enumDescriptions'][154]b/399143770
root['schemas']['FieldRelationshipDescriptorValue']['properties']['frdIdentifier']['enumDescriptions'][277]b/397762924
root['schemas']['FieldRelationshipDescriptorValue']['properties']['frdIdentifier']['enumDescriptions'][372]b/399076775
root['schemas']['FieldRelationshipDescriptorValue']['properties']['frdIdentifier']['enumDescriptions'][727]b/399143094
root['schemas']['FrdDisabled']['properties']['disabledFrdIdentifier']['enum'][66]IDENTIFIER_ADS_JOINT_BUSINESS_PLAN_ID
root['schemas']['FrdDisabled']['properties']['disabledFrdIdentifier']['enum'][154]IDENTIFIER_ADVERTISER_SERVICE_CATEGORY
root['schemas']['FrdDisabled']['properties']['disabledFrdIdentifier']['enum'][277]IDENTIFIER_CASES_WHATSAPP_CONSENT
root['schemas']['FrdDisabled']['properties']['disabledFrdIdentifier']['enum'][372]IDENTIFIER_CS_TEAM_ID
root['schemas']['FrdDisabled']['properties']['disabledFrdIdentifier']['enum'][727]IDENTIFIER_MENU_OF_SERVICE_ORDER_ID
root['schemas']['FrdDisabled']['properties']['disabledFrdIdentifier']['enumDescriptions'][66]b/400713111
root['schemas']['FrdDisabled']['properties']['disabledFrdIdentifier']['enumDescriptions'][154]b/399143770
root['schemas']['FrdDisabled']['properties']['disabledFrdIdentifier']['enumDescriptions'][277]b/397762924
root['schemas']['FrdDisabled']['properties']['disabledFrdIdentifier']['enumDescriptions'][372]b/399076775
root['schemas']['FrdDisabled']['properties']['disabledFrdIdentifier']['enumDescriptions'][727]b/399143094
root['schemas']['FrdSemanticTypeUndefined']['properties']['undefinedSemanticType']['enum'][45]SEMANTIC_TYPE_ADS_JOINT_BUSINESS_PLAN_ID
root['schemas']['FrdSemanticTypeUndefined']['properties']['undefinedSemanticType']['enum'][124]SEMANTIC_TYPE_ADVERTISER_SERVICE_CATEGORY
root['schemas']['FrdSemanticTypeUndefined']['properties']['undefinedSemanticType']['enum'][228]SEMANTIC_TYPE_CASES_WHATSAPP_CONSENT
root['schemas']['FrdSemanticTypeUndefined']['properties']['undefinedSemanticType']['enum'][285]SEMANTIC_TYPE_CS_TEAM_ID
root['schemas']['FrdSemanticTypeUndefined']['properties']['undefinedSemanticType']['enum'][555]SEMANTIC_TYPE_MENU_OF_SERVICE_ORDER_ID
root['schemas']['FrdSemanticTypeUndefined']['properties']['undefinedSemanticType']['enumDescriptions'][45]b/400713111
root['schemas']['FrdSemanticTypeUndefined']['properties']['undefinedSemanticType']['enumDescriptions'][124]b/399143770
root['schemas']['FrdSemanticTypeUndefined']['properties']['undefinedSemanticType']['enumDescriptions'][228]b/397762924
root['schemas']['FrdSemanticTypeUndefined']['properties']['undefinedSemanticType']['enumDescriptions'][285]b/399076775
root['schemas']['FrdSemanticTypeUndefined']['properties']['undefinedSemanticType']['enumDescriptions'][555]b/399143094
root['schemas']['FrdUndefined']['properties']['undefinedFrdIdentifier']['enum'][66]IDENTIFIER_ADS_JOINT_BUSINESS_PLAN_ID
root['schemas']['FrdUndefined']['properties']['undefinedFrdIdentifier']['enum'][154]IDENTIFIER_ADVERTISER_SERVICE_CATEGORY
root['schemas']['FrdUndefined']['properties']['undefinedFrdIdentifier']['enum'][277]IDENTIFIER_CASES_WHATSAPP_CONSENT
root['schemas']['FrdUndefined']['properties']['undefinedFrdIdentifier']['enum'][372]IDENTIFIER_CS_TEAM_ID
root['schemas']['FrdUndefined']['properties']['undefinedFrdIdentifier']['enum'][727]IDENTIFIER_MENU_OF_SERVICE_ORDER_ID
root['schemas']['FrdUndefined']['properties']['undefinedFrdIdentifier']['enumDescriptions'][66]b/400713111
root['schemas']['FrdUndefined']['properties']['undefinedFrdIdentifier']['enumDescriptions'][154]b/399143770
root['schemas']['FrdUndefined']['properties']['undefinedFrdIdentifier']['enumDescriptions'][277]b/397762924
root['schemas']['FrdUndefined']['properties']['undefinedFrdIdentifier']['enumDescriptions'][372]b/399076775
root['schemas']['FrdUndefined']['properties']['undefinedFrdIdentifier']['enumDescriptions'][727]b/399143094
root['schemas']['GetAvailableFrdValuesRequest']['properties']['resultFrdIdentifierMask']['items']['enum'][66]IDENTIFIER_ADS_JOINT_BUSINESS_PLAN_ID
root['schemas']['GetAvailableFrdValuesRequest']['properties']['resultFrdIdentifierMask']['items']['enum'][154]IDENTIFIER_ADVERTISER_SERVICE_CATEGORY
root['schemas']['GetAvailableFrdValuesRequest']['properties']['resultFrdIdentifierMask']['items']['enum'][277]IDENTIFIER_CASES_WHATSAPP_CONSENT
root['schemas']['GetAvailableFrdValuesRequest']['properties']['resultFrdIdentifierMask']['items']['enum'][372]IDENTIFIER_CS_TEAM_ID
root['schemas']['GetAvailableFrdValuesRequest']['properties']['resultFrdIdentifierMask']['items']['enum'][727]IDENTIFIER_MENU_OF_SERVICE_ORDER_ID
root['schemas']['GetAvailableFrdValuesRequest']['properties']['resultFrdIdentifierMask']['items']['enumDescriptions'][66]b/400713111
root['schemas']['GetAvailableFrdValuesRequest']['properties']['resultFrdIdentifierMask']['items']['enumDescriptions'][154]b/399143770
root['schemas']['GetAvailableFrdValuesRequest']['properties']['resultFrdIdentifierMask']['items']['enumDescriptions'][277]b/397762924
root['schemas']['GetAvailableFrdValuesRequest']['properties']['resultFrdIdentifierMask']['items']['enumDescriptions'][372]b/399076775
root['schemas']['GetAvailableFrdValuesRequest']['properties']['resultFrdIdentifierMask']['items']['enumDescriptions'][727]b/399143094
root['schemas']['LocalizedContextViewMetadataOmitForTypes']['properties']['requestSource']['items']['enum'][143]RS_RISK_MANAGEMENT_AND_COMPLIANCE
root['schemas']['PropertyValue']['properties']['userProduct']['enum'][17]YOUTUBE_CREATOR_SUPPORT_ADMIN_POLICY_CONTEXT
root['schemas']['PropertyValue']['properties']['userProduct']['enum'][18]YOUTUBE_CREATOR_SUPPORT_ADMIN_PROFILE_CONTEXT
root['schemas']['PropertyValue']['properties']['userProduct']['enum'][417]CUSTOMER_COMPANY_TIER_SEGMENTS
root['schemas']['PropertyValue']['properties']['userProduct']['enumDescriptions'][417]Specialize CDP Products Signal Groups *************************************** Customer Company Tier Segments from CustomerAccount used for Cases enrichment and/or routing.
root['schemas']['WorkflowClassValueTypeDescriptor']['properties']['sourceFrd']['enum'][66]IDENTIFIER_ADS_JOINT_BUSINESS_PLAN_ID
root['schemas']['WorkflowClassValueTypeDescriptor']['properties']['sourceFrd']['enum'][154]IDENTIFIER_ADVERTISER_SERVICE_CATEGORY
root['schemas']['WorkflowClassValueTypeDescriptor']['properties']['sourceFrd']['enum'][277]IDENTIFIER_CASES_WHATSAPP_CONSENT
root['schemas']['WorkflowClassValueTypeDescriptor']['properties']['sourceFrd']['enum'][372]IDENTIFIER_CS_TEAM_ID
root['schemas']['WorkflowClassValueTypeDescriptor']['properties']['sourceFrd']['enum'][727]IDENTIFIER_MENU_OF_SERVICE_ORDER_ID
root['schemas']['WorkflowClassValueTypeDescriptor']['properties']['sourceFrd']['enumDescriptions'][66]b/400713111
root['schemas']['WorkflowClassValueTypeDescriptor']['properties']['sourceFrd']['enumDescriptions'][154]b/399143770
root['schemas']['WorkflowClassValueTypeDescriptor']['properties']['sourceFrd']['enumDescriptions'][277]b/397762924
root['schemas']['WorkflowClassValueTypeDescriptor']['properties']['sourceFrd']['enumDescriptions'][372]b/399076775
root['schemas']['WorkflowClassValueTypeDescriptor']['properties']['sourceFrd']['enumDescriptions'][727]b/399143094
prod/contentmanager-v1
values_changed
root['revision']
new_value20250312
old_value20250305
iterable_item_added
root['schemas']['FieldRelationshipDescriptorContext']['properties']['frdIdentifier']['enum'][66]IDENTIFIER_ADS_JOINT_BUSINESS_PLAN_ID
root['schemas']['FieldRelationshipDescriptorContext']['properties']['frdIdentifier']['enum'][154]IDENTIFIER_ADVERTISER_SERVICE_CATEGORY
root['schemas']['FieldRelationshipDescriptorContext']['properties']['frdIdentifier']['enum'][277]IDENTIFIER_CASES_WHATSAPP_CONSENT
root['schemas']['FieldRelationshipDescriptorContext']['properties']['frdIdentifier']['enum'][372]IDENTIFIER_CS_TEAM_ID
root['schemas']['FieldRelationshipDescriptorContext']['properties']['frdIdentifier']['enum'][727]IDENTIFIER_MENU_OF_SERVICE_ORDER_ID
root['schemas']['FieldRelationshipDescriptorContext']['properties']['frdIdentifier']['enumDescriptions'][66]b/400713111
root['schemas']['FieldRelationshipDescriptorContext']['properties']['frdIdentifier']['enumDescriptions'][154]b/399143770
root['schemas']['FieldRelationshipDescriptorContext']['properties']['frdIdentifier']['enumDescriptions'][277]b/397762924
root['schemas']['FieldRelationshipDescriptorContext']['properties']['frdIdentifier']['enumDescriptions'][372]b/399076775
root['schemas']['FieldRelationshipDescriptorContext']['properties']['frdIdentifier']['enumDescriptions'][727]b/399143094
root['schemas']['FieldRelationshipDescriptorValue']['properties']['frdIdentifier']['enum'][66]IDENTIFIER_ADS_JOINT_BUSINESS_PLAN_ID
root['schemas']['FieldRelationshipDescriptorValue']['properties']['frdIdentifier']['enum'][154]IDENTIFIER_ADVERTISER_SERVICE_CATEGORY
root['schemas']['FieldRelationshipDescriptorValue']['properties']['frdIdentifier']['enum'][277]IDENTIFIER_CASES_WHATSAPP_CONSENT
root['schemas']['FieldRelationshipDescriptorValue']['properties']['frdIdentifier']['enum'][372]IDENTIFIER_CS_TEAM_ID
root['schemas']['FieldRelationshipDescriptorValue']['properties']['frdIdentifier']['enum'][727]IDENTIFIER_MENU_OF_SERVICE_ORDER_ID
root['schemas']['FieldRelationshipDescriptorValue']['properties']['frdIdentifier']['enumDescriptions'][66]b/400713111
root['schemas']['FieldRelationshipDescriptorValue']['properties']['frdIdentifier']['enumDescriptions'][154]b/399143770
root['schemas']['FieldRelationshipDescriptorValue']['properties']['frdIdentifier']['enumDescriptions'][277]b/397762924
root['schemas']['FieldRelationshipDescriptorValue']['properties']['frdIdentifier']['enumDescriptions'][372]b/399076775
root['schemas']['FieldRelationshipDescriptorValue']['properties']['frdIdentifier']['enumDescriptions'][727]b/399143094
root['schemas']['FrdDisabled']['properties']['disabledFrdIdentifier']['enum'][66]IDENTIFIER_ADS_JOINT_BUSINESS_PLAN_ID
root['schemas']['FrdDisabled']['properties']['disabledFrdIdentifier']['enum'][154]IDENTIFIER_ADVERTISER_SERVICE_CATEGORY
root['schemas']['FrdDisabled']['properties']['disabledFrdIdentifier']['enum'][277]IDENTIFIER_CASES_WHATSAPP_CONSENT
root['schemas']['FrdDisabled']['properties']['disabledFrdIdentifier']['enum'][372]IDENTIFIER_CS_TEAM_ID
root['schemas']['FrdDisabled']['properties']['disabledFrdIdentifier']['enum'][727]IDENTIFIER_MENU_OF_SERVICE_ORDER_ID
root['schemas']['FrdDisabled']['properties']['disabledFrdIdentifier']['enumDescriptions'][66]b/400713111
root['schemas']['FrdDisabled']['properties']['disabledFrdIdentifier']['enumDescriptions'][154]b/399143770
root['schemas']['FrdDisabled']['properties']['disabledFrdIdentifier']['enumDescriptions'][277]b/397762924
root['schemas']['FrdDisabled']['properties']['disabledFrdIdentifier']['enumDescriptions'][372]b/399076775
root['schemas']['FrdDisabled']['properties']['disabledFrdIdentifier']['enumDescriptions'][727]b/399143094
root['schemas']['FrdSemanticTypeUndefined']['properties']['undefinedSemanticType']['enum'][45]SEMANTIC_TYPE_ADS_JOINT_BUSINESS_PLAN_ID
root['schemas']['FrdSemanticTypeUndefined']['properties']['undefinedSemanticType']['enum'][124]SEMANTIC_TYPE_ADVERTISER_SERVICE_CATEGORY
root['schemas']['FrdSemanticTypeUndefined']['properties']['undefinedSemanticType']['enum'][228]SEMANTIC_TYPE_CASES_WHATSAPP_CONSENT
root['schemas']['FrdSemanticTypeUndefined']['properties']['undefinedSemanticType']['enum'][285]SEMANTIC_TYPE_CS_TEAM_ID
root['schemas']['FrdSemanticTypeUndefined']['properties']['undefinedSemanticType']['enum'][555]SEMANTIC_TYPE_MENU_OF_SERVICE_ORDER_ID
root['schemas']['FrdSemanticTypeUndefined']['properties']['undefinedSemanticType']['enumDescriptions'][45]b/400713111
root['schemas']['FrdSemanticTypeUndefined']['properties']['undefinedSemanticType']['enumDescriptions'][124]b/399143770
root['schemas']['FrdSemanticTypeUndefined']['properties']['undefinedSemanticType']['enumDescriptions'][228]b/397762924
root['schemas']['FrdSemanticTypeUndefined']['properties']['undefinedSemanticType']['enumDescriptions'][285]b/399076775
root['schemas']['FrdSemanticTypeUndefined']['properties']['undefinedSemanticType']['enumDescriptions'][555]b/399143094
root['schemas']['FrdUndefined']['properties']['undefinedFrdIdentifier']['enum'][66]IDENTIFIER_ADS_JOINT_BUSINESS_PLAN_ID
root['schemas']['FrdUndefined']['properties']['undefinedFrdIdentifier']['enum'][154]IDENTIFIER_ADVERTISER_SERVICE_CATEGORY
root['schemas']['FrdUndefined']['properties']['undefinedFrdIdentifier']['enum'][277]IDENTIFIER_CASES_WHATSAPP_CONSENT
root['schemas']['FrdUndefined']['properties']['undefinedFrdIdentifier']['enum'][372]IDENTIFIER_CS_TEAM_ID
root['schemas']['FrdUndefined']['properties']['undefinedFrdIdentifier']['enum'][727]IDENTIFIER_MENU_OF_SERVICE_ORDER_ID
root['schemas']['FrdUndefined']['properties']['undefinedFrdIdentifier']['enumDescriptions'][66]b/400713111
root['schemas']['FrdUndefined']['properties']['undefinedFrdIdentifier']['enumDescriptions'][154]b/399143770
root['schemas']['FrdUndefined']['properties']['undefinedFrdIdentifier']['enumDescriptions'][277]b/397762924
root['schemas']['FrdUndefined']['properties']['undefinedFrdIdentifier']['enumDescriptions'][372]b/399076775
root['schemas']['FrdUndefined']['properties']['undefinedFrdIdentifier']['enumDescriptions'][727]b/399143094
root['schemas']['GetAvailableFrdValuesRequest']['properties']['resultFrdIdentifierMask']['items']['enum'][66]IDENTIFIER_ADS_JOINT_BUSINESS_PLAN_ID
root['schemas']['GetAvailableFrdValuesRequest']['properties']['resultFrdIdentifierMask']['items']['enum'][154]IDENTIFIER_ADVERTISER_SERVICE_CATEGORY
root['schemas']['GetAvailableFrdValuesRequest']['properties']['resultFrdIdentifierMask']['items']['enum'][277]IDENTIFIER_CASES_WHATSAPP_CONSENT
root['schemas']['GetAvailableFrdValuesRequest']['properties']['resultFrdIdentifierMask']['items']['enum'][372]IDENTIFIER_CS_TEAM_ID
root['schemas']['GetAvailableFrdValuesRequest']['properties']['resultFrdIdentifierMask']['items']['enum'][727]IDENTIFIER_MENU_OF_SERVICE_ORDER_ID
root['schemas']['GetAvailableFrdValuesRequest']['properties']['resultFrdIdentifierMask']['items']['enumDescriptions'][66]b/400713111
root['schemas']['GetAvailableFrdValuesRequest']['properties']['resultFrdIdentifierMask']['items']['enumDescriptions'][154]b/399143770
root['schemas']['GetAvailableFrdValuesRequest']['properties']['resultFrdIdentifierMask']['items']['enumDescriptions'][277]b/397762924
root['schemas']['GetAvailableFrdValuesRequest']['properties']['resultFrdIdentifierMask']['items']['enumDescriptions'][372]b/399076775
root['schemas']['GetAvailableFrdValuesRequest']['properties']['resultFrdIdentifierMask']['items']['enumDescriptions'][727]b/399143094
root['schemas']['LocalizedContextViewMetadataOmitForTypes']['properties']['requestSource']['items']['enum'][143]RS_RISK_MANAGEMENT_AND_COMPLIANCE
root['schemas']['PropertyValue']['properties']['userProduct']['enum'][17]YOUTUBE_CREATOR_SUPPORT_ADMIN_POLICY_CONTEXT
root['schemas']['PropertyValue']['properties']['userProduct']['enum'][18]YOUTUBE_CREATOR_SUPPORT_ADMIN_PROFILE_CONTEXT
root['schemas']['PropertyValue']['properties']['userProduct']['enum'][417]CUSTOMER_COMPANY_TIER_SEGMENTS
root['schemas']['PropertyValue']['properties']['userProduct']['enumDescriptions'][417]Specialize CDP Products Signal Groups *************************************** Customer Company Tier Segments from CustomerAccount used for Cases enrichment and/or routing.
root['schemas']['WorkflowClassValueTypeDescriptor']['properties']['sourceFrd']['enum'][66]IDENTIFIER_ADS_JOINT_BUSINESS_PLAN_ID
root['schemas']['WorkflowClassValueTypeDescriptor']['properties']['sourceFrd']['enum'][154]IDENTIFIER_ADVERTISER_SERVICE_CATEGORY
root['schemas']['WorkflowClassValueTypeDescriptor']['properties']['sourceFrd']['enum'][277]IDENTIFIER_CASES_WHATSAPP_CONSENT
root['schemas']['WorkflowClassValueTypeDescriptor']['properties']['sourceFrd']['enum'][372]IDENTIFIER_CS_TEAM_ID
root['schemas']['WorkflowClassValueTypeDescriptor']['properties']['sourceFrd']['enum'][727]IDENTIFIER_MENU_OF_SERVICE_ORDER_ID
root['schemas']['WorkflowClassValueTypeDescriptor']['properties']['sourceFrd']['enumDescriptions'][66]b/400713111
root['schemas']['WorkflowClassValueTypeDescriptor']['properties']['sourceFrd']['enumDescriptions'][154]b/399143770
root['schemas']['WorkflowClassValueTypeDescriptor']['properties']['sourceFrd']['enumDescriptions'][277]b/397762924
root['schemas']['WorkflowClassValueTypeDescriptor']['properties']['sourceFrd']['enumDescriptions'][372]b/399076775
root['schemas']['WorkflowClassValueTypeDescriptor']['properties']['sourceFrd']['enumDescriptions'][727]b/399143094
prod/contrails-
values_changed
root['revision']
new_value20250312
old_value20250310
prod/contrails-v1
values_changed
root['revision']
new_value20250312
old_value20250310
prod/corplearning-
values_changed
root['revision']
new_value20250312
old_value20250309
prod/corplearning-v1
values_changed
root['revision']
new_value20250312
old_value20250309
prod/cryptauthdevicesync-
values_changed
root['revision']
new_value20250309
old_value20250223
prod/cryptauthdevicesync-v1
values_changed
root['revision']
new_value20250309
old_value20250223
prod/cryptauthvault-
values_changed
root['revision']
new_value20250302
old_value20250303
prod/cryptauthvault-v1
values_changed
root['revision']
new_value20250302
old_value20250303
prod/daily-cloudsearch-
values_changed
root['revision']
new_value20250313
old_value20250311
prod/daily-cloudsearch-v1
values_changed
root['revision']
new_value20250313
old_value20250311
prod/daily-dynamicmail-pa.sandbox-
values_changed
root['revision']
new_value20250313
old_value20250309
prod/daily-dynamicmail-pa.sandbox-v2
values_changed
root['revision']
new_value20250313
old_value20250309
prod/dataaccessauditlogging-pa-
values_changed
root['revision']
new_value20250309
old_value20250227
root['schemas']['DataaccessauditloggingPaSecurityDataAccessAppSpecificResources']['description']
new_valueA set of resources that EndUserCredentials (EUCs) may grant access to, independent of any given user's ability to access them. As always, an API scope code check must be performed before authorizing access. Regardless of what ASRs are present, no access should be permitted unless it would also be permitted under all-principals authority for the same scope code. Repeated field names in this file should not be pluralized. This file was created before go/protostyle started recommending pluralizing repeated field names. For legacy files, go/protostyle emphasizes consistency. Design doc: go/tonic-asr. Next tag: 160 The type of each field below must be defined in //logs/proto/data_access/asr/.
old_valueA set of resources that EndUserCredentials (EUCs) may grant access to, independent of any given user's ability to access them. As always, an API scope code check must be performed before authorizing access. Regardless of what ASRs are present, no access should be permitted unless it would also be permitted under all-principals authority for the same scope code. Repeated field names in this file should not be pluralized. This file was created before go/protostyle started recommending pluralizing repeated field names. For legacy files, go/protostyle emphasizes consistency. Design doc: go/tonic-asr. Next tag: 157 The type of each field below must be defined in //logs/proto/data_access/asr/.
root['schemas']['DataaccessauditloggingPaUtilStatusProto']['properties']['canonicalCode']['description']
new_valuecopybara:strip_begin(b/383363683) copybara:strip_end_and_replace optional int32 canonical_code = 6;
old_valueThe canonical error code (see codes.proto) that most closely corresponds to this status. This may be missing, and in the common case of the generic space, it definitely will be. copybara:strip_begin(b/383363683) copybara:strip_end_and_replace optional int32 canonical_code = 6;
root['schemas']['DataaccessauditloggingPaUtilStatusProto']['properties']['space']['description']
new_valuecopybara:strip_begin(b/383363683) Space to which this status belongs copybara:strip_end_and_replace optional string space = 2; // Space to which this status belongs
old_valueThe following are usually only present when code != 0 Space to which this status belongs copybara:strip_begin(b/383363683) copybara:strip_end_and_replace optional string space = 2;
root['schemas']['DataaccessauditloggingPaSecurityDataAccessResourceId']['properties']['semanticType']['items']['enumDescriptions'][122]
new_valueGoogle generated data, which is purely internal and from Google's system and operation. This data is not associated with (e.g., filtered to, grouped by) any specific external user/customer (an internal mdb group would be fine). This is not user data. System generated data that is associated with an end user/customer should instead use ST_SYSTEM_DIAGNOSTIC_INFO. Corresponds to http://go/cloud-dcg#operational-data Examples: * The name of a class, field, etc of Google maintained code. * Schema information of Google-owned internal DBs including SQL statements only referring to schema names (table, column, etc.). * Tool Proxy Grants guarding database backup/restores (go/cloud-dcg#operational-data)
old_valueGoogle generated data, which is purely internal and from Google's system and operation. This data is not associated with (e.g., filtered to, grouped by) any specific external user/customer (an internal mdb group would be fine). This is not user data. System generated data that is associated with an end user/customer should instead use ST_SYSTEM_DIAGNOSTIC_INFO. Corresponds to http://go/cloud-dcg#operational-data Examples: * Schema information of Google owned internal DBs including SQL statements only referring to schema names (table, column, etc.). Note: if a query has column value literals, the data type is the same as the column's annotated type in data governance (go/dg-kb) for different governance use cases. * Tool Proxy Grants guarding database backup/restores
root['schemas']['DataaccessauditloggingPaSecurityDataAccessDataAccessLogProtoFieldMetadata']['properties']['semanticType']['items']['enumDescriptions'][122]
new_valueGoogle generated data, which is purely internal and from Google's system and operation. This data is not associated with (e.g., filtered to, grouped by) any specific external user/customer (an internal mdb group would be fine). This is not user data. System generated data that is associated with an end user/customer should instead use ST_SYSTEM_DIAGNOSTIC_INFO. Corresponds to http://go/cloud-dcg#operational-data Examples: * The name of a class, field, etc of Google maintained code. * Schema information of Google-owned internal DBs including SQL statements only referring to schema names (table, column, etc.). * Tool Proxy Grants guarding database backup/restores (go/cloud-dcg#operational-data)
old_valueGoogle generated data, which is purely internal and from Google's system and operation. This data is not associated with (e.g., filtered to, grouped by) any specific external user/customer (an internal mdb group would be fine). This is not user data. System generated data that is associated with an end user/customer should instead use ST_SYSTEM_DIAGNOSTIC_INFO. Corresponds to http://go/cloud-dcg#operational-data Examples: * Schema information of Google owned internal DBs including SQL statements only referring to schema names (table, column, etc.). Note: if a query has column value literals, the data type is the same as the column's annotated type in data governance (go/dg-kb) for different governance use cases. * Tool Proxy Grants guarding database backup/restores
prod/dataaccessauditlogging-pa-v1
values_changed
root['revision']
new_value20250309
old_value20250227
root['schemas']['DataaccessauditloggingPaSecurityDataAccessAppSpecificResources']['description']
new_valueA set of resources that EndUserCredentials (EUCs) may grant access to, independent of any given user's ability to access them. As always, an API scope code check must be performed before authorizing access. Regardless of what ASRs are present, no access should be permitted unless it would also be permitted under all-principals authority for the same scope code. Repeated field names in this file should not be pluralized. This file was created before go/protostyle started recommending pluralizing repeated field names. For legacy files, go/protostyle emphasizes consistency. Design doc: go/tonic-asr. Next tag: 160 The type of each field below must be defined in //logs/proto/data_access/asr/.
old_valueA set of resources that EndUserCredentials (EUCs) may grant access to, independent of any given user's ability to access them. As always, an API scope code check must be performed before authorizing access. Regardless of what ASRs are present, no access should be permitted unless it would also be permitted under all-principals authority for the same scope code. Repeated field names in this file should not be pluralized. This file was created before go/protostyle started recommending pluralizing repeated field names. For legacy files, go/protostyle emphasizes consistency. Design doc: go/tonic-asr. Next tag: 157 The type of each field below must be defined in //logs/proto/data_access/asr/.
root['schemas']['DataaccessauditloggingPaUtilStatusProto']['properties']['canonicalCode']['description']
new_valuecopybara:strip_begin(b/383363683) copybara:strip_end_and_replace optional int32 canonical_code = 6;
old_valueThe canonical error code (see codes.proto) that most closely corresponds to this status. This may be missing, and in the common case of the generic space, it definitely will be. copybara:strip_begin(b/383363683) copybara:strip_end_and_replace optional int32 canonical_code = 6;
root['schemas']['DataaccessauditloggingPaUtilStatusProto']['properties']['space']['description']
new_valuecopybara:strip_begin(b/383363683) Space to which this status belongs copybara:strip_end_and_replace optional string space = 2; // Space to which this status belongs
old_valueThe following are usually only present when code != 0 Space to which this status belongs copybara:strip_begin(b/383363683) copybara:strip_end_and_replace optional string space = 2;
root['schemas']['DataaccessauditloggingPaSecurityDataAccessResourceId']['properties']['semanticType']['items']['enumDescriptions'][122]
new_valueGoogle generated data, which is purely internal and from Google's system and operation. This data is not associated with (e.g., filtered to, grouped by) any specific external user/customer (an internal mdb group would be fine). This is not user data. System generated data that is associated with an end user/customer should instead use ST_SYSTEM_DIAGNOSTIC_INFO. Corresponds to http://go/cloud-dcg#operational-data Examples: * The name of a class, field, etc of Google maintained code. * Schema information of Google-owned internal DBs including SQL statements only referring to schema names (table, column, etc.). * Tool Proxy Grants guarding database backup/restores (go/cloud-dcg#operational-data)
old_valueGoogle generated data, which is purely internal and from Google's system and operation. This data is not associated with (e.g., filtered to, grouped by) any specific external user/customer (an internal mdb group would be fine). This is not user data. System generated data that is associated with an end user/customer should instead use ST_SYSTEM_DIAGNOSTIC_INFO. Corresponds to http://go/cloud-dcg#operational-data Examples: * Schema information of Google owned internal DBs including SQL statements only referring to schema names (table, column, etc.). Note: if a query has column value literals, the data type is the same as the column's annotated type in data governance (go/dg-kb) for different governance use cases. * Tool Proxy Grants guarding database backup/restores
root['schemas']['DataaccessauditloggingPaSecurityDataAccessDataAccessLogProtoFieldMetadata']['properties']['semanticType']['items']['enumDescriptions'][122]
new_valueGoogle generated data, which is purely internal and from Google's system and operation. This data is not associated with (e.g., filtered to, grouped by) any specific external user/customer (an internal mdb group would be fine). This is not user data. System generated data that is associated with an end user/customer should instead use ST_SYSTEM_DIAGNOSTIC_INFO. Corresponds to http://go/cloud-dcg#operational-data Examples: * The name of a class, field, etc of Google maintained code. * Schema information of Google-owned internal DBs including SQL statements only referring to schema names (table, column, etc.). * Tool Proxy Grants guarding database backup/restores (go/cloud-dcg#operational-data)
old_valueGoogle generated data, which is purely internal and from Google's system and operation. This data is not associated with (e.g., filtered to, grouped by) any specific external user/customer (an internal mdb group would be fine). This is not user data. System generated data that is associated with an end user/customer should instead use ST_SYSTEM_DIAGNOSTIC_INFO. Corresponds to http://go/cloud-dcg#operational-data Examples: * Schema information of Google owned internal DBs including SQL statements only referring to schema names (table, column, etc.). Note: if a query has column value literals, the data type is the same as the column's annotated type in data governance (go/dg-kb) for different governance use cases. * Tool Proxy Grants guarding database backup/restores
prod/datamanager-
values_changed
root['revision']
new_value20250312
old_value20250309
prod/datamanager-v1
values_changed
root['revision']
new_value20250312
old_value20250309
prod/datamixer-pa-
values_changed
root['revision']
new_value20250310
old_value20250303
prod/datamixer-pa-v1
values_changed
root['revision']
new_value20250310
old_value20250303
prod/dataproc-control-
values_changed
root['revision']
new_value20250311
old_value20250224
prod/dataproc-control-v1
values_changed
root['revision']
new_value20250311
old_value20250224
prod/dataproccontrol-
values_changed
root['revision']
new_value20250311
old_value20250224
prod/dataproccontrol-v1
values_changed
root['revision']
new_value20250311
old_value20250224
prod/dataprocgdc-
values_changed
root['revision']
new_value20250305
old_value20250226
prod/dataprocgdc-v1
values_changed
root['revision']
new_value20250305
old_value20250226
prod/dataprocgdc-v1alpha1
values_changed
root['revision']
new_value20250305
old_value20250226
prod/dataprocrm-
values_changed
root['revision']
new_value20250306
old_value20250303
prod/dataprocrm-v1
values_changed
root['revision']
new_value20250306
old_value20250303
prod/datastudio-
values_changed
root['revision']
new_value20250311
old_value20250302
prod/datastudio-v1
values_changed
root['revision']
new_value20250311
old_value20250302
prod/developerscontentsearch-pa-
values_changed
root['revision']
new_value20250312
old_value20250309
prod/developerscontentsearch-pa-v1
values_changed
root['revision']
new_value20250312
old_value20250309
prod/deviceenrollmentforwindows-
values_changed
root['revision']
new_value20250309
old_value20250302
prod/deviceenrollmentforwindows-v1
values_changed
root['revision']
new_value20250309
old_value20250302
prod/devicemanagementforwindows-
values_changed
root['revision']
new_value20250309
old_value20250302
prod/devicemanagementforwindows-v1
values_changed
root['revision']
new_value20250309
old_value20250302
prod/directions-pa-
values_changed
root['revision']
new_value20250312
old_value20250306
prod/directions-pa-v1
values_changed
root['revision']
new_value20250312
old_value20250306
prod/directions-pa-v1alpha
values_changed
root['revision']
new_value20250312
old_value20250306
prod/drivefrontend-pa-
dictionary_item_added
  • root['schemas']['Item']['properties']['recursiveFolderCount']['deprecated']
  • root['schemas']['ListChangesResponse']['properties']['status']
values_changed
root['revision']
new_value20250311
old_value20250303
root['schemas']['RemovePreventSyncUserRestrictionRequest']['properties']['userAction']['enumDescriptions'][1]
new_valueThe user marked the detection as a false positive.
old_valueThe user clicked the "I recogonize it" button. Indicating the detection was a false-positive.
root['schemas']['RemovePreventSyncUserRestrictionRequest']['properties']['userAction']['enumDescriptions'][2]
new_valueThe user marked the detection as a true-positive.
old_valueThe user disconnected the DfD client from the account. Indicating the detection was a true-positive.
prod/drivefrontend-pa-v1
dictionary_item_added
  • root['schemas']['Item']['properties']['recursiveFolderCount']['deprecated']
  • root['schemas']['ListChangesResponse']['properties']['status']
values_changed
root['revision']
new_value20250311
old_value20250303
root['schemas']['RemovePreventSyncUserRestrictionRequest']['properties']['userAction']['enumDescriptions'][1]
new_valueThe user marked the detection as a false positive.
old_valueThe user clicked the "I recogonize it" button. Indicating the detection was a false-positive.
root['schemas']['RemovePreventSyncUserRestrictionRequest']['properties']['userAction']['enumDescriptions'][2]
new_valueThe user marked the detection as a true-positive.
old_valueThe user disconnected the DfD client from the account. Indicating the detection was a true-positive.
prod/dynamicmail-pa-
values_changed
root['revision']
new_value20250309
old_value20250304
prod/dynamicmail-pa-v2
values_changed
root['revision']
new_value20250309
old_value20250304
prod/dynamiteintegration-pa-
dictionary_item_added
  • root['schemas']['SheetsActionsNavigateAction']
  • root['schemas']['SheetsActionsNavigationInfo']
  • root['schemas']['ClientFeatureCapabilities']['properties']['speedbumpBypassLevel']
  • root['schemas']['DuetAiActionLinkAccount']['properties']['connectorUrl']
  • root['schemas']['SheetsActions']['properties']['navigateAction']
  • root['schemas']['SheetsActionsOpenSidebarAction']['properties']['navigationInfo']
values_changed
root['revision']
new_value20250311
old_value20250302
root['schemas']['ClientFeatureCapabilities']['description']
new_valueLINT: LEGACY_NAMES Collection of signals to tell the server how it should behave with respect to the specified feature. This is the backend version of the ClientFeatureCapabilities proto defined in frontend: http://shortn/_fTH8ERcJxW. Only the set of signals used in the backend are copied over from the frontend proto. LINT.IfChange Next tag: 52
old_valueLINT: LEGACY_NAMES Collection of signals to tell the server how it should behave with respect to the specified feature. This is the backend version of the ClientFeatureCapabilities proto defined in frontend: http://shortn/_fTH8ERcJxW. Only the set of signals used in the backend are copied over from the frontend proto. LINT.IfChange Next tag: 51
root['schemas']['SlashCommand']['properties']['name']['description']
new_valueThe name of the slash command that must start with a `/`.
old_valueThe name of the command.
root['schemas']['WorkflowDataSource']['description']
new_valueWorkflow only. In a `TextInput` or `SelectionInput` widget with MULTI_SELECT type or a `DateTimePicker`, provide data source from Google.
old_valueWorkflow only. In a `SelectionInput` or `TextInput` widget with DROPDOWN or MULTI_SELECT type, provide data source from Google.
iterable_item_added
root['schemas']['DuetAiActionStaticPlanData']['properties']['generateUseCase']['enum'][11]SUMMARIZE_FILE
root['schemas']['DuetAiActionStaticPlanData']['properties']['generateUseCase']['enum'][58]GENERATE_ITEM_NAME_SUGGESTIONS
root['schemas']['DuetAiActionStaticPlanData']['properties']['generateUseCase']['enum'][94]GENERATE_NUDGE_PROMPTS
root['schemas']['DuetAiActionStaticPlanData']['properties']['generateUseCase']['enumDescriptions'][11]Generate a summary based on the content of a specified file. This use case is now used for 1P Link Summary feature.
root['schemas']['DuetAiActionStaticPlanData']['properties']['generateUseCase']['enumDescriptions'][58]Generate item name suggestions from the context (e.g. drive item), and the user can apply a generated suggestion as the item name.
root['schemas']['DuetAiActionStaticPlanData']['properties']['generateUseCase']['enumDescriptions'][94]Use case for generating prompts for nudges. Currently used in the PDF Viewer in Drive.
root['schemas']['UiKitGemkickExtensionDetails']['properties']['operationType']['enum'][25]GEMKICK_EXTENSION_OPERATION_TYPE_CREATE_A_NOTE_FOR_CONTACT_IN_TOOL_IMPRESSION
root['schemas']['UiKitGemkickExtensionDetails']['properties']['operationType']['enum'][26]GEMKICK_EXTENSION_OPERATION_TYPE_CREATE_A_NOTE_FOR_CONTACT_IN_TOOL_CLICKED
iterable_item_removed
root['schemas']['DuetAiActionStaticPlanData']['properties']['generateUseCase']['enum'][93]CATEGORIZE_EMAIL_FOR_DRIVE
prod/dynamiteintegration-pa-v1
dictionary_item_added
  • root['schemas']['SheetsActionsNavigateAction']
  • root['schemas']['SheetsActionsNavigationInfo']
  • root['schemas']['ClientFeatureCapabilities']['properties']['speedbumpBypassLevel']
  • root['schemas']['DuetAiActionLinkAccount']['properties']['connectorUrl']
  • root['schemas']['SheetsActions']['properties']['navigateAction']
  • root['schemas']['SheetsActionsOpenSidebarAction']['properties']['navigationInfo']
values_changed
root['revision']
new_value20250311
old_value20250302
root['schemas']['ClientFeatureCapabilities']['description']
new_valueLINT: LEGACY_NAMES Collection of signals to tell the server how it should behave with respect to the specified feature. This is the backend version of the ClientFeatureCapabilities proto defined in frontend: http://shortn/_fTH8ERcJxW. Only the set of signals used in the backend are copied over from the frontend proto. LINT.IfChange Next tag: 52
old_valueLINT: LEGACY_NAMES Collection of signals to tell the server how it should behave with respect to the specified feature. This is the backend version of the ClientFeatureCapabilities proto defined in frontend: http://shortn/_fTH8ERcJxW. Only the set of signals used in the backend are copied over from the frontend proto. LINT.IfChange Next tag: 51
root['schemas']['SlashCommand']['properties']['name']['description']
new_valueThe name of the slash command that must start with a `/`.
old_valueThe name of the command.
root['schemas']['WorkflowDataSource']['description']
new_valueWorkflow only. In a `TextInput` or `SelectionInput` widget with MULTI_SELECT type or a `DateTimePicker`, provide data source from Google.
old_valueWorkflow only. In a `SelectionInput` or `TextInput` widget with DROPDOWN or MULTI_SELECT type, provide data source from Google.
iterable_item_added
root['schemas']['DuetAiActionStaticPlanData']['properties']['generateUseCase']['enum'][11]SUMMARIZE_FILE
root['schemas']['DuetAiActionStaticPlanData']['properties']['generateUseCase']['enum'][58]GENERATE_ITEM_NAME_SUGGESTIONS
root['schemas']['DuetAiActionStaticPlanData']['properties']['generateUseCase']['enum'][94]GENERATE_NUDGE_PROMPTS
root['schemas']['DuetAiActionStaticPlanData']['properties']['generateUseCase']['enumDescriptions'][11]Generate a summary based on the content of a specified file. This use case is now used for 1P Link Summary feature.
root['schemas']['DuetAiActionStaticPlanData']['properties']['generateUseCase']['enumDescriptions'][58]Generate item name suggestions from the context (e.g. drive item), and the user can apply a generated suggestion as the item name.
root['schemas']['DuetAiActionStaticPlanData']['properties']['generateUseCase']['enumDescriptions'][94]Use case for generating prompts for nudges. Currently used in the PDF Viewer in Drive.
root['schemas']['UiKitGemkickExtensionDetails']['properties']['operationType']['enum'][25]GEMKICK_EXTENSION_OPERATION_TYPE_CREATE_A_NOTE_FOR_CONTACT_IN_TOOL_IMPRESSION
root['schemas']['UiKitGemkickExtensionDetails']['properties']['operationType']['enum'][26]GEMKICK_EXTENSION_OPERATION_TYPE_CREATE_A_NOTE_FOR_CONTACT_IN_TOOL_CLICKED
iterable_item_removed
root['schemas']['DuetAiActionStaticPlanData']['properties']['generateUseCase']['enum'][93]CATEGORIZE_EMAIL_FOR_DRIVE
prod/embeddedassistant-
values_changed
root['revision']
new_value20250313
old_value20250310
prod/embeddedassistant-v1
values_changed
root['revision']
new_value20250313
old_value20250310
prod/embeddedassistant-v1alpha2
values_changed
root['revision']
new_value20250313
old_value20250310
prod/embeddedassistant-v1beta1
values_changed
root['revision']
new_value20250313
old_value20250310
prod/emmapplecodevice-
values_changed
root['revision']
new_value20250311
old_value20250309
prod/emmapplecodevice-v1
values_changed
root['revision']
new_value20250311
old_value20250304
prod/enterpriseknowledgegraph-
values_changed
root['revision']
new_value20250228
old_value20250221
prod/enterpriseknowledgegraph-v1
values_changed
root['revision']
new_value20250228
old_value20250221
prod/eu-alpha-vision-
values_changed
root['revision']
new_value20250307
old_value20250228
prod/eu-alpha-vision-v1
values_changed
root['revision']
new_value20250307
old_value20250228
prod/eu-alpha-vision-v1p1beta1
values_changed
root['revision']
new_value20250307
old_value20250228
prod/eu-alpha-vision-v1p2beta1
values_changed
root['revision']
new_value20250307
old_value20250228
prod/eu-alpha-vision-v1p3beta1
values_changed
root['revision']
new_value20250307
old_value20250228
prod/eu-alpha-vision-v1p4beta1
values_changed
root['revision']
new_value20250307
old_value20250228
prod/eu-chronicle-
values_changed
root['resources']['projects']['resources']['locations']['resources']['instances']['methods']['get']['parameters']['name']['description']
new_valueRequired. The name of the instance to retrieve. Format: projects/{project_id}/locations/{location}/instances/{instance}
old_valueRequired. The name of the instance to retrieve. Format: projects/{project_id}/locations/{region}/instances/{instance}
root['revision']
new_value20250310
old_value20250227
root['schemas']
new_value
AIOverview
descriptionAI generated overview for the search results.
idAIOverview
properties
aiSummary
descriptionAI summary for the search results. Markdown formatted.
typestring
complete
descriptionWhether AI overview generation is complete.
typeboolean
suggestions
descriptionSuggested actions to continue the investigation in chat.
items
$refAction
typearray
typeobject
Action
descriptionAction represents an action that can be performed in the host UI.
idAction
properties
actionType
descriptionOutput only. Type of action.
enum
  • ACTION_TYPE_UNSPECIFIED
  • FOLLOW_UP
  • NAVIGATION
  • EXECUTION
enumDescriptions
  • The action type is unspecified.
  • The action is a follow up action.
  • The action is a navigation action.
  • The action is an execution action.
readOnlyTrue
typestring
displayText
descriptionOutput only. The text that'll be displayed to the user if this is rendered in the UI as a suggested action.
readOnlyTrue
typestring
execution
$refExecution
descriptionMetadata for execution action.
followUp
$refFollowUp
descriptionMetadata for follow up action.
navigation
$refNavigation
descriptionMetadata for navigation action.
useCaseId
descriptionOutput only. The use case ID of the action. It's used internally to identify in which context the action is used.
readOnlyTrue
typestring
typeobject
AlertFieldAggregation
idAlertFieldAggregation
properties
alertCount
formatint32
typeinteger
allValues
items
$refAlertFieldValueCount
typearray
baselineAlertCount
formatint32
typeinteger
bottomValues
items
$refAlertFieldValueCount
typearray
fieldName
typestring
tooManyValues
typeboolean
topValues
items
$refAlertFieldValueCount
typearray
valueCount
formatint32
typeinteger
typeobject
AlertFieldAggregations
idAlertFieldAggregations
properties
fields
items
$refAlertFieldAggregation
typearray
typeobject
AlertFieldValue
idAlertFieldValue
properties
boolValue
typeboolean
bytesValue
formatbyte
typestring
doubleValue
formatdouble
typenumber
enumValue
typestring
floatValue
formatfloat
typenumber
int32Value
formatint32
typeinteger
int64Value
formatint64
typestring
stringValue
typestring
uint32Value
formatuint32
typeinteger
uint64Value
formatuint64
typestring
typeobject
AlertFieldValueCount
idAlertFieldValueCount
properties
alertCount
formatint32
typeinteger
baselineAlertCount
formatint32
typeinteger
value
$refAlertFieldValue
typeobject
AnalystVerdict
descriptionVerdict provided by the human analyst. These fields are used to model Mandiant sources.
idAnalystVerdict
properties
confidenceScore
descriptionConfidence score of the verdict.
formatint32
typeinteger
verdictResponse
descriptionDetails of the verdict.
enum
  • VERDICT_RESPONSE_UNSPECIFIED
  • MALICIOUS
  • BENIGN
enumDescriptions
  • The default verdict response type.
  • VerdictResponse resulted a threat as malicious.
  • VerdictResponse resulted a threat as benign.
typestring
verdictTime
descriptionTimestamp at which the verdict was generated.
formatgoogle-datetime
typestring
typeobject
AnalyticsMetadata
descriptionStores information about an analytics metric used in a rule.
idAnalyticsMetadata
properties
analytic
descriptionName of the analytic.
typestring
typeobject
Annotation
descriptionExtra parameters that don't fit anywhere else, captured as key/value. For example "VendorID/42" in BlackBerry user agents. The following keys are modified with reduced User-Agent and no client hints (go/ua-reduction-ua-string-reference): * "Chrome" (see `browser_version`) * "ChromiumBrowser" (unavailable) * "ChromeWebview" (unavailable) * "OS_VERSION" (see `os`) * "Rest" (unavailable) * "misc" (see `device`)
idAnnotation
properties
key
typestring
value
typestring
typeobject
Artifact
descriptionInformation about an artifact. The artifact can only be an IP.
idArtifact
properties
anonymous
descriptionWhether the VPN tunnels are configured for anonymous browsing or not.
typeboolean
artifactClient
$refArtifactClient
descriptionEntity or software accessing or utilizing network resources.
asOwner
descriptionOwner of the Autonomous System to which the IP address belongs.
typestring
asn
descriptionAutonomous System Number to which the IP address belongs.
formatint64
typestring
firstSeenTime
descriptionFirst seen timestamp of the IP in the customer's environment.
formatgoogle-datetime
typestring
ip
descriptionIP address of the artifact. This field can be used as an entity indicator for an external destination IP entity.
typestring
jarm
descriptionThe JARM hash for the IP address. (https://engineering.salesforce.com/easily-identify-malicious-servers-on-the-internet-with-jarm-e095edac525a).
typestring
lastHttpsCertificate
$refSSLCertificate
descriptionSSL certificate information about the IP address.
lastHttpsCertificateDate
descriptionMost recent date for the certificate in VirusTotal.
formatgoogle-datetime
typestring
lastSeenTime
descriptionLast seen timestamp of the IP address in the customer's environment.
formatgoogle-datetime
typestring
location
$refLocation
descriptionLocation of the Artifact's IP address.
network
$refNetwork
descriptionNetwork information related to the Artifact's IP address.
prevalence
$refPrevalence
descriptionThe prevalence of the artifact within the customer's environment.
regionalInternetRegistry
descriptionRIR (one of the current RIRs: AFRINIC, ARIN, APNIC, LACNIC or RIPE NCC).
typestring
risks
descriptionThis field lists potential risks associated with the network activity.
items
typestring
typearray
tags
descriptionIdentification attributes
items
typestring
typearray
tunnels
descriptionVPN tunnels.
items
$refTunnels
typearray
whois
descriptionWHOIS information as returned from the pertinent WHOIS server.
typestring
whoisDate
descriptionDate of the last update of the WHOIS record in VirusTotal.
formatgoogle-datetime
typestring
typeobject
ArtifactClient
descriptionEntity or software accessing or utilizing network resources.
idArtifactClient
properties
behaviors
descriptionThe behaviors of the client accessing the network.
items
typestring
typearray
proxies
descriptionThe type of proxies used by the client.
items
typestring
typearray
typeobject
Asset
descriptionInformation about a compute asset such as a workstation, laptop, phone, virtual desktop, or VM.
idAsset
properties
assetId
descriptionThe asset ID. Value must contain the ':' character. For example, cs:abcdd23434. This field can be used as an entity indicator for asset entities.
typestring
attribute
$refAttribute
descriptionGeneric entity metadata attributes of the asset.
category
descriptionThe category of the asset (e.g. "End User Asset", "Workstation", "Server").
typestring
creationTime
deprecatedTrue
descriptionTime the asset was created or provisioned. Deprecate: creation_time should be populated in Attribute as generic metadata.
formatgoogle-datetime
typestring
deploymentStatus
descriptionThe deployment status of the asset for device lifecycle purposes.
enum
  • DEPLOYMENT_STATUS_UNSPECIFIED
  • ACTIVE
  • PENDING_DECOMISSION
  • DECOMISSIONED
enumDescriptions
  • Unspecified deployment status.
  • Asset is active, functional and deployed.
  • Asset is pending decommission and no longer deployed.
  • Asset is decommissioned.
typestring
firstDiscoverTime
descriptionTime the asset was first discovered (by asset management/discoverability software).
formatgoogle-datetime
typestring
firstSeenTime
descriptionThe first observed time for an asset. The value is calculated on the basis of the first time the identifier was observed.
formatgoogle-datetime
typestring
hardware
descriptionThe asset hardware specifications.
items
$refHardware
typearray
hostname
descriptionAsset hostname or domain name field. This field can be used as an entity indicator for asset entities.
typestring
ip
descriptionA list of IP addresses associated with an asset. This field can be used as an entity indicator for asset entities.
items
typestring
typearray
labels
deprecatedTrue
descriptionMetadata labels for the asset. Deprecated: labels should be populated in Attribute as generic metadata.
items
$refLabel
typearray
lastBootTime
descriptionTime the asset was last boot started.
formatgoogle-datetime
typestring
lastDiscoverTime
descriptionTime the asset was last discovered (by asset management/discoverability software).
formatgoogle-datetime
typestring
location
$refLocation
descriptionLocation of the asset.
mac
descriptionList of MAC addresses associated with an asset. This field can be used as an entity indicator for asset entities.
items
typestring
typearray
natIp
descriptionList of NAT IP addresses associated with an asset.
items
typestring
typearray
networkDomain
descriptionThe network domain of the asset (e.g. "corp.acme.com")
typestring
platformSoftware
$refPlatformSoftware
descriptionThe asset operating system platform software.
productObjectId
descriptionA vendor-specific identifier to uniquely identify the entity (a GUID or similar). This field can be used as an entity indicator for asset entities.
typestring
software
descriptionThe asset software details.
items
$refSoftware
typearray
systemLastUpdateTime
descriptionTime the asset system or OS was last updated. For all other operations that are not system updates (such as resizing a VM), use Attribute.last_update_time.
formatgoogle-datetime
typestring
type
descriptionThe type of the asset (e.g. workstation or laptop or server).
enum
  • ROLE_UNSPECIFIED
  • WORKSTATION
  • LAPTOP
  • IOT
  • NETWORK_ATTACHED_STORAGE
  • PRINTER
  • SCANNER
  • SERVER
  • TAPE_LIBRARY
  • MOBILE
enumDescriptions
  • Unspecified asset role.
  • A workstation or desktop.
  • A laptop computer.
  • An IOT asset.
  • A network attached storage device.
  • A printer.
  • A scanner.
  • A server.
  • A tape library device.
  • A mobile device such as a mobile phone or PDA.
typestring
vulnerabilities
descriptionVulnerabilities discovered on asset.
items
$refVulnerability
typearray
typeobject
Association
descriptionAssociations represents different metadata about malware and threat actors involved with an IoC.
idAssociation
properties
alias
descriptionDifferent aliases of the threat actor given by different sources.
items
$refAssociationAlias
typearray
associatedActors
descriptionList of associated threat actors for a malware. Not applicable for threat actors.
items
$refAssociation
typearray
countryCode
descriptionCountry from which the threat actor/ malware is originated.
items
typestring
typearray
description
descriptionHuman readable description about the association.
typestring
firstReferenceTime
descriptionFirst time the threat actor was referenced or seen.
formatgoogle-datetime
typestring
id
descriptionUnique association id generated by mandiant.
typestring
industriesAffected
descriptionList of industries the threat actor affects.
items
typestring
typearray
lastReferenceTime
descriptionLast time the threat actor was referenced or seen.
formatgoogle-datetime
typestring
name
descriptionName of the threat actor/malware.
typestring
regionCode
$refLocation
descriptionName of the country, the threat is originating from.
role
descriptionRole of the malware. Not applicable for threat actor.
typestring
sourceCountry
deprecatedTrue
descriptionName of the country the threat originated from.
typestring
sponsorRegion
$refLocation
descriptionSponsor region of the threat actor.
tags
descriptionTags.
items
typestring
typearray
targetedRegions
descriptionTargeted regions.
items
$refLocation
typearray
type
descriptionSignifies the type of association.
enum
  • ASSOCIATION_TYPE_UNSPECIFIED
  • THREAT_ACTOR
  • MALWARE
enumDescriptions
  • The default Association Type.
  • Association type Threat actor.
  • Association type Malware.
typestring
typeobject
AssociationAlias
descriptionAssociation Alias used to represent Mandiant Threat Intelligence.
idAssociationAlias
properties
company
descriptionName of the provider who gave the association's name.
typestring
name
descriptionName of the alias.
typestring
typeobject
AttackDetails
descriptionMITRE ATT&CK details.
idAttackDetails
properties
tactics
descriptionTactics employed.
items
$refTactic
typearray
techniques
descriptionTechniques employed.
items
$refTechnique
typearray
version
descriptionATT&CK version (e.g. 12.1).
typestring
typeobject
Attribute
descriptionAttribute is a container for generic entity attributes including common attributes across core entities (such as, user or asset). For example, Cloud is a generic entity attribute since it can apply to an asset (for example, a VM) or a user (for example, an identity service account).
idAttribute
properties
cloud
$refCloud
descriptionCloud metadata attributes such as project ID, account ID, or organizational hierarchy.
creationTime
descriptionTime the resource or entity was created or provisioned.
formatgoogle-datetime
typestring
labels
descriptionSet of labels for the entity. Should only be used for product labels (for example, Google Cloud resource labels or Azure AD sensitivity labels. Should not be used for arbitrary key-value mappings.
items
$refLabel
typearray
lastUpdateTime
descriptionTime the resource or entity was last updated.
formatgoogle-datetime
typestring
permissions
descriptionSystem permissions for IAM entity (human principal, service account, group).
items
$refPermission
typearray
roles
descriptionSystem IAM roles to be assumed by resources to use the role's permissions for access control.
items
$refRole
typearray
typeobject
Authentication
descriptionThe Authentication extension captures details specific to authentication events. General guidelines for authentication events: * Details about the source of the authentication event (for example, client IP or hostname), should be captured in principal. The principal may be empty if we have no details about the source of the login. * Details about the target of the authentication event (for example, details about the machine that is being logged into or logged out of) should be captured in target. * Some authentication events may involve a third-party. For example, a user logs into a cloud service (for example, Chronicle) via their company's SSO (the event is logged by their SSO solution). In this case, the principal captures information about the user's device, the target captures details about the cloud service they logged into, and the intermediary captures details about the SSO solution.
idAuthentication
properties
authDetails
descriptionThe vendor defined details of the authentication.
typestring
mechanism
descriptionThe authentication mechanism.
items
enum
  • MECHANISM_UNSPECIFIED
  • USERNAME_PASSWORD
  • OTP
  • HARDWARE_KEY
  • LOCAL
  • REMOTE
  • REMOTE_INTERACTIVE
  • MECHANISM_OTHER
  • BADGE_READER
  • NETWORK
  • BATCH
  • SERVICE
  • UNLOCK
  • NETWORK_CLEAR_TEXT
  • NEW_CREDENTIALS
  • INTERACTIVE
  • CACHED_INTERACTIVE
  • CACHED_REMOTE_INTERACTIVE
  • CACHED_UNLOCK
  • BIOMETRIC
  • WEARABLE
enumDescriptions
  • The default mechanism.
  • Username + password authentication.
  • OTP authentication.
  • Hardware key authentication.
  • Local authentication.
  • Remote authentication.
  • RDP, Terminal Services, or VNC.
  • Some other mechanism that is not defined here.
  • Badge reader authentication
  • Network authentication.
  • Batch authentication.
  • Service authentication
  • Direct human-interactive unlock authentication.
  • Network clear text authentication.
  • Authentication with new credentials.
  • Interactive authentication.
  • Interactive authentication using cached credentials.
  • Cached Remote Interactive authentication using cached credentials.
  • Cached Remote Interactive authentication using cached credentials.
  • Biometric device such as a fingerprint reader.
  • Wearable such as an Apple Watch.
typestring
typearray
type
descriptionThe type of authentication.
enum
  • AUTHTYPE_UNSPECIFIED
  • MACHINE
  • SSO
  • VPN
  • PHYSICAL
  • TACACS
enumDescriptions
  • The default type.
  • A machine authentication.
  • An SSO authentication.
  • A VPN authentication.
  • A Physical authentication (e.g. "Badge reader").
  • A TACACS family protocol for networked systems authentication (e.g. TACACS, TACACS+).
typestring
typeobject
AuthorityKeyId
descriptionIdentifies the public key to be used to verify the signature on this certificate or CRL.
idAuthorityKeyId
properties
keyid
descriptionKey hexdump.
typestring
serialNumber
descriptionSerial number hexdump.
typestring
typeobject
BackstoryEntity
descriptionAn Entity provides additional context about an item in a UDM event. For example, a PROCESS_LAUNCH event describes that user 'abc@example.corp' launched process 'shady.exe'. The event does not include information that user 'abc@example.com' is a recently terminated employee who administers a server storing finance data. Information stored in one or more Entities can add this additional context.
idBackstoryEntity
properties
additional
additionalProperties
descriptionProperties of the object.
typeany
descriptionImportant entity data that cannot be adequately represented within the formal sections of the Entity.
typeobject
entity
$refNoun
descriptionNoun in the UDM event that this entity represents.
metadata
$refEntityMetadata
descriptionEntity metadata such as timestamp, product, etc.
metric
$refMetric
descriptionStores statistical metrics about the entity. Used if metadata.entity_type is METRIC.
relations
descriptionOne or more relationships between the entity (a) and other entities, including the relationship type and related entity.
items
$refRelation
typearray
riskScore
$refEntityRisk
descriptionStores information related to the entity's risk score.
typeobject
BackstoryFile
descriptionInformation about a file.
idBackstoryFile
properties
ahash
deprecatedTrue
descriptionDeprecated. Use authentihash instead.
typestring
authentihash
descriptionAuthentihash of the file.
typestring
capabilitiesTags
descriptionCapabilities tags.
items
typestring
typearray
createTime
descriptionTimestamp when the file was created.
formatgoogle-datetime
typestring
embeddedDomains
descriptionEmbedded domains found in the file.
items
typestring
typearray
embeddedIps
descriptionEmbedded IP addresses found in the file.
items
typestring
typearray
embeddedUrls
descriptionEmbedded urls found in the file.
items
typestring
typearray
exifInfo
$refExifInfo
descriptionExif metadata from different file formats extracted by exiftool.
fileMetadata
$refFileMetadata
deprecatedTrue
descriptionMetadata associated with the file. Deprecate FileMetadata in favor of using fields in File.
fileType
descriptionFileType field.
enum
  • FILE_TYPE_UNSPECIFIED
  • FILE_TYPE_PE_EXE
  • FILE_TYPE_PE_DLL
  • FILE_TYPE_MSI
  • FILE_TYPE_NE_EXE
  • FILE_TYPE_NE_DLL
  • FILE_TYPE_DOS_EXE
  • FILE_TYPE_DOS_COM
  • FILE_TYPE_COFF
  • FILE_TYPE_ELF
  • FILE_TYPE_LINUX_KERNEL
  • FILE_TYPE_RPM
  • FILE_TYPE_LINUX
  • FILE_TYPE_MACH_O
  • FILE_TYPE_JAVA_BYTECODE
  • FILE_TYPE_DMG
  • FILE_TYPE_DEB
  • FILE_TYPE_PKG
  • FILE_TYPE_PYC
  • FILE_TYPE_LNK
  • FILE_TYPE_DESKTOP_ENTRY
  • FILE_TYPE_JPEG
  • FILE_TYPE_TIFF
  • FILE_TYPE_GIF
  • FILE_TYPE_PNG
  • FILE_TYPE_BMP
  • FILE_TYPE_GIMP
  • FILE_TYPE_IN_DESIGN
  • FILE_TYPE_PSD
  • FILE_TYPE_TARGA
  • FILE_TYPE_XWD
  • FILE_TYPE_DIB
  • FILE_TYPE_JNG
  • FILE_TYPE_ICO
  • FILE_TYPE_FPX
  • FILE_TYPE_EPS
  • FILE_TYPE_SVG
  • FILE_TYPE_EMF
  • FILE_TYPE_WEBP
  • FILE_TYPE_DWG
  • FILE_TYPE_DXF
  • FILE_TYPE_THREEDS
  • FILE_TYPE_OGG
  • FILE_TYPE_FLC
  • FILE_TYPE_FLI
  • FILE_TYPE_MP3
  • FILE_TYPE_FLAC
  • FILE_TYPE_WAV
  • FILE_TYPE_MIDI
  • FILE_TYPE_AVI
  • FILE_TYPE_MPEG
  • FILE_TYPE_QUICKTIME
  • FILE_TYPE_ASF
  • FILE_TYPE_DIVX
  • FILE_TYPE_FLV
  • FILE_TYPE_WMA
  • FILE_TYPE_WMV
  • FILE_TYPE_RM
  • FILE_TYPE_MOV
  • FILE_TYPE_MP4
  • FILE_TYPE_T3GP
  • FILE_TYPE_WEBM
  • FILE_TYPE_MKV
  • FILE_TYPE_PDF
  • FILE_TYPE_PS
  • FILE_TYPE_DOC
  • FILE_TYPE_DOCX
  • FILE_TYPE_PPT
  • FILE_TYPE_PPTX
  • FILE_TYPE_XLS
  • FILE_TYPE_XLSX
  • FILE_TYPE_RTF
  • FILE_TYPE_PPSX
  • FILE_TYPE_ODP
  • FILE_TYPE_ODS
  • FILE_TYPE_ODT
  • FILE_TYPE_HWP
  • FILE_TYPE_GUL
  • FILE_TYPE_ODF
  • FILE_TYPE_ODG
  • FILE_TYPE_ONE_NOTE
  • FILE_TYPE_OOXML
  • FILE_TYPE_SLK
  • FILE_TYPE_EBOOK
  • FILE_TYPE_LATEX
  • FILE_TYPE_TTF
  • FILE_TYPE_EOT
  • FILE_TYPE_WOFF
  • FILE_TYPE_CHM
  • FILE_TYPE_ZIP
  • FILE_TYPE_GZIP
  • FILE_TYPE_BZIP
  • FILE_TYPE_RZIP
  • FILE_TYPE_DZIP
  • FILE_TYPE_SEVENZIP
  • FILE_TYPE_CAB
  • FILE_TYPE_JAR
  • FILE_TYPE_RAR
  • FILE_TYPE_MSCOMPRESS
  • FILE_TYPE_ACE
  • FILE_TYPE_ARC
  • FILE_TYPE_ARJ
  • FILE_TYPE_ASD
  • FILE_TYPE_BLACKHOLE
  • FILE_TYPE_KGB
  • FILE_TYPE_ZLIB
  • FILE_TYPE_TAR
  • FILE_TYPE_ZST
  • FILE_TYPE_LZFSE
  • FILE_TYPE_PYTHON_WHL
  • FILE_TYPE_PYTHON_PKG
  • FILE_TYPE_MSIX
  • FILE_TYPE_TEXT
  • FILE_TYPE_SCRIPT
  • FILE_TYPE_PHP
  • FILE_TYPE_PYTHON
  • FILE_TYPE_PERL
  • FILE_TYPE_RUBY
  • FILE_TYPE_C
  • FILE_TYPE_CPP
  • FILE_TYPE_JAVA
  • FILE_TYPE_SHELLSCRIPT
  • FILE_TYPE_PASCAL
  • FILE_TYPE_AWK
  • FILE_TYPE_DYALOG
  • FILE_TYPE_FORTRAN
  • FILE_TYPE_JAVASCRIPT
  • FILE_TYPE_POWERSHELL
  • FILE_TYPE_VBA
  • FILE_TYPE_M4
  • FILE_TYPE_OBJETIVEC
  • FILE_TYPE_JMOD
  • FILE_TYPE_MAKEFILE
  • FILE_TYPE_INI
  • FILE_TYPE_CLJ
  • FILE_TYPE_PDB
  • FILE_TYPE_SQL
  • FILE_TYPE_NEKO
  • FILE_TYPE_WER
  • FILE_TYPE_GOLANG
  • FILE_TYPE_M3U
  • FILE_TYPE_BAT
  • FILE_TYPE_MSC
  • FILE_TYPE_RDP
  • FILE_TYPE_SYMBIAN
  • FILE_TYPE_PALMOS
  • FILE_TYPE_WINCE
  • FILE_TYPE_ANDROID
  • FILE_TYPE_IPHONE
  • FILE_TYPE_HTML
  • FILE_TYPE_XML
  • FILE_TYPE_SWF
  • FILE_TYPE_FLA
  • FILE_TYPE_COOKIE
  • FILE_TYPE_TORRENT
  • FILE_TYPE_EMAIL_TYPE
  • FILE_TYPE_OUTLOOK
  • FILE_TYPE_SGML
  • FILE_TYPE_JSON
  • FILE_TYPE_CSV
  • FILE_TYPE_HTA
  • FILE_TYPE_INTERNET_SHORTCUT
  • FILE_TYPE_CAP
  • FILE_TYPE_ISOIMAGE
  • FILE_TYPE_SQUASHFS
  • FILE_TYPE_VHD
  • FILE_TYPE_APPLE
  • FILE_TYPE_MACINTOSH
  • FILE_TYPE_APPLESINGLE
  • FILE_TYPE_APPLEDOUBLE
  • FILE_TYPE_MACINTOSH_HFS
  • FILE_TYPE_APPLE_PLIST
  • FILE_TYPE_MACINTOSH_LIB
  • FILE_TYPE_APPLESCRIPT
  • FILE_TYPE_APPLESCRIPT_COMPILED
  • FILE_TYPE_CRX
  • FILE_TYPE_XPI
  • FILE_TYPE_ROM
  • FILE_TYPE_IPS
  • FILE_TYPE_PEM
  • FILE_TYPE_PGP
  • FILE_TYPE_CRT
enumDescriptions
  • File type is UNSPECIFIED.
  • File type is PE_EXE.
  • Although DLLs are actually portable executables, this value enables the file type to be identified separately. File type is PE_DLL.
  • File type is MSI.
  • File type is NE_EXE.
  • File type is NE_DLL.
  • File type is DOS_EXE.
  • File type is DOS_COM.
  • File type is COFF.
  • File type is ELF.
  • File type is LINUX_KERNEL.
  • File type is RPM.
  • File type is LINUX.
  • File type is MACH_O.
  • File type is JAVA_BYTECODE.
  • File type is DMG.
  • File type is DEB.
  • File type is PKG.
  • File type is PYC.
  • File type is LNK.
  • File type is DESKTOP_ENTRY.
  • File type is JPEG.
  • File type is TIFF.
  • File type is GIF.
  • File type is PNG.
  • File type is BMP.
  • File type is GIMP.
  • File type is Adobe InDesign.
  • File type is PSD. Adobe Photoshop.
  • File type is TARGA.
  • File type is XWD.
  • File type is DIB.
  • File type is JNG.
  • File type is ICO.
  • File type is FPX.
  • File type is EPS.
  • File type is SVG.
  • File type is EMF.
  • File type is WEBP.
  • File type is DWG.
  • File type is DXF.
  • File type is 3DS.
  • File type is OGG.
  • File type is FLC.
  • File type is FLI.
  • File type is MP3.
  • File type is FLAC.
  • File type is WAV.
  • File type is MIDI.
  • File type is AVI.
  • File type is MPEG.
  • File type is QUICKTIME.
  • File type is ASF.
  • File type is DIVX.
  • File type is FLV.
  • File type is WMA.
  • File type is WMV.
  • File type is RM. RealMedia type.
  • File type is MOV.
  • File type is MP4.
  • File type is T3GP.
  • File type is WEBM.
  • File type is MKV.
  • File type is PDF.
  • File type is PS.
  • File type is DOC.
  • File type is DOCX.
  • File type is PPT.
  • File type is PPTX.
  • File type is XLS.
  • File type is XLSX.
  • File type is RTF.
  • File type is PPSX.
  • File type is ODP.
  • File type is ODS.
  • File type is ODT.
  • File type is HWP.
  • File type is GUL.
  • File type is ODF.
  • File type is ODG.
  • File type is ONE_NOTE.
  • File type is OOXML.
  • File type is SLK.
  • File type is EBOOK.
  • File type is LATEX.
  • File type is TTF.
  • File type is EOT.
  • File type is WOFF.
  • File type is CHM.
  • File type is ZIP.
  • File type is GZIP.
  • File type is BZIP.
  • File type is RZIP.
  • File type is DZIP.
  • File type is SEVENZIP.
  • File type is CAB.
  • File type is JAR.
  • File type is RAR.
  • File type is MSCOMPRESS.
  • File type is ACE.
  • File type is ARC.
  • File type is ARJ.
  • File type is ASD.
  • File type is BLACKHOLE.
  • File type is KGB.
  • File type is ZLIB.
  • File type is TAR.
  • File type is ZST.
  • File type is LZFSE.
  • File type is PYTHON_WHL.
  • File type is PYTHON_PKG.
  • File type is MSIX, new Windows app package format.
  • File type is TEXT.
  • File type is SCRIPT.
  • File type is PHP.
  • File type is PYTHON.
  • File type is PERL.
  • File type is RUBY.
  • File type is C.
  • File type is CPP.
  • File type is JAVA.
  • File type is SHELLSCRIPT.
  • File type is PASCAL.
  • File type is AWK.
  • File type is DYALOG.
  • File type is FORTRAN.
  • File type is JAVASCRIPT.
  • File type is POWERSHELL.
  • File type is VBA.
  • File type is M4.
  • File type is OBJETIVEC.
  • File type is JMOD.
  • File type is MAKEFILE.
  • File type is INI.
  • File type is CLJ.
  • File type is PDB.
  • File type is SQL.
  • File type is NEKO.
  • File type is WER.
  • File type is GOLANG.
  • File type is M3U.
  • File type is BAT, Windows .bat/.cmd (old files are tagged as SHELLSCRIPT).
  • File type is MSC, Microsoft Management Console (MMC).
  • File type is RDP, Microsoft Remote Desktop Protocol (RDP) file.
  • File type is SYMBIAN.
  • File type is PALMOS.
  • File type is WINCE.
  • File type is ANDROID.
  • File type is IPHONE.
  • File type is HTML.
  • File type is XML.
  • File type is SWF.
  • File type is FLA.
  • File type is COOKIE.
  • File type is TORRENT.
  • File type is EMAIL_TYPE.
  • File type is OUTLOOK.
  • File type is SGML.
  • File type is JSON.
  • File type is CSV.
  • File type is HTA (HTML Application).
  • File type is MSHTML .url.
  • File type is CAP.
  • File type is ISOIMAGE.
  • File type is SQUASHFS.
  • File type is VHD.
  • File type is APPLE.
  • File type is MACINTOSH.
  • File type is APPLESINGLE.
  • File type is APPLEDOUBLE.
  • File type is MACINTOSH_HFS.
  • File type is APPLE_PLIST.
  • File type is MACINTOSH_LIB.
  • File type is APPLESCRIPT.
  • File type is APPLESCRIPT_COMPILED .
  • File type is CRX.
  • File type is XPI.
  • File type is ROM.
  • File type is IPS.
  • File type is PEM.
  • File type is PGP.
  • File type is CRT.
typestring
firstSeenTime
descriptionTimestamp the file was first seen in the customer's environment.
formatgoogle-datetime
typestring
firstSubmissionTime
descriptionFirst submission time of the file.
formatgoogle-datetime
typestring
fullPath
descriptionThe full path identifying the location of the file on the system. This field can be used as an entity indicator for file entities.
typestring
lastAccessTime
descriptionTimestamp when the file was accessed.
formatgoogle-datetime
typestring
lastAnalysisTime
descriptionTimestamp the file was last analysed.
formatgoogle-datetime
typestring
lastModificationTime
descriptionTimestamp when the file was last updated.
formatgoogle-datetime
typestring
lastSeenTime
descriptionTimestamp the file was last seen in the customer's environment.
formatgoogle-datetime
typestring
lastSubmissionTime
descriptionLast submission time of the file.
formatgoogle-datetime
typestring
mainIcon
$refFavicon
descriptionIcon's relevant hashes.
md5
descriptionThe MD5 hash of the file, as a hex-encoded string. This field can be used as an entity indicator for file entities.
typestring
mimeType
descriptionThe MIME (Multipurpose Internet Mail Extensions) type of the file, for example "PE", "PDF", or "powershell script".
typestring
names
descriptionNames fields.
items
typestring
typearray
ntfs
$refNtfsFileMetadata
descriptionNTFS metadata.
pdfInfo
$refPDFInfo
descriptionInformation about the PDF file structure.
peFile
$refFileMetadataPE
descriptionMetadata about the Portable Executable (PE) file.
prevalence
$refPrevalence
descriptionPrevalence of the file hash in the customer's environment.
securityResult
$refSecurityResult
descriptionGoogle Cloud Threat Intelligence (GCTI) security result for the file including threat context and detection metadata.
sha1
descriptionThe SHA1 hash of the file, as a hex-encoded string. This field can be used as an entity indicator for file entities.
typestring
sha256
descriptionThe SHA256 hash of the file, as a hex-encoded string. This field can be used as an entity indicator for file entities.
typestring
signatureInfo
$refSignatureInfo
descriptionFile signature information extracted from different tools.
size
descriptionThe size of the file in bytes.
formatuint64
typestring
ssdeep
descriptionSsdeep of the file
typestring
statDev
descriptionThe file system identifier to which the object belongs.
formatuint64
typestring
statFlags
descriptionUser defined flags for file.
formatuint32
typeinteger
statInode
descriptionThe file identifier. Unique identifier of object within a file system.
formatuint64
typestring
statMode
descriptionThe mode of the file. A bit string indicating the permissions and privileges of the file.
formatuint64
typestring
statNlink
descriptionNumber of links to file.
formatuint64
typestring
symhash
descriptionSymHash of the file. Used for Mach-O (e.g. MacOS) binaries, to identify similar files based on their symbol table.
typestring
tags
descriptionTags for the file.
items
typestring
typearray
vhash
descriptionVhash of the file.
typestring
typeobject
BoolSequence
descriptionBoolSequence represents a sequence of bools.
idBoolSequence
properties
boolVals
descriptionbool sequence.
items
typeboolean
typearray
typeobject
BytesSequence
descriptionBytesSequence represents a sequence of bytes.
idBytesSequence
properties
bytesVals
descriptionbytes sequence.
items
formatbyte
typestring
typearray
typeobject
CancelOperationRequest
descriptionThe request message for Operations.CancelOperation.
idCancelOperationRequest
properties
typeobject
CertSignature
descriptionCertificate's signature and algorithm.
idCertSignature
properties
signature
descriptionSignature.
typestring
signatureAlgorithm
descriptionAlgorithm.
typestring
typeobject
Certificate
descriptionCertificate information
idCertificate
properties
issuer
descriptionIssuer of the certificate.
typestring
md5
descriptionThe MD5 hash of the certificate, as a hex-encoded string.
typestring
notAfter
descriptionIndicates when the certificate is no longer valid.
formatgoogle-datetime
typestring
notBefore
descriptionIndicates when the certificate is first valid.
formatgoogle-datetime
typestring
serial
descriptionCertificate serial number.
typestring
sha1
descriptionThe SHA1 hash of the certificate, as a hex-encoded string.
typestring
sha256
descriptionThe SHA256 hash of the certificate, as a hex-encoded string.
typestring
subject
descriptionSubject of the certificate.
typestring
version
descriptionCertificate version.
typestring
typeobject
Chip
idChip
properties
text
typestring
type
enum
  • UNSPECIFIED
  • ALERT
  • NETWORK_CONNECTION
  • EDR
  • UNPARSED_RAW_LOG
  • LOGIN_EVENT
  • EMAIL_EVENT
  • GENERIC
  • TELEMETRY
enumDescriptions
typestring
typeobject
Client
descriptionTransport Layer Security (TLS) information associated with the client (for example, Certificate or JA3 hash).
idClient
properties
certificate
$refCertificate
descriptionClient certificate.
ja3
descriptionJA3 hash from the TLS ClientHello, as a hex-encoded string.
typestring
serverName
descriptionHost name of the server, that the client is connecting to.
typestring
supportedCiphers
descriptionCiphers supported by the client during client hello.
items
typestring
typearray
typeobject
Cloud
descriptionMetadata related to the cloud environment.
idCloud
properties
availabilityZone
descriptionThe cloud environment availability zone (different from region which is location.name).
typestring
environment
descriptionThe Cloud environment.
enum
  • UNSPECIFIED_CLOUD_ENVIRONMENT
  • GOOGLE_CLOUD_PLATFORM
  • AMAZON_WEB_SERVICES
  • MICROSOFT_AZURE
enumDescriptions
  • Default.
  • Google Cloud Platform.
  • Amazon Web Services.
  • Microsoft Azure.
typestring
project
$refResource
deprecatedTrue
descriptionThe cloud environment project information. Deprecated: Use Resource.resource_ancestors
vpc
$refResource
deprecatedTrue
descriptionThe cloud environment VPC. Deprecated.
typeobject
Collection
descriptionCollection represents a container of objects (such as events, entity context metadata, detection finding metadata) and state (such as investigation details). BEGIN GOOGLE-INTERNAL See go/udm:collections for additional details. END GOOGLE-INTERNAL An example use case for Collection is to model a detection and investigation from detection finding metadata to investigative state collected in the course of the investigation. For more complex investigation and response workflows a Collection could represent an incident consisting of multiple child findings or incidents. This can be expanded on to model remediation elements of a full detection and response workflow. NEXT TAG: 20
idCollection
properties
caseName
descriptionThe resource name of the Case that this collection belongs to. Example: projects/{project id}/locations/{region}/chronicle/cases/{internal_case_id}
typestring
collectionElements
descriptionConstituent elements of the collection. Each element shares an association that groups it together and is a component of the overall collection. For example, a detection collection may have several constituent elements that each share a correlation association that together represent a particular pattern or behavior.
items
$refElement
typearray
createdTime
descriptionTime the collection was created.
formatgoogle-datetime
typestring
dataAccessScope
descriptionThe resource name of the DataAccessScope of this collection. BEGIN GOOGLE-INTERNAL We may change this name based on the final resource design of the scope. END GOOGLE-INTERNAL
typestring
detection
descriptionDetection metadata for findings that represent detections, can include rule details, machine learning model metadata, and indicators implicated in the detection (using the .about field).
items
$refSecurityResult
typearray
detectionTime
descriptionTimestamp within the time_window related to the time of the collection_elements. For Rule Detections, this timestamp is the end of the the time_window for multi-event rules or the time of the event for single event rules. For late-arriving events that trigger new alerts, the detection_time will be the event time of the event.
formatgoogle-datetime
typestring
feedbackHistory
descriptionThe history of feedback submitted by analysts for this finding, in descending order by timestamp. This field is limited to the most recent 1000 feedback events. The primary feedback will also be included in this list.
items
$refFeedback
typearray
feedbackSummary
$refFeedback
descriptionThe current primary analyst feedback. This does not include the history of feedback given, which may be supplied in `feedback`.
id
descriptionUnique ID for the collection. The ID is specific to the type of collection. For example, with rule detections this is the detection ID.
typestring
idNamespace
descriptionThe ID namespace used for the Collection.
enum
  • NORMALIZED_TELEMETRY
  • RAW_TELEMETRY
  • RULE_DETECTIONS
  • UPPERCASE
  • MACHINE_INTELLIGENCE
  • SECURITY_COMMAND_CENTER
  • UNSPECIFIED
  • SOAR_ALERT
  • VIRUS_TOTAL
enumDescriptions
  • Ingested and Normalized telemetry events
  • Ingested Raw telemetry
  • Chronicle Rules engine
  • Uppercase
  • DSML - Machine Intelligence
  • A normalized telemetry event from Google Security Command Center.
  • Unspecified Namespace
  • An alert coming from other SIEMs via Chronicle SOAR.
  • VirusTotal.
typestring
investigation
$refInvestigation
descriptionConsolidated investigation details (categorization, status, etc) typically for collections that begin as detection findings and then evolve with analyst action and feedback into investigations around the detection output.
lastUpdatedTime
descriptionTime the collection was last updated.
formatgoogle-datetime
typestring
responsePlatformInfo
$refResponsePlatformInfo
descriptionAlert related info of this same alert in customer's SOAR platform.
soarAlert
descriptionA boolean field indicating that the alert is present in SOAR.
typeboolean
soarAlertMetadata
$refSoarAlertMetadata
descriptionMetadata fields of alerts coming from other SIEM systems via SOAR.
tags
descriptionTags set by UC/DSML/RE for the Finding during creation.
items
typestring
typearray
timeWindow
$refInterval
descriptionTime interval that the collection represents.
type
descriptionWhat the collection represents.
enum
  • COLLECTION_TYPE_UNSPECIFIED
  • TELEMETRY_ALERT
  • GCTI_FINDING
  • UPPERCASE_ALERT
  • RULE_DETECTION
  • MACHINE_INTELLIGENCE_ALERT
  • SOAR_ALERT
enumDescriptions
  • An unspecified collection type.
  • An alert reported in customer telemetry.
  • A finding from the Uppercase team.
  • A detection found by applying a rule.
  • An alert generated by Chronicle machine learning models.
  • An alert coming from other SIEMs via Chronicle SOAR.
typestring
typeobject
ColumnNames
idColumnNames
properties
names
items
typestring
typearray
typeobject
CompilationDiagnostic
descriptionCompilationDiagnostic represents a compilation diagnostic generated during a rule's compilation, such as a compilation error or a compilation warning.
idCompilationDiagnostic
properties
message
descriptionOutput only. The diagnostic message.
readOnlyTrue
typestring
position
$refCompilationPosition
descriptionOutput only. The approximate position in the rule text associated with the compilation diagnostic. Compilation Position may be empty.
readOnlyTrue
severity
descriptionOutput only. The severity of a rule's compilation diagnostic.
enum
  • SEVERITY_UNSPECIFIED
  • WARNING
  • ERROR
enumDescriptions
  • An unspecified severity level.
  • A compilation warning.
  • A compilation error.
readOnlyTrue
typestring
uri
descriptionOutput only. Link to documentation that describes a diagnostic in more detail.
readOnlyTrue
typestring
typeobject
CompilationPosition
descriptionCompilationPosition represents the location of a compilation diagnostic in rule text.
idCompilationPosition
properties
endColumn
descriptionOutput only. End column number, beginning at 1.
formatint32
readOnlyTrue
typeinteger
endLine
descriptionOutput only. End line number, beginning at 1.
formatint32
readOnlyTrue
typeinteger
startColumn
descriptionOutput only. Start column number, beginning at 1.
formatint32
readOnlyTrue
typeinteger
startLine
descriptionOutput only. Start line number, beginning at 1.
formatint32
readOnlyTrue
typeinteger
typeobject
CreateParserExtensionMetadata
descriptionOperation metadata for creating a parser extension.
idCreateParserExtensionMetadata
properties
state
descriptionThe state of the parser extension creation process.
enum
  • STATE_UNSPECIFIED
  • NEW
  • VALIDATING
  • LIVE
  • REJECTED
  • INTERNAL_ERROR
  • VALIDATED
  • ARCHIVED
enumDescriptions
  • The state for this parser extension was not specified.
  • The parser extension has been newly submitted and is waiting to be validated.
  • The parser extension is currently going through the validation pipeline.
  • The parser extension is live in production. Only configs that have successfully passed the validation stage will be set to LIVE.
  • Validation completed, but the parser extension was rejected with errors.
  • An error occurred when processing this parser extension.
  • Extension is validated.
  • Extension is archived and is no more being used.
typestring
stateLastChangedTime
descriptionThe time the config state was last changed.
formatgoogle-datetime
typestring
validationErrors
descriptionAny validation error while validating the extension, this have cap of size 10
items
typestring
typearray
validationReport
descriptionThe validation report generated during validation of the parser extension.
typestring
typeobject
CreateParserMetadata
descriptionOperation metadata for creating a parser.
idCreateParserMetadata
properties
stage
descriptionThe validation stage of the parser creation process.
enum
  • VALIDATION_STAGE_UNSPECIFIED
  • NEW
  • VALIDATING
  • PASSED
  • FAILED
  • DELETE_CANDIDATE
enumDescriptions
  • The validation stage is not specified.
  • The custom parser is submitted for validation.
  • The custom parser is currently going through the validation pipeline
  • The custom parser has successfully passed the validation.
  • The custom parser has failed validation.
  • The parser is no good, It is available for auto deletion.
typestring
validationReport
descriptionThe validation report generated during validation of the parser.
typestring
typeobject
DNSRecord
descriptionDNS record.
idDNSRecord
properties
expire
descriptionExpire.
formatgoogle-duration
typestring
minimum
descriptionMinimum.
formatgoogle-duration
typestring
priority
descriptionPriority.
formatint64
typestring
refresh
descriptionRefresh.
formatgoogle-duration
typestring
retry
descriptionRetry.
formatint64
typestring
rname
descriptionRname.
typestring
serial
descriptionSerial.
formatint64
typestring
ttl
descriptionTime to live.
formatgoogle-duration
typestring
type
descriptionType.
typestring
value
descriptionValue.
typestring
typeobject
DataAccessIngestionLabel
idDataAccessIngestionLabel
properties
key
descriptionThe key.
typestring
value
descriptionThe value.
typestring
typeobject
DataAccessLabel
descriptionA DataAccessLabel is a label on events to define user access to data.
idDataAccessLabel
properties
author
descriptionOutput only. The user who created the data access label.
readOnlyTrue
typestring
createTime
descriptionOutput only. The time at which the data access label was created.
formatgoogle-datetime
readOnlyTrue
typestring
description
descriptionOptional. A description of the data access label for a human reader.
typestring
displayName
descriptionOutput only. The short name displayed for the label as it appears on event data.
readOnlyTrue
typestring
lastEditor
descriptionOutput only. The user who last updated the data access label.
readOnlyTrue
typestring
name
descriptionRequired. The unique resource name of the data access label.
typestring
udmQuery
descriptionA UDM query over event data.
typestring
updateTime
descriptionOutput only. The time at which the data access label was last updated.
formatgoogle-datetime
readOnlyTrue
typestring
typeobject
DataAccessLabelReference
descriptionReference object to a data access label.
idDataAccessLabelReference
properties
assetNamespace
descriptionThe asset namespace configured in the forwarder of the customer's events.
typestring
dataAccessLabel
descriptionThe name of the data access label.
typestring
displayName
descriptionOutput only. The display name of the label. Data access label and log types's name will match the display name of the resource. The asset namespace will match the namespace itself. The ingestion key value pair will match the key of the tuple.
readOnlyTrue
typestring
ingestionLabel
$refIngestionLabel
descriptionThe ingestion label configured in the forwarder of the customer's events.
logType
descriptionThe name of the log type.
typestring
typeobject
DataAccessLabels
idDataAccessLabels
properties
allowScopedAccess
descriptionAre the labels ready for scoped access
typeboolean
customLabels
descriptionAll the complex labels (UDM search syntax based).
items
typestring
typearray
ingestionKvLabels
descriptionAll the ingestion labels (key/value pairs).
items
$refDataAccessIngestionLabel
typearray
ingestionLabels
deprecatedTrue
descriptionAll the ingestion labels.
items
typestring
typearray
logTypes
descriptionAll the LogType labels.
items
typestring
typearray
namespaces
descriptionAll the namespaces.
items
typestring
typearray
typeobject
DataAccessScope
descriptionA DataAccessScope is a boolean expression of data access labels used to restrict access to data for users.
idDataAccessScope
properties
allowAll
descriptionOptional. Whether or not the scope allows all labels, allow_all and allowed_data_access_labels are mutually exclusive and one of them must be present. denied_data_access_labels can still be used along with allow_all. When combined with denied_data_access_labels, access will be granted to all data that doesn't have labels mentioned in denied_data_access_labels. E.g.: A customer with scope with denied labels A and B and allow_all will be able to see all data except data labeled with A and data labeled with B and data with labels A and B.
typeboolean
allowedDataAccessLabels
descriptionOptional. The allowed labels for the scope. Either allow_all or allowed_data_access_labels needs to be provided. When provided, there has to be at least one label allowed for the scope to be valid. The logical operator for evaluation of the allowed labels is OR. E.g.: A customer with scope with allowed labels A and B will be able to see data with labeled with A or B or (A and B).
items
$refDataAccessLabelReference
typearray
author
descriptionOutput only. The user who created the data access scope.
readOnlyTrue
typestring
createTime
descriptionOutput only. The time at which the data access scope was created.
formatgoogle-datetime
readOnlyTrue
typestring
deniedDataAccessLabels
descriptionOptional. The denied labels for the scope. The logical operator for evaluation of the denied labels is AND. E.g.: A customer with scope with denied labels A and B won't be able to see data labeled with A and data labeled with B and data with labels A and B.
items
$refDataAccessLabelReference
typearray
description
descriptionOptional. A description of the data access scope for a human reader.
typestring
displayName
descriptionOutput only. The name to be used for display to customers of the data access scope.
readOnlyTrue
typestring
lastEditor
descriptionOutput only. The user who last updated the data access scope.
readOnlyTrue
typestring
name
descriptionRequired. The unique full name of the data access scope. The name should comply with https://google.aip.dev/122 standards.
typestring
updateTime
descriptionOutput only. The time at which the data access scope was last updated.
formatgoogle-datetime
readOnlyTrue
typestring
typeobject
Date
descriptionRepresents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values. * A month and day, with a zero year (for example, an anniversary). * A year on its own, with a zero month and a zero day. * A year and month, with a zero day (for example, a credit card expiration date). Related types: * google.type.TimeOfDay * google.type.DateTime * google.protobuf.Timestamp
idDate
properties
day
descriptionDay of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.
formatint32
typeinteger
month
descriptionMonth of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.
formatint32
typeinteger
year
descriptionYear of the date. Must be from 1 to 9999, or 0 to specify a date without a year.
formatint32
typeinteger
typeobject
Detections
idDetections
properties
baselineAlertsCount
formatint32
typeinteger
complete
typeboolean
detectionFieldAggregations
$refAlertFieldAggregations
detections
items
$refCollection
typearray
filteredAlertsCount
formatint32
typeinteger
tooManyDetections
typeboolean
validSnapshotQuery
typeboolean
typeobject
Dhcp
descriptionDHCP information.
idDhcp
properties
chaddr
descriptionClient hardware address (chaddr).
typestring
ciaddr
descriptionClient IP address (ciaddr).
typestring
clientHostname
descriptionClient hostname. See RFC2132, section 3.14.
typestring
clientIdentifier
descriptionClient identifier. See RFC2132, section 9.14. Note: Make sure to update the client_identifier_string field as well if you update this field.
formatbyte
typestring
clientIdentifierString
descriptionClient identifier as string. See RFC2132, section 9.14. This field holds the string value of the client_identifier.
typestring
file
descriptionBoot image filename.
typestring
flags
descriptionFlags.
formatuint32
typeinteger
giaddr
descriptionRelay agent IP address (giaddr).
typestring
hlen
descriptionHardware address length.
formatuint32
typeinteger
hops
descriptionHardware ops.
formatuint32
typeinteger
htype
descriptionHardware address type.
formatuint32
typeinteger
leaseTimeSeconds
descriptionLease time in seconds. See RFC2132, section 9.2.
formatuint32
typeinteger
opcode
descriptionThe BOOTP op code.
enum
  • UNKNOWN_OPCODE
  • BOOTREQUEST
  • BOOTREPLY
enumDescriptions
  • Default opcode.
  • Request.
  • Reply.
typestring
options
descriptionList of DHCP options.
items
$refOption
typearray
requestedAddress
descriptionRequested IP address. See RFC2132, section 9.1.
typestring
seconds
descriptionSeconds elapsed since client began address acquisition/renewal process.
formatuint32
typeinteger
siaddr
descriptionIP address of the next bootstrap server.
typestring
sname
descriptionServer name that the client wishes to boot from.
typestring
transactionId
descriptionTransaction ID.
formatuint32
typeinteger
type
descriptionDHCP message type.
enum
  • UNKNOWN_MESSAGE_TYPE
  • DISCOVER
  • OFFER
  • REQUEST
  • DECLINE
  • ACK
  • NAK
  • RELEASE
  • INFORM
  • WIN_DELETED
  • WIN_EXPIRED
enumDescriptions
  • Default message type.
  • DHCPDISCOVER.
  • DHCPOFFER.
  • DHCPREQUEST.
  • DHCPDECLINE.
  • DHCPACK.
  • DHCPNAK.
  • DHCPRELEASE.
  • DHCPINFORM.
  • Microsoft Windows DHCP "lease deleted".
  • Microsoft Windows DHCP "lease expired".
typestring
yiaddr
descriptionYour IP address (yiaddr).
typestring
typeobject
Dns
descriptionDNS information.
idDns
properties
additional
descriptionA list of additional domain name servers that can be used to verify the answer to the domain.
items
$refResourceRecord
typearray
answers
descriptionA list of answers to the domain name query.
items
$refResourceRecord
typearray
authoritative
descriptionOther DNS header flags. See RFC1035, section 4.1.1.
typeboolean
authority
descriptionA list of domain name servers which verified the answers to the domain name queries.
items
$refResourceRecord
typearray
id
descriptionDNS query id.
formatuint32
typeinteger
opcode
descriptionThe DNS OpCode used to specify the type of DNS query (for example, QUERY, IQUERY, or STATUS).
formatuint32
typeinteger
questions
descriptionA list of domain protocol message questions.
items
$refQuestion
typearray
recursionAvailable
descriptionWhether a recursive DNS lookup is available.
typeboolean
recursionDesired
descriptionWhether a recursive DNS lookup is desired.
typeboolean
response
descriptionSet to true if the event is a DNS response. See QR field from RFC1035.
typeboolean
responseCode
descriptionResponse code. See RCODE from RFC1035.
formatuint32
typeinteger
truncated
descriptionWhether the DNS response was truncated.
typeboolean
typeobject
Domain
descriptionInformation about a domain.
idDomain
properties
admin
$refUser
descriptionParsed contact information for the administrative contact for the domain.
auditUpdateTime
descriptionAudit updated time.
formatgoogle-datetime
typestring
billing
$refUser
descriptionParsed contact information for the billing contact of the domain.
categories
descriptionCategories assign to the domain as retrieved from VirusTotal.
items
typestring
typearray
contactEmail
descriptionContact email address.
typestring
creationTime
descriptionDomain creation time.
formatgoogle-datetime
typestring
expirationTime
descriptionExpiration time.
formatgoogle-datetime
typestring
favicon
$refFavicon
descriptionIncludes difference hash and MD5 hash of the domain's favicon.
firstSeenTime
descriptionFirst seen timestamp of the domain in the customer's environment.
formatgoogle-datetime
typestring
ianaRegistrarId
descriptionIANA Registrar ID. See https://www.iana.org/assignments/registrar-ids/registrar-ids.xhtml
formatint32
typeinteger
jarm
descriptionDomain's JARM hash.
typestring
lastDnsRecords
descriptionDomain's DNS records from the last scan.
items
$refDNSRecord
typearray
lastDnsRecordsTime
descriptionDate when the DNS records list was retrieved by VirusTotal.
formatgoogle-datetime
typestring
lastHttpsCertificate
$refSSLCertificate
descriptionSSL certificate object retrieved last time the domain was analyzed.
lastHttpsCertificateTime
descriptionWhen the certificate was retrieved by VirusTotal.
formatgoogle-datetime
typestring
lastSeenTime
descriptionLast seen timestamp of the domain in the customer's environment.
formatgoogle-datetime
typestring
name
descriptionThe domain name. This field can be used as an entity indicator for Domain entities.
typestring
nameServer
descriptionRepeated list of name servers.
items
typestring
typearray
popularityRanks
descriptionDomain's position in popularity ranks such as Alexa, Quantcast, Statvoo, etc
items
$refPopularityRank
typearray
prevalence
$refPrevalence
descriptionThe prevalence of the domain within the customer's environment.
privateRegistration
descriptionIndicates whether the domain appears to be using a private registration service to mask the owner's contact information.
typeboolean
registrant
$refUser
descriptionParsed contact information for the registrant of the domain.
registrar
descriptionRegistrar name . FOr example, "Wild West Domains, Inc. (R120-LROR)", "GoDaddy.com, LLC", or "PDR LTD. D/B/A PUBLICDOMAINREGISTRY.COM".
typestring
registryDataRawText
descriptionRegistry Data raw text.
formatbyte
typestring
status
descriptionDomain status. See https://www.icann.org/resources/pages/epp-status-codes-2014-06-16-en for meanings of possible values
typestring
tags
descriptionList of representative attributes.
items
typestring
typearray
tech
$refUser
descriptionParsed contact information for the technical contact for the domain
updateTime
descriptionLast updated time.
formatgoogle-datetime
typestring
whoisRecordRawText
descriptionWHOIS raw text.
formatbyte
typestring
whoisServer
descriptionWhois server name.
typestring
whoisTime
descriptionDate of the last update of the WHOIS record.
formatgoogle-datetime
typestring
zone
$refUser
descriptionParsed contact information for the zone.
typeobject
DoubleSequence
descriptionDoubleSequence represents a sequence of doubles.
idDoubleSequence
properties
doubleVals
descriptiondouble sequence.
items
formatdouble
typenumber
typearray
typeobject
EC
descriptionEC public key information.
idEC
properties
oid
descriptionCurve name.
typestring
pub
descriptionPublic key hexdump.
typestring
typeobject
Element
descriptionNEXT TAG: 5
idElement
properties
association
$refSecurityResult
descriptionMetadata that provides the relevant association for the references in the element. For a detection, this can be the correlated aspect of the references that contributed to the overall detection. For example, may include sub-rule condition, machine learning model metadata, and/or indicators implicated in this component of the detection (using the .about field).
label
descriptionA name that labels the entire references group.
typestring
references
descriptionReferences to model primatives including events and entities that share a common association. Even though a reference can have both UDM and entity, a collection of references (of a single element) will only have one type of message in it (either UDM / Entity).
items
$refReference
typearray
referencesSampled
descriptionCopied from the detection event_sample.too_many_event_samples field. If true, the number of references will be capped at the sample limit (set at rule service). This is applicable to both UDM references and Entity references.
typeboolean
typeobject
Email
descriptionEmail info.
idEmail
properties
bcc
descriptionA list of 'bcc' addresses.
items
typestring
typearray
bounceAddress
descriptionThe envelope from address. https://en.wikipedia.org/wiki/Bounce_address
typestring
cc
descriptionA list of 'cc' addresses.
items
typestring
typearray
from
descriptionThe 'from' address.
typestring
mailId
descriptionThe mail (or message) ID.
typestring
replyTo
descriptionThe 'reply to' address.
typestring
subject
descriptionThe subject line(s) of the email.
items
typestring
typearray
to
descriptionA list of 'to' addresses.
items
typestring
typearray
typeobject
Empty
descriptionA generic empty message that you can re-use to avoid defining duplicated empty messages in your APIs. A typical example is to use it as the request or the response type of an API method. For instance: service Foo { rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty); }
idEmpty
properties
typeobject
EntityChangedCountTimelineBucket
idEntityChangedCountTimelineBucket
properties
entityChangedInfo
items
$refEntityChangedInfo
typearray
totalChangedEntitiesCount
formatint32
typeinteger
typeobject
EntityChangedInfo
idEntityChangedInfo
properties
artifacts
$refFieldAndValue
entityCount
formatint32
typeinteger
typeobject
EntityCount
descriptionCount of different types of entities in the watchlist.
idEntityCount
properties
asset
descriptionOutput only. Count of asset type entities in the watchlist.
formatint32
readOnlyTrue
typeinteger
user
descriptionOutput only. Count of user type entities in the watchlist.
formatint32
readOnlyTrue
typeinteger
typeobject
EntityMetadata
descriptionInformation about the Entity and the product where the entity was created. Next Tag: 17
idEntityMetadata
properties
collectedTimestamp
descriptionGMT timestamp when the entity information was collected by the vendor's local collection infrastructure.
formatgoogle-datetime
typestring
creationTimestamp
descriptionGMT timestamp when the entity described by the product_entity_id was created on the system where data was collected.
formatgoogle-datetime
typestring
description
descriptionHuman-readable description of the entity.
typestring
entityType
descriptionEntity type. If an entity has multiple possible types, this specifies the most specific type.
enum
  • UNKNOWN_ENTITYTYPE
  • ASSET
  • USER
  • GROUP
  • RESOURCE
  • IP_ADDRESS
  • FILE
  • DOMAIN_NAME
  • URL
  • MUTEX
  • METRIC
enumDescriptions
  • @hide_from_doc
  • An asset, such as workstation, laptop, phone, virtual machine, etc.
  • User.
  • Group.
  • Resource.
  • An external IP address.
  • A file.
  • A domain.
  • A url.
  • A mutex.
  • A metric.
typestring
eventMetadata
$refMetadata
descriptionMetadata field from the event.
extracted
additionalProperties
descriptionProperties of the object.
typeany
descriptionFlattened fields extracted from the log.
typeobject
feed
descriptionVendor feed name for a threat indicator feed.
typestring
interval
$refInterval
descriptionValid existence time range for the version of the entity represented by this entity data.
productEntityId
descriptionA vendor-specific identifier that uniquely identifies the entity (e.g. a GUID, LDAP, OID, or similar).
typestring
productName
descriptionProduct name that produced the entity information.
typestring
productVersion
descriptionVersion of the product that produced the entity information.
typestring
sourceLabels
descriptionEntity source metadata labels.
items
$refLabel
typearray
sourceType
descriptionThe source of the entity.
enum
  • SOURCE_TYPE_UNSPECIFIED
  • ENTITY_CONTEXT
  • DERIVED_CONTEXT
  • GLOBAL_CONTEXT
enumDescriptions
  • Default source type
  • Entities ingested from customers (e.g. AD_CONTEXT, DLP_CONTEXT)
  • Entities derived from customer data such as prevalence, artifact first/last seen, or asset/user first seen stats.
  • Global contextual entities such as WHOIS or Safe Browsing.
typestring
structuredFields
additionalProperties
descriptionProperties of the object.
typeany
deprecatedTrue
descriptionStructured fields extracted from the log.
typeobject
threat
descriptionMetadata provided by a threat intelligence feed that identified the entity as malicious.
items
$refSecurityResult
typearray
vendorName
descriptionVendor name of the product that produced the entity information.
typestring
typeobject
EntityPopulationMechanism
descriptionMechanism to populate entities in the watchlist.
idEntityPopulationMechanism
properties
manual
$refManual
descriptionOptional. Entities are added manually.
typeobject
EntityRisk
descriptionStores information related to the risk score of an entity. Next ID: 15
idEntityRisk
properties
DEPRECATEDRiskScore
deprecatedTrue
descriptionDeprecated risk score.
formatint32
typeinteger
detailUri
descriptionLink to the Google Security Operations UI with information about the entity risk score. If the SecOps instance has multiple frontend paths configured, this will be a relative path that can be used to construct the full URL.
typestring
detectionsCount
descriptionNumber of detections that make up the risk score within the time window.
formatint32
typeinteger
firstDetectionTime
descriptionTimestamp of the first detection within the specified time window. This field is empty when there are no detections.
formatgoogle-datetime
typestring
lastDetectionTime
descriptionTimestamp of the last detection within the specified time window. This field is empty when there are no detections.
formatgoogle-datetime
typestring
lastResetTime
descriptionTimestamp for UEBA risk score reset based deduplication. Used specifically for risk based meta rules.
formatgoogle-datetime
typestring
normalizedRiskScore
descriptionNormalized risk score for the entity. This value is between 0-1000.
formatint32
typeinteger
rawRiskDelta
$refRiskDelta
descriptionRepresents the change in raw risk score for an entity between the end of the previous time window and the end of the current time window.
riskDelta
$refRiskDelta
descriptionRepresents the change in risk score for an entity between the end of the previous time window and the end of the current time window.
riskScore
descriptionRaw risk score for the entity.
formatfloat
typenumber
riskVersion
descriptionVersion of the risk score calculation algorithm.
typestring
riskWindow
$refInterval
descriptionTime window used when computing the risk score for an entity, for example 24 hours or 7 days.
riskWindowHasNewDetections
descriptionWhether there are new detections for the risk window.
typeboolean
riskWindowSize
descriptionRisk window duration for the entity.
formatgoogle-duration
typestring
typeobject
ErrorMessage
idErrorMessage
properties
errorText
typestring
type
enum
  • UNDEFINED_ERROR_TYPE
  • INVALID_QUERY_TYPE
  • INVALID_FIELD_PATH_TYPE
  • UNCLOSED_BRACKET_TYPE
  • BACKEND_ERROR_TYPE
  • UNCLOSED_QUOTES_TYPE
  • QUERY_TOO_LARGE_TYPE
enumDescriptions
typestring
typeobject
EventCountTimeline
idEventCountTimeline
properties
buckets
items
$refEventCountTimelineBucket
typearray
sizeOfBucketMs
formatint64
typestring
typeobject
EventCountTimelineBucket
idEventCountTimelineBucket
properties
alertCount
formatint32
typeinteger
baselineAlertCount
formatint32
typeinteger
baselineEventCount
formatint32
typeinteger
baselineTimedEntityCount
formatint32
typeinteger
entityChangedCount
$refEntityChangedCountTimelineBucket
eventCount
formatint32
typeinteger
filteredTimedEntityCount
formatint32
typeinteger
typeobject
Execution
descriptionExecution can be used to store metadata required for what action the UI should execute.
idExecution
properties
metadata
additionalProperties
typestring
descriptionOutput only. The payload to use when executing the action.
readOnlyTrue
typeobject
typeobject
ExifInfo
descriptionExif information.
idExifInfo
properties
company
descriptioncompany name.
typestring
compilationTime
descriptionCompilation time.
formatgoogle-datetime
typestring
entryPoint
descriptionentry point.
formatint64
typestring
fileDescription
descriptiondescription of a file.
typestring
originalFile
descriptionoriginal file name.
typestring
product
descriptionproduct name.
typestring
typeobject
Extension
descriptionCertificate's extensions.
idExtension
properties
authorityKeyId
$refAuthorityKeyId
descriptionIdentifies the public key to be used to verify the signature on this certificate or CRL.
ca
descriptionWhether the subject acts as a certificate authority (CA) or not.
typeboolean
caInfoAccess
descriptionAuthority information access locations are URLs that are added to a certificate in its authority information access extension.
typestring
certTemplateNameDc
descriptionBMP data value "DomainController". See MS Q291010.
typestring
certificatePolicies
descriptionDifferent certificate policies will relate to different applications which may use the certified key.
typestring
crlDistributionPoints
descriptionCRL distribution points to which a certificate user should refer to ascertain if the certificate has been revoked.
typestring
extendedKeyUsage
descriptionOne or more purposes for which the certified public key may be used, in addition to or in place of the basic purposes indicated in the key usage extension field.
typestring
keyUsage
descriptionThe purpose for which the certified public key is used.
typestring
netscapeCertComment
descriptionUsed to include free-form text comments inside certificates.
typestring
netscapeCertificate
descriptionIdentify whether the certificate subject is an SSL client, an SSL server, or a CA.
typeboolean
oldAuthorityKeyId
descriptionWhether the certificate has an old authority key identifier extension.
typeboolean
peLogotype
descriptionWhether the certificate includes a logotype.
typeboolean
subjectAlternativeName
descriptionContains one or more alternative names, using any of a variety of name forms, for the entity that is bound by the CA to the certified public key.
typestring
subjectKeyId
descriptionIdentifies the public key being certified.
typestring
typeobject
Extensions
descriptionExtensions to a UDM event.
idExtensions
properties
auth
$refAuthentication
descriptionAn authentication extension.
entityRisk
$refEntityRisk
descriptionAn entity risk change extension.
vulns
$refVulnerabilities
descriptionA vulnerability extension.
typeobject
Favicon
descriptionDifference hash and MD5 hash of the domain's favicon.
idFavicon
properties
dhash
descriptionDifference hash.
typestring
rawMd5
descriptionFavicon's MD5 hash.
typestring
typeobject
Feedback
idFeedback
properties
comment
descriptionOptional.
typestring
confidenceScore
formatint32
typeinteger
createdTime
formatgoogle-datetime
typestring
disregarded
typeboolean
idpUserId
typestring
priority
descriptionOptional.
enum
  • PRIORITY_UNSPECIFIED
  • PRIORITY_INFO
  • PRIORITY_LOW
  • PRIORITY_MEDIUM
  • PRIORITY_HIGH
  • PRIORITY_CRITICAL
enumDescriptions
  • Default priority level.
  • Informational priority.
  • Low priority.
  • Medium priority.
  • High priority.
  • Critical priority.
typestring
priorityDisplay
descriptionOptional.
typestring
reason
descriptionOptional.
enum
  • REASON_UNSPECIFIED
  • REASON_NOT_MALICIOUS
  • REASON_MALICIOUS
  • REASON_MAINTENANCE
enumDescriptions
  • Default reason.
  • Case or Alert not malicious.
  • Case or Alert is malicious.
  • Case or Alert is under maintenance.
typestring
reputation
enum
  • REPUTATION_UNSPECIFIED
  • USEFUL
  • NOT_USEFUL
enumDescriptions
  • An unspecified reputation.
  • A categorization of the finding as useful.
  • A categorization of the finding as not useful.
typestring
riskScore
formatint32
typeinteger
rootCause
descriptionOptional.
typestring
severity
formatint32
typeinteger
severityDisplay
descriptionOptional.
typestring
status
descriptionOptional.
enum
  • STATUS_UNSPECIFIED
  • NEW
  • REVIEWED
  • CLOSED
  • OPEN
enumDescriptions
  • Unspecified finding status.
  • New finding.
  • When a finding has feedback.
  • When an analyst closes an finding.
  • Open. Used to indicate that a Case / Alert is open.
typestring
verdict
enum
  • VERDICT_UNSPECIFIED
  • TRUE_POSITIVE
  • FALSE_POSITIVE
enumDescriptions
  • An unspecified verdict.
  • A categorization of the finding as a "true positive".
  • A categorization of the finding as a "false positive".
typestring
typeobject
FieldAndValue
idFieldAndValue
properties
entityNamespace
typestring
fieldPath
typestring
kvalueType
enum
  • UNKNOWN
  • COLLECTOR_ID
  • EVENT_SHARD
  • ASSET_IP_ADDRESS
  • MAC
  • HOSTNAME
  • PRODUCT_SPECIFIC_ID
  • NAMESPACE
  • DOMAIN_NAME
  • RESOLVED_IP_ADDRESS
  • STEMMED_DOMAIN_NAME
  • PROCESS_ID
  • FULL_COMMAND_LINE
  • FILE_NAME
  • FILE_PATH
  • HASH_MD5
  • HASH_SHA256
  • HASH_SHA1
  • RAW_PID
  • PARENT_PROCESS_ID
  • EMAIL
  • USERNAME
  • WINDOWS_SID
  • EMPLOYEE_ID
  • PRODUCT_OBJECT_ID
  • USER_DISPLAY_NAME
  • CLOUD_RESOURCE_NAME
  • REGISTRY_KEY
  • REGISTRY_VALUE_DATA
  • REGISTRY_VALUE_NAME
enumDescriptions
typestring
value
typestring
typeobject
FileMetadata
descriptionMetadata about a file. Place metadata about different file types here, for example data from the Microsoft Windows VersionInfo block or digital signer details. Use a different sub-message per file type.
idFileMetadata
properties
pe
$refPeFileMetadata
deprecatedTrue
descriptionMetadata for Microsoft Windows PE files. Deprecate PeFileMetadata in favor of single File proto.
typeobject
FileMetadataCodesign
descriptionFile metadata from the codesign utility.
idFileMetadataCodesign
properties
compilationTime
descriptionCode sign timestamp
formatgoogle-datetime
typestring
format
descriptionCode sign format.
typestring
id
descriptionCode sign identifier.
typestring
teamId
descriptionThe assigned team identifier of the developer who signed the application.
typestring
typeobject
FileMetadataImports
descriptionFile metadata imports.
idFileMetadataImports
properties
functions
descriptionFunction field.
items
typestring
typearray
library
descriptionLibrary field.
typestring
typeobject
FileMetadataPE
descriptionMetadata about the Portable Executable (PE) file.
idFileMetadataPE
properties
compilationExiftoolTime
descriptioninfo.exiftool.TimeStamp.
formatgoogle-datetime
typestring
compilationTime
descriptioninfo.pe-timestamp.
formatgoogle-datetime
typestring
entryPoint
descriptioninfo.pe-entry-point.
formatint64
typestring
entryPointExiftool
descriptioninfo.exiftool.EntryPoint.
formatint64
typestring
imphash
descriptionImphash of the file.
typestring
imports
descriptionFilemetadataImports fields.
items
$refFileMetadataImports
typearray
resource
descriptionFilemetadataPeResourceInfo fields.
items
$refFileMetadataPeResourceInfo
typearray
resourcesLanguageCount
deprecatedTrue
descriptionDeprecated: use resources_language_count_str.
items
$refStringToInt64MapEntry
typearray
resourcesLanguageCountStr
descriptionNumber of resources by language. Example: NEUTRAL: 20, ENGLISH US: 10
items
$refLabel
typearray
resourcesTypeCount
deprecatedTrue
descriptionDeprecated: use resources_type_count_str.
items
$refStringToInt64MapEntry
typearray
resourcesTypeCountStr
descriptionNumber of resources by resource type. Example: RT_ICON: 10, RT_DIALOG: 5
items
$refLabel
typearray
section
descriptionFilemetadataSection fields.
items
$refFileMetadataSection
typearray
signatureInfo
$refFileMetadataSignatureInfo
deprecatedTrue
descriptionFilemetadataSignatureInfo field. deprecated, user File.signature_info instead.
typeobject
FileMetadataPeResourceInfo
descriptionFile metadata for PE resource.
idFileMetadataPeResourceInfo
properties
entropy
descriptionEntropy of the resource.
formatdouble
typenumber
fileType
descriptionFile type. Note that this value may not match any of the well-known type identifiers defined in the ResourceType enum.
typestring
filetypeMagic
descriptionType of resource content, as identified by the magic Python module.
typestring
languageCode
descriptionHuman-readable version of the language and sublanguage identifiers, as defined in the Microsoft Windows PE specification. Examples: | Language | Sublanguage | Field value | | LANG_NEUTRAL | SUBLANG_NEUTRAL | NEUTRAL | | LANG_FRENCH | - | FRENCH | | LANG_ENGLISH | SUBLANG_ENGLISH US | ENGLISH US |
typestring
sha256Hex
descriptionSHA256_hex field..
typestring
typeobject
FileMetadataSection
descriptionFile metadata section.
idFileMetadataSection
properties
entropy
descriptionEntropy of the section.
formatdouble
typenumber
md5Hex
descriptionMD5 hex of the file.
typestring
name
descriptionName of the section.
typestring
rawSizeBytes
descriptionRaw file size in bytes.
formatint64
typestring
virtualSizeBytes
descriptionVirtual file size in bytes.
formatint64
typestring
typeobject
FileMetadataSignatureInfo
descriptionSignature information.
idFileMetadataSignatureInfo
properties
signer
deprecatedTrue
descriptionDeprecated: use signers field.
items
typestring
typearray
signers
descriptionFile metadata signer information. The order of the signers matters. Each element is a higher level authority, being the last the root authority.
items
$refSignerInfo
typearray
verificationMessage
descriptionStatus of the certificate. Valid values are "Signed", "Unsigned" or a description of the certificate anomaly, if found.
typestring
verified
descriptionTrue if verification_message == "Signed"
typeboolean
x509
descriptionList of certificates.
items
$refX509
typearray
typeobject
FilterProperties
idFilterProperties
properties
hidden
typeboolean
stringProperties
additionalProperties
$refStringValues
typeobject
typeobject
FindingVariable
descriptionA structure that holds the value and associated metadata for values extracted while producing a Finding.
idFindingVariable
properties
boolSeq
$refBoolSequence
descriptionThe value in boolsequence format.
boolVal
descriptionThe value in boolean format.
typeboolean
bytesSeq
$refBytesSequence
descriptionThe value in bytessequence format.
bytesVal
descriptionThe value in bytes format.
formatbyte
typestring
doubleSeq
$refDoubleSequence
descriptionThe value in doublesequence format.
doubleVal
descriptionThe value in double format.
formatdouble
typenumber
int64Seq
$refInt64Sequence
descriptionThe value in int64sequence format.
int64Val
descriptionThe value in int64 format.
formatint64
typestring
nullVal
descriptionWhether the value is null.
typeboolean
sourcePath
descriptionThe UDM field path for the field which this value was derived from. Example: `principal.user.username`
typestring
stringSeq
$refStringSequence
descriptionThe value in stringsequence format.
stringVal
descriptionThe value in string format. Enum values are returned as strings.
typestring
type
descriptionThe type of the variable.
enum
  • TYPE_UNSPECIFIED
  • MATCH
  • OUTCOME
enumDescriptions
  • An unspecified variable type.
  • A variable coming from the match conditions.
  • A variable representing significant data that was found in the detection logic.
typestring
uint64Seq
$refUint64Sequence
descriptionThe value in uint64sequence format.
uint64Val
descriptionThe value in uint64 format.
formatuint64
typestring
value
descriptionThe value in string form.
typestring
typeobject
FollowUp
descriptionFollowUp can be used to store metadata required to send a follow up message by the UI.
idFollowUp
properties
followUp
descriptionOutput only. The text to use as input when generating the follow up message.
readOnlyTrue
typestring
typeobject
Ftp
descriptionFTP info.
idFtp
properties
command
descriptionThe FTP command.
typestring
typeobject
FunctionResponse
idFunctionResponse
properties
rows
items
$refFunctionResponseRow
typearray
tooManyRows
typeboolean
typeobject
FunctionResponseRow
idFunctionResponseRow
properties
values
items
$refUdmFieldValue
typearray
typeobject
GoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStats
descriptionLINT.IfChange(stats_data) Stats results when the query is for statistics NEXT TAG = 6;
idGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStats
properties
dataQueryExpression
descriptionExpression that represent the subset of the requested query used to filter data. The expression will be used to enable features such as drill-down from stats results to UDM events. In that case, the new query will be composed by this expression and the expression related to a stats result.
typestring
results
descriptionResult rows that are queried.
items
$refGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnData
typearray
sortOrder
descriptionIndicates the columns used for sorting and the order in which they are sorted. If no ORDER section is specified in the query, this will be empty.
items
$refGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnSort
typearray
tooManyResults
descriptionIf true, there are too many results to return and some have been omitted.
typeboolean
totalResults
descriptionThe total number of results returned.
formatint32
typeinteger
typeobject
GoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnData
descriptionRepresents a single column in the set of columns returned as the stats query result.
idGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnData
properties
column
descriptionUsed to store column names.
typestring
filterExpression
descriptionExpression used to compose a query for filtering/drill-downs related to the data in this column.
typestring
filterable
descriptionTo identify if the column can be used for filtering/drill-downs.
typeboolean
values
descriptionTo store store column data.
items
$refGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnType
typearray
typeobject
GoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnSort
descriptionContains the column name and which direction the column is sorted (ascending or descenging).
idGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnSort
properties
descending
descriptionWhether the column is sorted in descending order (ascending by default);
typeboolean
name
descriptionName of the column.
typestring
typeobject
GoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnType
descriptionSingular vs list of values in a column.
idGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnType
properties
list
$refGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnTypeList
descriptionList of values in a column e.g. IPs
value
$refGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnValue
descriptionSingle value in a column.
typeobject
GoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnTypeList
descriptionStore list of values in a column.
idGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnTypeList
properties
values
descriptionList of values in one cell of the column.
items
$refGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnValue
typearray
typeobject
GoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnValue
descriptionValue of the column based on data type
idGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnValue
properties
boolVal
descriptionBoolean value.
typeboolean
bytesVal
descriptionBytes value.
formatbyte
typestring
dateVal
$refDate
descriptionDate values.
doubleVal
descriptionDouble value.
formatdouble
typenumber
int64Val
descriptionInteger value (signed).
formatint64
typestring
nullVal
descriptionTrue if the value is NULL.
typeboolean
protoVal
additionalProperties
descriptionProperties of the object. Contains field @type with type URL.
typeany
descriptionFor any proto values that are not any of the above.
typeobject
stringVal
descriptionString value. Enum values are returned as strings.
typestring
timestampVal
descriptionTimestamp values.
formatgoogle-datetime
typestring
uint64Val
descriptionUn-signed integer value.
formatuint64
typestring
typeobject
Group
descriptionInformation about an organizational group.
idGroup
properties
attribute
$refAttribute
descriptionGeneric entity metadata attributes of the group.
creationTime
deprecatedTrue
descriptionGroup creation time. Deprecated: creation_time should be populated in Attribute as generic metadata.
formatgoogle-datetime
typestring
emailAddresses
descriptionEmail addresses of the group.
items
typestring
typearray
groupDisplayName
descriptionGroup display name. e.g. "Finance".
typestring
productObjectId
descriptionProduct globally unique user object identifier, such as an LDAP Object Identifier.
typestring
windowsSid
descriptionMicrosoft Windows SID of the group.
typestring
typeobject
GroupAggregationByField
idGroupAggregationByField
properties
baselineEventCount
formatint32
typeinteger
eventCount
formatint32
typeinteger
fieldName
typestring
fieldValue
$refUdmFieldValue
fields
items
$refUdmFieldAggregation
typearray
valueCount
formatint32
typeinteger
typeobject
Hardware
descriptionHardware specification details for a resource, including both physical and virtual hardware.
idHardware
properties
cpuClockSpeed
descriptionClock speed of the hardware CPU in MHz.
formatuint64
typestring
cpuMaxClockSpeed
descriptionMaximum possible clock speed of the hardware CPU in MHz.
formatuint64
typestring
cpuModel
descriptionModel description of the hardware CPU (e.g. "2.8 GHz Quad-Core Intel Core i5").
typestring
cpuNumberCores
descriptionNumber of CPU cores.
formatuint64
typestring
cpuPlatform
descriptionPlatform of the hardware CPU (e.g. "Intel Broadwell").
typestring
manufacturer
descriptionHardware manufacturer.
typestring
model
descriptionHardware model.
typestring
ram
descriptionAmount of the hardware ramdom access memory (RAM) in Mb.
formatuint64
typestring
serialNumber
descriptionHardware serial number.
typestring
typeobject
Http
descriptionSpecify the full URL of the HTTP request within "target". Also specify any uploaded or downloaded file information within "source" or "target".
idHttp
properties
method
descriptionThe HTTP request method (e.g. "GET", "POST", "PATCH", "DELETE").
typestring
parsedUserAgent
$refUserAgentProto
descriptionThe parsed user_agent string.
referralUrl
descriptionThe URL for the HTTP referer.
typestring
responseCode
descriptionThe response status code, for example 200, 302, 404, or 500.
formatint32
typeinteger
userAgent
descriptionThe User-Agent request header which includes the application type, operating system, software vendor or software version of the requesting software user agent.
typestring
typeobject
Id
descriptionIdentifier to identify a UDM object like a UDM event, Entity, Collection. The full identifier for persistence is created by setting the 32 most significant bits as the Id.Namespace enum and the rest according to go/udm:ids. This is a convenience wrapper to define the id space enum values and provide an easy interface for RPCs, most persistence use cases should use a denormalized form. See go/udm:ids for background and details.
idId
properties
id
descriptionFull raw ID.
formatbyte
typestring
namespace
descriptionNamespace the id belongs to.
enum
  • NORMALIZED_TELEMETRY
  • RAW_TELEMETRY
  • RULE_DETECTIONS
  • UPPERCASE
  • MACHINE_INTELLIGENCE
  • SECURITY_COMMAND_CENTER
  • UNSPECIFIED
  • SOAR_ALERT
  • VIRUS_TOTAL
enumDescriptions
  • Ingested and Normalized telemetry events
  • Ingested Raw telemetry
  • Chronicle Rules engine
  • Uppercase
  • DSML - Machine Intelligence
  • A normalized telemetry event from Google Security Command Center.
  • Unspecified Namespace
  • An alert coming from other SIEMs via Chronicle SOAR.
  • VirusTotal.
typestring
stringId
descriptionSome ids are stored as strings that are not able to be translated to bytes, so store these separately. Ex. detection id of the form de_aaaaaaaa-aaaa...
typestring
typeobject
IngestionLabel
descriptionRepresentation of an ingestion label type.
idIngestionLabel
properties
ingestionLabelKey
descriptionRequired. The key of the ingestion label. Always required.
typestring
ingestionLabelValue
descriptionOptional. The value of the ingestion label. Optional. An object with no provided value and some key provided would match against the given key and ANY value.
typestring
typeobject
InputsUsed
descriptionInputsUsed is a convenience field that tells us which sources of events (if any) were used in the rule. NEXT TAG: 4
idInputsUsed
properties
usesDetection
descriptionOptional. Whether the rule queries detections.
typeboolean
usesEntity
descriptionOptional. Whether the rule queries entity events.
typeboolean
usesUdm
descriptionOptional. Whether the rule queries UDM events.
typeboolean
typeobject
Instance
descriptionA Instance represents an instantiation of the Instance product.
idInstance
properties
name
descriptionOutput only. The resource name of this instance. Format: projects/{project}/locations/{location}/instances/{instance}
readOnlyTrue
typestring
typeobject
InstanceUdmSearchResponse
idInstanceUdmSearchResponse
properties
baselineEventsCount
formatint32
typeinteger
complete
typeboolean
detections
$refDetections
filteredEventsCount
formatint32
typeinteger
instanceId
typestring
prevalence
$refUdmPrevalenceResponse
progress
formatdouble
typenumber
runtimeErrors
$refRuntimeError
timeline
$refEventCountTimeline
tooManyEvents
typeboolean
typeobject
Int64Sequence
descriptionInt64Sequence represents a sequence of int64s.
idInt64Sequence
properties
int64Vals
descriptionint64 sequence.
items
formatint64
typestring
typearray
typeobject
Interval
descriptionRepresents a time interval, encoded as a Timestamp start (inclusive) and a Timestamp end (exclusive). The start must be less than or equal to the end. When the start equals the end, the interval is empty (matches no time). When both start and end are unspecified, the interval matches any time.
idInterval
properties
endTime
descriptionOptional. Exclusive end of the interval. If specified, a Timestamp matching this interval will have to be before the end.
formatgoogle-datetime
typestring
startTime
descriptionOptional. Inclusive start of the interval. If specified, a Timestamp matching this interval will have to be the same or after the start.
formatgoogle-datetime
typestring
typeobject
Investigation
descriptionRepresents the aggregated state of an investigation such as categorization, severity, and status. Can be expanded to include analyst assignment details and more.
idInvestigation
properties
comments
descriptionComment added by the Analyst.
items
typestring
typearray
priority
descriptionPriority of the Alert or Finding set by analyst.
enum
  • PRIORITY_UNSPECIFIED
  • PRIORITY_INFO
  • PRIORITY_LOW
  • PRIORITY_MEDIUM
  • PRIORITY_HIGH
  • PRIORITY_CRITICAL
enumDescriptions
  • Default priority level.
  • Informational priority.
  • Low priority.
  • Medium priority.
  • High priority.
  • Critical priority.
typestring
reason
descriptionReason for closing the Case or Alert.
enum
  • REASON_UNSPECIFIED
  • REASON_NOT_MALICIOUS
  • REASON_MALICIOUS
  • REASON_MAINTENANCE
enumDescriptions
  • Default reason.
  • Case or Alert not malicious.
  • Case or Alert is malicious.
  • Case or Alert is under maintenance.
typestring
reputation
descriptionDescribes whether a finding was useful or not-useful.
enum
  • REPUTATION_UNSPECIFIED
  • USEFUL
  • NOT_USEFUL
enumDescriptions
  • An unspecified reputation.
  • A categorization of the finding as useful.
  • A categorization of the finding as not useful.
typestring
riskScore
descriptionRisk score for a finding set by an analyst.
formatuint32
typeinteger
rootCause
descriptionRoot cause of the Alert or Finding set by analyst.
typestring
severityScore
descriptionSeverity score for a finding set by an analyst.
formatuint32
typeinteger
status
descriptionDescribes the workflow status of a finding.
enum
  • STATUS_UNSPECIFIED
  • NEW
  • REVIEWED
  • CLOSED
  • OPEN
enumDescriptions
  • Unspecified finding status.
  • New finding.
  • When a finding has feedback.
  • When an analyst closes an finding.
  • Open. Used to indicate that a Case / Alert is open.
typestring
verdict
descriptionDescribes reason a finding investigation was resolved.
enum
  • VERDICT_UNSPECIFIED
  • TRUE_POSITIVE
  • FALSE_POSITIVE
enumDescriptions
  • An unspecified verdict.
  • A categorization of the finding as a "true positive".
  • A categorization of the finding as a "false positive".
typestring
typeobject
IoCStats
descriptionInformation about the threat intelligence source. These fields are used to model Mandiant sources.
idIoCStats
properties
benignCount
descriptionCount of responses where the IoC was identified as benign.
formatint32
typeinteger
firstLevelSource
descriptionName of first level IoC source, for example Mandiant or a third-party.
typestring
iocStatsType
descriptionDescribes the source of the IoCStat.
enum
  • UNSPECIFIED_IOC_STATS_TYPE
  • MANDIANT_SOURCES
  • THIRD_PARTY_SOURCES
  • THREAT_INTELLIGENCE_IOC_STATS
enumDescriptions
  • IoCStat source is unidentified.
  • IoCStat is from a Mandiant Source.
  • IoCStat is from a third-party source.
  • IoCStat is from a threat intelligence feed.
typestring
maliciousCount
descriptionCount of responses where the IoC was identified as malicious.
formatint32
typeinteger
quality
descriptionLevel of confidence in the IoC mapping extracted from the source.
enum
  • UNKNOWN_CONFIDENCE
  • LOW_CONFIDENCE
  • MEDIUM_CONFIDENCE
  • HIGH_CONFIDENCE
enumDescriptions
  • The default confidence level.
  • Low confidence.
  • Medium confidence.
  • High confidence.
typestring
responseCount
descriptionTotal number of response from the source.
formatint32
typeinteger
secondLevelSource
descriptionName of the second-level IoC source, for example Crowdsourced Threat Analysis or Knowledge Graph.
typestring
sourceCount
descriptionNumber of sources from which information was extracted.
formatint32
typeinteger
typeobject
Label
descriptionKey value labels.
idLabel
properties
key
descriptionThe key.
typestring
rbacEnabled
descriptionIndicates whether this label can be used for Data RBAC
typeboolean
source
descriptionWhere the label is derived from.
typestring
value
descriptionThe value.
typestring
typeobject
LatLng
descriptionAn object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges.
idLatLng
properties
latitude
descriptionThe latitude in degrees. It must be in the range [-90.0, +90.0].
formatdouble
typenumber
longitude
descriptionThe longitude in degrees. It must be in the range [-180.0, +180.0].
formatdouble
typenumber
typeobject
LegacyFederatedUdmSearchViewResponse
descriptionResponse to a Federated UDM Search query. This will be used by StreamSearchOperation RPC to return the results of a federated search operation.
idLegacyFederatedUdmSearchViewResponse
properties
activityTimeline
$refEventCountTimeline
descriptionTimeline of event counts broken into hourly/daily buckets to identify activity.
aiOverview
$refAIOverview
descriptionLINT.ThenChange( //depot/google3/google/cloud/chronicle/v1main/dashboard_query.proto:data_sources, //depot/google3/googlex/security/malachite/proto/udm_search.proto:data_sources ) AI generated overview for the search results. Only populated if the AI features are enabled for the customer and generate_ai_overview is set to true in the request.
baselineEventsCount
descriptionThe number of events in the baseline query.
formatint32
typeinteger
complete
descriptionStreaming for this response is done. There will be no additional updates.
typeboolean
dataSources
descriptionDatasource of the query and results in case of a statistics query
items
enum
  • SEARCH_DATA_SOURCE_UNSPECIFIED
  • SEARCH_UDM
  • SEARCH_ENTITY
  • SEARCH_RULE_DETECTIONS
  • SEARCH_RULESETS
enumDescriptions
  • Unspecified data source.
  • Events
  • Entities
  • To be used for detections data source.
  • To be used for ruleset with detections datasource.
typestring
typearray
detectionFieldAggregations
$refAlertFieldAggregations
descriptionList of detection fields with aggregated values. This enabled filtering in the Alerts panel for federated search.
events
$refUdmEventList
descriptionList of UDM events. NOTE: After complete is set to true, the `UdmEventList` message will be omitted from the response. The latest message should be used as reference. If the `UdmEventList` message is returned again, then it should replace the previous value.
fieldAggregations
$refUdmFieldAggregations
descriptionList of UDM fields with aggregated values.
filteredEventsCount
descriptionThe number of events in the snapshot that match the snapshot_query. This is <= `baseline_events_count`. If the snapshot query is empty this will be equivalent to `baseline_events_count`.
formatint32
typeinteger
groupedFieldAggregations
$refUdmFieldAggregations
descriptionList of grouped fields with aggregated values.
instanceAggregations
$refUdmFieldAggregations
descriptionInstance aggregations for the search results. Provides information on the number of events per instance for the aggregations panel in the UI. This allows users to easily drill-down into the individual instances.
instanceUdmSearchResponses
descriptionAll the instance specific UDM search responses.
items
$refInstanceUdmSearchResponse
typearray
operation
descriptionThe name of the operation resource representing the UDM Search operation. This can be passed to `StreamSearchOperation` to fetch stored results or stream the results of an in-progress operation. The metadata type of the operation is `UdmSearchMetadata`. The response type is `LegacyFetchUdmSearchViewResponse`. Format: projects/{project}/locations/{location}/instances/{instance}/operations/{operation}
typestring
progress
descriptionProgress of the query represented as a double between 0 and 1.
formatdouble
typenumber
queryValidationErrors
descriptionParse error for the baseline_query and/or the snapshot_query.
items
$refErrorMessage
typearray
runtimeErrors
descriptionRuntime errors.
items
$refRuntimeError
typearray
stats
$refGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStats
descriptionStats results when the query is for statistics
statsFunctionParameterValidationErrorMessage
descriptionIf the request's stats_function_parameter` is invalid, this field will contain the detailed error message.
typestring
statsFunctionResponse
$refFunctionResponse
descriptionResult for statistical function.
timeline
$refEventCountTimeline
descriptionTimeline of event counts broken into buckets. This populates the trend-over-time chart in the UI.
tooLargeResponse
descriptionIf true, the response to be returned to the UI is too large and some events have been omitted.
typeboolean
tooManyEvents
descriptionIf true, there are too many events to return and some have been omitted.
typeboolean
validBaselineQuery
descriptionIndicates whether the request baseline_query is a valid structured query or not. If not, `query_validation_errors` will include the parse error.
typeboolean
validSnapshotQuery
descriptionIndicates whether the request baseline and snapshot queries are valid. If not, `query_validation_errors` will include the parse error.
typeboolean
typeobject
ListDataAccessLabelsResponse
descriptionResponse message for ListDataAccessLabels.
idListDataAccessLabelsResponse
properties
dataAccessLabels
descriptionList of data access labels.
items
$refDataAccessLabel
typearray
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
typeobject
ListDataAccessScopesResponse
descriptionResponse message for ListDataAccessScopes.
idListDataAccessScopesResponse
properties
dataAccessScopes
descriptionList of data access scopes.
items
$refDataAccessScope
typearray
globalDataAccessScopeGranted
descriptionWhether or not global scope is granted to the user.
typeboolean
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
typeobject
ListOperationsResponse
descriptionThe response message for Operations.ListOperations.
idListOperationsResponse
properties
nextPageToken
descriptionThe standard List next-page token.
typestring
operations
descriptionA list of operations that matches the specified filter in the request.
items
$refOperation
typearray
typeobject
ListReferenceListsResponse
descriptionA response to a request for a list of reference lists.
idListReferenceListsResponse
properties
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
referenceLists
descriptionThe reference lists. Ordered in ascending alphabetical order by name.
items
$refReferenceList
typearray
typeobject
ListRetrohuntsResponse
descriptionResponse message for ListRetrohunts method.
idListRetrohuntsResponse
properties
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
retrohunts
descriptionThe retrohunts from the specified rule.
items
$refRetrohunt
typearray
typeobject
ListRuleDeploymentsResponse
descriptionResponse message for ListRuleDeployments.
idListRuleDeploymentsResponse
properties
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
ruleDeployments
descriptionThe rule deployments from all rules.
items
$refRuleDeployment
typearray
typeobject
ListRuleRevisionsResponse
descriptionResponse message for ListRuleRevisions method.
idListRuleRevisionsResponse
properties
nextPageToken
descriptionA token that can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
rules
descriptionThe revisions of the rule.
items
$refRule
typearray
typeobject
ListRulesResponse
descriptionResponse message for ListRules method.
idListRulesResponse
properties
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
rules
descriptionThe rules from the specified instance.
items
$refRule
typearray
typeobject
ListWatchlistsResponse
descriptionResponse message for listing watchlists.
idListWatchlistsResponse
properties
nextPageToken
descriptionOptional. A token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
watchlists
descriptionOptional. The watchlists from the specified instance.
items
$refWatchlist
typearray
typeobject
Location
descriptionInformation about a location.
idLocation
properties
city
descriptionThe city.
typestring
countryOrRegion
descriptionThe country or region.
typestring
deskName
descriptionDesk name or individual location, typically for an employee in an office. (e.g. "IN-BLR-BCPC-11-1121D").
typestring
floorName
descriptionFloor name, number or a combination of the two for a building. (e.g. "1-A").
typestring
name
descriptionCustom location name (e.g. building or site name like "London Office"). For cloud environments, this is the region (e.g. "us-west2").
typestring
regionCoordinates
$refLatLng
descriptionCoordinates for the associated region. See https://cloud.google.com/vision/docs/reference/rest/v1/LatLng for a description of the fields.
regionLatitude
deprecatedTrue
descriptionDeprecated: use region_coordinates.
formatfloat
typenumber
regionLongitude
deprecatedTrue
descriptionDeprecated: use region_coordinates.
formatfloat
typenumber
state
descriptionThe state.
typestring
typeobject
Manual
descriptionEntities are added manually.
idManual
properties
typeobject
Measure
descriptionDescribes the precomputed measure.
idMeasure
properties
aggregateFunction
descriptionFunction used to calculate the aggregated measure.
enum
  • AGGREGATE_FUNCTION_UNSPECIFIED
  • MIN
  • MAX
  • COUNT
  • SUM
  • AVG
  • STDDEV
enumDescriptions
  • Default value.
  • Minimum.
  • Maximum.
  • Count.
  • Sum.
  • Average.
  • Standard Deviation.
typestring
value
descriptionValue of the aggregated measure.
formatdouble
typenumber
typeobject
Metadata
descriptionGeneral information associated with a UDM event.
idMetadata
properties
baseLabels
$refDataAccessLabels
descriptionData access labels on the base event.
collectedTimestamp
descriptionThe GMT timestamp when the event was collected by the vendor's local collection infrastructure.
formatgoogle-datetime
typestring
description
descriptionA human-readable unparsable description of the event.
typestring
enrichmentLabels
$refDataAccessLabels
descriptionData access labels from all the contextual events used to enrich the base event.
enrichmentState
descriptionThe enrichment state.
enum
  • ENRICHMENT_STATE_UNSPECIFIED
  • ENRICHED
  • UNENRICHED
enumDescriptions
  • Unspecified.
  • The event has been enriched by Chronicle.
  • The event has not been enriched by Chronicle.
typestring
eventTimestamp
descriptionThe GMT timestamp when the event was generated.
formatgoogle-datetime
typestring
eventType
descriptionThe event type. If an event has multiple possible types, this specifies the most specific type.
enum
  • EVENTTYPE_UNSPECIFIED
  • PROCESS_UNCATEGORIZED
  • PROCESS_LAUNCH
  • PROCESS_INJECTION
  • PROCESS_PRIVILEGE_ESCALATION
  • PROCESS_TERMINATION
  • PROCESS_OPEN
  • PROCESS_MODULE_LOAD
  • REGISTRY_UNCATEGORIZED
  • REGISTRY_CREATION
  • REGISTRY_MODIFICATION
  • REGISTRY_DELETION
  • SETTING_UNCATEGORIZED
  • SETTING_CREATION
  • SETTING_MODIFICATION
  • SETTING_DELETION
  • MUTEX_UNCATEGORIZED
  • MUTEX_CREATION
  • FILE_UNCATEGORIZED
  • FILE_CREATION
  • FILE_DELETION
  • FILE_MODIFICATION
  • FILE_READ
  • FILE_COPY
  • FILE_OPEN
  • FILE_MOVE
  • FILE_SYNC
  • USER_UNCATEGORIZED
  • USER_LOGIN
  • USER_LOGOUT
  • USER_CREATION
  • USER_CHANGE_PASSWORD
  • USER_CHANGE_PERMISSIONS
  • USER_STATS
  • USER_BADGE_IN
  • USER_DELETION
  • USER_RESOURCE_CREATION
  • USER_RESOURCE_UPDATE_CONTENT
  • USER_RESOURCE_UPDATE_PERMISSIONS
  • USER_COMMUNICATION
  • USER_RESOURCE_ACCESS
  • USER_RESOURCE_DELETION
  • GROUP_UNCATEGORIZED
  • GROUP_CREATION
  • GROUP_DELETION
  • GROUP_MODIFICATION
  • EMAIL_UNCATEGORIZED
  • EMAIL_TRANSACTION
  • EMAIL_URL_CLICK
  • NETWORK_UNCATEGORIZED
  • NETWORK_FLOW
  • NETWORK_CONNECTION
  • NETWORK_FTP
  • NETWORK_DHCP
  • NETWORK_DNS
  • NETWORK_HTTP
  • NETWORK_SMTP
  • STATUS_UNCATEGORIZED
  • STATUS_HEARTBEAT
  • STATUS_STARTUP
  • STATUS_SHUTDOWN
  • STATUS_UPDATE
  • SCAN_UNCATEGORIZED
  • SCAN_FILE
  • SCAN_PROCESS_BEHAVIORS
  • SCAN_PROCESS
  • SCAN_HOST
  • SCAN_VULN_HOST
  • SCAN_VULN_NETWORK
  • SCAN_NETWORK
  • SCHEDULED_TASK_UNCATEGORIZED
  • SCHEDULED_TASK_CREATION
  • SCHEDULED_TASK_DELETION
  • SCHEDULED_TASK_ENABLE
  • SCHEDULED_TASK_DISABLE
  • SCHEDULED_TASK_MODIFICATION
  • SYSTEM_AUDIT_LOG_UNCATEGORIZED
  • SYSTEM_AUDIT_LOG_WIPE
  • SERVICE_UNSPECIFIED
  • SERVICE_CREATION
  • SERVICE_DELETION
  • SERVICE_START
  • SERVICE_STOP
  • SERVICE_MODIFICATION
  • GENERIC_EVENT
  • RESOURCE_CREATION
  • RESOURCE_DELETION
  • RESOURCE_PERMISSIONS_CHANGE
  • RESOURCE_READ
  • RESOURCE_WRITTEN
  • DEVICE_FIRMWARE_UPDATE
  • DEVICE_CONFIG_UPDATE
  • DEVICE_PROGRAM_UPLOAD
  • DEVICE_PROGRAM_DOWNLOAD
  • ANALYST_UPDATE_VERDICT
  • ANALYST_UPDATE_REPUTATION
  • ANALYST_UPDATE_SEVERITY_SCORE
  • ANALYST_UPDATE_STATUS
  • ANALYST_ADD_COMMENT
  • ANALYST_UPDATE_PRIORITY
  • ANALYST_UPDATE_ROOT_CAUSE
  • ANALYST_UPDATE_REASON
  • ANALYST_UPDATE_RISK_SCORE
  • ENTITY_RISK_CHANGE
enumDeprecated
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • True
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • True
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • True
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
enumDescriptions
  • Default event type
  • Activity related to a process which does not match any other event types.
  • Process launch.
  • Process injecting into another process.
  • Process privilege escalation.
  • Process termination.
  • Process being opened.
  • Process loading a module.
  • Registry event which does not match any of the other event types.
  • Registry creation.
  • Registry modification.
  • Registry deletion.
  • Settings-related event which does not match any of the other event types.
  • Setting creation.
  • Setting modification.
  • Setting deletion.
  • Any mutex event other than creation.
  • Mutex creation.
  • File event which does not match any of the other event types.
  • File created.
  • File deleted.
  • File modified.
  • File read.
  • File copied. Used for file copies, for example, to a thumb drive.
  • File opened.
  • File moved or renamed.
  • File synced (for example, Google Drive, Dropbox, backup).
  • User activity which does not match any of the other event types.
  • User login.
  • User logout.
  • User creation.
  • User password change event.
  • Change in user permissions.
  • Deprecated. Used to update user info for an LDAP dump.
  • User physically badging into a location.
  • User deletion.
  • User creating a virtual resource. This is equivalent to RESOURCE_CREATION.
  • User updating content of a virtual resource. This is equivalent to RESOURCE_WRITTEN.
  • User updating permissions of a virtual resource. This is equivalent to RESOURCE_PERMISSIONS_CHANGE.
  • User initiating communication through a medium (for example, video).
  • User accessing a virtual resource. This is equivalent to RESOURCE_READ.
  • User deleting a virtual resource. This is equivalent to RESOURCE_DELETION.
  • A group activity that does not fall into one of the other event types.
  • A group creation.
  • A group deletion.
  • A group modification.
  • Email messages
  • An email transaction.
  • Deprecated: use NETWORK_HTTP instead. An email URL click event.
  • A network event that does not fit into one of the other event types.
  • Aggregated flow stats like netflow.
  • Network connection details like from a FW.
  • FTP telemetry.
  • DHCP payload.
  • DNS payload.
  • HTTP telemetry.
  • SMTP telemetry.
  • A status message that does not fit into one of the other event types.
  • Heartbeat indicating product is alive.
  • An agent startup.
  • An agent shutdown.
  • A software or fingerprint update.
  • Scan item that does not fit into one of the other event types.
  • A file scan.
  • Scan process behaviors. Please use SCAN_PROCESS instead.
  • Scan process.
  • Scan results from scanning an entire host device for threats/sensitive documents.
  • Vulnerability scan logs about host vulnerabilities (e.g., out of date software) and network vulnerabilities (e.g., unprotected service detected via a network scan).
  • Vulnerability scan logs about network vulnerabilities.
  • Scan network for suspicious activity
  • Scheduled task event that does not fall into one of the other event types.
  • Scheduled task creation.
  • Scheduled task deletion.
  • Scheduled task being enabled.
  • Scheduled task being disabled.
  • Scheduled task being modified.
  • A system audit log event that is not a wipe.
  • A system audit log wipe.
  • Service event that does not fit into one of the other event types.
  • A service creation.
  • A service deletion.
  • A service start.
  • A service stop.
  • A service modification.
  • Operating system events that are not described by any of the other event types. Might include uncategorized Microsoft Windows event logs.
  • The resource was created/provisioned. This is equivalent to USER_RESOURCE_CREATION.
  • The resource was deleted/deprovisioned. This is equivalent to USER_RESOURCE_DELETION.
  • The resource had it's permissions or ACLs updated. This is equivalent to USER_RESOURCE_UPDATE_PERMISSIONS.
  • The resource was read. This is equivalent to USER_RESOURCE_ACCESS.
  • The resource was written to. This is equivalent to USER_RESOURCE_UPDATE_CONTENT.
  • Firmware update.
  • Configuration update.
  • A program or application uploaded to a device.
  • A program or application downloaded to a device.
  • Analyst update about the Verdict (such as true positive, false positive, or disregard) of a finding.
  • Analyst update about the Reputation (such as useful or not useful) of a finding.
  • Analyst update about the Severity score (0-100) of a finding.
  • Analyst update about the finding status.
  • Analyst addition of a comment for a finding.
  • Analyst update about the priority (such as low, medium, or high) for a finding.
  • Analyst update about the root cause for a finding.
  • Analyst update about the reason (such as malicious or not malicious) for a finding.
  • Analyst update about the risk score (0-100) of a finding.
  • An update to an entity risk score. This event type is restricted to events published by Google Securit Operations Risk Analytics.
typestring
id
descriptionID of the UDM event. Can be used for raw and normalized event retrieval.
formatbyte
typestring
ingestedTimestamp
descriptionThe GMT timestamp when the event was ingested (received) by Chronicle.
formatgoogle-datetime
typestring
ingestionLabels
descriptionUser-configured ingestion metadata labels.
items
$refLabel
typearray
logType
descriptionThe string value of log type.
typestring
productDeploymentId
descriptionThe deployment identifier assigned by the vendor for a product deployment.
typestring
productEventType
descriptionA short, descriptive, human-readable, product-specific event name or type (e.g. "Scanned X", "User account created", "process_start").
typestring
productLogId
descriptionA vendor-specific event identifier to uniquely identify the event (e.g. a GUID).
typestring
productName
descriptionThe name of the product.
typestring
productVersion
descriptionThe version of the product.
typestring
structuredFields
additionalProperties
descriptionProperties of the object.
typeany
deprecatedTrue
descriptionFlattened fields extracted from the log.
typeobject
tags
$refTags
descriptionTags added by Chronicle after an event is parsed. It is an error to populate this field from within a parser.
urlBackToProduct
descriptionA URL that takes the user to the source product console for this event.
typestring
vendorName
descriptionThe name of the product vendor.
typestring
typeobject
Metric
descriptionStores precomputed aggregated analytic data for an entity.
idMetric
properties
dimensions
descriptionAll group by clauses used to calculate the metric.
items
enum
  • DIMENSION_UNSPECIFIED
  • PRINCIPAL_DEVICE
  • TARGET_USER
  • TARGET_DEVICE
  • PRINCIPAL_USER
  • TARGET_IP
  • PRINCIPAL_FILE_HASH
  • PRINCIPAL_COUNTRY
  • SECURITY_CATEGORY
  • NETWORK_ASN
  • CLIENT_CERTIFICATE_HASH
  • DNS_QUERY_TYPE
  • DNS_DOMAIN
  • HTTP_USER_AGENT
  • EVENT_TYPE
  • PRODUCT_NAME
  • PRODUCT_EVENT_TYPE
  • PARENT_FOLDER_PATH
  • TARGET_RESOURCE_NAME
  • PRINCIPAL_APPLICATION
  • TARGET_APPLICATION
  • EMAIL_TO_ADDRESS
  • EMAIL_FROM_ADDRESS
  • MAIL_ID
  • PRINCIPAL_IP
  • SECURITY_ACTION
  • SECURITY_RULE_ID
  • TARGET_NETWORK_ORGANIZATION_NAME
  • PRINCIPAL_NETWORK_ORGANIZATION_NAME
  • PRINCIPAL_PROCESS_FILE_PATH
  • PRINCIPAL_PROCESS_FILE_HASH
  • SECURITY_RESULT_RULE_NAME
  • TARGET_RESOURCE_LABEL_KEY
  • VENDOR_NAME
  • TARGET_RESOURCE_TYPE
  • TARGET_LOCATION_NAME
enumDescriptions
  • Default
  • Principal Device
  • Target User
  • Target Device
  • Principal User
  • Target IP
  • Principal File Hash
  • Principal Country
  • Security Category
  • Network ASN
  • Client Certificate Hash
  • DNS Query Type
  • DNS Domain
  • HTTP User Agent
  • Event Type
  • Product Name
  • Product Event Type
  • Parent Folder Path
  • Target resource Name
  • Principal Application.
  • Target Application.
  • Email To Address.
  • Email From Address.
  • Mail Id.
  • Principal IP.
  • Security Action.
  • Security Rule Id.
  • Target Network Organization name.
  • Principal Network Organization name.
  • Principal Process File Path.
  • Principal Process File SHA256 Hash.
  • Security Result rule name.
  • Target Resource label key.
  • Vendor name.
  • Target Resource type.
  • Target Location name.
typestring
typearray
exportWindow
descriptionExport window for which the metric was exported.
formatint64
typestring
firstSeen
descriptionTimestamp of the first time the entity was seen in the environment.
formatgoogle-datetime
typestring
lastSeen
descriptionTime stamp of the last time last time the entity was seen in the environment.
formatgoogle-datetime
typestring
metricName
descriptionName of the analytic.
enum
  • METRIC_NAME_UNSPECIFIED
  • NETWORK_BYTES_INBOUND
  • NETWORK_BYTES_OUTBOUND
  • NETWORK_BYTES_TOTAL
  • AUTH_ATTEMPTS_SUCCESS
  • AUTH_ATTEMPTS_FAIL
  • AUTH_ATTEMPTS_TOTAL
  • DNS_BYTES_OUTBOUND
  • NETWORK_FLOWS_INBOUND
  • NETWORK_FLOWS_OUTBOUND
  • NETWORK_FLOWS_TOTAL
  • DNS_QUERIES_SUCCESS
  • DNS_QUERIES_FAIL
  • DNS_QUERIES_TOTAL
  • FILE_EXECUTIONS_SUCCESS
  • FILE_EXECUTIONS_FAIL
  • FILE_EXECUTIONS_TOTAL
  • HTTP_QUERIES_SUCCESS
  • HTTP_QUERIES_FAIL
  • HTTP_QUERIES_TOTAL
  • WORKSPACE_EMAILS_SENT_TOTAL
  • WORKSPACE_TOTAL_DOWNLOAD_ACTIONS
  • WORKSPACE_TOTAL_CHANGE_ACTIONS
  • WORKSPACE_AUTH_ATTEMPTS_TOTAL
  • WORKSPACE_NETWORK_BYTES_OUTBOUND
  • WORKSPACE_NETWORK_BYTES_TOTAL
  • ALERT_EVENT_NAME_COUNT
  • RESOURCE_CREATION_TOTAL
  • RESOURCE_CREATION_SUCCESS
  • RESOURCE_READ_SUCCESS
  • RESOURCE_READ_FAIL
  • RESOURCE_DELETION_SUCCESS
enumDescriptions
  • Default
  • Total received network bytes.
  • Total network sent bytes.
  • Total network sent bytes and received bytes.
  • Successful authentication attempts.
  • Failed authentication attempts.
  • Total authentication attempts.
  • Total number of sent bytes for DNS events.
  • Total number of events having non-null received bytes.
  • Total number of events having non-null sent bytes.
  • Total events having non-null sent or received bytes.
  • DNS query success count - Number of events with response_code = 0.
  • Number of events with response_code != 0.
  • Total number of DNS queries made.
  • Number of successfule file executions.
  • Number of failed file executions.
  • Total number file executions.
  • Number of successful HTTP queries.
  • Number of failed HTTP queries.
  • Total number of HTTP queries.
  • Total number of emails sent in Google Workspace.
  • Total number of download actions in Google Workspace.
  • Total number of change actions in Google Workspace.
  • Total number of authentication attempts in Google Workspace.
  • Number of outbound network bytes (total sent) in Google Workspace.
  • Total number of network bytes (both sent and received) in Google Workspace.
  • Track number of alerts fired by EDR/SENTINEL/MICROSOFT_GRAPH.
  • First-time analytic tracking successful resource creations.
  • Volume-based analytic tracking successful resource creations.
  • Volume-based analytic tracking successful resource reads.
  • Volume-based analytic tracking failed resource reads.
  • Volume-based analytic tracking successful resource deletions.
typestring
sumMeasure
$refMeasure
descriptionSum of all precomputed measures for the given metric.
totalEvents
descriptionTotal number of events used to calculate the given precomputed metric.
formatint64
typestring
typeobject
Navigation
descriptionNavigation can be used to store the metadata required to navigate the user to a new URL.
idNavigation
properties
targetUri
descriptionOutput only. The URI to redirect the user to.
readOnlyTrue
typestring
typeobject
Network
descriptionA network event.
idNetwork
properties
applicationProtocol
descriptionThe application protocol.
enum
  • UNKNOWN_APPLICATION_PROTOCOL
  • AFP
  • APPC
  • AMQP
  • ATOM
  • BEEP
  • BITCOIN
  • BIT_TORRENT
  • CFDP
  • CIP
  • COAP
  • COTP
  • DCERPC
  • DDS
  • DEVICE_NET
  • DHCP
  • DICOM
  • DNP3
  • DNS
  • E_DONKEY
  • ENRP
  • FAST_TRACK
  • FINGER
  • FREENET
  • FTAM
  • GOOSE
  • GOPHER
  • GRPC
  • HL7
  • H323
  • HTTP
  • HTTPS
  • IEC104
  • IRCP
  • KADEMLIA
  • KRB5
  • LDAP
  • LPD
  • MIME
  • MMS
  • MODBUS
  • MQTT
  • NETCONF
  • NFS
  • NIS
  • NNTP
  • NTCIP
  • NTP
  • OSCAR
  • PNRP
  • PTP
  • QUIC
  • RDP
  • RELP
  • RIP
  • RLOGIN
  • RPC
  • RTMP
  • RTP
  • RTPS
  • RTSP
  • SAP
  • SDP
  • SIP
  • SLP
  • SMB
  • SMTP
  • SNMP
  • SNTP
  • SSH
  • SSMS
  • STYX
  • SV
  • TCAP
  • TDS
  • TOR
  • TSP
  • VTP
  • WHOIS
  • WEB_DAV
  • X400
  • X500
  • XMPP
enumDescriptions
  • The default application protocol.
  • Apple Filing Protocol.
  • Advanced Program-to-Program Communication.
  • Advanced Message Queuing Protocol.
  • Publishing Protocol.
  • Block Extensible Exchange Protocol.
  • Crypto currency protocol.
  • Peer-to-peer file sharing.
  • Coherent File Distribution Protocol.
  • Common Industrial Protocol.
  • Constrained Application Protocol.
  • Connection Oriented Transport Protocol.
  • DCE/RPC.
  • Data Distribution Service.
  • Automation industry protocol.
  • DHCP.
  • Digital Imaging and Communications in Medicine Protocol.
  • Distributed Network Protocol 3 (DNP3)
  • DNS.
  • Classic file sharing protocol.
  • Endpoint Handlespace Redundancy Protocol.
  • Filesharing peer-to-peer protocol.
  • User Information Protocol.
  • Censorship resistant peer-to-peer network.
  • File Transfer Access and Management.
  • GOOSE Protocol.
  • Gopher protocol.
  • gRPC Remote Procedure Call.
  • Health Level Seven.
  • Packet-based multimedia communications system.
  • HTTP.
  • HTTPS.
  • IEC 60870-5-104 (IEC 104) Protocol.
  • Internet Relay Chat Protocol.
  • Peer-to-peer hashtables.
  • Kerberos 5.
  • Lightweight Directory Access Protocol.
  • Line Printer Daemon Protocol.
  • Multipurpose Internet Mail Extensions and Secure MIME.
  • Multimedia Messaging Service.
  • Serial communications protocol.
  • Message Queuing Telemetry Transport.
  • Network Configuration.
  • Network File System.
  • Network Information Service.
  • Network News Transfer Protocol.
  • National Transportation Communications for Intelligent Transportation System.
  • Network Time Protocol.
  • AOL Instant Messenger Protocol.
  • Peer Name Resolution Protocol.
  • Precision Time Protocol.
  • QUIC.
  • Remote Desktop Protocol.
  • Reliable Event Logging Protocol.
  • Routing Information Protocol.
  • Remote Login in UNIX Systems.
  • Remote Procedure Call.
  • Real Time Messaging Protocol.
  • Real-time Transport Protocol.
  • Real Time Publish Subscribe.
  • Real Time Streaming Protocol.
  • Session Announcement Protocol.
  • Session Description Protocol.
  • Session Initiation Protocol.
  • Service Location Protocol.
  • Server Message Block.
  • Simple Mail Transfer Protocol.
  • Simple Network Management Protocol.
  • Simple Network Time Protocol.
  • Secure Shell.
  • Secure SMS Messaging Protocol.
  • Styx/9P - Plan 9 from Bell Labs distributed file system protocol.
  • Sampled Values Protocol.
  • Transaction Capabilities Application Part.
  • Tabular Data Stream.
  • Anonymity network.
  • Time Stamp Protocol.
  • Virtual Terminal Protocol.
  • Remote Directory Access Protocol.
  • Web Distributed Authoring and Versioning.
  • Message Handling Service Protocol.
  • Directory Access Protocol (DAP).
  • Extensible Messaging and Presence Protocol.
typestring
applicationProtocolVersion
descriptionThe version of the application protocol. e.g. "1.1, 2.0"
typestring
asn
descriptionAutonomous system number.
typestring
carrierName
descriptionCarrier identification.
typestring
communityId
descriptionCommunity ID network flow value.
typestring
dhcp
$refDhcp
descriptionDHCP info.
direction
descriptionThe direction of network traffic.
enum
  • UNKNOWN_DIRECTION
  • INBOUND
  • OUTBOUND
  • BROADCAST
enumDescriptions
  • The default direction.
  • An inbound request.
  • An outbound request.
  • A broadcast.
typestring
dns
$refDns
descriptionDNS info.
dnsDomain
descriptionDNS domain name.
typestring
email
$refEmail
descriptionEmail info for the sender/recipient.
ftp
$refFtp
descriptionFTP info.
http
$refHttp
descriptionHTTP info.
ipProtocol
descriptionThe IP protocol.
enum
  • UNKNOWN_IP_PROTOCOL
  • ICMP
  • IGMP
  • TCP
  • UDP
  • IP6IN4
  • GRE
  • ESP
  • ICMP6
  • EIGRP
  • ETHERIP
  • PIM
  • VRRP
  • SCTP
enumDescriptions
  • The default protocol.
  • ICMP.
  • IGMP
  • TCP.
  • UDP.
  • IPv6 Encapsulation
  • Generic Routing Encapsulation
  • Encapsulating Security Payload
  • ICMPv6
  • Enhanced Interior Gateway Routing
  • Ethernet-within-IP Encapsulation
  • Protocol Independent Multicast
  • Virtual Router Redundancy Protocol
  • Stream Control Transmission Protocol
typestring
ipSubnetRange
descriptionAssociated human-readable IP subnet range (e.g. 10.1.2.0/24).
typestring
organizationName
descriptionOrganization name (e.g Google).
typestring
parentSessionId
descriptionThe ID of the parent network session.
typestring
receivedBytes
descriptionThe number of bytes received.
formatuint64
typestring
receivedPackets
descriptionThe number of packets received.
formatint64
typestring
sentBytes
descriptionThe number of bytes sent.
formatuint64
typestring
sentPackets
descriptionThe number of packets sent.
formatint64
typestring
sessionDuration
descriptionThe duration of the session as the number of seconds and nanoseconds. For seconds, network.session_duration.seconds, the type is a 64-bit integer. For nanoseconds, network.session_duration.nanos, the type is a 32-bit integer.
formatgoogle-duration
typestring
sessionId
descriptionThe ID of the network session.
typestring
smtp
$refSmtp
descriptionSMTP info. Store fields specific to SMTP not covered by Email.
tls
$refTls
descriptionTLS info.
typeobject
Noun
descriptionThe Noun type is used to represent the different entities in an event: principal, src, target, observer, intermediary, and about. It stores attributes known about the entity. For example, if the entity is a device with multiple IP or MAC addresses, it stores the IP and MAC addresses that are relevant to the event.
idNoun
properties
administrativeDomain
descriptionDomain which the device belongs to (for example, the Microsoft Windows domain).
typestring
application
descriptionThe name of an application or service. Some SSO solutions only capture the name of a target application such as "Atlassian" or "Chronicle".
typestring
artifact
$refArtifact
descriptionInformation about an artifact.
asset
$refAsset
descriptionInformation about the asset.
assetId
descriptionThe asset ID. This field can be used as an entity indicator for asset entities.
typestring
cloud
$refCloud
deprecatedTrue
descriptionCloud metadata. Deprecated: cloud should be populated in entity Attribute as generic metadata (e.g. asset.attribute.cloud).
domain
$refDomain
descriptionInformation about the domain.
email
descriptionEmail address. Only filled in for security_result.about
typestring
file
$refBackstoryFile
descriptionInformation about the file.
group
$refGroup
descriptionInformation about the group.
hostname
descriptionClient hostname or domain name field. Hostname also doubles as the domain for remote entities. This field can be used as an entity indicator for asset entities.
typestring
investigation
$refInvestigation
descriptionAnalyst feedback/investigation for alerts.
ip
descriptionA list of IP addresses associated with a network connection. This field can be used as an entity indicator for asset entities.
items
typestring
typearray
ipGeoArtifact
descriptionEnriched geographic information corresponding to an IP address. Specifically, location and network data.
items
$refArtifact
typearray
ipLocation
deprecatedTrue
descriptionDeprecated: use ip_geo_artifact.location instead.
items
$refLocation
typearray
labels
deprecatedTrue
descriptionLabels are key-value pairs. For example: key = "env", value = "prod". Deprecated: labels should be populated in entity Attribute as generic metadata (e.g. user.attribute.labels).
items
$refLabel
typearray
location
$refLocation
descriptionPhysical location. For cloud environments, set the region in location.name.
mac
descriptionList of MAC addresses associated with a device. This field can be used as an entity indicator for asset entities.
items
typestring
typearray
namespace
descriptionNamespace which the device belongs to, such as "AD forest". Uses for this field include Microsoft Windows AD forest, the name of subsidiary, or the name of acquisition. This field can be used along with an asset indicator to identify an asset.
typestring
natIp
descriptionA list of NAT translated IP addresses associated with a network connection.
items
typestring
typearray
natPort
descriptionNAT external network port number when a specific network connection is described within an event.
formatint32
typeinteger
network
$refNetwork
descriptionNetwork details, including sub-messages with details on each protocol (for example, DHCP, DNS, or HTTP).
objectReference
$refId
descriptionFinding to which the Analyst updated the feedback.
platform
descriptionPlatform.
enum
  • UNKNOWN_PLATFORM
  • WINDOWS
  • MAC
  • LINUX
  • GCP
  • AWS
  • AZURE
  • IOS
  • ANDROID
  • CHROME_OS
enumDeprecated
  • False
  • False
  • False
  • False
  • True
  • True
  • True
  • False
  • False
  • False
enumDescriptions
  • Default value.
  • Microsoft Windows.
  • macOS.
  • Linux.
  • Deprecated: see cloud.environment.
  • Deprecated: see cloud.environment.
  • Deprecated: see cloud.environment.
  • IOS
  • Android
  • Chrome OS
typestring
platformPatchLevel
descriptionPlatform patch level. For example, "Build 17134.48"
typestring
platformVersion
descriptionPlatform version. For example, "Microsoft Windows 1803".
typestring
port
descriptionSource or destination network port number when a specific network connection is described within an event.
formatint32
typeinteger
process
$refProcess
descriptionInformation about the process.
processAncestors
descriptionInformation about the process's ancestors ordered from immediate ancestor (parent process) to root. Note: process_ancestors is only populated when data is exported to BigQuery since recursive fields (e.g. process.parent_process) are not supported by BigQuery.
items
$refProcess
typearray
registry
$refRegistry
descriptionRegistry information.
resource
$refResource
descriptionInformation about the resource (e.g. scheduled task, calendar entry). This field should not be used for files, registry, or processes because these objects are already part of Noun.
resourceAncestors
descriptionInformation about the resource's ancestors ordered from immediate ancestor (starting with parent resource).
items
$refResource
typearray
securityResult
descriptionA list of security results.
items
$refSecurityResult
typearray
url
descriptionThe URL.
typestring
urlMetadata
$refUrl
descriptionInformation about the URL.
user
$refUser
descriptionInformation about the user.
userManagementChain
descriptionInformation about the user's management chain (reporting hierarchy). Note: user_management_chain is only populated when data is exported to BigQuery since recursive fields (e.g. user.managers) are not supported by BigQuery.
items
$refUser
typearray
typeobject
NtfsFileMetadata
descriptionNTFS-specific file metadata.
idNtfsFileMetadata
properties
changeTime
descriptionNTFS MFT entry changed timestamp.
formatgoogle-datetime
typestring
filenameAccessTime
descriptionNTFS $FILE_NAME attribute accessed timestamp.
formatgoogle-datetime
typestring
filenameChangeTime
descriptionNTFS $FILE_NAME attribute changed timestamp.
formatgoogle-datetime
typestring
filenameCreateTime
descriptionNTFS $FILE_NAME attribute created timestamp.
formatgoogle-datetime
typestring
filenameModifyTime
descriptionNTFS $FILE_NAME attribute modified timestamp.
formatgoogle-datetime
typestring
typeobject
Operation
descriptionThis resource represents a long-running operation that is the result of a network API call.
idOperation
properties
done
descriptionIf the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available.
typeboolean
error
$refStatus
descriptionThe error result of the operation in case of failure or cancellation.
metadata
additionalProperties
descriptionProperties of the object. Contains field @type with type URL.
typeany
descriptionService-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any.
typeobject
name
descriptionThe server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`.
typestring
response
additionalProperties
descriptionProperties of the object. Contains field @type with type URL.
typeany
descriptionThe normal, successful response of the operation. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`.
typeobject
typeobject
Option
descriptionDHCP options.
idOption
properties
code
descriptionCode. See RFC1533.
formatuint32
typeinteger
data
descriptionData.
formatbyte
typestring
typeobject
PDFInfo
descriptionInformation about the PDF file structure. See https://developers.virustotal.com/reference/pdf_info
idPDFInfo
properties
acroform
descriptionNumber of /AcroForm tags found in the PDF.
formatint64
typestring
autoaction
descriptionNumber of /AA tags found in the PDF.
formatint64
typestring
embeddedFile
descriptionNumber of /EmbeddedFile tags found in the PDF.
formatint64
typestring
encrypted
descriptionWhether the document is encrypted or not. This is defined by the /Encrypt tag.
formatint64
typestring
endobjCount
descriptionNumber of object definitions (endobj keyword).
formatint64
typestring
endstreamCount
descriptionNumber of defined stream objects (stream keyword).
formatint64
typestring
flash
descriptionNumber of /RichMedia tags found in the PDF.
formatint64
typestring
header
descriptionPDF version.
typestring
javascript
descriptionNumber of /JavaScript tags found in the PDF file. Should be the same as the js field in normal scenarios.
formatint64
typestring
jbig2Compression
descriptionNumber of /JBIG2Decode tags found in the PDF.
formatint64
typestring
js
descriptionNumber of /JS tags found in the PDF file. Should be the same as javascript field in normal scenarios.
formatint64
typestring
launchActionCount
descriptionNumber of /Launch tags found in the PDF file.
formatint64
typestring
objCount
descriptionNumber of objects definitions (obj keyword).
formatint64
typestring
objectStreamCount
descriptionNumber of object streams.
formatint64
typestring
openaction
descriptionNumber of /OpenAction tags found in the PDF.
formatint64
typestring
pageCount
descriptionNumber of pages in the PDF.
formatint64
typestring
startxref
descriptionNumber of startxref keywords in the PDF.
formatint64
typestring
streamCount
descriptionNumber of defined stream objects (stream keyword).
formatint64
typestring
suspiciousColors
descriptionNumber of colors expressed with more than 3 bytes (CVE-2009-3459).
formatint64
typestring
trailer
descriptionNumber of trailer keywords in the PDF.
formatint64
typestring
xfa
descriptionNumber of \XFA tags found in the PDF.
formatint64
typestring
xref
descriptionNumber of xref keywords in the PDF.
formatint64
typestring
typeobject
PeFileMetadata
descriptionMetadata about a Microsoft Windows Portable Executable.
idPeFileMetadata
properties
importHash
descriptionHash of PE imports.
typestring
typeobject
Permission
descriptionSystem permission for resource access and modification.
idPermission
properties
description
descriptionDescription of the permission (e.g. 'Ability to update detect rules').
typestring
name
descriptionName of the permission (e.g. chronicle.analyst.updateRule).
typestring
type
descriptionType of the permission.
enum
  • UNKNOWN_PERMISSION_TYPE
  • ADMIN_WRITE
  • ADMIN_READ
  • DATA_WRITE
  • DATA_READ
enumDescriptions
  • Default permission type.
  • Administrator write permission.
  • Administrator read permission.
  • Data resource access write permission.
  • Data resource access read permission.
typestring
typeobject
PlatformSoftware
descriptionPlatform software information about an operating system.
idPlatformSoftware
properties
platform
descriptionThe platform operating system.
enum
  • UNKNOWN_PLATFORM
  • WINDOWS
  • MAC
  • LINUX
  • GCP
  • AWS
  • AZURE
  • IOS
  • ANDROID
  • CHROME_OS
enumDeprecated
  • False
  • False
  • False
  • False
  • True
  • True
  • True
  • False
  • False
  • False
enumDescriptions
  • Default value.
  • Microsoft Windows.
  • macOS.
  • Linux.
  • Deprecated: see cloud.environment.
  • Deprecated: see cloud.environment.
  • Deprecated: see cloud.environment.
  • IOS
  • Android
  • Chrome OS
typestring
platformPatchLevel
descriptionThe platform software patch level ( e.g. "Build 17134.48", "SP1").
typestring
platformVersion
descriptionThe platform software version ( e.g. "Microsoft Windows 1803").
typestring
typeobject
PopularityRank
descriptionDomain's position in popularity ranks for sources such as Alexa, Quantcast, or Statvoo.
idPopularityRank
properties
giver
descriptionName of the rank serial number hexdump.
typestring
ingestionTime
descriptionTimestamp when the rank was ingested.
formatgoogle-datetime
typestring
rank
descriptionRank position.
formatint64
typestring
typeobject
Prevalence
descriptionThe prevalence of a resource within the customer's environment. This measures how common it is for assets to access the resource.
idPrevalence
properties
dayCount
descriptionThe number of days over which rolling_max is calculated.
formatint32
typeinteger
dayMax
descriptionThe max prevalence score in a day interval window.
formatint32
typeinteger
dayMaxSubDomains
descriptionThe max prevalence score in a day interval window across sub-domains. This field is only valid for domains.
formatint32
typeinteger
rollingMax
descriptionThe maximum number of assets per day accessing the resource over the trailing day_count days.
formatint32
typeinteger
rollingMaxSubDomains
descriptionThe maximum number of assets per day accessing the domain along with sub-domains over the trailing day_count days. This field is only valid for domains.
formatint32
typeinteger
typeobject
Process
descriptionInformation about a process.
idProcess
properties
accessMask
descriptionA bit mask representing the level of access.
formatuint64
typestring
commandLine
descriptionThe command line command that created the process. This field can be used as an entity indicator for process entities.
typestring
commandLineHistory
descriptionThe command line history of the process.
items
typestring
typearray
egid
descriptionThe effective group ID of the process.
typestring
euid
descriptionThe effective user ID of the process.
typestring
file
$refBackstoryFile
descriptionInformation about the file in use by the process.
integrityLevelRid
descriptionThe Microsoft Windows integrity level relative ID (RID) of the process.
formatuint64
typestring
parentPid
deprecatedTrue
descriptionThe ID of the parent process. Deprecated: use parent_process.pid instead.
typestring
parentProcess
$refProcess
descriptionInformation about the parent process.
pgid
descriptionThe identifier that points to the process group ID leader.
typestring
pid
descriptionThe process ID. This field can be used as an entity indicator for process entities.
typestring
productSpecificParentProcessId
deprecatedTrue
descriptionA product specific id for the parent process. Please use parent_process.product_specific_process_id instead.
typestring
productSpecificProcessId
descriptionA product specific process id.
typestring
rgid
descriptionThe real group ID of the process.
typestring
ruid
descriptionThe real user ID of the process.
typestring
sessionLeaderPid
descriptionThe process ID of the session leader process.
typestring
tokenElevationType
descriptionThe elevation type of the process on Microsoft Windows. This determines if any privileges are removed when UAC is enabled.
enum
  • UNKNOWN
  • TYPE_1
  • TYPE_2
  • TYPE_3
enumDescriptions
  • An undetermined token type.
  • A full token with no privileges removed or groups disabled.
  • An elevated token with no privileges removed or groups disabled. Used when running as administrator.
  • A limited token with administrative privileges removed and administrative groups disabled.
typestring
tty
descriptionThe teletype terminal which the command was executed within.
typestring
typeobject
ProviderMLVerdict
descriptionDeprecated. MLVerdict result provided from threat providers, like Mandiant. These fields are used to model Mandiant sources.
idProviderMLVerdict
properties
benignCount
descriptionCount of responses where this IoC was marked benign.
formatint32
typeinteger
confidenceScore
descriptionConfidence score of the verdict.
formatint32
typeinteger
maliciousCount
descriptionCount of responses where this IoC was marked malicious.
formatint32
typeinteger
mandiantSources
descriptionList of mandiant sources from which the verdict was generated.
items
$refSource
typearray
sourceProvider
descriptionSource provider giving the ML verdict.
typestring
thirdPartySources
descriptionList of third-party sources from which the verdict was generated.
items
$refSource
typearray
typeobject
PublicKey
descriptionSubject public key info.
idPublicKey
properties
algorithm
descriptionAny of "RSA", "DSA" or "EC". Indicates the algorithm used to generate the certificate.
typestring
rsa
$refRSA
descriptionRSA public key information.
typeobject
Question
descriptionDNS Questions. See RFC1035, section 4.1.2.
idQuestion
properties
class
descriptionThe code specifying the class of the query.
formatuint32
typeinteger
name
descriptionThe domain name.
typestring
prevalence
$refPrevalence
descriptionThe prevalence of the domain within the customer's environment.
type
descriptionThe code specifying the type of the query.
formatuint32
typeinteger
typeobject
RSA
descriptionRSA public key information.
idRSA
properties
exponent
descriptionKey exponent hexdump.
typestring
keySize
descriptionKey size.
formatint64
typestring
modulus
descriptionKey modulus hexdump.
typestring
typeobject
Reference
descriptionReference to model primatives including event and entity. As support is added for fast retrieval of objects by identifiers, this will be expanded to include ID references rather than full object copies. BEGIN GOOGLE-INTERNAL See go/udm:ids for additional details. END GOOGLE-INTERNAL
idReference
properties
entity
$refBackstoryEntity
descriptionEntity being referenced. End one-of
event
$refUDM
descriptionOnly one of event or entity will be populated for a single reference. Start one-of Event being referenced.
id
$refId
descriptionId being referenced. This field will also be populated for both event and entity with the event id. For detections, only this field will be populated.
typeobject
ReferenceList
descriptionA reference list. Reference lists are user-defined lists of values which users can use in multiple Rules.
idReferenceList
properties
description
descriptionRequired. A user-provided description of the reference list.
typestring
displayName
descriptionOutput only. The unique display name of the reference list.
readOnlyTrue
typestring
entries
descriptionRequired. The entries of the reference list. When listed, they are returned in the order that was specified at creation or update. The combined size of the values of the reference list may not exceed 6MB. This is returned only when the view is REFERENCE_LIST_VIEW_FULL.
items
$refReferenceListEntry
typearray
name
descriptionOutput only. The resource name of the reference list. Format: projects/{project}/locations/{location}/instances/{instance}/referenceLists/{reference_list}
readOnlyTrue
typestring
revisionCreateTime
descriptionOutput only. The timestamp when the reference list was last updated.
formatgoogle-datetime
readOnlyTrue
typestring
ruleAssociationsCount
descriptionOutput only. The count of self-authored rules using the reference list.
formatint32
readOnlyTrue
typeinteger
rules
descriptionOutput only. The resource names for the associated self-authored Rules that use this reference list. This is returned only when the view is REFERENCE_LIST_VIEW_FULL.
items
typestring
readOnlyTrue
typearray
scopeInfo
$refScopeInfo
descriptionOutput only. The scope info of the reference list. During reference list creation, if this field is not set, the reference list without scopes (an unscoped list) will be created for an unscoped user. For a scoped user, this field must be set. During reference list update, if scope_info is requested to be updated, this field must be set.
readOnlyTrue
syntaxType
descriptionRequired. The syntax type indicating how list entries should be validated.
enum
  • REFERENCE_LIST_SYNTAX_TYPE_UNSPECIFIED
  • REFERENCE_LIST_SYNTAX_TYPE_PLAIN_TEXT_STRING
  • REFERENCE_LIST_SYNTAX_TYPE_REGEX
  • REFERENCE_LIST_SYNTAX_TYPE_CIDR
enumDescriptions
  • Defaults to REFERENCE_LIST_SYNTAX_TYPE_PLAIN_TEXT_STRING.
  • List contains plain text patterns.
  • List contains only Regular Expression patterns.
  • List contains only CIDR patterns.
typestring
typeobject
ReferenceListEntry
descriptionAn entry in a reference list.
idReferenceListEntry
properties
value
descriptionRequired. The value of the entry. Maximum length is 512 characters.
typestring
typeobject
ReferenceListScope
descriptionReferenceListScope specifies the list of scope names of the reference list.
idReferenceListScope
properties
scopeNames
descriptionOptional. The list of scope names of the reference list. The scope names should be full resource names and should be of the format: "projects/{project}/locations/{location}/instances/{instance}/dataAccessScopes/{scope_name}".
items
typestring
typearray
typeobject
Registry
descriptionInformation about a registry key or value.
idRegistry
properties
registryKey
descriptionRegistry key associated with an application or system component (e.g., HKEY_, HKCU\Environment...).
typestring
registryValueData
descriptionData associated with a registry value (e.g. %USERPROFILE%\Local Settings\Temp).
typestring
registryValueName
descriptionName of the registry value associated with an application or system component (e.g. TEMP).
typestring
registryValueType
descriptionType of the registry value.
enum
  • TYPE_UNSPECIFIED
  • NONE
  • SZ
  • EXPAND_SZ
  • BINARY
  • DWORD
  • DWORD_LITTLE_ENDIAN
  • DWORD_BIG_ENDIAN
  • LINK
  • MULTI_SZ
  • RESOURCE_LIST
  • QWORD
  • QWORD_LITTLE_ENDIAN
enumDescriptions
  • Default registry value type used when the type is unknown.
  • The registry value is not set and only the key exists.
  • A null-terminated string.
  • A null-terminated string that contains unexpanded references to environment variables
  • Binary data in any form.
  • A 32-bit number.
  • A 32-bit number in little-endian format.
  • A 32-bit number in big-endian format.
  • A null-terminated Unicode string that contains the target path of a symbolic link.
  • A sequence of null-terminated strings, terminated by an empty string
  • A device driver resource list.
  • A 64-bit number.
  • A 64-bit number in little-endian format.
typestring
typeobject
Relation
descriptionDefines the relationship between the entity (a) and another entity (b).
idRelation
properties
direction
descriptionDirectionality of relationship between primary entity (a) and the related entity (b).
enum
  • DIRECTIONALITY_UNSPECIFIED
  • BIDIRECTIONAL
  • UNIDIRECTIONAL
enumDescriptions
  • Default value.
  • Modeled in both directions. Primary entity (a) to related entity (b) and related entity (b) to primary entity (a).
  • Modeled in a single direction. Primary entity (a) to related entity (b).
typestring
entity
$refNoun
descriptionEntity (b) that the primary entity (a) is related to.
entityLabel
descriptionLabel to identify the Noun of the relation.
enum
  • ENTITY_LABEL_UNSPECIFIED
  • PRINCIPAL
  • TARGET
  • OBSERVER
  • SRC
  • NETWORK
  • SECURITY_RESULT
  • INTERMEDIARY
enumDescriptions
  • Default value.
  • The Noun represents a principal type object.
  • The Noun represents a target type object.
  • The Noun represents an observer type object.
  • The Noun represents src type object.
  • The Noun represents a network type object.
  • The Noun represents a SecurityResult object.
  • The Noun represents an intermediary type object.
typestring
entityType
descriptionType of the related entity (b) in this relationship.
enum
  • UNKNOWN_ENTITYTYPE
  • ASSET
  • USER
  • GROUP
  • RESOURCE
  • IP_ADDRESS
  • FILE
  • DOMAIN_NAME
  • URL
  • MUTEX
  • METRIC
enumDescriptions
  • @hide_from_doc
  • An asset, such as workstation, laptop, phone, virtual machine, etc.
  • User.
  • Group.
  • Resource.
  • An external IP address.
  • A file.
  • A domain.
  • A url.
  • A mutex.
  • A metric.
typestring
relationship
descriptionType of relationship.
enum
  • RELATIONSHIP_UNSPECIFIED
  • OWNS
  • ADMINISTERS
  • MEMBER
  • EXECUTES
  • DOWNLOADED_FROM
  • CONTACTS
enumDescriptions
  • Default value
  • Related entity is owned by the primary entity (e.g. user owns device asset).
  • Related entity is administered by the primary entity (e.g. user administers a group).
  • Primary entity is a member of the related entity (e.g. user is a member of a group).
  • Primary entity may have executed the related entity.
  • Primary entity may have been downloaded from the related entity.
  • Primary entity contacts the related entity.
typestring
uid
descriptionUID of the relationship.
formatbyte
typestring
typeobject
Resource
descriptionInformation about a resource such as a task, Cloud Storage bucket, database, disk, logical policy, or something similar.
idResource
properties
attribute
$refAttribute
descriptionGeneric entity metadata attributes of the resource.
id
deprecatedTrue
descriptionDeprecated: Use resource.name or resource.product_object_id.
typestring
name
descriptionThe full name of the resource. For example, Google Cloud: //cloudresourcemanager.googleapis.com/projects/wombat-123, and AWS: arn:aws:iam::123456789012:user/johndoe.
typestring
parent
deprecatedTrue
descriptionThe parent of the resource. For a database table, the parent is the database. For a storage object, the bucket name. Deprecated: use resource_ancestors.name.
typestring
productObjectId
descriptionA vendor-specific identifier to uniquely identify the entity (a GUID, OID, or similar) This field can be used as an entity indicator for a Resource entity.
typestring
resourceSubtype
descriptionResource sub-type (e.g. "BigQuery", "Bigtable").
typestring
resourceType
descriptionResource type.
enum
  • UNSPECIFIED
  • MUTEX
  • TASK
  • PIPE
  • DEVICE
  • FIREWALL_RULE
  • MAILBOX_FOLDER
  • VPC_NETWORK
  • VIRTUAL_MACHINE
  • STORAGE_BUCKET
  • STORAGE_OBJECT
  • DATABASE
  • TABLE
  • CLOUD_PROJECT
  • CLOUD_ORGANIZATION
  • SERVICE_ACCOUNT
  • ACCESS_POLICY
  • CLUSTER
  • SETTING
  • DATASET
  • BACKEND_SERVICE
  • POD
  • CONTAINER
  • FUNCTION
  • RUNTIME
  • IP_ADDRESS
  • DISK
  • VOLUME
  • IMAGE
  • SNAPSHOT
  • REPOSITORY
  • CREDENTIAL
  • LOAD_BALANCER
  • GATEWAY
  • SUBNET
  • USER
enumDescriptions
  • Default type.
  • Mutex.
  • Task.
  • Named pipe.
  • Device.
  • Firewall rule.
  • Mailbox folder.
  • VPC Network.
  • Virtual machine.
  • Storage bucket.
  • Storage object.
  • Database.
  • Data table.
  • Cloud project.
  • Cloud organization.
  • Service account.
  • Access policy.
  • Cluster.
  • Settings.
  • Dataset.
  • Endpoint that receive traffic from a load balancer or proxy.
  • Pod, which is a collection of containers. Often used in Kubernetes.
  • Container.
  • Cloud function.
  • Runtime.
  • IP address.
  • Disk.
  • Volume.
  • Machine image.
  • Snapshot.
  • Repository.
  • Credential, e.g. access keys, ssh keys, tokens, certificates.
  • Load balancer.
  • Gateway.
  • Subnet.
  • User.
typestring
type
deprecatedTrue
descriptionDeprecated: use resource_type instead.
typestring
typeobject
ResourceRecord
descriptionDNS Resource Records. See RFC1035, section 4.1.3.
idResourceRecord
properties
binaryData
descriptionThe raw bytes of any non-UTF8 strings that might be included as part of a DNS response.
formatbyte
typestring
class
descriptionThe code specifying the class of the resource record.
formatuint32
typeinteger
data
descriptionThe payload or response to the DNS question for all responses encoded in UTF-8 format
typestring
name
descriptionThe name of the owner of the resource record.
typestring
ttl
descriptionThe time interval for which the resource record can be cached before the source of the information should again be queried.
formatuint32
typeinteger
type
descriptionThe code specifying the type of the resource record.
formatuint32
typeinteger
typeobject
ResponsePlatformInfo
descriptionRelated info of an Alert in customer's SOAR platform.
idResponsePlatformInfo
properties
alertId
descriptionId of the alert in SOAR product.
typestring
responsePlatformType
descriptionType of SOAR product.
enum
  • RESPONSE_PLATFORM_TYPE_UNSPECIFIED
  • RESPONSE_PLATFORM_TYPE_SIEMPLIFY
enumDescriptions
  • Response platform not specified.
  • Siemplify
typestring
typeobject
Retrohunt
descriptionRetrohunt is an execution of a Rule over a time range in the past.
idRetrohunt
properties
executionInterval
$refInterval
descriptionOutput only. The start and end time of the retrohunt execution. If the retrohunt is not yet finished, the end time of the interval will not be populated.
readOnlyTrue
name
descriptionThe resource name of the retrohunt. Retrohunt is the child of a rule revision. {rule} in the format below is structured as {rule_id@revision_id}. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}/retrohunts/{retrohunt}
typestring
processInterval
$refInterval
descriptionRequired. The start and end time of the event time range this retrohunt processes.
progressPercentage
descriptionOutput only. Percent progress of the retrohunt towards completion, from 0.00 to 100.00.
formatfloat
readOnlyTrue
typenumber
state
descriptionOutput only. The state of the retrohunt.
enum
  • STATE_UNSPECIFIED
  • RUNNING
  • DONE
  • CANCELLED
  • FAILED
enumDescriptions
  • Unspecified or unknown retrohunt state.
  • Running state.
  • Done state.
  • Cancelled state.
  • Failed state.
readOnlyTrue
typestring
typeobject
RetrohuntMetadata
descriptionOperation Metadata for Retrohunts.
idRetrohuntMetadata
properties
executionInterval
$refInterval
descriptionThe start and end time of the retrohunt execution. If the retrohunt is not yet finished, the end time of the interval will not be filled.
progressPercentage
descriptionPercent progress of the retrohunt towards completion, from 0.00 to 100.00.
formatfloat
typenumber
retrohunt
descriptionThe name of the retrohunt. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}/retrohunts/{retrohunt}
typestring
typeobject
RiskDelta
descriptionDescribes the difference in risk score between two points in time.
idRiskDelta
properties
previousRangeEndTime
descriptionEnd time of the previous time window.
formatgoogle-datetime
typestring
previousRiskScore
descriptionRisk score from previous risk window
formatint32
typeinteger
riskScoreDelta
descriptionDifference in the normalized risk score from the previous recorded value.
formatint32
typeinteger
riskScoreNumericDelta
descriptionNumeric change between current and previous risk score
formatint32
typeinteger
typeobject
Role
descriptionSystem role for resource access and modification.
idRole
properties
description
descriptionSystem role description for user.
typestring
name
descriptionSystem role name for user.
typestring
type
descriptionSystem role type for well known roles.
enum
  • TYPE_UNSPECIFIED
  • ADMINISTRATOR
  • SERVICE_ACCOUNT
enumDescriptions
  • Default user role.
  • Product administrator with elevated privileges.
  • System service account for automated privilege access.
typestring
typeobject
Rule
descriptionThe Rule resource represents a user-created rule. NEXT TAG: 21
idRule
properties
allowedRunFrequencies
descriptionOutput only. The run frequencies that are allowed for the rule. Populated in BASIC view and FULL view.
items
enum
  • RUN_FREQUENCY_UNSPECIFIED
  • LIVE
  • HOURLY
  • DAILY
enumDescriptions
  • The run frequency is unspecified/unknown.
  • Executes in real time.
  • Executes once per hour.
  • Executes once per day.
typestring
readOnlyTrue
typearray
author
descriptionOutput only. The author of the rule. Extracted from the meta section of text. Populated in BASIC view and FULL view.
readOnlyTrue
typestring
compilationDiagnostics
descriptionOutput only. A list of a rule's corresponding compilation diagnostic messages such as compilation errors and compilation warnings. Populated in FULL view.
items
$refCompilationDiagnostic
readOnlyTrue
typearray
compilationState
descriptionOutput only. The current compilation state of the rule. Populated in FULL view.
enum
  • COMPILATION_STATE_UNSPECIFIED
  • SUCCEEDED
  • FAILED
enumDescriptions
  • The compilation state is unspecified/unknown.
  • The Rule can successfully compile.
  • The Rule cannot successfully compile. This is possible if a backwards-incompatible change was made to the compiler.
readOnlyTrue
typestring
createTime
descriptionOutput only. The timestamp of when the rule was created. Populated in FULL view.
formatgoogle-datetime
readOnlyTrue
typestring
dataTables
descriptionOutput only. Resource names of the data tables used in this rule.
items
typestring
readOnlyTrue
typearray
displayName
descriptionOutput only. Display name of the rule. Populated in BASIC view and FULL view.
readOnlyTrue
typestring
etag
descriptionThe etag for this rule. If this is provided on update, the request will succeed if and only if it matches the server-computed value, and will fail with an ABORTED error otherwise. Populated in BASIC view and FULL view.
typestring
inputsUsed
$refInputsUsed
descriptionOutput only. The set of inputs used in the rule. For example, if the rule uses $e.principal.hostname, then the uses_udm field will be true.
readOnlyTrue
metadata
additionalProperties
typestring
descriptionOutput only. Additional metadata specified in the meta section of text. Populated in FULL view.
readOnlyTrue
typeobject
name
descriptionFull resource name for the rule. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}
typestring
nearRealTimeLiveRuleEligible
descriptionOutput only. Indicate the rule can run in near real time live rule. If this is true, the rule uses the near real time live rule when the run frequency is set to LIVE.
readOnlyTrue
typeboolean
referenceLists
descriptionOutput only. Resource names of the reference lists used in this rule. Populated in FULL view.
items
typestring
readOnlyTrue
typearray
revisionCreateTime
descriptionOutput only. The timestamp of when the rule revision was created. Populated in FULL, REVISION_METADATA_ONLY views.
formatgoogle-datetime
readOnlyTrue
typestring
revisionId
descriptionOutput only. The revision ID of the rule. A new revision is created whenever the rule text is changed in any way. Format: v_{10 digits}_{9 digits} Populated in REVISION_METADATA_ONLY view and FULL view.
readOnlyTrue
typestring
scope
descriptionResource name of the DataAccessScope bound to this rule. Populated in BASIC view and FULL view. If reference lists are used in the rule, validations will be performed against this scope to ensure that the reference lists are compatible with both the user's and the rule's scopes. The scope should be in the format: "projects/{project}/locations/{location}/instances/{instance}/dataAccessScopes/{scope}".
typestring
severity
$refSeverity
descriptionOutput only. The severity of the rule as specified in the meta section of text. Populated in BASIC view and FULL view.
readOnlyTrue
text
descriptionThe YARA-L content of the rule. Populated in FULL view.
typestring
type
descriptionOutput only. User-facing type of the rule. Extracted from the events section of rule text. Populated in BASIC view and FULL view.
enum
  • RULE_TYPE_UNSPECIFIED
  • SINGLE_EVENT
  • MULTI_EVENT
enumDescriptions
  • The rule type is unspecified/unknown.
  • Rule checks for the existence of a single event.
  • Rule checks for correlation between multiple events
readOnlyTrue
typestring
typeobject
RuleDeployment
descriptionThe RuleDeployment resource represents the deployment state of a Rule.
idRuleDeployment
properties
alerting
descriptionWhether detections resulting from this deployment should be considered alerts.
typeboolean
archiveTime
descriptionOutput only. The timestamp when the rule deployment archive state was last set to true. If the rule deployment's current archive state is not set to true, the field will be empty.
formatgoogle-datetime
readOnlyTrue
typestring
archived
descriptionThe archive state of the rule deployment. Cannot be set to true unless enabled is set to false. If set to true, alerting will automatically be set to false. If currently set to true, enabled, alerting, and run_frequency cannot be updated.
typeboolean
consumerRules
descriptionOutput only. The names of the associated/chained consumer rules. Rules are considered consumers of this rule if their rule text explicitly filters on this rule's ruleid. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}
items
typestring
readOnlyTrue
typearray
enabled
descriptionWhether the rule is currently deployed continuously against incoming data.
typeboolean
executionState
descriptionOutput only. The execution state of the rule deployment.
enum
  • EXECUTION_STATE_UNSPECIFIED
  • DEFAULT
  • LIMITED
  • PAUSED
enumDescriptions
  • Unspecified or unknown execution state.
  • Default execution state.
  • Rules in limited state may not have their executions guaranteed.
  • Paused rules are not executed at all.
readOnlyTrue
typestring
lastAlertStatusChangeTime
descriptionOutput only. The timestamp when the rule deployment alert state was lastly changed. This is filled regardless of the current alert state. E.g. if the current alert status is false, this timestamp will be the timestamp when the alert status was changed to false.
formatgoogle-datetime
readOnlyTrue
typestring
name
descriptionRequired. The resource name of the rule deployment. Note that RuleDeployment is a child of the overall Rule, not any individual revision, so the resource ID segment for the Rule resource must not reference a specific revision. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}/deployment
typestring
producerRules
descriptionOutput only. The names of the associated/chained producer rules. Rules are considered producers for this rule if this rule explicitly filters on their ruleid. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}
items
typestring
readOnlyTrue
typearray
runFrequency
descriptionThe run frequency of the rule deployment.
enum
  • RUN_FREQUENCY_UNSPECIFIED
  • LIVE
  • HOURLY
  • DAILY
enumDescriptions
  • The run frequency is unspecified/unknown.
  • Executes in real time.
  • Executes once per hour.
  • Executes once per day.
typestring
typeobject
RuntimeError
idRuntimeError
properties
errorText
typestring
timeRange
$refInterval
typeobject
SSLCertificate
descriptionSSL certificate.
idSSLCertificate
properties
certExtensions
additionalProperties
descriptionProperties of the object.
typeany
descriptionCertificate's extensions.
typeobject
certSignature
$refCertSignature
descriptionCertificate's signature and algorithm.
ec
$refEC
descriptionEC public key information.
extension
$refExtension
deprecatedTrue
description(DEPRECATED) certificate's extension.
firstSeenTime
descriptionDate the certificate was first retrieved by VirusTotal.
formatgoogle-datetime
typestring
issuer
$refSubject
descriptionCertificate's issuer data.
publicKey
$refPublicKey
descriptionPublic key information.
serialNumber
descriptionCertificate's serial number hexdump.
typestring
signatureAlgorithm
descriptionAlgorithm used for the signature (for example, "sha1RSA").
typestring
size
descriptionCertificate content length.
formatint64
typestring
subject
$refSubject
descriptionCertificate's subject data.
thumbprint
descriptionCertificate's content SHA1 hash.
typestring
thumbprintSha256
descriptionCertificate's content SHA256 hash.
typestring
validity
$refValidity
descriptionCertificate's validity period.
version
descriptionCertificate version (typically "V1", "V2" or "V3").
typestring
typeobject
ScopeInfo
descriptionScopeInfo specifies the scope info of the reference list.
idScopeInfo
properties
referenceListScope
$refReferenceListScope
descriptionRequired. The list of scope names of the reference list, if the list is empty the reference list is treated as unscoped.
typeobject
SearchDataTableColumnInfo
idSearchDataTableColumnInfo
properties
isDefault
typeboolean
originalColumn
typestring
typeobject
SearchDataTableInfo
idSearchDataTableInfo
properties
columnInfo
items
$refSearchDataTableColumnInfo
typearray
dataTable
typestring
typeobject
SearchDataTableRow
idSearchDataTableRow
properties
column
typestring
value
typestring
typeobject
SearchDataTableRowInfo
idSearchDataTableRowInfo
properties
dataTable
typestring
rows
items
$refSearchDataTableRow
typearray
typeobject
SecurityResult
descriptionSecurity related metadata for the event. A security result might be something like "virus detected and quarantined," "malicious connection blocked," or "sensitive data included in document foo.doc." Each security result, of which there may be more than one, may either pertain to the whole event, or to a specific object or device referenced in the event (e.g. a malicious file that was detected, or a sensitive document sent as an email attachment). For security results that apply to a particular object referenced in the event, the security_results message MUST contain details about the implicated object (such as process, user, IP, domain, URL, IP, or email address) in the about field. For security results that apply to the entire event (e.g. SPAM found in this email), the about field must remain empty.
idSecurityResult
properties
about
$refNoun
descriptionIf the security result is about a specific entity (Noun), add it here. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
action
descriptionActions taken for this event. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
items
enum
  • UNKNOWN_ACTION
  • ALLOW
  • BLOCK
  • ALLOW_WITH_MODIFICATION
  • QUARANTINE
  • FAIL
  • CHALLENGE
enumDescriptions
  • The default action.
  • Allowed.
  • Blocked.
  • Strip, modify something (e.g. File or email was disinfected or rewritten and still forwarded).
  • Put somewhere for later analysis (does NOT imply block).
  • Failed (e.g. the event was allowed but failed).
  • Challenged (e.g. the user was challenged by a Captcha, 2FA).
typestring
typearray
actionDetails
descriptionThe detail of the action taken as provided by the vendor. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
typestring
alertState
descriptionThe alerting types of this security result. This is primarily set for rule-generated detections and alerts.
enum
  • UNSPECIFIED
  • NOT_ALERTING
  • ALERTING
enumDescriptions
  • The security result type is not known.
  • The security result is not an alert.
  • The security result is an alert.
typestring
analyticsMetadata
descriptionStores metadata about each risk analytic metric the rule uses. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
items
$refAnalyticsMetadata
typearray
associations
descriptionAssociations related to the threat. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
items
$refAssociation
typearray
attackDetails
$refAttackDetails
descriptionMITRE ATT&CK details. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
campaigns
descriptionCampaigns using this IOC threat. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
items
typestring
typearray
category
descriptionThe security category. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
items
enum
  • UNKNOWN_CATEGORY
  • SOFTWARE_MALICIOUS
  • SOFTWARE_SUSPICIOUS
  • SOFTWARE_PUA
  • NETWORK_MALICIOUS
  • NETWORK_SUSPICIOUS
  • NETWORK_CATEGORIZED_CONTENT
  • NETWORK_DENIAL_OF_SERVICE
  • NETWORK_RECON
  • NETWORK_COMMAND_AND_CONTROL
  • ACL_VIOLATION
  • AUTH_VIOLATION
  • EXPLOIT
  • DATA_EXFILTRATION
  • DATA_AT_REST
  • DATA_DESTRUCTION
  • TOR_EXIT_NODE
  • MAIL_SPAM
  • MAIL_PHISHING
  • MAIL_SPOOFING
  • POLICY_VIOLATION
  • SOCIAL_ENGINEERING
  • PHISHING
enumDescriptions
  • The default category.
  • Malware, spyware, rootkit.
  • Below the conviction threshold; probably bad.
  • Potentially Unwanted App (such as adware).
  • Includes C&C or network exploit.
  • Suspicious activity, such as potential reverse tunnel.
  • Non-security related: URL has category like gambling or porn.
  • DoS, DDoS.
  • Port scan detected by an IDS, probing of web app.
  • If we know this is a C&C channel.
  • Unauthorized access attempted, including attempted access to files, web services, processes, web objects, etc.
  • Authentication failed (e.g. bad password or bad 2-factor authentication).
  • Exploit: For all manner of exploits including attempted overflows, bad protocol encodings, ROP, SQL injection, etc. For both network and host- based exploits.
  • DLP: Sensitive data transmission, copy to thumb drive.
  • DLP: Sensitive data found at rest in a scan.
  • Attempt to destroy/delete data.
  • TOR Exit Nodes.
  • Spam email, message, etc.
  • Phishing email, chat messages, etc.
  • Spoofed source email address, etc.
  • Security-related policy violation (e.g. firewall/proxy/HIPS rule violated, NAC block action).
  • Threats which manipulate to break normal security procedures.
  • Phishing pages, pops, https phishing etc.
typestring
typearray
categoryDetails
descriptionFor vendor-specific categories. For web categorization, put type in here such as "gambling" or "porn". This field is not populated when the SecurityResult appears in a finding (a detection or alert).
items
typestring
typearray
confidence
descriptionThe confidence level of the result as estimated by the product. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
enum
  • UNKNOWN_CONFIDENCE
  • LOW_CONFIDENCE
  • MEDIUM_CONFIDENCE
  • HIGH_CONFIDENCE
enumDescriptions
  • The default confidence level.
  • Low confidence.
  • Medium confidence.
  • High confidence.
typestring
confidenceDetails
descriptionAdditional detail with regards to the confidence of a security event as estimated by the product vendor. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
typestring
confidenceScore
descriptionThe confidence score of the security result. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
formatfloat
typenumber
description
descriptionA human-readable description (e.g. "user password was wrong"). This can be more detailed than the summary.
typestring
detectionDepth
descriptionThe depth of the detection chain. Applies only to composite detections.
formatint64
typestring
detectionFields
descriptionAn ordered list of values, that represent fields in detections for a security finding. This list represents mapping of names of requested entities to their values (the security result matched variables). This is only populated when the SecurityResult appears in a finding (a detection or alert).
items
$refLabel
typearray
firstDiscoveredTime
descriptionFirst time the IoC threat was discovered in the provider. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
formatgoogle-datetime
typestring
lastDiscoveredTime
descriptionLast time the IoC was seen in the provider data. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
formatgoogle-datetime
typestring
lastUpdatedTime
descriptionLast time the IoC threat was updated in the provider. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
formatgoogle-datetime
typestring
outcomes
descriptionA list of outcomes that represent the results of this security finding. This list represents a mapping of names of the requested outcomes, to a stringified version of their values. This is only populated when the SecurityResult appears in a finding (a detection or alert).
items
$refLabel
typearray
priority
descriptionThe priority of the result. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
enum
  • UNKNOWN_PRIORITY
  • LOW_PRIORITY
  • MEDIUM_PRIORITY
  • HIGH_PRIORITY
enumDescriptions
  • Default priority level.
  • Low priority.
  • Medium priority.
  • High priority.
typestring
priorityDetails
descriptionVendor-specific information about the security result priority. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
typestring
reports
descriptionReports that reference this IOC threat. These are the report IDs. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
items
typestring
typearray
riskScore
descriptionThe risk score of the security result.
formatfloat
typenumber
ruleAuthor
descriptionAuthor of the security rule. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
typestring
ruleId
descriptionA vendor-specific ID for a rule, varying by observer type (e.g. "08123", "5d2b44d0-5ef6-40f5-a704-47d61d3babbe").
typestring
ruleLabels
descriptionA list of rule labels that can't be captured by the other fields in security result (e.g. "reference : AnotherRule", "contributor : John"). This is primarily set in rule-generated detections and alerts.
items
$refLabel
typearray
ruleName
descriptionName of the security rule (e.g. "BlockInboundToOracle").
typestring
ruleSet
descriptionThe curated detection's rule set identifier. (for example, "windows-threats") This is primarily set in rule-generated detections and alerts.
typestring
ruleSetDisplayName
descriptionThe curated detections rule set display name. This is primarily set in rule-generated detections and alerts.
typestring
ruleType
descriptionThe type of security rule.
typestring
ruleVersion
descriptionVersion of the security rule. (e.g. "v1.1", "00001", "1604709794", "2020-11-16T23:04:19+00:00"). Note that rule versions are source-dependant and lexical ordering should not be assumed.
typestring
rulesetCategoryDisplayName
descriptionThe curated detection rule set category display name. (for example, if rule_set_display_name is "CDIR SCC Enhanced Exfiltration", the rule_set_category is "Cloud Threats"). This is primarily set in rule-generated detections and alerts.
typestring
severity
descriptionThe severity of the result.
enum
  • UNKNOWN_SEVERITY
  • INFORMATIONAL
  • ERROR
  • NONE
  • LOW
  • MEDIUM
  • HIGH
  • CRITICAL
enumDescriptions
  • The default severity level.
  • Info severity.
  • An error.
  • No malicious result.
  • Low-severity malicious result.
  • Medium-severity malicious result.
  • High-severity malicious result.
  • Critical-severity malicious result.
typestring
severityDetails
descriptionVendor-specific severity. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
typestring
summary
descriptionA short human-readable summary (e.g. "failed login occurred")
typestring
threatFeedName
descriptionVendor feed name for a threat indicator feed. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
typestring
threatId
descriptionVendor-specific ID for a threat. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
typestring
threatIdNamespace
descriptionThe attribute threat_id_namespace qualifies threat_id with an id namespace to get an unique id. The attribute threat_id by itself is not unique across Chronicle as it is a vendor specific id. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
enum
  • NORMALIZED_TELEMETRY
  • RAW_TELEMETRY
  • RULE_DETECTIONS
  • UPPERCASE
  • MACHINE_INTELLIGENCE
  • SECURITY_COMMAND_CENTER
  • UNSPECIFIED
  • SOAR_ALERT
  • VIRUS_TOTAL
enumDescriptions
  • Ingested and Normalized telemetry events
  • Ingested Raw telemetry
  • Chronicle Rules engine
  • Uppercase
  • DSML - Machine Intelligence
  • A normalized telemetry event from Google Security Command Center.
  • Unspecified Namespace
  • An alert coming from other SIEMs via Chronicle SOAR.
  • VirusTotal.
typestring
threatName
descriptionA vendor-assigned classification common across multiple customers (for example, "W32/File-A", "Slammer"). This field is not populated when the SecurityResult appears in a finding (a detection or alert).
typestring
threatStatus
descriptionCurrent status of the threat This field is not populated when the SecurityResult appears in a finding (a detection or alert).
enum
  • THREAT_STATUS_UNSPECIFIED
  • ACTIVE
  • CLEARED
  • FALSE_POSITIVE
enumDescriptions
  • Default threat status
  • Active threat.
  • Cleared threat.
  • False positive.
typestring
threatVerdict
descriptionGCTI threat verdict on the security result entity. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
enum
  • THREAT_VERDICT_UNSPECIFIED
  • UNDETECTED
  • SUSPICIOUS
  • MALICIOUS
enumDescriptions
  • Unspecified threat verdict level.
  • Undetected threat verdict level.
  • Suspicious threat verdict level.
  • Malicious threat verdict level.
typestring
urlBackToProduct
descriptionURL that takes the user to the source product console for this event. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
typestring
variables
additionalProperties
$refFindingVariable
descriptionA list of outcomes and match variables that represent the results of this security finding. This list represents a mapping of names of the requested outcomes or match variables, to their values. This is only populated when the SecurityResult appears in a finding (a detection or alert).
typeobject
verdict
$refVerdict
deprecatedTrue
descriptionVerdict about the IoC from the provider. This field is now deprecated. Use VerdictInfo instead.
verdictInfo
descriptionVerdict information about the IoC from the provider. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
items
$refVerdictInfo
typearray
typeobject
Server
descriptionTransport Layer Security (TLS) information associated with the server (for example, Certificate or JA3 hash).
idServer
properties
certificate
$refCertificate
descriptionServer certificate.
ja3s
descriptionJA3 hash from the TLS ServerHello, as a hex-encoded string.
typestring
typeobject
Severity
descriptionSeverity represents the severity level of the rule.
idSeverity
properties
displayName
descriptionThe display name of the severity level. Extracted from the meta section of the rule text.
typestring
typeobject
SignatureInfo
descriptionFile signature information extracted from different tools.
idSignatureInfo
properties
codesign
$refFileMetadataCodesign
descriptionSignature information extracted from the codesign utility.
sigcheck
$refFileMetadataSignatureInfo
descriptionSignature information extracted from the sigcheck tool.
typeobject
SignerInfo
descriptionFile metadata related to the signer information.
idSignerInfo
properties
certIssuer
descriptionCompany that issued the certificate.
typestring
name
descriptionCommon name of the signers/certificate. The order of the signers matters. Each element is a higher level authority, the last being the root authority.
typestring
status
descriptionIt can say "Valid" or state the problem with the certificate if any (e.g. "This certificate or one of the certificates in the certificate chain is not time valid.").
typestring
validUsage
descriptionIndicates which situations the certificate is valid for (e.g. "Code Signing").
typestring
typeobject
Smtp
descriptionSMTP info. See RFC 2821.
idSmtp
properties
helo
descriptionThe client's 'HELO'/'EHLO' string.
typestring
isTls
descriptionIf the connection switched to TLS.
typeboolean
isWebmail
descriptionIf the message was sent via a webmail client.
typeboolean
mailFrom
descriptionThe client's 'MAIL FROM' string.
typestring
messagePath
descriptionThe message's path (extracted from the headers).
typestring
rcptTo
descriptionThe client's 'RCPT TO' string(s).
items
typestring
typearray
serverResponse
descriptionThe server's response(s) to the client.
items
typestring
typearray
typeobject
SoarAlertMetadata
descriptionMetadata fields of alerts coming from other SIEM systems.
idSoarAlertMetadata
properties
alertId
descriptionAlert ID in the source SIEM system.
typestring
product
descriptionName of the product the alert is coming from.
typestring
sourceRule
descriptionName of the rule triggering the alert in the source SIEM.
typestring
sourceSystem
descriptionName of the Source SIEM system.
typestring
sourceSystemTicketId
descriptionTicket id for the alert in the source system.
typestring
sourceSystemUri
descriptionUrl to the source SIEM system.
typestring
vendor
descriptionName of the vendor.
typestring
typeobject
Software
descriptionInformation about a software package or application.
idSoftware
properties
description
descriptionThe description of the software.
typestring
name
descriptionThe name of the software.
typestring
permissions
descriptionSystem permissions granted to the software. For example, "android.permission.WRITE_EXTERNAL_STORAGE"
items
$refPermission
typearray
vendorName
descriptionThe name of the software vendor.
typestring
version
descriptionThe version of the software.
typestring
typeobject
Source
descriptionDeprecated. Information about the threat intelligence source. These fields are used to model Mandiant sources.
idSource
properties
benignCount
descriptionCount of responses where this IoC was marked benign.
formatint32
typeinteger
maliciousCount
descriptionCount of responses where this IoC was marked malicious.
formatint32
typeinteger
name
descriptionName of the IoC source.
typestring
quality
descriptionQuality of the IoC mapping extracted from the source.
enum
  • UNKNOWN_CONFIDENCE
  • LOW_CONFIDENCE
  • MEDIUM_CONFIDENCE
  • HIGH_CONFIDENCE
enumDescriptions
  • The default confidence level.
  • Low confidence.
  • Medium confidence.
  • High confidence.
typestring
responseCount
descriptionTotal response count from this source.
formatint32
typeinteger
sourceCount
descriptionNumber of sources from which intelligence was extracted.
formatint32
typeinteger
threatIntelligenceSources
descriptionDifferent threat intelligence sources from which IoC info was extracted.
items
$refSource
typearray
typeobject
Status
descriptionThe `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors).
idStatus
properties
code
descriptionThe status code, which should be an enum value of google.rpc.Code.
formatint32
typeinteger
details
descriptionA list of messages that carry the error details. There is a common set of message types for APIs to use.
items
additionalProperties
descriptionProperties of the object. Contains field @type with type URL.
typeany
typeobject
typearray
message
descriptionA developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
typestring
typeobject
StringSequence
descriptionStringSequence represents a sequence of string.
idStringSequence
properties
stringVals
descriptionstring sequence.
items
typestring
typearray
typeobject
StringToInt64MapEntry
idStringToInt64MapEntry
properties
key
descriptionKey field.
typestring
value
descriptionValue field.
formatint64
typestring
typeobject
StringValue
idStringValue
properties
displayValue
typestring
rawValue
typestring
typeobject
StringValues
idStringValues
properties
values
items
$refStringValue
typearray
typeobject
Subject
descriptionSubject data.
idSubject
properties
commonName
descriptionCN: CommonName.
typestring
countryName
descriptionC: Country name.
typestring
locality
descriptionL: Locality.
typestring
organization
descriptionO: Organization.
typestring
organizationalUnit
descriptionOU: OrganizationalUnit.
typestring
stateOrProvinceName
descriptionST: StateOrProvinceName.
typestring
typeobject
Tactic
descriptionTactic information related to an attack or threat.
idTactic
properties
id
descriptionTactic ID (e.g. "TA0043").
typestring
name
descriptionTactic Name (e.g. "Reconnaissance")
typestring
typeobject
Tags
descriptionTags are event metadata which is set by examining event contents post-parsing. For example, a UDM event may be assigned a tenant_id based on certain customer-defined parameters.
idTags
properties
dataTapConfigName
descriptionA list of sink name values defined in DataTap configurations.
items
typestring
typearray
tenantId
descriptionA list of subtenant ids that this event belongs to.
items
formatbyte
typestring
typearray
typeobject
Technique
descriptionTechnique information related to an attack or threat.
idTechnique
properties
id
descriptionTechnique ID (e.g. "T1595").
typestring
name
descriptionTechnique Name (e.g. "Active Scanning").
typestring
subtechniqueId
descriptionSubtechnique ID (e.g. "T1595.001").
typestring
subtechniqueName
descriptionSubtechnique Name (e.g. "Scanning IP Blocks").
typestring
typeobject
TimeOff
descriptionSystem record for leave/time-off from a Human Capital Management (HCM) system.
idTimeOff
properties
description
descriptionDescription of the leave if available (e.g. 'Vacation').
typestring
interval
$refInterval
descriptionInterval duration of the leave.
typeobject
Tls
descriptionTransport Layer Security (TLS) information.
idTls
properties
cipher
descriptionCipher used during the connection.
typestring
client
$refClient
descriptionCertificate information for the client certificate.
curve
descriptionElliptical curve used for a given cipher.
typestring
established
descriptionIndicates whether the TLS negotiation was successful.
typeboolean
nextProtocol
descriptionProtocol to be used for tunnel.
typestring
resumed
descriptionIndicates whether the TLS connection was resumed from a previous TLS negotiation.
typeboolean
server
$refServer
descriptionCertificate information for the server certificate.
version
descriptionTLS version.
typestring
versionProtocol
descriptionProtocol.
typestring
typeobject
Tracker
descriptionURL Tracker.
idTracker
properties
id
descriptionTracker ID, if available.
typestring
timestamp
descriptionTracker ingestion date.
formatgoogle-datetime
typestring
tracker
descriptionTracker name.
typestring
url
descriptionTracker script URL.
typestring
typeobject
Tunnels
descriptionVPN tunnels.
idTunnels
properties
provider
descriptionThe provider of the VPN tunnels being used.
typestring
type
descriptionThe type of the VPN tunnels.
typestring
typeobject
UDM
descriptionA Unified Data Model event.
idUDM
properties
about
descriptionRepresents entities referenced by the event that are not otherwise described in principal, src, target, intermediary or observer. For example, it could be used to track email file attachments, domains/URLs/IPs embedded within an email body, and DLLs that are loaded during a PROCESS_LAUNCH event.
items
$refNoun
typearray
additional
additionalProperties
descriptionProperties of the object.
typeany
descriptionAny important vendor-specific event data that cannot be adequately represented within the formal sections of the UDM model.
typeobject
extensions
$refExtensions
descriptionAll other first-class, event-specific metadata goes in this message. Do not place protocol metadata in Extensions; put it in Network.
extracted
additionalProperties
descriptionProperties of the object.
typeany
descriptionFlattened fields extracted from the log.
typeobject
intermediary
descriptionRepresents details on one or more intermediate entities processing activity described in the event. This includes device details about a proxy server or SMTP relay server. If an active event (that has a principal and possibly target) passes through any intermediaries, they're added here. Intermediaries can impact the overall action, for example blocking or modifying an ongoing request. A rule of thumb here is that 'principal', 'target', and description of the initial action should be the same regardless of the intermediary or its action. A successful network connection from A->B should look the same in principal/target/intermediary as one blocked by firewall C: principal: A, target: B (intermediary: C).
items
$refNoun
typearray
metadata
$refMetadata
descriptionEvent metadata such as timestamp, source product, etc.
network
$refNetwork
descriptionAll network details go here, including sub-messages with details on each protocol (for example, DHCP, DNS, or HTTP).
observer
$refNoun
descriptionRepresents an observer entity (for example, a packet sniffer or network-based vulnerability scanner), which is not a direct intermediary, but which observes and reports on the event in question.
principal
$refNoun
descriptionRepresents the acting entity that originates the activity described in the event. The principal must include at least one machine detail (hostname, MACs, IPs, port, product-specific identifiers like an EDR asset ID) or user detail (for example, username), and optionally include process details. It must NOT include any of the following fields: email, files, registry keys or values.
securityResult
descriptionA list of security results.
items
$refSecurityResult
typearray
src
$refNoun
descriptionRepresents a source entity being acted upon by the participant along with the device or process context for the source object (the machine where the source object resides). For example, if user U copies file A on machine X to file B on machine Y, both file A and machine X would be specified in the src portion of the UDM event.
target
$refNoun
descriptionRepresents a target entity being referenced by the event or an object on the target entity. For example, in a firewall connection from device A to device B, A is described as the principal and B is described as the target. For a process injection by process C into target process D, process C is described as the principal and process D is described as the target.
typeobject
UdmColumnList
idUdmColumnList
properties
values
items
$refUdmColumnValue
typearray
typeobject
UdmColumnType
idUdmColumnType
properties
list
$refUdmColumnList
value
$refUdmColumnValue
typeobject
UdmColumnValue
idUdmColumnValue
properties
boolVal
typeboolean
bytesVal
formatbyte
typestring
dateVal
$refDate
doubleVal
formatdouble
typenumber
int64Val
formatint64
typestring
nullVal
typeboolean
protoVal
additionalProperties
descriptionProperties of the object. Contains field @type with type URL.
typeany
typeobject
stringVal
typestring
timestampVal
formatgoogle-datetime
typestring
uint64Val
formatuint64
typestring
typeobject
UdmEventInfo
idUdmEventInfo
properties
alertNumber
formatint32
typeinteger
annotations
items
enum
  • ANNOTATION_UNSPECIFIED
  • ANNOTATION_ALERT
enumDescriptions
typestring
typearray
chip
$refChip
deprecatedTrue
connectedComponentLabel
descriptionOptional.
formatbyte
typestring
datatableRowInfo
items
$refSearchDataTableRowInfo
typearray
detections
items
$refCollection
typearray
displayName
deprecatedTrue
typestring
entity
$refBackstoryEntity
event
$refUDM
eventLogToken
typestring
filterProperties
$refFilterProperties
deprecatedTrue
outcomes
items
$refUdmColumnType
typearray
tenantId
descriptionOptional.
typestring
uid
formatbyte
typestring
typeobject
UdmEventList
idUdmEventList
properties
columnNames
$refColumnNames
complete
typeboolean
datatableInfo
items
$refSearchDataTableInfo
typearray
events
items
$refUdmEventInfo
typearray
progress
formatdouble
typenumber
tooManyEvents
typeboolean
typeobject
UdmFieldAggregation
idUdmFieldAggregation
properties
aggregationType
enum
  • UNSPECIFIED_FIELD_AGGREGATION_TYPE
  • UDM_FIELD_AGGREGATION_TYPE
  • ENTITY_FIELD_AGGREGATION_TYPE
enumDescriptions
typestring
allValues
items
$refUdmValueCount
typearray
baselineEventCount
formatint32
typeinteger
bottomValues
items
$refUdmValueCount
typearray
eventCount
formatint32
typeinteger
fieldName
typestring
tooManyValues
typeboolean
topValues
items
$refUdmValueCount
typearray
valueCount
formatint32
typeinteger
typeobject
UdmFieldAggregations
idUdmFieldAggregations
properties
complete
typeboolean
fields
items
$refUdmFieldAggregation
typearray
groupByFields
items
$refGroupAggregationByField
typearray
typeobject
UdmFieldValue
idUdmFieldValue
properties
boolValue
typeboolean
bytesValue
formatbyte
typestring
doubleValue
formatdouble
typenumber
enumValue
typestring
floatValue
formatfloat
typenumber
int32Value
formatint32
typeinteger
int64Value
formatint64
typestring
isNull
typeboolean
stringValue
typestring
timestampValue
formatgoogle-datetime
typestring
uint32Value
formatuint32
typeinteger
uint64Value
formatuint64
typestring
typeobject
UdmPrevalence
idUdmPrevalence
properties
artifacts
items
$refFieldAndValue
typearray
prevalence
formatint32
typeinteger
typeobject
UdmPrevalenceBucket
idUdmPrevalenceBucket
properties
prevalence
items
$refUdmPrevalence
typearray
typeobject
UdmPrevalenceResponse
idUdmPrevalenceResponse
properties
buckets
items
$refUdmPrevalenceBucket
typearray
partialPrevalence
typeboolean
typeobject
UdmSearchOperationMetadata
descriptionInformation about a UDM Search operation. This message is used to populate the `metadata` field of `Operation` resources created by UDM Search.
idUdmSearchOperationMetadata
properties
baselineEventsCount
descriptionThe number of events matching the baseline query so far.
formatint32
typeinteger
baselineQuery
descriptionQuery used to search for events.
typestring
baselineTimeRange
$refInterval
descriptionThe time range used for the baseline query [inclusive start time, exclusive end time).
caseInsensitive
descriptionIf true, the search was performed in a case-insensitive manner.
typeboolean
endTime
descriptionThe end time of the operation, if done.
formatgoogle-datetime
typestring
expireTime
descriptionThe time when the operation results expire. This time may change while the operation is in progress. If unset, the results never expire.
formatgoogle-datetime
typestring
filteredEventsCount
descriptionThe number of events matching the snapshot query so far. This is <= `baseline_events_count`. If the snapshot query is empty, this will be equal to `baseline_events_count`.
formatint32
typeinteger
progress
descriptionA value from 0 to 1 representing the progress of the operation.
formatdouble
typenumber
snapshotQuery
descriptionQuery used to filter the baseline query's events.
typestring
snapshotTimeRange
$refInterval
descriptionTime range used to filter the baseline query's events [inclusive start time, exclusive end time). This time range is completely within `baseline_time_range`. If not set, it is assumed to match `baseline_time_range`.
startTime
descriptionThe start time of the operation.
formatgoogle-datetime
typestring
statsRowsCount
descriptionThe total number of rows returned for a stats query.
formatint32
typeinteger
typeobject
UdmValueCount
idUdmValueCount
properties
baselineEventCount
formatint32
typeinteger
eventCount
formatint32
typeinteger
value
$refUdmFieldValue
typeobject
Uint64Sequence
descriptionUint64Sequence represents a sequence of uint64s.
idUint64Sequence
properties
uint64Vals
descriptionuint64 sequence.
items
formatuint64
typestring
typearray
typeobject
Url
descriptionUrl.
idUrl
properties
categories
descriptionCategorisation done by VirusTotal partners.
items
typestring
typearray
favicon
$refFavicon
descriptionDifference hash and MD5 hash of the URL's.
htmlMeta
additionalProperties
descriptionProperties of the object.
typeany
descriptionMeta tags (only for URLs downloading HTML).
typeobject
lastFinalUrl
descriptionIf the original URL redirects, where does it end.
typestring
lastHttpResponseCode
descriptionHTTP response code of the last response.
formatint32
typeinteger
lastHttpResponseContentLength
descriptionLength in bytes of the content received.
formatint64
typestring
lastHttpResponseContentSha256
descriptionURL response body's SHA256 hash.
typestring
lastHttpResponseCookies
additionalProperties
descriptionProperties of the object.
typeany
descriptionWebsite's cookies.
typeobject
lastHttpResponseHeaders
additionalProperties
descriptionProperties of the object.
typeany
descriptionHeaders and values of the last HTTP response.
typeobject
tags
descriptionTags.
items
typestring
typearray
title
descriptionWebpage title.
typestring
trackers
descriptionTrackers found in the URL in a historical manner.
items
$refTracker
typearray
url
descriptionURL.
typestring
typeobject
User
descriptionInformation about a user.
idUser
properties
accountExpirationTime
descriptionUser account expiration timestamp.
formatgoogle-datetime
typestring
accountLockoutTime
descriptionUser account lockout timestamp.
formatgoogle-datetime
typestring
accountType
descriptionType of user account (for example, service, domain, or cloud). This is somewhat aligned to: https://attack.mitre.org/techniques/T1078/
enum
  • ACCOUNT_TYPE_UNSPECIFIED
  • DOMAIN_ACCOUNT_TYPE
  • LOCAL_ACCOUNT_TYPE
  • CLOUD_ACCOUNT_TYPE
  • SERVICE_ACCOUNT_TYPE
  • DEFAULT_ACCOUNT_TYPE
enumDescriptions
  • Default user account type.
  • A human account part of some domain in directory services.
  • A local machine account.
  • A SaaS service account type (such as Slack or GitHub).
  • A non-human account for data access.
  • A system built in default account.
typestring
attribute
$refAttribute
descriptionGeneric entity metadata attributes of the user.
companyName
descriptionUser job company name.
typestring
department
descriptionUser job department
items
typestring
typearray
emailAddresses
descriptionEmail addresses of the user. This field can be used as an entity indicator for user entities.
items
typestring
typearray
employeeId
descriptionHuman capital management identifier. This field can be used as an entity indicator for user entities.
typestring
firstName
descriptionFirst name of the user (e.g. "John").
typestring
firstSeenTime
descriptionThe first observed time for a user. The value is calculated on the basis of the first time the identifier was observed.
formatgoogle-datetime
typestring
groupIdentifiers
descriptionProduct object identifiers of the group(s) the user belongs to A vendor-specific identifier to uniquely identify the group(s) the user belongs to (a GUID, LDAP OID, or similar).
items
typestring
typearray
groupid
deprecatedTrue
descriptionThe ID of the group that the user belongs to. Deprecated in favor of the repeated group_identifiers field.
typestring
hireDate
descriptionUser job employment hire date.
formatgoogle-datetime
typestring
lastBadPasswordAttemptTime
descriptionUser last bad password attempt timestamp.
formatgoogle-datetime
typestring
lastLoginTime
descriptionUser last login timestamp.
formatgoogle-datetime
typestring
lastName
descriptionLast name of the user (e.g. "Locke").
typestring
lastPasswordChangeTime
descriptionUser last password change timestamp.
formatgoogle-datetime
typestring
managers
descriptionUser job manager(s).
items
$refUser
typearray
middleName
descriptionMiddle name of the user.
typestring
officeAddress
$refLocation
descriptionUser job office location.
passwordExpirationTime
descriptionUser password expiration timestamp.
formatgoogle-datetime
typestring
personalAddress
$refLocation
descriptionPersonal address of the user.
phoneNumbers
descriptionPhone numbers for the user.
items
typestring
typearray
productObjectId
descriptionA vendor-specific identifier to uniquely identify the entity (e.g. a GUID, LDAP, OID, or similar). This field can be used as an entity indicator for user entities.
typestring
roleDescription
deprecatedTrue
descriptionSystem role description for user. Deprecated: use attribute.roles.
typestring
roleName
deprecatedTrue
descriptionSystem role name for user. Deprecated: use attribute.roles.
typestring
terminationDate
descriptionUser job employment termination date.
formatgoogle-datetime
typestring
timeOff
descriptionUser time off leaves from active work.
items
$refTimeOff
typearray
title
descriptionUser job title.
typestring
userAuthenticationStatus
descriptionSystem authentication status for user.
enum
  • UNKNOWN_AUTHENTICATION_STATUS
  • ACTIVE
  • SUSPENDED
  • NO_ACTIVE_CREDENTIALS
  • DELETED
enumDescriptions
  • The default authentication status.
  • The authentication method is in active state.
  • The authentication method is in suspended/disabled state.
  • The authentication method has no active credentials.
  • The authentication method has been deleted.
typestring
userDisplayName
descriptionThe display name of the user (e.g. "John Locke").
typestring
userRole
deprecatedTrue
descriptionSystem role for user. Deprecated: use attribute.roles.
enum
  • UNKNOWN_ROLE
  • ADMINISTRATOR
  • SERVICE_ACCOUNT
enumDeprecated
  • False
  • False
  • True
enumDescriptions
  • Default user role.
  • Product administrator with elevated privileges.
  • System service account for automated privilege access. Deprecated: not a role, instead set User.account_type.
typestring
userid
descriptionThe ID of the user. This field can be used as an entity indicator for user entities.
typestring
windowsSid
descriptionThe Microsoft Windows SID of the user. This field can be used as an entity indicator for user entities.
typestring
typeobject
UserAgentProto
idUserAgentProto
properties
annotation
items
$refAnnotation
typearray
browser
descriptionProduct brand within the family: Firefox, Netscape, Camino etc.. Or Earth, Windows-Media-Player etc.. for non-browser user agents.
typestring
browserEngineVersion
descriptionVersion of the rendering engine e.g. "8.01" for "Opera/8.01"
typestring
browserVersion
descriptionMinor and lower versions unavailable with reduced User-Agent and no client hints (go/ua-reduction-ua-string-reference).
typestring
carrier
descriptionMobile specific: name of mobile carrier
typestring
device
description(Usually) Mobile specific: name of hardware device, may or may not contain the full model name. e.g. iPhone, Palm750, SPH-M800. Reduced to "K" for Android devices with reduced User-Agent and no client hints (go/ua-reduction-ua-string-reference).
typestring
deviceVersion
description(Usually) Mobile specific: version of hardware device Unavailable with reduced User-Agent and no client hints (go/ua-reduction-ua-string-reference).
typestring
family
descriptionUser agent family captures the type of browser/app at a high-level e.g. MSIE, Gecko, Safari etc..
enum
  • USER_DEFINED
  • MSIE
  • GECKO
  • APPLEWEBKIT
  • OPERA
  • KHTML
  • OTHER
  • APPLE
  • BLACKBERRY
  • DOCOMO
  • GOOGLE
  • OPENWAVE
  • POLARIS
  • OBIGO
  • TELECA
  • MICROSOFT
  • NOKIA
  • NETFRONT
  • SEMC
  • SMIT
  • KOREAN
  • CLIENT_HINTS
enumDescriptions
  • Used to represent new families supported by user-defined parsers
  • Desktop user agent families
  • WebKit based browsers e.g. Safari
  • e.g. Konqueror
  • Mobile and non-browser user agent families UA's w/o enough data to fit into a family
  • Apple apps e.g. YouTube on iPhone
  • Google Earth, Sketchup, UpdateChecker etc...
  • UP.Browser
  • Windows Media Player, RSS platform etc...
  • Sony Ericsson Mobile Communications
  • SKT, LGT
  • Constructed from UA-CH instead of UserAgent string.
typestring
googleToolbarVersion
descriptionVersion number of GoogleToolbar, if installed. Applies only to MSIE and Firefox at this time.
typestring
javaConfiguration
descriptionMobile specific: e.g. Configuration/CLDC-1.1
typestring
javaConfigurationVersion
typestring
javaProfile
descriptionMobile specific: e.g. Profile/MIDP-2.0
typestring
javaProfileVersion
typestring
locale
descriptionLocale in which the browser is running as country code and optionally language pair. Unavailable with reduced User-Agent and no client hints (go/ua-reduction-ua-string-reference).
typestring
messaging
descriptionMobile specific: e.g. MMP/2.0
typestring
messagingVersion
typestring
os
descriptionFull name of the operating system e.g. "Darwin/9.7.0", "Android 1.5", "Windows 98" Version is reduced, and other data might also be missing, for reduced User-Agent and no client hints (go/ua-reduction-ua-string-reference).
typestring
osVariant
descriptionExtra qualifier for the OS e.g. "(i386)", "Build/CUPCAKE", "PalmSource/Palm-D061" Unavailable with reduced User-Agent and no client hints (go/ua-reduction-ua-string-reference).
typestring
platform
descriptionThe platform describes the environment in which the browser or app runs. For desktop user agents, Platform is a string describing the OS family e.g. Windows, Macintosh, Linux. For mobile user agents, Platform either describes the OS family (if available) or the hardware maker. e.g. Linux, or HTC, LG, Palm.
typestring
security
descriptionSecurity level reported by user agent, either U, I or N. Unavailable with reduced User-Agent and no client hints (go/ua-reduction-ua-string-reference).
typestring
subFamily
descriptionSub-family identifies individual regexps when a family has more than 1. This is used to generate the right UA string from a protobuf. Examples in the AppleWebKit family: Chrome and Safari. Can also be an arbitrary identifier.
typestring
typeobject
UserError
descriptionThis message exists solely to get the `UserErrorReason` enum to appear in the service discovery document.
idUserError
properties
reason
descriptionThe reason for a specific error that should be shown to the app user.
enum
  • USER_ERROR_REASON_UNSPECIFIED
  • RULE_REFERENCES_OUT_OF_SCOPE
  • RULE_ARCHIVED
  • RULE_STALE_VERSION
  • RULE_ACTIVE
  • RULE_RETROHUNT_RUNNING
  • RULE_LIVE
  • RULE_ALREADY_DISABLED
  • EXPENSIVE_RULE_LARGE_WINDOW
  • RULE_LIMITED_PAUSED
  • REFERENCE_LIST_NOT_FOUND
  • UEBA_RULES_NO_SCOPE
  • RULE_TESTING_INTERVAL_TOO_SHORT
  • SEARCH_CSV_FIELDS_NOT_SUPPORTED
  • INVALID_ARGUMENT_FOR_DASHBOARD_FILTER
  • INVALID_CONFIG_FOR_DASHBOARD_IMPORT
  • RETROHUNT_LIMIT_REACHED
enumDescriptions
  • Do not use this default value.
  • The rule text references resources, such as reference lists, that are out of scope for the rule. Example of an ErrorInfo for this reason: { "reason": "RULE_REFERENCES_OUT_OF_SCOPE", "domain": "chronicle.googleapis.com", "metadata": { "reference_lists": "list_name1,list_name2,list_name3,", } }
  • The rule being operated on (saving or setting run frequency) is archived, and so the operation can't be done.
  • The rule version being operated on is not the latest, and so the operation can't be done.
  • The rule can't be archived because it is live (detecting) and a retrohunt is running.
  • The rule can't be archived because a retrohunt is running against it.
  • The rule can't be archived because it is live (detecting).
  • The rule can't be disabled because is is already disabled.
  • The rule's match time window is too large for its current run frequency.
  • The rule can't be enabled because it has been limited or paused because of high resource use.
  • The list being referred to doesn't exist.
  • UEBA rules may not be assigned a data access scope.
  • The rule's match window is longer than the time range it's being tested over. Returns the match window duration and testing interval duration as metadata labeled `match_window_duration` and `testing_interval_duration`, formatted as Go durations. Example ErrorInfo: { "reason": "RULE_TESTING_INTERVAL_TOO_SHORT", "domain": "chronicle.googleapis.com", "metadata": { "match_window_duration": "24h", "testing_interval_duration": "12h", } }
  • The CSV fields are not supported for download. Returns the unsupported fields as metadata labeled `unsupported_fields`. Example ErrorInfo: { "reason": "SEARCH_CSV_FIELDS_NOT_SUPPORTED", "domain": "chronicle.googleapis.com", "metadata": { "unsupported_fields": "udm.about.security_result.variables,udm.network.http.parsed_user_agent.family", } }
  • Invalid argument for dashboard chart filters. Returns the filter name, filter value, operator, and expected type as metadata labeled `filter_name`, `filter_value`, `operator`, and `expected_type`, respectively. Example ErrorInfo: { "reason": "INVALID_ARGUMENT_FOR_DASHBOARD_FILTER", "domain": "chronicle.googleapis.com", "metadata": { "filter_name": "filter_name", "filter_value": "filter_value", "operater": "operator", "expected_type": "expected_type", } }
  • Invalid config for dashboard import. Example ErrorInfo: { "reason": "INVALID_CONFIG_FOR_DASHBOARD_IMPORT", "domain": "chronicle.googleapis.com", }
  • The user has reached the limit of retrohunts that can be run. Returns the retrohunt limit as metadata labeled `retrohunt_limit`. Example ErrorInfo: { "reason": "RETROHUNT_LIMIT_REACHED", "domain": "chronicle.googleapis.com", "metadata": { "retrohunt_limit": "10", } }
typestring
typeobject
Validity
descriptionDefines certificate's validity period.
idValidity
properties
expiryTime
descriptionExpiry date.
formatgoogle-datetime
typestring
issueTime
descriptionIssue date.
formatgoogle-datetime
typestring
typeobject
Verdict
descriptionDeprecated. Encapsulates the threat verdict provided by human analysts and ML models. These fields are used to model Mandiant sources.
idVerdict
properties
analystVerdict
$refAnalystVerdict
descriptionHuman analyst verdict provided by sources like Mandiant.
neighbourInfluence
descriptionDescribes the neighbour influence of the verdict.
typestring
responseCount
descriptionTotal response count across all sources.
formatint32
typeinteger
sourceCount
descriptionNumber of sources from which intelligence was extracted.
formatint32
typeinteger
verdict
$refProviderMLVerdict
descriptionML Verdict provided by sources like Mandiant.
typeobject
VerdictInfo
descriptionDescribes the threat verdict provided by human analysts and machine learning models. These fields are used to model Mandiant sources.
idVerdictInfo
properties
benignCount
descriptionCount of responses where this IoC was marked as benign.
formatint32
typeinteger
categoryDetails
descriptionTags related to the verdict.
typestring
confidenceScore
descriptionConfidence score of the verdict.
formatint32
typeinteger
globalCustomerCount
descriptionGlobal customer count over the last 30 days
formatint32
typeinteger
globalHitsCount
descriptionGlobal hit count over the last 30 days.
formatint32
typeinteger
iocStats
descriptionList of IoCStats from which the verdict was generated.
items
$refIoCStats
typearray
maliciousCount
descriptionCount of responses where this IoC was marked as malicious.
formatint32
typeinteger
neighbourInfluence
descriptionDescribes the near neighbor influence of the verdict.
typestring
pwn
descriptionWhether one or more Mandiant incident response customers had this indicator in their environment.
typeboolean
pwnFirstTaggedTime
descriptionThe timestamp of the first time a pwn was associated to this entity.
formatgoogle-datetime
typestring
responseCount
descriptionTotal response count across all sources.
formatint32
typeinteger
sourceCount
descriptionNumber of sources from which intelligence was extracted.
formatint32
typeinteger
sourceProvider
descriptionSource provider giving the machine learning verdict.
typestring
verdictResponse
descriptionDetails about the verdict.
enum
  • VERDICT_RESPONSE_UNSPECIFIED
  • MALICIOUS
  • BENIGN
enumDescriptions
  • The default verdict response type.
  • VerdictResponse resulted a threat as malicious.
  • VerdictResponse resulted a threat as benign.
typestring
verdictTime
descriptionTimestamp when the verdict was generated.
formatgoogle-datetime
typestring
verdictType
descriptionType of verdict.
enum
  • VERDICT_TYPE_UNSPECIFIED
  • PROVIDER_ML_VERDICT
  • ANALYST_VERDICT
enumDescriptions
  • Verdict category not specified.
  • MLVerdict result provided from threat providers, like Mandiant. These fields are used to model Mandiant sources.
  • Verdict provided by the human analyst. These fields are used to model Mandiant sources.
typestring
typeobject
Vulnerabilities
descriptionThe Vulnerabilities extension captures details on observed/detected vulnerabilities.
idVulnerabilities
properties
vulnerabilities
descriptionA list of vulnerabilities.
items
$refVulnerability
typearray
typeobject
Vulnerability
descriptionA vulnerability.
idVulnerability
properties
about
$refNoun
descriptionIf the vulnerability is about a specific noun (e.g. executable), then add it here.
cveDescription
descriptionCommon Vulnerabilities and Exposures Description. https://cve.mitre.org/about/faqs.html#what_is_cve_record
typestring
cveId
descriptionCommon Vulnerabilities and Exposures Id. https://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures https://cve.mitre.org/about/faqs.html#what_is_cve_id
typestring
cvssBaseScore
descriptionCVSS Base Score in the range of 0.0 to 10.0. Useful for sorting.
formatfloat
typenumber
cvssVector
descriptionVector of CVSS properties (e.g. "AV:L/AC:H/Au:N/C:N/I:P/A:C") Can be linked to via: https://nvd.nist.gov/vuln-metrics/cvss/v2-calculator
typestring
cvssVersion
descriptionVersion of CVSS Vector/Score.
typestring
description
descriptionDescription of the vulnerability.
typestring
firstFound
descriptionProducts that maintain a history of vuln scans should populate first_found with the time that a scan first detected the vulnerability on this asset.
formatgoogle-datetime
typestring
lastFound
descriptionProducts that maintain a history of vuln scans should populate last_found with the time that a scan last detected the vulnerability on this asset.
formatgoogle-datetime
typestring
name
descriptionName of the vulnerability (e.g. "Unsupported OS Version detected").
typestring
scanEndTime
descriptionIf the vulnerability was discovered during an asset scan, then this field should be populated with the time the scan ended. This field can be left unset if the end time is not available or not applicable.
formatgoogle-datetime
typestring
scanStartTime
descriptionIf the vulnerability was discovered during an asset scan, then this field should be populated with the time the scan started. This field can be left unset if the start time is not available or not applicable.
formatgoogle-datetime
typestring
severity
descriptionThe severity of the vulnerability.
enum
  • UNKNOWN_SEVERITY
  • LOW
  • MEDIUM
  • HIGH
  • CRITICAL
enumDescriptions
  • The default severity level.
  • Low severity.
  • Medium severity.
  • High severity.
  • Critical severity.
typestring
severityDetails
descriptionVendor-specific severity
typestring
vendor
descriptionVendor of scan that discovered vulnerability.
typestring
vendorKnowledgeBaseArticleId
descriptionVendor specific knowledge base article (e.g. "KBXXXXXX" from Microsoft). https://en.wikipedia.org/wiki/Microsoft_Knowledge_Base https://access.redhat.com/knowledgebase
typestring
vendorVulnerabilityId
descriptionVendor specific vulnerability id (e.g. Microsoft security bulletin id).
typestring
typeobject
Watchlist
descriptionA watchlist is a list of entities that allows for bulk operations over the included entities.
idWatchlist
properties
createTime
descriptionOutput only. Time the watchlist was created.
formatgoogle-datetime
readOnlyTrue
typestring
description
descriptionOptional. Description of the watchlist.
typestring
displayName
descriptionRequired. Display name of the watchlist. Note that it must be at least one character and less than 63 characters (https://google.aip.dev/148).
typestring
entityCount
$refEntityCount
descriptionOutput only. Entity count in the watchlist.
readOnlyTrue
entityPopulationMechanism
$refEntityPopulationMechanism
descriptionRequired. Mechanism to populate entities in the watchlist.
multiplyingFactor
descriptionOptional. Weight applied to the risk score for entities in this watchlist. The default is 1.0 if it is not specified.
formatfloat
typenumber
name
descriptionIdentifier. Resource name of the watchlist. Format: projects/{project}/locations/{location}/instances/{instance}/watchlists/{watchlist}
typestring
updateTime
descriptionOutput only. Time the watchlist was last updated.
formatgoogle-datetime
readOnlyTrue
typestring
watchlistUserPreferences
$refWatchlistUserPreferences
descriptionOptional. User preferences for watchlist configuration.
typeobject
WatchlistUserPreferences
descriptionA collection of user preferences for watchlist UI configuration.
idWatchlistUserPreferences
properties
pinned
descriptionOptional. Whether the watchlist is pinned on the dashboard.
typeboolean
typeobject
X509
descriptionFile certificate.
idX509
properties
algorithm
descriptionCertificate algorithm.
typestring
certIssuer
descriptionIssuer of the certificate.
typestring
name
descriptionCertificate name.
typestring
serialNumber
descriptionCertificate serial number.
typestring
thumbprint
descriptionCertificate thumbprint.
typestring
typeobject
old_value
CancelOperationRequest
descriptionThe request message for Operations.CancelOperation.
idCancelOperationRequest
properties
typeobject
CompilationDiagnostic
descriptionCompilationDiagnostic represents a compilation diagnostic generated during a rule's compilation, such as a compilation error or a compilation warning.
idCompilationDiagnostic
properties
message
descriptionOutput only. The diagnostic message.
readOnlyTrue
typestring
position
$refCompilationPosition
descriptionOutput only. The approximate position in the rule text associated with the compilation diagnostic. Compilation Position may be empty.
readOnlyTrue
severity
descriptionOutput only. The severity of a rule's compilation diagnostic.
enum
  • SEVERITY_UNSPECIFIED
  • WARNING
  • ERROR
enumDescriptions
  • An unspecified severity level.
  • A compilation warning.
  • A compilation error.
readOnlyTrue
typestring
uri
descriptionOutput only. Link to documentation that describes a diagnostic in more detail.
readOnlyTrue
typestring
typeobject
CompilationPosition
descriptionCompilationPosition represents the location of a compilation diagnostic in rule text.
idCompilationPosition
properties
endColumn
descriptionOutput only. End column number, beginning at 1.
formatint32
readOnlyTrue
typeinteger
endLine
descriptionOutput only. End line number, beginning at 1.
formatint32
readOnlyTrue
typeinteger
startColumn
descriptionOutput only. Start column number, beginning at 1.
formatint32
readOnlyTrue
typeinteger
startLine
descriptionOutput only. Start line number, beginning at 1.
formatint32
readOnlyTrue
typeinteger
typeobject
CreateParserExtensionMetadata
descriptionOperation metadata for creating a parser extension.
idCreateParserExtensionMetadata
properties
state
descriptionThe state of the parser extension creation process.
enum
  • STATE_UNSPECIFIED
  • NEW
  • VALIDATING
  • LIVE
  • REJECTED
  • INTERNAL_ERROR
  • VALIDATED
  • ARCHIVED
enumDescriptions
  • The state for this parser extension was not specified.
  • The parser extension has been newly submitted and is waiting to be validated.
  • The parser extension is currently going through the validation pipeline.
  • The parser extension is live in production. Only configs that have successfully passed the validation stage will be set to LIVE.
  • Validation completed, but the parser extension was rejected with errors.
  • An error occurred when processing this parser extension.
  • Extension is validated.
  • Extension is archived and is no more being used.
typestring
stateLastChangedTime
descriptionThe time the config state was last changed.
formatgoogle-datetime
typestring
validationErrors
descriptionAny validation error while validating the extension, this have cap of size 10
items
typestring
typearray
validationReport
descriptionThe validation report generated during validation of the parser extension.
typestring
typeobject
CreateParserMetadata
descriptionOperation metadata for creating a parser.
idCreateParserMetadata
properties
stage
descriptionThe validation stage of the parser creation process.
enum
  • VALIDATION_STAGE_UNSPECIFIED
  • NEW
  • VALIDATING
  • PASSED
  • FAILED
  • DELETE_CANDIDATE
enumDescriptions
  • The validation stage is not specified.
  • The custom parser is submitted for validation.
  • The custom parser is currently going through the validation pipeline
  • The custom parser has successfully passed the validation.
  • The custom parser has failed validation.
  • The parser is no good, It is available for auto deletion.
typestring
validationReport
descriptionThe validation report generated during validation of the parser.
typestring
typeobject
DataAccessLabel
descriptionA DataAccessLabel is a label on events to define user access to data.
idDataAccessLabel
properties
author
descriptionOutput only. The user who created the data access label.
readOnlyTrue
typestring
createTime
descriptionOutput only. The time at which the data access label was created.
formatgoogle-datetime
readOnlyTrue
typestring
description
descriptionOptional. A description of the data access label for a human reader.
typestring
displayName
descriptionOutput only. The short name displayed for the label as it appears on event data.
readOnlyTrue
typestring
lastEditor
descriptionOutput only. The user who last updated the data access label.
readOnlyTrue
typestring
name
descriptionRequired. The unique resource name of the data access label.
typestring
udmQuery
descriptionA UDM query over event data.
typestring
updateTime
descriptionOutput only. The time at which the data access label was last updated.
formatgoogle-datetime
readOnlyTrue
typestring
typeobject
DataAccessLabelReference
descriptionReference object to a data access label.
idDataAccessLabelReference
properties
assetNamespace
descriptionThe asset namespace configured in the forwarder of the customer's events.
typestring
dataAccessLabel
descriptionThe name of the data access label.
typestring
displayName
descriptionOutput only. The display name of the label. Data access label and log types's name will match the display name of the resource. The asset namespace will match the namespace itself. The ingestion key value pair will match the key of the tuple.
readOnlyTrue
typestring
ingestionLabel
$refIngestionLabel
descriptionThe ingestion label configured in the forwarder of the customer's events.
logType
descriptionThe name of the log type.
typestring
typeobject
DataAccessScope
descriptionA DataAccessScope is a boolean expression of data access labels used to restrict access to data for users.
idDataAccessScope
properties
allowAll
descriptionOptional. Whether or not the scope allows all labels, allow_all and allowed_data_access_labels are mutually exclusive and one of them must be present. denied_data_access_labels can still be used along with allow_all. When combined with denied_data_access_labels, access will be granted to all data that doesn't have labels mentioned in denied_data_access_labels. E.g.: A customer with scope with denied labels A and B and allow_all will be able to see all data except data labeled with A and data labeled with B and data with labels A and B.
typeboolean
allowedDataAccessLabels
descriptionOptional. The allowed labels for the scope. Either allow_all or allowed_data_access_labels needs to be provided. When provided, there has to be at least one label allowed for the scope to be valid. The logical operator for evaluation of the allowed labels is OR. E.g.: A customer with scope with allowed labels A and B will be able to see data with labeled with A or B or (A and B).
items
$refDataAccessLabelReference
typearray
author
descriptionOutput only. The user who created the data access scope.
readOnlyTrue
typestring
createTime
descriptionOutput only. The time at which the data access scope was created.
formatgoogle-datetime
readOnlyTrue
typestring
deniedDataAccessLabels
descriptionOptional. The denied labels for the scope. The logical operator for evaluation of the denied labels is AND. E.g.: A customer with scope with denied labels A and B won't be able to see data labeled with A and data labeled with B and data with labels A and B.
items
$refDataAccessLabelReference
typearray
description
descriptionOptional. A description of the data access scope for a human reader.
typestring
displayName
descriptionOutput only. The name to be used for display to customers of the data access scope.
readOnlyTrue
typestring
lastEditor
descriptionOutput only. The user who last updated the data access scope.
readOnlyTrue
typestring
name
descriptionRequired. The unique full name of the data access scope. The name should comply with https://google.aip.dev/122 standards.
typestring
updateTime
descriptionOutput only. The time at which the data access scope was last updated.
formatgoogle-datetime
readOnlyTrue
typestring
typeobject
Empty
descriptionA generic empty message that you can re-use to avoid defining duplicated empty messages in your APIs. A typical example is to use it as the request or the response type of an API method. For instance: service Foo { rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty); }
idEmpty
properties
typeobject
EntityCount
descriptionCount of different types of entities in the watchlist.
idEntityCount
properties
asset
descriptionOutput only. Count of asset type entities in the watchlist.
formatint32
readOnlyTrue
typeinteger
user
descriptionOutput only. Count of user type entities in the watchlist.
formatint32
readOnlyTrue
typeinteger
typeobject
EntityPopulationMechanism
descriptionMechanism to populate entities in the watchlist.
idEntityPopulationMechanism
properties
manual
$refManual
descriptionOptional. Entities are added manually.
typeobject
IngestionLabel
descriptionRepresentation of an ingestion label type.
idIngestionLabel
properties
ingestionLabelKey
descriptionRequired. The key of the ingestion label. Always required.
typestring
ingestionLabelValue
descriptionOptional. The value of the ingestion label. Optional. An object with no provided value and some key provided would match against the given key and ANY value.
typestring
typeobject
InputsUsed
descriptionInputsUsed is a convenience field that tells us which sources of events (if any) were used in the rule. NEXT TAG: 4
idInputsUsed
properties
usesDetection
descriptionOptional. Whether the rule queries detections.
typeboolean
usesEntity
descriptionOptional. Whether the rule queries entity events.
typeboolean
usesUdm
descriptionOptional. Whether the rule queries UDM events.
typeboolean
typeobject
Instance
descriptionA Instance represents an instantiation of the Instance product.
idInstance
properties
name
descriptionOutput only. The resource name of this instance. Format: projects/{project}/locations/{region}/instances/{instance}
readOnlyTrue
typestring
typeobject
Interval
descriptionRepresents a time interval, encoded as a Timestamp start (inclusive) and a Timestamp end (exclusive). The start must be less than or equal to the end. When the start equals the end, the interval is empty (matches no time). When both start and end are unspecified, the interval matches any time.
idInterval
properties
endTime
descriptionOptional. Exclusive end of the interval. If specified, a Timestamp matching this interval will have to be before the end.
formatgoogle-datetime
typestring
startTime
descriptionOptional. Inclusive start of the interval. If specified, a Timestamp matching this interval will have to be the same or after the start.
formatgoogle-datetime
typestring
typeobject
ListDataAccessLabelsResponse
descriptionResponse message for ListDataAccessLabels.
idListDataAccessLabelsResponse
properties
dataAccessLabels
descriptionList of data access labels.
items
$refDataAccessLabel
typearray
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
typeobject
ListDataAccessScopesResponse
descriptionResponse message for ListDataAccessScopes.
idListDataAccessScopesResponse
properties
dataAccessScopes
descriptionList of data access scopes.
items
$refDataAccessScope
typearray
globalDataAccessScopeGranted
descriptionWhether or not global scope is granted to the user.
typeboolean
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
typeobject
ListOperationsResponse
descriptionThe response message for Operations.ListOperations.
idListOperationsResponse
properties
nextPageToken
descriptionThe standard List next-page token.
typestring
operations
descriptionA list of operations that matches the specified filter in the request.
items
$refOperation
typearray
typeobject
ListReferenceListsResponse
descriptionA response to a request for a list of reference lists.
idListReferenceListsResponse
properties
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
referenceLists
descriptionThe reference lists. Ordered in ascending alphabetical order by name.
items
$refReferenceList
typearray
typeobject
ListRetrohuntsResponse
descriptionResponse message for ListRetrohunts method.
idListRetrohuntsResponse
properties
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
retrohunts
descriptionThe retrohunts from the specified rule.
items
$refRetrohunt
typearray
typeobject
ListRuleDeploymentsResponse
descriptionResponse message for ListRuleDeployments.
idListRuleDeploymentsResponse
properties
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
ruleDeployments
descriptionThe rule deployments from all rules.
items
$refRuleDeployment
typearray
typeobject
ListRuleRevisionsResponse
descriptionResponse message for ListRuleRevisions method.
idListRuleRevisionsResponse
properties
nextPageToken
descriptionA token that can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
rules
descriptionThe revisions of the rule.
items
$refRule
typearray
typeobject
ListRulesResponse
descriptionResponse message for ListRules method.
idListRulesResponse
properties
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
rules
descriptionThe rules from the specified instance.
items
$refRule
typearray
typeobject
ListWatchlistsResponse
descriptionResponse message for listing watchlists.
idListWatchlistsResponse
properties
nextPageToken
descriptionOptional. A token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
watchlists
descriptionOptional. The watchlists from the specified instance.
items
$refWatchlist
typearray
typeobject
Manual
descriptionEntities are added manually.
idManual
properties
typeobject
Operation
descriptionThis resource represents a long-running operation that is the result of a network API call.
idOperation
properties
done
descriptionIf the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available.
typeboolean
error
$refStatus
descriptionThe error result of the operation in case of failure or cancellation.
metadata
additionalProperties
descriptionProperties of the object. Contains field @type with type URL.
typeany
descriptionService-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any.
typeobject
name
descriptionThe server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`.
typestring
response
additionalProperties
descriptionProperties of the object. Contains field @type with type URL.
typeany
descriptionThe normal, successful response of the operation. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`.
typeobject
typeobject
ReferenceList
descriptionA reference list. Reference lists are user-defined lists of values which users can use in multiple Rules.
idReferenceList
properties
description
descriptionRequired. A user-provided description of the reference list.
typestring
displayName
descriptionOutput only. The unique display name of the reference list.
readOnlyTrue
typestring
entries
descriptionRequired. The entries of the reference list. When listed, they are returned in the order that was specified at creation or update. The combined size of the values of the reference list may not exceed 6MB. This is returned only when the view is REFERENCE_LIST_VIEW_FULL.
items
$refReferenceListEntry
typearray
name
descriptionOutput only. The resource name of the reference list. Format: projects/{project}/locations/{location}/instances/{instance}/referenceLists/{reference_list}
readOnlyTrue
typestring
revisionCreateTime
descriptionOutput only. The timestamp when the reference list was last updated.
formatgoogle-datetime
readOnlyTrue
typestring
ruleAssociationsCount
descriptionOutput only. The count of self-authored rules using the reference list.
formatint32
readOnlyTrue
typeinteger
rules
descriptionOutput only. The resource names for the associated self-authored Rules that use this reference list. This is returned only when the view is REFERENCE_LIST_VIEW_FULL.
items
typestring
readOnlyTrue
typearray
scopeInfo
$refScopeInfo
descriptionOutput only. The scope info of the reference list. During reference list creation, if this field is not set, the reference list without scopes (an unscoped list) will be created for an unscoped user. For a scoped user, this field must be set. During reference list update, if scope_info is requested to be updated, this field must be set.
readOnlyTrue
syntaxType
descriptionRequired. The syntax type indicating how list entries should be validated.
enum
  • REFERENCE_LIST_SYNTAX_TYPE_UNSPECIFIED
  • REFERENCE_LIST_SYNTAX_TYPE_PLAIN_TEXT_STRING
  • REFERENCE_LIST_SYNTAX_TYPE_REGEX
  • REFERENCE_LIST_SYNTAX_TYPE_CIDR
enumDescriptions
  • Defaults to REFERENCE_LIST_SYNTAX_TYPE_PLAIN_TEXT_STRING.
  • List contains plain text patterns.
  • List contains only Regular Expression patterns.
  • List contains only CIDR patterns.
typestring
typeobject
ReferenceListEntry
descriptionAn entry in a reference list.
idReferenceListEntry
properties
value
descriptionRequired. The value of the entry. Maximum length is 512 characters.
typestring
typeobject
ReferenceListScope
descriptionReferenceListScope specifies the list of scope names of the reference list.
idReferenceListScope
properties
scopeNames
descriptionOptional. The list of scope names of the reference list. The scope names should be full resource names and should be of the format: "projects/{project}/locations/{location}/instances/{instance}/dataAccessScopes/{scope_name}".
items
typestring
typearray
typeobject
Retrohunt
descriptionRetrohunt is an execution of a Rule over a time range in the past.
idRetrohunt
properties
executionInterval
$refInterval
descriptionOutput only. The start and end time of the retrohunt execution. If the retrohunt is not yet finished, the end time of the interval will not be populated.
readOnlyTrue
name
descriptionThe resource name of the retrohunt. Retrohunt is the child of a rule revision. {rule} in the format below is structured as {rule_id@revision_id}. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}/retrohunts/{retrohunt}
typestring
processInterval
$refInterval
descriptionRequired. The start and end time of the event time range this retrohunt processes.
progressPercentage
descriptionOutput only. Percent progress of the retrohunt towards completion, from 0.00 to 100.00.
formatfloat
readOnlyTrue
typenumber
state
descriptionOutput only. The state of the retrohunt.
enum
  • STATE_UNSPECIFIED
  • RUNNING
  • DONE
  • CANCELLED
  • FAILED
enumDescriptions
  • Unspecified or unknown retrohunt state.
  • Running state.
  • Done state.
  • Cancelled state.
  • Failed state.
readOnlyTrue
typestring
typeobject
RetrohuntMetadata
descriptionOperation Metadata for Retrohunts.
idRetrohuntMetadata
properties
executionInterval
$refInterval
descriptionThe start and end time of the retrohunt execution. If the retrohunt is not yet finished, the end time of the interval will not be filled.
progressPercentage
descriptionPercent progress of the retrohunt towards completion, from 0.00 to 100.00.
formatfloat
typenumber
retrohunt
descriptionThe name of the retrohunt. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}/retrohunts/{retrohunt}
typestring
typeobject
Rule
descriptionThe Rule resource represents a user-created rule. NEXT TAG: 21
idRule
properties
allowedRunFrequencies
descriptionOutput only. The run frequencies that are allowed for the rule. Populated in BASIC view and FULL view.
items
enum
  • RUN_FREQUENCY_UNSPECIFIED
  • LIVE
  • HOURLY
  • DAILY
enumDescriptions
  • The run frequency is unspecified/unknown.
  • Executes in real time.
  • Executes once per hour.
  • Executes once per day.
typestring
readOnlyTrue
typearray
author
descriptionOutput only. The author of the rule. Extracted from the meta section of text. Populated in BASIC view and FULL view.
readOnlyTrue
typestring
compilationDiagnostics
descriptionOutput only. A list of a rule's corresponding compilation diagnostic messages such as compilation errors and compilation warnings. Populated in FULL view.
items
$refCompilationDiagnostic
readOnlyTrue
typearray
compilationState
descriptionOutput only. The current compilation state of the rule. Populated in FULL view.
enum
  • COMPILATION_STATE_UNSPECIFIED
  • SUCCEEDED
  • FAILED
enumDescriptions
  • The compilation state is unspecified/unknown.
  • The Rule can successfully compile.
  • The Rule cannot successfully compile. This is possible if a backwards-incompatible change was made to the compiler.
readOnlyTrue
typestring
createTime
descriptionOutput only. The timestamp of when the rule was created. Populated in FULL view.
formatgoogle-datetime
readOnlyTrue
typestring
dataTables
descriptionOutput only. Resource names of the data tables used in this rule.
items
typestring
readOnlyTrue
typearray
displayName
descriptionOutput only. Display name of the rule. Populated in BASIC view and FULL view.
readOnlyTrue
typestring
etag
descriptionThe etag for this rule. If this is provided on update, the request will succeed if and only if it matches the server-computed value, and will fail with an ABORTED error otherwise. Populated in BASIC view and FULL view.
typestring
inputsUsed
$refInputsUsed
descriptionOutput only. The set of inputs used in the rule. For example, if the rule uses $e.principal.hostname, then the uses_udm field will be true.
readOnlyTrue
metadata
additionalProperties
typestring
descriptionOutput only. Additional metadata specified in the meta section of text. Populated in FULL view.
readOnlyTrue
typeobject
name
descriptionFull resource name for the rule. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}
typestring
nearRealTimeLiveRuleEligible
descriptionOutput only. Indicate the rule can run in near real time live rule. If this is true, the rule uses the near real time live rule when the run frequency is set to LIVE.
readOnlyTrue
typeboolean
referenceLists
descriptionOutput only. Resource names of the reference lists used in this rule. Populated in FULL view.
items
typestring
readOnlyTrue
typearray
revisionCreateTime
descriptionOutput only. The timestamp of when the rule revision was created. Populated in FULL, REVISION_METADATA_ONLY views.
formatgoogle-datetime
readOnlyTrue
typestring
revisionId
descriptionOutput only. The revision ID of the rule. A new revision is created whenever the rule text is changed in any way. Format: v_{10 digits}_{9 digits} Populated in REVISION_METADATA_ONLY view and FULL view.
readOnlyTrue
typestring
scope
descriptionResource name of the DataAccessScope bound to this rule. Populated in BASIC view and FULL view. If reference lists are used in the rule, validations will be performed against this scope to ensure that the reference lists are compatible with both the user's and the rule's scopes. The scope should be in the format: "projects/{project}/locations/{location}/instances/{instance}/dataAccessScopes/{scope}".
typestring
severity
$refSeverity
descriptionOutput only. The severity of the rule as specified in the meta section of text. Populated in BASIC view and FULL view.
readOnlyTrue
text
descriptionThe YARA-L content of the rule. Populated in FULL view.
typestring
type
descriptionOutput only. User-facing type of the rule. Extracted from the events section of rule text. Populated in BASIC view and FULL view.
enum
  • RULE_TYPE_UNSPECIFIED
  • SINGLE_EVENT
  • MULTI_EVENT
enumDescriptions
  • The rule type is unspecified/unknown.
  • Rule checks for the existence of a single event.
  • Rule checks for correlation between multiple events
readOnlyTrue
typestring
typeobject
RuleDeployment
descriptionThe RuleDeployment resource represents the deployment state of a Rule.
idRuleDeployment
properties
alerting
descriptionWhether detections resulting from this deployment should be considered alerts.
typeboolean
archiveTime
descriptionOutput only. The timestamp when the rule deployment archive state was last set to true. If the rule deployment's current archive state is not set to true, the field will be empty.
formatgoogle-datetime
readOnlyTrue
typestring
archived
descriptionThe archive state of the rule deployment. Cannot be set to true unless enabled is set to false. If set to true, alerting will automatically be set to false. If currently set to true, enabled, alerting, and run_frequency cannot be updated.
typeboolean
consumerRules
descriptionOutput only. The names of the associated/chained consumer rules. Rules are considered consumers of this rule if their rule text explicitly filters on this rule's ruleid. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}
items
typestring
readOnlyTrue
typearray
enabled
descriptionWhether the rule is currently deployed continuously against incoming data.
typeboolean
executionState
descriptionOutput only. The execution state of the rule deployment.
enum
  • EXECUTION_STATE_UNSPECIFIED
  • DEFAULT
  • LIMITED
  • PAUSED
enumDescriptions
  • Unspecified or unknown execution state.
  • Default execution state.
  • Rules in limited state may not have their executions guaranteed.
  • Paused rules are not executed at all.
readOnlyTrue
typestring
lastAlertStatusChangeTime
descriptionOutput only. The timestamp when the rule deployment alert state was lastly changed. This is filled regardless of the current alert state. E.g. if the current alert status is false, this timestamp will be the timestamp when the alert status was changed to false.
formatgoogle-datetime
readOnlyTrue
typestring
name
descriptionRequired. The resource name of the rule deployment. Note that RuleDeployment is a child of the overall Rule, not any individual revision, so the resource ID segment for the Rule resource must not reference a specific revision. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}/deployment
typestring
producerRules
descriptionOutput only. The names of the associated/chained producer rules. Rules are considered producers for this rule if this rule explicitly filters on their ruleid. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}
items
typestring
readOnlyTrue
typearray
runFrequency
descriptionThe run frequency of the rule deployment.
enum
  • RUN_FREQUENCY_UNSPECIFIED
  • LIVE
  • HOURLY
  • DAILY
enumDescriptions
  • The run frequency is unspecified/unknown.
  • Executes in real time.
  • Executes once per hour.
  • Executes once per day.
typestring
typeobject
ScopeInfo
descriptionScopeInfo specifies the scope info of the reference list.
idScopeInfo
properties
referenceListScope
$refReferenceListScope
descriptionRequired. The list of scope names of the reference list, if the list is empty the reference list is treated as unscoped.
typeobject
Severity
descriptionSeverity represents the severity level of the rule.
idSeverity
properties
displayName
descriptionThe display name of the severity level. Extracted from the meta section of the rule text.
typestring
typeobject
Status
descriptionThe `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors).
idStatus
properties
code
descriptionThe status code, which should be an enum value of google.rpc.Code.
formatint32
typeinteger
details
descriptionA list of messages that carry the error details. There is a common set of message types for APIs to use.
items
additionalProperties
descriptionProperties of the object. Contains field @type with type URL.
typeany
typeobject
typearray
message
descriptionA developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
typestring
typeobject
UdmSearchOperationMetadata
descriptionInformation about a UDM Search operation. This message is used to populate the `metadata` field of `Operation` resources created by UDM Search.
idUdmSearchOperationMetadata
properties
baselineEventsCount
descriptionThe number of events matching the baseline query so far.
formatint32
typeinteger
baselineQuery
descriptionQuery used to search for events.
typestring
baselineTimeRange
$refInterval
descriptionThe time range used for the baseline query [inclusive start time, exclusive end time).
caseInsensitive
descriptionIf true, the search was performed in a case-insensitive manner.
typeboolean
endTime
descriptionThe end time of the operation, if done.
formatgoogle-datetime
typestring
expireTime
descriptionThe time when the operation results expire. This time may change while the operation is in progress. If unset, the results never expire.
formatgoogle-datetime
typestring
filteredEventsCount
descriptionThe number of events matching the snapshot query so far. This is <= `baseline_events_count`. If the snapshot query is empty, this will be equal to `baseline_events_count`.
formatint32
typeinteger
progress
descriptionA value from 0 to 1 representing the progress of the operation.
formatdouble
typenumber
snapshotQuery
descriptionQuery used to filter the baseline query's events.
typestring
snapshotTimeRange
$refInterval
descriptionTime range used to filter the baseline query's events [inclusive start time, exclusive end time). This time range is completely within `baseline_time_range`. If not set, it is assumed to match `baseline_time_range`.
startTime
descriptionThe start time of the operation.
formatgoogle-datetime
typestring
statsRowsCount
descriptionThe total number of rows returned for a stats query.
formatint32
typeinteger
typeobject
UserError
descriptionThis message exists solely to get the `UserErrorReason` enum to appear in the service discovery document.
idUserError
properties
reason
descriptionThe reason for a specific error that should be shown to the app user.
enum
  • USER_ERROR_REASON_UNSPECIFIED
  • RULE_REFERENCES_OUT_OF_SCOPE
  • RULE_ARCHIVED
  • RULE_STALE_VERSION
  • RULE_ACTIVE
  • RULE_RETROHUNT_RUNNING
  • RULE_LIVE
  • RULE_ALREADY_DISABLED
  • EXPENSIVE_RULE_LARGE_WINDOW
  • RULE_LIMITED_PAUSED
  • REFERENCE_LIST_NOT_FOUND
  • UEBA_RULES_NO_SCOPE
  • RULE_TESTING_INTERVAL_TOO_SHORT
  • SEARCH_CSV_FIELDS_NOT_SUPPORTED
  • INVALID_ARGUMENT_FOR_DASHBOARD_FILTER
  • INVALID_CONFIG_FOR_DASHBOARD_IMPORT
  • RETROHUNT_LIMIT_REACHED
enumDescriptions
  • Do not use this default value.
  • The rule text references resources, such as reference lists, that are out of scope for the rule. Example of an ErrorInfo for this reason: { "reason": "RULE_REFERENCES_OUT_OF_SCOPE", "domain": "chronicle.googleapis.com", "metadata": { "reference_lists": "list_name1,list_name2,list_name3,", } }
  • The rule being operated on (saving or setting run frequency) is archived, and so the operation can't be done.
  • The rule version being operated on is not the latest, and so the operation can't be done.
  • The rule can't be archived because it is live (detecting) and a retrohunt is running.
  • The rule can't be archived because a retrohunt is running against it.
  • The rule can't be archived because it is live (detecting).
  • The rule can't be disabled because is is already disabled.
  • The rule's match time window is too large for its current run frequency.
  • The rule can't be enabled because it has been limited or paused because of high resource use.
  • The list being referred to doesn't exist.
  • UEBA rules may not be assigned a data access scope.
  • The rule's match window is longer than the time range it's being tested over. Returns the match window duration and testing interval duration as metadata labeled `match_window_duration` and `testing_interval_duration`, formatted as Go durations. Example ErrorInfo: { "reason": "RULE_TESTING_INTERVAL_TOO_SHORT", "domain": "chronicle.googleapis.com", "metadata": { "match_window_duration": "24h", "testing_interval_duration": "12h", } }
  • The CSV fields are not supported for download. Returns the unsupported fields as metadata labeled `unsupported_fields`. Example ErrorInfo: { "reason": "SEARCH_CSV_FIELDS_NOT_SUPPORTED", "domain": "chronicle.googleapis.com", "metadata": { "unsupported_fields": "udm.about.security_result.variables,udm.network.http.parsed_user_agent.family", } }
  • Invalid argument for dashboard chart filters. Returns the filter name, filter value, operator, and expected type as metadata labeled `filter_name`, `filter_value`, `operator`, and `expected_type`, respectively. Example ErrorInfo: { "reason": "INVALID_ARGUMENT_FOR_DASHBOARD_FILTER", "domain": "chronicle.googleapis.com", "metadata": { "filter_name": "filter_name", "filter_value": "filter_value", "operater": "operator", "expected_type": "expected_type", } }
  • Invalid config for dashboard import. Example ErrorInfo: { "reason": "INVALID_CONFIG_FOR_DASHBOARD_IMPORT", "domain": "chronicle.googleapis.com", }
  • The user has reached the limit of retrohunts that can be run. Returns the retrohunt limit as metadata labeled `retrohunt_limit`. Example ErrorInfo: { "reason": "RETROHUNT_LIMIT_REACHED", "domain": "chronicle.googleapis.com", "metadata": { "retrohunt_limit": "10", } }
typestring
typeobject
Watchlist
descriptionA watchlist is a list of entities that allows for bulk operations over the included entities.
idWatchlist
properties
createTime
descriptionOutput only. Time the watchlist was created.
formatgoogle-datetime
readOnlyTrue
typestring
description
descriptionOptional. Description of the watchlist.
typestring
displayName
descriptionRequired. Display name of the watchlist. Note that it must be at least one character and less than 63 characters (https://google.aip.dev/148).
typestring
entityCount
$refEntityCount
descriptionOutput only. Entity count in the watchlist.
readOnlyTrue
entityPopulationMechanism
$refEntityPopulationMechanism
descriptionRequired. Mechanism to populate entities in the watchlist.
multiplyingFactor
descriptionOptional. Weight applied to the risk score for entities in this watchlist. The default is 1.0 if it is not specified.
formatfloat
typenumber
name
descriptionIdentifier. Resource name of the watchlist. Format: projects/{project}/locations/{location}/instances/{instance}/watchlists/{watchlist}
typestring
updateTime
descriptionOutput only. Time the watchlist was last updated.
formatgoogle-datetime
readOnlyTrue
typestring
watchlistUserPreferences
$refWatchlistUserPreferences
descriptionOptional. User preferences for watchlist configuration.
typeobject
WatchlistUserPreferences
descriptionA collection of user preferences for watchlist UI configuration.
idWatchlistUserPreferences
properties
pinned
descriptionOptional. Whether the watchlist is pinned on the dashboard.
typeboolean
typeobject
prod/eu-chronicle-v1alpha
dictionary_item_added
  • root['resources']['projects']['resources']['locations']['resources']['instances']['methods']['delete']
  • root['resources']['projects']['resources']['locations']['resources']['instances']['methods']['undelete']
  • root['resources']['projects']['resources']['locations']['resources']['instances']['resources']['legacy']['methods']['legacyCreateOrUpdateCase']
  • root['resources']['projects']['resources']['locations']['resources']['instances']['resources']['legacy']['methods']['legacyCreateSoarAlert']
  • root['schemas']['GoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStats']
  • root['schemas']['GoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnData']
  • root['schemas']['GoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnSort']
  • root['schemas']['GoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnType']
  • root['schemas']['GoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnTypeList']
  • root['schemas']['GoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnValue']
  • root['schemas']['GoogleCloudStorageEventDrivenSettings']
  • root['schemas']['InstanceUdmSearchResponse']
  • root['schemas']['LegacyCreateOrUpdateCaseRequest']
  • root['schemas']['LegacyCreateSoarAlertRequest']
  • root['schemas']['LegacyFederatedUdmSearchViewResponse']
  • root['schemas']['LegacySoarAlert']
  • root['schemas']['SQSV2AccessKeySecretAuth']
  • root['schemas']['SoarEvent']
  • root['schemas']['UndeleteInstanceRequest']
  • root['schemas']['BackstoryFile']['properties']['symhash']
  • root['schemas']['ColumnMetadata']['properties']['latitude']
  • root['schemas']['ColumnMetadata']['properties']['longitude']
  • root['schemas']['EntityRisk']['properties']['riskWindowHasNewDetections']
  • root['schemas']['Extensions']['properties']['entityRisk']
  • root['schemas']['FeedDetails']['properties']['googleCloudStorageEventDrivenSettings']
  • root['schemas']['Instance']['properties']['customerCode']
  • root['schemas']['Instance']['properties']['deleteTime']
  • root['schemas']['Instance']['properties']['purgeTime']
  • root['schemas']['Instance']['properties']['wipeoutStatus']
  • root['schemas']['SQSAuthV2']['properties']['sqsV2AccessKeySecretAuth']
dictionary_item_removed
  • root['resources']['projects']['resources']['locations']['resources']['instances']['resources']['findings']
  • root['schemas']['FetchSimilarFindingsResponse']
  • root['schemas']['OmniflowAmazonS3Settings']
  • root['schemas']['OmniflowAmazonSQSSettings']
  • root['schemas']['OmniflowGoogleCloudStorageSettings']
  • root['schemas']['OmniflowS3Auth']
  • root['schemas']['FeedDetails']['properties']['omniflowAmazonS3Settings']
  • root['schemas']['FeedDetails']['properties']['omniflowAmazonSqsSettings']
  • root['schemas']['FeedDetails']['properties']['omniflowGcsSettings']
  • root['schemas']['FeedDetails']['properties']['feedSourceType']['enumDeprecated']
  • root['schemas']['FeedSourceTypeSchema']['properties']['feedSourceType']['enumDeprecated']
  • root['schemas']['PackLogType']['properties']['recommendedSourceType']['enumDeprecated']
values_changed
root['resources']['projects']['resources']['locations']['resources']['instances']['methods']['generateCollectionAgentAuth']['parameters']['name']['description']
new_valueRequired. The name of the chronicle instance to generate a collection agent auth json file for. Format: projects/{project_id}/locations/{location}/instances/{instance}
old_valueRequired. The name of the chronicle instance to generate a collection agent auth json file for. Format: projects/{project_id}/locations/{region}/instances/{instance}
root['resources']['projects']['resources']['locations']['resources']['instances']['methods']['generateSoarAuthJwt']['parameters']['name']['description']
new_valueRequired. The name of the chronicle instance to retrieve a report for. Format: projects/{project_id}/locations/{location}/instances/{instance}
old_valueRequired. The name of the chronicle instance to retrieve a report for. Format: projects/{project_id}/locations/{region}/instances/{instance}
root['resources']['projects']['resources']['locations']['resources']['instances']['methods']['generateWorkspaceConnectionToken']['parameters']['name']['description']
new_valueRequired. The name of the chronicle instance to create workspace token for. Format: projects/{project_id}/locations/{location}/instances/{instance}
old_valueRequired. The name of the chronicle instance to create workspace token for. Format: projects/{project_id}/locations/{region}/instances/{instance}
root['resources']['projects']['resources']['locations']['resources']['instances']['methods']['get']['parameters']['name']['description']
new_valueRequired. The name of the instance to retrieve. Format: projects/{project_id}/locations/{location}/instances/{instance}
old_valueRequired. The name of the instance to retrieve. Format: projects/{project_id}/locations/{region}/instances/{instance}
root['resources']['projects']['resources']['locations']['resources']['instances']['methods']['report']['parameters']['name']['description']
new_valueRequired. The name of the chronicle instance to retrieve a report for. Format: projects/{project_id}/locations/{location}/instances/{instance}
old_valueRequired. The name of the chronicle instance to retrieve a report for. Format: projects/{project_id}/locations/{region}/instances/{instance}
root['resources']['projects']['resources']['locations']['resources']['instances']['resources']['legacy']['methods']['legacyBatchGetCases']['parameters']['instance']['description']
new_valueRequired. Chronicle instance this request is sent to. Format: projects/{project}/locations/{location}/instances/{instance}/legacy
old_valueChronicle instance this request is sent to. Format: projects/{project}/locations/{location}/instances/{instance}/legacy
root['revision']
new_value20250310
old_value20250227
root['schemas']['EntityRisk']['description']
new_valueStores information related to the risk score of an entity. Next ID: 15
old_valueStores information related to the risk score of an entity. Next ID: 14
root['schemas']['EntityRisk']['properties']['riskWindowSize']['description']
new_valueRisk window duration for the entity.
old_valueRisk window duration for the Entity.
root['schemas']['Instance']['properties']['name']['description']
new_valueOutput only. The resource name of this instance. Format: projects/{project}/locations/{location}/instances/{instance}
old_valueOutput only. The resource name of this instance. Format: projects/{project}/locations/{region}/instances/{instance}
root['schemas']['SQSAuthV2']['properties']['additionalS3AccessKeySecretAuth']['description']
new_valueRequired. Deprecated. If the S3 objects referred to by the SQS queue require different auth info other than the SQS auth, that can be specified here. Additional S3AccessKeySecret. Required.
old_valueRequired. If the S3 objects referred to by the SQS queue require different auth info other than the SQS auth, that can be specified here. Additional S3AccessKeySecret. Required.
root['schemas']['StatusProto']['properties']['canonicalCode']['description']
new_valuecopybara:strip_begin(b/383363683) copybara:strip_end_and_replace optional int32 canonical_code = 6;
old_valueThe canonical error code (see codes.proto) that most closely corresponds to this status. This may be missing, and in the common case of the generic space, it definitely will be. copybara:strip_begin(b/383363683) copybara:strip_end_and_replace optional int32 canonical_code = 6;
root['schemas']['StatusProto']['properties']['space']['description']
new_valuecopybara:strip_begin(b/383363683) Space to which this status belongs copybara:strip_end_and_replace optional string space = 2; // Space to which this status belongs
old_valueThe following are usually only present when code != 0 Space to which this status belongs copybara:strip_begin(b/383363683) copybara:strip_end_and_replace optional string space = 2;
iterable_item_added
root['schemas']['AnalyticValue']['properties']['eventType']['enum'][103]ENTITY_RISK_CHANGE
root['schemas']['AnalyticValue']['properties']['eventType']['enumDescriptions'][103]An update to an entity risk score. This event type is restricted to events published by Google Securit Operations Risk Analytics.
root['schemas']['EnrichmentDisablementTarget']['properties']['eventType']['enum'][103]ENTITY_RISK_CHANGE
root['schemas']['EnrichmentDisablementTarget']['properties']['eventType']['enumDescriptions'][103]An update to an entity risk score. This event type is restricted to events published by Google Securit Operations Risk Analytics.
root['schemas']['EventTypesSuggestion']['properties']['eventType']['enum'][103]ENTITY_RISK_CHANGE
root['schemas']['EventTypesSuggestion']['properties']['eventType']['enumDescriptions'][103]An update to an entity risk score. This event type is restricted to events published by Google Securit Operations Risk Analytics.
root['schemas']['FeedDetails']['properties']['feedSourceType']['enum'][19]GOOGLE_CLOUD_STORAGE_EVENT_DRIVEN
root['schemas']['FeedDetails']['properties']['feedSourceType']['enumDescriptions'][19]Google Cloud Storage Feed backed by Omniflow STS driven by pubsub events.
root['schemas']['FeedSourceTypeSchema']['properties']['feedSourceType']['enum'][19]GOOGLE_CLOUD_STORAGE_EVENT_DRIVEN
root['schemas']['FeedSourceTypeSchema']['properties']['feedSourceType']['enumDescriptions'][19]Google Cloud Storage Feed backed by Omniflow STS driven by pubsub events.
root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][1412]BLOCKDAEMON_METOMIC
root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][2124]JIT
root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][2125]PROCORE
root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][2126]HP_INC_MFP
root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][2127]MERU_CONTENTKEEPER_PROXY
root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][2128]KPMG_JAPAN_HR
root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][2129]FORD_ADFS_IDP
root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][2130]FORD_BLUE_DNS
root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][2131]TSA_VMS
root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][2132]ALLIANZ_CPAM
root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][2133]HKBK_ASE1_DIGITALGUARDIAN_NDLP
root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][2134]PANORAYS
root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][2135]BBVA_BAEMPRE
root['schemas']['Metadata']['properties']['eventType']['enum'][103]ENTITY_RISK_CHANGE
root['schemas']['Metadata']['properties']['eventType']['enumDescriptions'][103]An update to an entity risk score. This event type is restricted to events published by Google Securit Operations Risk Analytics.
root['schemas']['PackLogType']['properties']['recommendedSourceType']['enum'][19]GOOGLE_CLOUD_STORAGE_EVENT_DRIVEN
root['schemas']['PackLogType']['properties']['recommendedSourceType']['enumDescriptions'][19]Google Cloud Storage Feed backed by Omniflow STS driven by pubsub events.
root['schemas']['RawLog']['properties']['type']['enum'][1412]BLOCKDAEMON_METOMIC
root['schemas']['RawLog']['properties']['type']['enum'][2124]JIT
root['schemas']['RawLog']['properties']['type']['enum'][2125]PROCORE
root['schemas']['RawLog']['properties']['type']['enum'][2126]HP_INC_MFP
root['schemas']['RawLog']['properties']['type']['enum'][2127]MERU_CONTENTKEEPER_PROXY
root['schemas']['RawLog']['properties']['type']['enum'][2128]KPMG_JAPAN_HR
root['schemas']['RawLog']['properties']['type']['enum'][2129]FORD_ADFS_IDP
root['schemas']['RawLog']['properties']['type']['enum'][2130]FORD_BLUE_DNS
root['schemas']['RawLog']['properties']['type']['enum'][2131]TSA_VMS
root['schemas']['RawLog']['properties']['type']['enum'][2132]ALLIANZ_CPAM
root['schemas']['RawLog']['properties']['type']['enum'][2133]HKBK_ASE1_DIGITALGUARDIAN_NDLP
root['schemas']['RawLog']['properties']['type']['enum'][2134]PANORAYS
root['schemas']['RawLog']['properties']['type']['enum'][2135]BBVA_BAEMPRE
root['schemas']['RawLogEventInformation']['properties']['eventType']['enum'][103]ENTITY_RISK_CHANGE
root['schemas']['RawLogEventInformation']['properties']['eventType']['enumDescriptions'][103]An update to an entity risk score. This event type is restricted to events published by Google Securit Operations Risk Analytics.
root['schemas']['SIEventData']['properties']['rawLogType']['enum'][1412]BLOCKDAEMON_METOMIC
root['schemas']['SIEventData']['properties']['rawLogType']['enum'][2124]JIT
root['schemas']['SIEventData']['properties']['rawLogType']['enum'][2125]PROCORE
root['schemas']['SIEventData']['properties']['rawLogType']['enum'][2126]HP_INC_MFP
root['schemas']['SIEventData']['properties']['rawLogType']['enum'][2127]MERU_CONTENTKEEPER_PROXY
root['schemas']['SIEventData']['properties']['rawLogType']['enum'][2128]KPMG_JAPAN_HR
root['schemas']['SIEventData']['properties']['rawLogType']['enum'][2129]FORD_ADFS_IDP
root['schemas']['SIEventData']['properties']['rawLogType']['enum'][2130]FORD_BLUE_DNS
root['schemas']['SIEventData']['properties']['rawLogType']['enum'][2131]TSA_VMS
root['schemas']['SIEventData']['properties']['rawLogType']['enum'][2132]ALLIANZ_CPAM
root['schemas']['SIEventData']['properties']['rawLogType']['enum'][2133]HKBK_ASE1_DIGITALGUARDIAN_NDLP
root['schemas']['SIEventData']['properties']['rawLogType']['enum'][2134]PANORAYS
root['schemas']['SIEventData']['properties']['rawLogType']['enum'][2135]BBVA_BAEMPRE
iterable_item_removed
root['schemas']['FeedDetails']['properties']['feedSourceType']['enum'][14]OMNIFLOW_GOOGLE_CLOUD_STORAGE
root['schemas']['FeedDetails']['properties']['feedSourceType']['enum'][15]OMNIFLOW_AMAZON_S3
root['schemas']['FeedDetails']['properties']['feedSourceType']['enum'][16]OMNIFLOW_AMAZON_SQS
root['schemas']['FeedDetails']['properties']['feedSourceType']['enumDescriptions'][14]
root['schemas']['FeedSourceTypeSchema']['properties']['feedSourceType']['enum'][14]OMNIFLOW_GOOGLE_CLOUD_STORAGE
root['schemas']['FeedSourceTypeSchema']['properties']['feedSourceType']['enum'][15]OMNIFLOW_AMAZON_S3
root['schemas']['FeedSourceTypeSchema']['properties']['feedSourceType']['enum'][16]OMNIFLOW_AMAZON_SQS
root['schemas']['FeedSourceTypeSchema']['properties']['feedSourceType']['enumDescriptions'][14]
root['schemas']['PackLogType']['properties']['recommendedSourceType']['enum'][14]OMNIFLOW_GOOGLE_CLOUD_STORAGE
root['schemas']['PackLogType']['properties']['recommendedSourceType']['enum'][15]OMNIFLOW_AMAZON_S3
root['schemas']['PackLogType']['properties']['recommendedSourceType']['enum'][16]OMNIFLOW_AMAZON_SQS
root['schemas']['PackLogType']['properties']['recommendedSourceType']['enumDescriptions'][14]
prod/eu-chronicle-v1beta
values_changed
root['resources']['projects']['resources']['locations']['resources']['instances']['methods']['get']['parameters']['name']['description']
new_valueRequired. The name of the instance to retrieve. Format: projects/{project_id}/locations/{location}/instances/{instance}
old_valueRequired. The name of the instance to retrieve. Format: projects/{project_id}/locations/{region}/instances/{instance}
root['revision']
new_value20250310
old_value20250227
root['schemas']
new_value
AIOverview
descriptionAI generated overview for the search results.
idAIOverview
properties
aiSummary
descriptionAI summary for the search results. Markdown formatted.
typestring
complete
descriptionWhether AI overview generation is complete.
typeboolean
suggestions
descriptionSuggested actions to continue the investigation in chat.
items
$refAction
typearray
typeobject
Action
descriptionAction represents an action that can be performed in the host UI.
idAction
properties
actionType
descriptionOutput only. Type of action.
enum
  • ACTION_TYPE_UNSPECIFIED
  • FOLLOW_UP
  • NAVIGATION
  • EXECUTION
enumDescriptions
  • The action type is unspecified.
  • The action is a follow up action.
  • The action is a navigation action.
  • The action is an execution action.
readOnlyTrue
typestring
displayText
descriptionOutput only. The text that'll be displayed to the user if this is rendered in the UI as a suggested action.
readOnlyTrue
typestring
execution
$refExecution
descriptionMetadata for execution action.
followUp
$refFollowUp
descriptionMetadata for follow up action.
navigation
$refNavigation
descriptionMetadata for navigation action.
useCaseId
descriptionOutput only. The use case ID of the action. It's used internally to identify in which context the action is used.
readOnlyTrue
typestring
typeobject
AlertFieldAggregation
idAlertFieldAggregation
properties
alertCount
formatint32
typeinteger
allValues
items
$refAlertFieldValueCount
typearray
baselineAlertCount
formatint32
typeinteger
bottomValues
items
$refAlertFieldValueCount
typearray
fieldName
typestring
tooManyValues
typeboolean
topValues
items
$refAlertFieldValueCount
typearray
valueCount
formatint32
typeinteger
typeobject
AlertFieldAggregations
idAlertFieldAggregations
properties
fields
items
$refAlertFieldAggregation
typearray
typeobject
AlertFieldValue
idAlertFieldValue
properties
boolValue
typeboolean
bytesValue
formatbyte
typestring
doubleValue
formatdouble
typenumber
enumValue
typestring
floatValue
formatfloat
typenumber
int32Value
formatint32
typeinteger
int64Value
formatint64
typestring
stringValue
typestring
uint32Value
formatuint32
typeinteger
uint64Value
formatuint64
typestring
typeobject
AlertFieldValueCount
idAlertFieldValueCount
properties
alertCount
formatint32
typeinteger
baselineAlertCount
formatint32
typeinteger
value
$refAlertFieldValue
typeobject
AnalystVerdict
descriptionVerdict provided by the human analyst. These fields are used to model Mandiant sources.
idAnalystVerdict
properties
confidenceScore
descriptionConfidence score of the verdict.
formatint32
typeinteger
verdictResponse
descriptionDetails of the verdict.
enum
  • VERDICT_RESPONSE_UNSPECIFIED
  • MALICIOUS
  • BENIGN
enumDescriptions
  • The default verdict response type.
  • VerdictResponse resulted a threat as malicious.
  • VerdictResponse resulted a threat as benign.
typestring
verdictTime
descriptionTimestamp at which the verdict was generated.
formatgoogle-datetime
typestring
typeobject
AnalyticsMetadata
descriptionStores information about an analytics metric used in a rule.
idAnalyticsMetadata
properties
analytic
descriptionName of the analytic.
typestring
typeobject
Annotation
descriptionExtra parameters that don't fit anywhere else, captured as key/value. For example "VendorID/42" in BlackBerry user agents. The following keys are modified with reduced User-Agent and no client hints (go/ua-reduction-ua-string-reference): * "Chrome" (see `browser_version`) * "ChromiumBrowser" (unavailable) * "ChromeWebview" (unavailable) * "OS_VERSION" (see `os`) * "Rest" (unavailable) * "misc" (see `device`)
idAnnotation
properties
key
typestring
value
typestring
typeobject
Artifact
descriptionInformation about an artifact. The artifact can only be an IP.
idArtifact
properties
anonymous
descriptionWhether the VPN tunnels are configured for anonymous browsing or not.
typeboolean
artifactClient
$refArtifactClient
descriptionEntity or software accessing or utilizing network resources.
asOwner
descriptionOwner of the Autonomous System to which the IP address belongs.
typestring
asn
descriptionAutonomous System Number to which the IP address belongs.
formatint64
typestring
firstSeenTime
descriptionFirst seen timestamp of the IP in the customer's environment.
formatgoogle-datetime
typestring
ip
descriptionIP address of the artifact. This field can be used as an entity indicator for an external destination IP entity.
typestring
jarm
descriptionThe JARM hash for the IP address. (https://engineering.salesforce.com/easily-identify-malicious-servers-on-the-internet-with-jarm-e095edac525a).
typestring
lastHttpsCertificate
$refSSLCertificate
descriptionSSL certificate information about the IP address.
lastHttpsCertificateDate
descriptionMost recent date for the certificate in VirusTotal.
formatgoogle-datetime
typestring
lastSeenTime
descriptionLast seen timestamp of the IP address in the customer's environment.
formatgoogle-datetime
typestring
location
$refLocation
descriptionLocation of the Artifact's IP address.
network
$refNetwork
descriptionNetwork information related to the Artifact's IP address.
prevalence
$refPrevalence
descriptionThe prevalence of the artifact within the customer's environment.
regionalInternetRegistry
descriptionRIR (one of the current RIRs: AFRINIC, ARIN, APNIC, LACNIC or RIPE NCC).
typestring
risks
descriptionThis field lists potential risks associated with the network activity.
items
typestring
typearray
tags
descriptionIdentification attributes
items
typestring
typearray
tunnels
descriptionVPN tunnels.
items
$refTunnels
typearray
whois
descriptionWHOIS information as returned from the pertinent WHOIS server.
typestring
whoisDate
descriptionDate of the last update of the WHOIS record in VirusTotal.
formatgoogle-datetime
typestring
typeobject
ArtifactClient
descriptionEntity or software accessing or utilizing network resources.
idArtifactClient
properties
behaviors
descriptionThe behaviors of the client accessing the network.
items
typestring
typearray
proxies
descriptionThe type of proxies used by the client.
items
typestring
typearray
typeobject
Asset
descriptionInformation about a compute asset such as a workstation, laptop, phone, virtual desktop, or VM.
idAsset
properties
assetId
descriptionThe asset ID. Value must contain the ':' character. For example, cs:abcdd23434. This field can be used as an entity indicator for asset entities.
typestring
attribute
$refAttribute
descriptionGeneric entity metadata attributes of the asset.
category
descriptionThe category of the asset (e.g. "End User Asset", "Workstation", "Server").
typestring
creationTime
deprecatedTrue
descriptionTime the asset was created or provisioned. Deprecate: creation_time should be populated in Attribute as generic metadata.
formatgoogle-datetime
typestring
deploymentStatus
descriptionThe deployment status of the asset for device lifecycle purposes.
enum
  • DEPLOYMENT_STATUS_UNSPECIFIED
  • ACTIVE
  • PENDING_DECOMISSION
  • DECOMISSIONED
enumDescriptions
  • Unspecified deployment status.
  • Asset is active, functional and deployed.
  • Asset is pending decommission and no longer deployed.
  • Asset is decommissioned.
typestring
firstDiscoverTime
descriptionTime the asset was first discovered (by asset management/discoverability software).
formatgoogle-datetime
typestring
firstSeenTime
descriptionThe first observed time for an asset. The value is calculated on the basis of the first time the identifier was observed.
formatgoogle-datetime
typestring
hardware
descriptionThe asset hardware specifications.
items
$refHardware
typearray
hostname
descriptionAsset hostname or domain name field. This field can be used as an entity indicator for asset entities.
typestring
ip
descriptionA list of IP addresses associated with an asset. This field can be used as an entity indicator for asset entities.
items
typestring
typearray
labels
deprecatedTrue
descriptionMetadata labels for the asset. Deprecated: labels should be populated in Attribute as generic metadata.
items
$refLabel
typearray
lastBootTime
descriptionTime the asset was last boot started.
formatgoogle-datetime
typestring
lastDiscoverTime
descriptionTime the asset was last discovered (by asset management/discoverability software).
formatgoogle-datetime
typestring
location
$refLocation
descriptionLocation of the asset.
mac
descriptionList of MAC addresses associated with an asset. This field can be used as an entity indicator for asset entities.
items
typestring
typearray
natIp
descriptionList of NAT IP addresses associated with an asset.
items
typestring
typearray
networkDomain
descriptionThe network domain of the asset (e.g. "corp.acme.com")
typestring
platformSoftware
$refPlatformSoftware
descriptionThe asset operating system platform software.
productObjectId
descriptionA vendor-specific identifier to uniquely identify the entity (a GUID or similar). This field can be used as an entity indicator for asset entities.
typestring
software
descriptionThe asset software details.
items
$refSoftware
typearray
systemLastUpdateTime
descriptionTime the asset system or OS was last updated. For all other operations that are not system updates (such as resizing a VM), use Attribute.last_update_time.
formatgoogle-datetime
typestring
type
descriptionThe type of the asset (e.g. workstation or laptop or server).
enum
  • ROLE_UNSPECIFIED
  • WORKSTATION
  • LAPTOP
  • IOT
  • NETWORK_ATTACHED_STORAGE
  • PRINTER
  • SCANNER
  • SERVER
  • TAPE_LIBRARY
  • MOBILE
enumDescriptions
  • Unspecified asset role.
  • A workstation or desktop.
  • A laptop computer.
  • An IOT asset.
  • A network attached storage device.
  • A printer.
  • A scanner.
  • A server.
  • A tape library device.
  • A mobile device such as a mobile phone or PDA.
typestring
vulnerabilities
descriptionVulnerabilities discovered on asset.
items
$refVulnerability
typearray
typeobject
Association
descriptionAssociations represents different metadata about malware and threat actors involved with an IoC.
idAssociation
properties
alias
descriptionDifferent aliases of the threat actor given by different sources.
items
$refAssociationAlias
typearray
associatedActors
descriptionList of associated threat actors for a malware. Not applicable for threat actors.
items
$refAssociation
typearray
countryCode
descriptionCountry from which the threat actor/ malware is originated.
items
typestring
typearray
description
descriptionHuman readable description about the association.
typestring
firstReferenceTime
descriptionFirst time the threat actor was referenced or seen.
formatgoogle-datetime
typestring
id
descriptionUnique association id generated by mandiant.
typestring
industriesAffected
descriptionList of industries the threat actor affects.
items
typestring
typearray
lastReferenceTime
descriptionLast time the threat actor was referenced or seen.
formatgoogle-datetime
typestring
name
descriptionName of the threat actor/malware.
typestring
regionCode
$refLocation
descriptionName of the country, the threat is originating from.
role
descriptionRole of the malware. Not applicable for threat actor.
typestring
sourceCountry
deprecatedTrue
descriptionName of the country the threat originated from.
typestring
sponsorRegion
$refLocation
descriptionSponsor region of the threat actor.
tags
descriptionTags.
items
typestring
typearray
targetedRegions
descriptionTargeted regions.
items
$refLocation
typearray
type
descriptionSignifies the type of association.
enum
  • ASSOCIATION_TYPE_UNSPECIFIED
  • THREAT_ACTOR
  • MALWARE
enumDescriptions
  • The default Association Type.
  • Association type Threat actor.
  • Association type Malware.
typestring
typeobject
AssociationAlias
descriptionAssociation Alias used to represent Mandiant Threat Intelligence.
idAssociationAlias
properties
company
descriptionName of the provider who gave the association's name.
typestring
name
descriptionName of the alias.
typestring
typeobject
AttackDetails
descriptionMITRE ATT&CK details.
idAttackDetails
properties
tactics
descriptionTactics employed.
items
$refTactic
typearray
techniques
descriptionTechniques employed.
items
$refTechnique
typearray
version
descriptionATT&CK version (e.g. 12.1).
typestring
typeobject
Attribute
descriptionAttribute is a container for generic entity attributes including common attributes across core entities (such as, user or asset). For example, Cloud is a generic entity attribute since it can apply to an asset (for example, a VM) or a user (for example, an identity service account).
idAttribute
properties
cloud
$refCloud
descriptionCloud metadata attributes such as project ID, account ID, or organizational hierarchy.
creationTime
descriptionTime the resource or entity was created or provisioned.
formatgoogle-datetime
typestring
labels
descriptionSet of labels for the entity. Should only be used for product labels (for example, Google Cloud resource labels or Azure AD sensitivity labels. Should not be used for arbitrary key-value mappings.
items
$refLabel
typearray
lastUpdateTime
descriptionTime the resource or entity was last updated.
formatgoogle-datetime
typestring
permissions
descriptionSystem permissions for IAM entity (human principal, service account, group).
items
$refPermission
typearray
roles
descriptionSystem IAM roles to be assumed by resources to use the role's permissions for access control.
items
$refRole
typearray
typeobject
Authentication
descriptionThe Authentication extension captures details specific to authentication events. General guidelines for authentication events: * Details about the source of the authentication event (for example, client IP or hostname), should be captured in principal. The principal may be empty if we have no details about the source of the login. * Details about the target of the authentication event (for example, details about the machine that is being logged into or logged out of) should be captured in target. * Some authentication events may involve a third-party. For example, a user logs into a cloud service (for example, Chronicle) via their company's SSO (the event is logged by their SSO solution). In this case, the principal captures information about the user's device, the target captures details about the cloud service they logged into, and the intermediary captures details about the SSO solution.
idAuthentication
properties
authDetails
descriptionThe vendor defined details of the authentication.
typestring
mechanism
descriptionThe authentication mechanism.
items
enum
  • MECHANISM_UNSPECIFIED
  • USERNAME_PASSWORD
  • OTP
  • HARDWARE_KEY
  • LOCAL
  • REMOTE
  • REMOTE_INTERACTIVE
  • MECHANISM_OTHER
  • BADGE_READER
  • NETWORK
  • BATCH
  • SERVICE
  • UNLOCK
  • NETWORK_CLEAR_TEXT
  • NEW_CREDENTIALS
  • INTERACTIVE
  • CACHED_INTERACTIVE
  • CACHED_REMOTE_INTERACTIVE
  • CACHED_UNLOCK
  • BIOMETRIC
  • WEARABLE
enumDescriptions
  • The default mechanism.
  • Username + password authentication.
  • OTP authentication.
  • Hardware key authentication.
  • Local authentication.
  • Remote authentication.
  • RDP, Terminal Services, or VNC.
  • Some other mechanism that is not defined here.
  • Badge reader authentication
  • Network authentication.
  • Batch authentication.
  • Service authentication
  • Direct human-interactive unlock authentication.
  • Network clear text authentication.
  • Authentication with new credentials.
  • Interactive authentication.
  • Interactive authentication using cached credentials.
  • Cached Remote Interactive authentication using cached credentials.
  • Cached Remote Interactive authentication using cached credentials.
  • Biometric device such as a fingerprint reader.
  • Wearable such as an Apple Watch.
typestring
typearray
type
descriptionThe type of authentication.
enum
  • AUTHTYPE_UNSPECIFIED
  • MACHINE
  • SSO
  • VPN
  • PHYSICAL
  • TACACS
enumDescriptions
  • The default type.
  • A machine authentication.
  • An SSO authentication.
  • A VPN authentication.
  • A Physical authentication (e.g. "Badge reader").
  • A TACACS family protocol for networked systems authentication (e.g. TACACS, TACACS+).
typestring
typeobject
AuthorityKeyId
descriptionIdentifies the public key to be used to verify the signature on this certificate or CRL.
idAuthorityKeyId
properties
keyid
descriptionKey hexdump.
typestring
serialNumber
descriptionSerial number hexdump.
typestring
typeobject
BackstoryEntity
descriptionAn Entity provides additional context about an item in a UDM event. For example, a PROCESS_LAUNCH event describes that user 'abc@example.corp' launched process 'shady.exe'. The event does not include information that user 'abc@example.com' is a recently terminated employee who administers a server storing finance data. Information stored in one or more Entities can add this additional context.
idBackstoryEntity
properties
additional
additionalProperties
descriptionProperties of the object.
typeany
descriptionImportant entity data that cannot be adequately represented within the formal sections of the Entity.
typeobject
entity
$refNoun
descriptionNoun in the UDM event that this entity represents.
metadata
$refEntityMetadata
descriptionEntity metadata such as timestamp, product, etc.
metric
$refMetric
descriptionStores statistical metrics about the entity. Used if metadata.entity_type is METRIC.
relations
descriptionOne or more relationships between the entity (a) and other entities, including the relationship type and related entity.
items
$refRelation
typearray
riskScore
$refEntityRisk
descriptionStores information related to the entity's risk score.
typeobject
BackstoryFile
descriptionInformation about a file.
idBackstoryFile
properties
ahash
deprecatedTrue
descriptionDeprecated. Use authentihash instead.
typestring
authentihash
descriptionAuthentihash of the file.
typestring
capabilitiesTags
descriptionCapabilities tags.
items
typestring
typearray
createTime
descriptionTimestamp when the file was created.
formatgoogle-datetime
typestring
embeddedDomains
descriptionEmbedded domains found in the file.
items
typestring
typearray
embeddedIps
descriptionEmbedded IP addresses found in the file.
items
typestring
typearray
embeddedUrls
descriptionEmbedded urls found in the file.
items
typestring
typearray
exifInfo
$refExifInfo
descriptionExif metadata from different file formats extracted by exiftool.
fileMetadata
$refFileMetadata
deprecatedTrue
descriptionMetadata associated with the file. Deprecate FileMetadata in favor of using fields in File.
fileType
descriptionFileType field.
enum
  • FILE_TYPE_UNSPECIFIED
  • FILE_TYPE_PE_EXE
  • FILE_TYPE_PE_DLL
  • FILE_TYPE_MSI
  • FILE_TYPE_NE_EXE
  • FILE_TYPE_NE_DLL
  • FILE_TYPE_DOS_EXE
  • FILE_TYPE_DOS_COM
  • FILE_TYPE_COFF
  • FILE_TYPE_ELF
  • FILE_TYPE_LINUX_KERNEL
  • FILE_TYPE_RPM
  • FILE_TYPE_LINUX
  • FILE_TYPE_MACH_O
  • FILE_TYPE_JAVA_BYTECODE
  • FILE_TYPE_DMG
  • FILE_TYPE_DEB
  • FILE_TYPE_PKG
  • FILE_TYPE_PYC
  • FILE_TYPE_LNK
  • FILE_TYPE_DESKTOP_ENTRY
  • FILE_TYPE_JPEG
  • FILE_TYPE_TIFF
  • FILE_TYPE_GIF
  • FILE_TYPE_PNG
  • FILE_TYPE_BMP
  • FILE_TYPE_GIMP
  • FILE_TYPE_IN_DESIGN
  • FILE_TYPE_PSD
  • FILE_TYPE_TARGA
  • FILE_TYPE_XWD
  • FILE_TYPE_DIB
  • FILE_TYPE_JNG
  • FILE_TYPE_ICO
  • FILE_TYPE_FPX
  • FILE_TYPE_EPS
  • FILE_TYPE_SVG
  • FILE_TYPE_EMF
  • FILE_TYPE_WEBP
  • FILE_TYPE_DWG
  • FILE_TYPE_DXF
  • FILE_TYPE_THREEDS
  • FILE_TYPE_OGG
  • FILE_TYPE_FLC
  • FILE_TYPE_FLI
  • FILE_TYPE_MP3
  • FILE_TYPE_FLAC
  • FILE_TYPE_WAV
  • FILE_TYPE_MIDI
  • FILE_TYPE_AVI
  • FILE_TYPE_MPEG
  • FILE_TYPE_QUICKTIME
  • FILE_TYPE_ASF
  • FILE_TYPE_DIVX
  • FILE_TYPE_FLV
  • FILE_TYPE_WMA
  • FILE_TYPE_WMV
  • FILE_TYPE_RM
  • FILE_TYPE_MOV
  • FILE_TYPE_MP4
  • FILE_TYPE_T3GP
  • FILE_TYPE_WEBM
  • FILE_TYPE_MKV
  • FILE_TYPE_PDF
  • FILE_TYPE_PS
  • FILE_TYPE_DOC
  • FILE_TYPE_DOCX
  • FILE_TYPE_PPT
  • FILE_TYPE_PPTX
  • FILE_TYPE_XLS
  • FILE_TYPE_XLSX
  • FILE_TYPE_RTF
  • FILE_TYPE_PPSX
  • FILE_TYPE_ODP
  • FILE_TYPE_ODS
  • FILE_TYPE_ODT
  • FILE_TYPE_HWP
  • FILE_TYPE_GUL
  • FILE_TYPE_ODF
  • FILE_TYPE_ODG
  • FILE_TYPE_ONE_NOTE
  • FILE_TYPE_OOXML
  • FILE_TYPE_SLK
  • FILE_TYPE_EBOOK
  • FILE_TYPE_LATEX
  • FILE_TYPE_TTF
  • FILE_TYPE_EOT
  • FILE_TYPE_WOFF
  • FILE_TYPE_CHM
  • FILE_TYPE_ZIP
  • FILE_TYPE_GZIP
  • FILE_TYPE_BZIP
  • FILE_TYPE_RZIP
  • FILE_TYPE_DZIP
  • FILE_TYPE_SEVENZIP
  • FILE_TYPE_CAB
  • FILE_TYPE_JAR
  • FILE_TYPE_RAR
  • FILE_TYPE_MSCOMPRESS
  • FILE_TYPE_ACE
  • FILE_TYPE_ARC
  • FILE_TYPE_ARJ
  • FILE_TYPE_ASD
  • FILE_TYPE_BLACKHOLE
  • FILE_TYPE_KGB
  • FILE_TYPE_ZLIB
  • FILE_TYPE_TAR
  • FILE_TYPE_ZST
  • FILE_TYPE_LZFSE
  • FILE_TYPE_PYTHON_WHL
  • FILE_TYPE_PYTHON_PKG
  • FILE_TYPE_MSIX
  • FILE_TYPE_TEXT
  • FILE_TYPE_SCRIPT
  • FILE_TYPE_PHP
  • FILE_TYPE_PYTHON
  • FILE_TYPE_PERL
  • FILE_TYPE_RUBY
  • FILE_TYPE_C
  • FILE_TYPE_CPP
  • FILE_TYPE_JAVA
  • FILE_TYPE_SHELLSCRIPT
  • FILE_TYPE_PASCAL
  • FILE_TYPE_AWK
  • FILE_TYPE_DYALOG
  • FILE_TYPE_FORTRAN
  • FILE_TYPE_JAVASCRIPT
  • FILE_TYPE_POWERSHELL
  • FILE_TYPE_VBA
  • FILE_TYPE_M4
  • FILE_TYPE_OBJETIVEC
  • FILE_TYPE_JMOD
  • FILE_TYPE_MAKEFILE
  • FILE_TYPE_INI
  • FILE_TYPE_CLJ
  • FILE_TYPE_PDB
  • FILE_TYPE_SQL
  • FILE_TYPE_NEKO
  • FILE_TYPE_WER
  • FILE_TYPE_GOLANG
  • FILE_TYPE_M3U
  • FILE_TYPE_BAT
  • FILE_TYPE_MSC
  • FILE_TYPE_RDP
  • FILE_TYPE_SYMBIAN
  • FILE_TYPE_PALMOS
  • FILE_TYPE_WINCE
  • FILE_TYPE_ANDROID
  • FILE_TYPE_IPHONE
  • FILE_TYPE_HTML
  • FILE_TYPE_XML
  • FILE_TYPE_SWF
  • FILE_TYPE_FLA
  • FILE_TYPE_COOKIE
  • FILE_TYPE_TORRENT
  • FILE_TYPE_EMAIL_TYPE
  • FILE_TYPE_OUTLOOK
  • FILE_TYPE_SGML
  • FILE_TYPE_JSON
  • FILE_TYPE_CSV
  • FILE_TYPE_HTA
  • FILE_TYPE_INTERNET_SHORTCUT
  • FILE_TYPE_CAP
  • FILE_TYPE_ISOIMAGE
  • FILE_TYPE_SQUASHFS
  • FILE_TYPE_VHD
  • FILE_TYPE_APPLE
  • FILE_TYPE_MACINTOSH
  • FILE_TYPE_APPLESINGLE
  • FILE_TYPE_APPLEDOUBLE
  • FILE_TYPE_MACINTOSH_HFS
  • FILE_TYPE_APPLE_PLIST
  • FILE_TYPE_MACINTOSH_LIB
  • FILE_TYPE_APPLESCRIPT
  • FILE_TYPE_APPLESCRIPT_COMPILED
  • FILE_TYPE_CRX
  • FILE_TYPE_XPI
  • FILE_TYPE_ROM
  • FILE_TYPE_IPS
  • FILE_TYPE_PEM
  • FILE_TYPE_PGP
  • FILE_TYPE_CRT
enumDescriptions
  • File type is UNSPECIFIED.
  • File type is PE_EXE.
  • Although DLLs are actually portable executables, this value enables the file type to be identified separately. File type is PE_DLL.
  • File type is MSI.
  • File type is NE_EXE.
  • File type is NE_DLL.
  • File type is DOS_EXE.
  • File type is DOS_COM.
  • File type is COFF.
  • File type is ELF.
  • File type is LINUX_KERNEL.
  • File type is RPM.
  • File type is LINUX.
  • File type is MACH_O.
  • File type is JAVA_BYTECODE.
  • File type is DMG.
  • File type is DEB.
  • File type is PKG.
  • File type is PYC.
  • File type is LNK.
  • File type is DESKTOP_ENTRY.
  • File type is JPEG.
  • File type is TIFF.
  • File type is GIF.
  • File type is PNG.
  • File type is BMP.
  • File type is GIMP.
  • File type is Adobe InDesign.
  • File type is PSD. Adobe Photoshop.
  • File type is TARGA.
  • File type is XWD.
  • File type is DIB.
  • File type is JNG.
  • File type is ICO.
  • File type is FPX.
  • File type is EPS.
  • File type is SVG.
  • File type is EMF.
  • File type is WEBP.
  • File type is DWG.
  • File type is DXF.
  • File type is 3DS.
  • File type is OGG.
  • File type is FLC.
  • File type is FLI.
  • File type is MP3.
  • File type is FLAC.
  • File type is WAV.
  • File type is MIDI.
  • File type is AVI.
  • File type is MPEG.
  • File type is QUICKTIME.
  • File type is ASF.
  • File type is DIVX.
  • File type is FLV.
  • File type is WMA.
  • File type is WMV.
  • File type is RM. RealMedia type.
  • File type is MOV.
  • File type is MP4.
  • File type is T3GP.
  • File type is WEBM.
  • File type is MKV.
  • File type is PDF.
  • File type is PS.
  • File type is DOC.
  • File type is DOCX.
  • File type is PPT.
  • File type is PPTX.
  • File type is XLS.
  • File type is XLSX.
  • File type is RTF.
  • File type is PPSX.
  • File type is ODP.
  • File type is ODS.
  • File type is ODT.
  • File type is HWP.
  • File type is GUL.
  • File type is ODF.
  • File type is ODG.
  • File type is ONE_NOTE.
  • File type is OOXML.
  • File type is SLK.
  • File type is EBOOK.
  • File type is LATEX.
  • File type is TTF.
  • File type is EOT.
  • File type is WOFF.
  • File type is CHM.
  • File type is ZIP.
  • File type is GZIP.
  • File type is BZIP.
  • File type is RZIP.
  • File type is DZIP.
  • File type is SEVENZIP.
  • File type is CAB.
  • File type is JAR.
  • File type is RAR.
  • File type is MSCOMPRESS.
  • File type is ACE.
  • File type is ARC.
  • File type is ARJ.
  • File type is ASD.
  • File type is BLACKHOLE.
  • File type is KGB.
  • File type is ZLIB.
  • File type is TAR.
  • File type is ZST.
  • File type is LZFSE.
  • File type is PYTHON_WHL.
  • File type is PYTHON_PKG.
  • File type is MSIX, new Windows app package format.
  • File type is TEXT.
  • File type is SCRIPT.
  • File type is PHP.
  • File type is PYTHON.
  • File type is PERL.
  • File type is RUBY.
  • File type is C.
  • File type is CPP.
  • File type is JAVA.
  • File type is SHELLSCRIPT.
  • File type is PASCAL.
  • File type is AWK.
  • File type is DYALOG.
  • File type is FORTRAN.
  • File type is JAVASCRIPT.
  • File type is POWERSHELL.
  • File type is VBA.
  • File type is M4.
  • File type is OBJETIVEC.
  • File type is JMOD.
  • File type is MAKEFILE.
  • File type is INI.
  • File type is CLJ.
  • File type is PDB.
  • File type is SQL.
  • File type is NEKO.
  • File type is WER.
  • File type is GOLANG.
  • File type is M3U.
  • File type is BAT, Windows .bat/.cmd (old files are tagged as SHELLSCRIPT).
  • File type is MSC, Microsoft Management Console (MMC).
  • File type is RDP, Microsoft Remote Desktop Protocol (RDP) file.
  • File type is SYMBIAN.
  • File type is PALMOS.
  • File type is WINCE.
  • File type is ANDROID.
  • File type is IPHONE.
  • File type is HTML.
  • File type is XML.
  • File type is SWF.
  • File type is FLA.
  • File type is COOKIE.
  • File type is TORRENT.
  • File type is EMAIL_TYPE.
  • File type is OUTLOOK.
  • File type is SGML.
  • File type is JSON.
  • File type is CSV.
  • File type is HTA (HTML Application).
  • File type is MSHTML .url.
  • File type is CAP.
  • File type is ISOIMAGE.
  • File type is SQUASHFS.
  • File type is VHD.
  • File type is APPLE.
  • File type is MACINTOSH.
  • File type is APPLESINGLE.
  • File type is APPLEDOUBLE.
  • File type is MACINTOSH_HFS.
  • File type is APPLE_PLIST.
  • File type is MACINTOSH_LIB.
  • File type is APPLESCRIPT.
  • File type is APPLESCRIPT_COMPILED .
  • File type is CRX.
  • File type is XPI.
  • File type is ROM.
  • File type is IPS.
  • File type is PEM.
  • File type is PGP.
  • File type is CRT.
typestring
firstSeenTime
descriptionTimestamp the file was first seen in the customer's environment.
formatgoogle-datetime
typestring
firstSubmissionTime
descriptionFirst submission time of the file.
formatgoogle-datetime
typestring
fullPath
descriptionThe full path identifying the location of the file on the system. This field can be used as an entity indicator for file entities.
typestring
lastAccessTime
descriptionTimestamp when the file was accessed.
formatgoogle-datetime
typestring
lastAnalysisTime
descriptionTimestamp the file was last analysed.
formatgoogle-datetime
typestring
lastModificationTime
descriptionTimestamp when the file was last updated.
formatgoogle-datetime
typestring
lastSeenTime
descriptionTimestamp the file was last seen in the customer's environment.
formatgoogle-datetime
typestring
lastSubmissionTime
descriptionLast submission time of the file.
formatgoogle-datetime
typestring
mainIcon
$refFavicon
descriptionIcon's relevant hashes.
md5
descriptionThe MD5 hash of the file, as a hex-encoded string. This field can be used as an entity indicator for file entities.
typestring
mimeType
descriptionThe MIME (Multipurpose Internet Mail Extensions) type of the file, for example "PE", "PDF", or "powershell script".
typestring
names
descriptionNames fields.
items
typestring
typearray
ntfs
$refNtfsFileMetadata
descriptionNTFS metadata.
pdfInfo
$refPDFInfo
descriptionInformation about the PDF file structure.
peFile
$refFileMetadataPE
descriptionMetadata about the Portable Executable (PE) file.
prevalence
$refPrevalence
descriptionPrevalence of the file hash in the customer's environment.
securityResult
$refSecurityResult
descriptionGoogle Cloud Threat Intelligence (GCTI) security result for the file including threat context and detection metadata.
sha1
descriptionThe SHA1 hash of the file, as a hex-encoded string. This field can be used as an entity indicator for file entities.
typestring
sha256
descriptionThe SHA256 hash of the file, as a hex-encoded string. This field can be used as an entity indicator for file entities.
typestring
signatureInfo
$refSignatureInfo
descriptionFile signature information extracted from different tools.
size
descriptionThe size of the file in bytes.
formatuint64
typestring
ssdeep
descriptionSsdeep of the file
typestring
statDev
descriptionThe file system identifier to which the object belongs.
formatuint64
typestring
statFlags
descriptionUser defined flags for file.
formatuint32
typeinteger
statInode
descriptionThe file identifier. Unique identifier of object within a file system.
formatuint64
typestring
statMode
descriptionThe mode of the file. A bit string indicating the permissions and privileges of the file.
formatuint64
typestring
statNlink
descriptionNumber of links to file.
formatuint64
typestring
symhash
descriptionSymHash of the file. Used for Mach-O (e.g. MacOS) binaries, to identify similar files based on their symbol table.
typestring
tags
descriptionTags for the file.
items
typestring
typearray
vhash
descriptionVhash of the file.
typestring
typeobject
BoolSequence
descriptionBoolSequence represents a sequence of bools.
idBoolSequence
properties
boolVals
descriptionbool sequence.
items
typeboolean
typearray
typeobject
BytesSequence
descriptionBytesSequence represents a sequence of bytes.
idBytesSequence
properties
bytesVals
descriptionbytes sequence.
items
formatbyte
typestring
typearray
typeobject
CancelOperationRequest
descriptionThe request message for Operations.CancelOperation.
idCancelOperationRequest
properties
typeobject
CertSignature
descriptionCertificate's signature and algorithm.
idCertSignature
properties
signature
descriptionSignature.
typestring
signatureAlgorithm
descriptionAlgorithm.
typestring
typeobject
Certificate
descriptionCertificate information
idCertificate
properties
issuer
descriptionIssuer of the certificate.
typestring
md5
descriptionThe MD5 hash of the certificate, as a hex-encoded string.
typestring
notAfter
descriptionIndicates when the certificate is no longer valid.
formatgoogle-datetime
typestring
notBefore
descriptionIndicates when the certificate is first valid.
formatgoogle-datetime
typestring
serial
descriptionCertificate serial number.
typestring
sha1
descriptionThe SHA1 hash of the certificate, as a hex-encoded string.
typestring
sha256
descriptionThe SHA256 hash of the certificate, as a hex-encoded string.
typestring
subject
descriptionSubject of the certificate.
typestring
version
descriptionCertificate version.
typestring
typeobject
Chip
idChip
properties
text
typestring
type
enum
  • UNSPECIFIED
  • ALERT
  • NETWORK_CONNECTION
  • EDR
  • UNPARSED_RAW_LOG
  • LOGIN_EVENT
  • EMAIL_EVENT
  • GENERIC
  • TELEMETRY
enumDescriptions
typestring
typeobject
Client
descriptionTransport Layer Security (TLS) information associated with the client (for example, Certificate or JA3 hash).
idClient
properties
certificate
$refCertificate
descriptionClient certificate.
ja3
descriptionJA3 hash from the TLS ClientHello, as a hex-encoded string.
typestring
serverName
descriptionHost name of the server, that the client is connecting to.
typestring
supportedCiphers
descriptionCiphers supported by the client during client hello.
items
typestring
typearray
typeobject
Cloud
descriptionMetadata related to the cloud environment.
idCloud
properties
availabilityZone
descriptionThe cloud environment availability zone (different from region which is location.name).
typestring
environment
descriptionThe Cloud environment.
enum
  • UNSPECIFIED_CLOUD_ENVIRONMENT
  • GOOGLE_CLOUD_PLATFORM
  • AMAZON_WEB_SERVICES
  • MICROSOFT_AZURE
enumDescriptions
  • Default.
  • Google Cloud Platform.
  • Amazon Web Services.
  • Microsoft Azure.
typestring
project
$refResource
deprecatedTrue
descriptionThe cloud environment project information. Deprecated: Use Resource.resource_ancestors
vpc
$refResource
deprecatedTrue
descriptionThe cloud environment VPC. Deprecated.
typeobject
Collection
descriptionCollection represents a container of objects (such as events, entity context metadata, detection finding metadata) and state (such as investigation details). BEGIN GOOGLE-INTERNAL See go/udm:collections for additional details. END GOOGLE-INTERNAL An example use case for Collection is to model a detection and investigation from detection finding metadata to investigative state collected in the course of the investigation. For more complex investigation and response workflows a Collection could represent an incident consisting of multiple child findings or incidents. This can be expanded on to model remediation elements of a full detection and response workflow. NEXT TAG: 20
idCollection
properties
caseName
descriptionThe resource name of the Case that this collection belongs to. Example: projects/{project id}/locations/{region}/chronicle/cases/{internal_case_id}
typestring
collectionElements
descriptionConstituent elements of the collection. Each element shares an association that groups it together and is a component of the overall collection. For example, a detection collection may have several constituent elements that each share a correlation association that together represent a particular pattern or behavior.
items
$refElement
typearray
createdTime
descriptionTime the collection was created.
formatgoogle-datetime
typestring
dataAccessScope
descriptionThe resource name of the DataAccessScope of this collection. BEGIN GOOGLE-INTERNAL We may change this name based on the final resource design of the scope. END GOOGLE-INTERNAL
typestring
detection
descriptionDetection metadata for findings that represent detections, can include rule details, machine learning model metadata, and indicators implicated in the detection (using the .about field).
items
$refSecurityResult
typearray
detectionTime
descriptionTimestamp within the time_window related to the time of the collection_elements. For Rule Detections, this timestamp is the end of the the time_window for multi-event rules or the time of the event for single event rules. For late-arriving events that trigger new alerts, the detection_time will be the event time of the event.
formatgoogle-datetime
typestring
feedbackHistory
descriptionThe history of feedback submitted by analysts for this finding, in descending order by timestamp. This field is limited to the most recent 1000 feedback events. The primary feedback will also be included in this list.
items
$refFeedback
typearray
feedbackSummary
$refFeedback
descriptionThe current primary analyst feedback. This does not include the history of feedback given, which may be supplied in `feedback`.
id
descriptionUnique ID for the collection. The ID is specific to the type of collection. For example, with rule detections this is the detection ID.
typestring
idNamespace
descriptionThe ID namespace used for the Collection.
enum
  • NORMALIZED_TELEMETRY
  • RAW_TELEMETRY
  • RULE_DETECTIONS
  • UPPERCASE
  • MACHINE_INTELLIGENCE
  • SECURITY_COMMAND_CENTER
  • UNSPECIFIED
  • SOAR_ALERT
  • VIRUS_TOTAL
enumDescriptions
  • Ingested and Normalized telemetry events
  • Ingested Raw telemetry
  • Chronicle Rules engine
  • Uppercase
  • DSML - Machine Intelligence
  • A normalized telemetry event from Google Security Command Center.
  • Unspecified Namespace
  • An alert coming from other SIEMs via Chronicle SOAR.
  • VirusTotal.
typestring
investigation
$refInvestigation
descriptionConsolidated investigation details (categorization, status, etc) typically for collections that begin as detection findings and then evolve with analyst action and feedback into investigations around the detection output.
lastUpdatedTime
descriptionTime the collection was last updated.
formatgoogle-datetime
typestring
responsePlatformInfo
$refResponsePlatformInfo
descriptionAlert related info of this same alert in customer's SOAR platform.
soarAlert
descriptionA boolean field indicating that the alert is present in SOAR.
typeboolean
soarAlertMetadata
$refSoarAlertMetadata
descriptionMetadata fields of alerts coming from other SIEM systems via SOAR.
tags
descriptionTags set by UC/DSML/RE for the Finding during creation.
items
typestring
typearray
timeWindow
$refInterval
descriptionTime interval that the collection represents.
type
descriptionWhat the collection represents.
enum
  • COLLECTION_TYPE_UNSPECIFIED
  • TELEMETRY_ALERT
  • GCTI_FINDING
  • UPPERCASE_ALERT
  • RULE_DETECTION
  • MACHINE_INTELLIGENCE_ALERT
  • SOAR_ALERT
enumDescriptions
  • An unspecified collection type.
  • An alert reported in customer telemetry.
  • A finding from the Uppercase team.
  • A detection found by applying a rule.
  • An alert generated by Chronicle machine learning models.
  • An alert coming from other SIEMs via Chronicle SOAR.
typestring
typeobject
ColumnNames
idColumnNames
properties
names
items
typestring
typearray
typeobject
CompilationDiagnostic
descriptionCompilationDiagnostic represents a compilation diagnostic generated during a rule's compilation, such as a compilation error or a compilation warning.
idCompilationDiagnostic
properties
message
descriptionOutput only. The diagnostic message.
readOnlyTrue
typestring
position
$refCompilationPosition
descriptionOutput only. The approximate position in the rule text associated with the compilation diagnostic. Compilation Position may be empty.
readOnlyTrue
severity
descriptionOutput only. The severity of a rule's compilation diagnostic.
enum
  • SEVERITY_UNSPECIFIED
  • WARNING
  • ERROR
enumDescriptions
  • An unspecified severity level.
  • A compilation warning.
  • A compilation error.
readOnlyTrue
typestring
uri
descriptionOutput only. Link to documentation that describes a diagnostic in more detail.
readOnlyTrue
typestring
typeobject
CompilationPosition
descriptionCompilationPosition represents the location of a compilation diagnostic in rule text.
idCompilationPosition
properties
endColumn
descriptionOutput only. End column number, beginning at 1.
formatint32
readOnlyTrue
typeinteger
endLine
descriptionOutput only. End line number, beginning at 1.
formatint32
readOnlyTrue
typeinteger
startColumn
descriptionOutput only. Start column number, beginning at 1.
formatint32
readOnlyTrue
typeinteger
startLine
descriptionOutput only. Start line number, beginning at 1.
formatint32
readOnlyTrue
typeinteger
typeobject
CreateParserExtensionMetadata
descriptionOperation metadata for creating a parser extension.
idCreateParserExtensionMetadata
properties
state
descriptionThe state of the parser extension creation process.
enum
  • STATE_UNSPECIFIED
  • NEW
  • VALIDATING
  • LIVE
  • REJECTED
  • INTERNAL_ERROR
  • VALIDATED
  • ARCHIVED
enumDescriptions
  • The state for this parser extension was not specified.
  • The parser extension has been newly submitted and is waiting to be validated.
  • The parser extension is currently going through the validation pipeline.
  • The parser extension is live in production. Only configs that have successfully passed the validation stage will be set to LIVE.
  • Validation completed, but the parser extension was rejected with errors.
  • An error occurred when processing this parser extension.
  • Extension is validated.
  • Extension is archived and is no more being used.
typestring
stateLastChangedTime
descriptionThe time the config state was last changed.
formatgoogle-datetime
typestring
validationErrors
descriptionAny validation error while validating the extension, this have cap of size 10
items
typestring
typearray
validationReport
descriptionThe validation report generated during validation of the parser extension.
typestring
typeobject
CreateParserMetadata
descriptionOperation metadata for creating a parser.
idCreateParserMetadata
properties
stage
descriptionThe validation stage of the parser creation process.
enum
  • VALIDATION_STAGE_UNSPECIFIED
  • NEW
  • VALIDATING
  • PASSED
  • FAILED
  • DELETE_CANDIDATE
enumDescriptions
  • The validation stage is not specified.
  • The custom parser is submitted for validation.
  • The custom parser is currently going through the validation pipeline
  • The custom parser has successfully passed the validation.
  • The custom parser has failed validation.
  • The parser is no good, It is available for auto deletion.
typestring
validationReport
descriptionThe validation report generated during validation of the parser.
typestring
typeobject
DNSRecord
descriptionDNS record.
idDNSRecord
properties
expire
descriptionExpire.
formatgoogle-duration
typestring
minimum
descriptionMinimum.
formatgoogle-duration
typestring
priority
descriptionPriority.
formatint64
typestring
refresh
descriptionRefresh.
formatgoogle-duration
typestring
retry
descriptionRetry.
formatint64
typestring
rname
descriptionRname.
typestring
serial
descriptionSerial.
formatint64
typestring
ttl
descriptionTime to live.
formatgoogle-duration
typestring
type
descriptionType.
typestring
value
descriptionValue.
typestring
typeobject
DataAccessIngestionLabel
idDataAccessIngestionLabel
properties
key
descriptionThe key.
typestring
value
descriptionThe value.
typestring
typeobject
DataAccessLabel
descriptionA DataAccessLabel is a label on events to define user access to data.
idDataAccessLabel
properties
author
descriptionOutput only. The user who created the data access label.
readOnlyTrue
typestring
createTime
descriptionOutput only. The time at which the data access label was created.
formatgoogle-datetime
readOnlyTrue
typestring
description
descriptionOptional. A description of the data access label for a human reader.
typestring
displayName
descriptionOutput only. The short name displayed for the label as it appears on event data.
readOnlyTrue
typestring
lastEditor
descriptionOutput only. The user who last updated the data access label.
readOnlyTrue
typestring
name
descriptionRequired. The unique resource name of the data access label.
typestring
udmQuery
descriptionA UDM query over event data.
typestring
updateTime
descriptionOutput only. The time at which the data access label was last updated.
formatgoogle-datetime
readOnlyTrue
typestring
typeobject
DataAccessLabelReference
descriptionReference object to a data access label.
idDataAccessLabelReference
properties
assetNamespace
descriptionThe asset namespace configured in the forwarder of the customer's events.
typestring
dataAccessLabel
descriptionThe name of the data access label.
typestring
displayName
descriptionOutput only. The display name of the label. Data access label and log types's name will match the display name of the resource. The asset namespace will match the namespace itself. The ingestion key value pair will match the key of the tuple.
readOnlyTrue
typestring
ingestionLabel
$refIngestionLabel
descriptionThe ingestion label configured in the forwarder of the customer's events.
logType
descriptionThe name of the log type.
typestring
typeobject
DataAccessLabels
idDataAccessLabels
properties
allowScopedAccess
descriptionAre the labels ready for scoped access
typeboolean
customLabels
descriptionAll the complex labels (UDM search syntax based).
items
typestring
typearray
ingestionKvLabels
descriptionAll the ingestion labels (key/value pairs).
items
$refDataAccessIngestionLabel
typearray
ingestionLabels
deprecatedTrue
descriptionAll the ingestion labels.
items
typestring
typearray
logTypes
descriptionAll the LogType labels.
items
typestring
typearray
namespaces
descriptionAll the namespaces.
items
typestring
typearray
typeobject
DataAccessScope
descriptionA DataAccessScope is a boolean expression of data access labels used to restrict access to data for users.
idDataAccessScope
properties
allowAll
descriptionOptional. Whether or not the scope allows all labels, allow_all and allowed_data_access_labels are mutually exclusive and one of them must be present. denied_data_access_labels can still be used along with allow_all. When combined with denied_data_access_labels, access will be granted to all data that doesn't have labels mentioned in denied_data_access_labels. E.g.: A customer with scope with denied labels A and B and allow_all will be able to see all data except data labeled with A and data labeled with B and data with labels A and B.
typeboolean
allowedDataAccessLabels
descriptionOptional. The allowed labels for the scope. Either allow_all or allowed_data_access_labels needs to be provided. When provided, there has to be at least one label allowed for the scope to be valid. The logical operator for evaluation of the allowed labels is OR. E.g.: A customer with scope with allowed labels A and B will be able to see data with labeled with A or B or (A and B).
items
$refDataAccessLabelReference
typearray
author
descriptionOutput only. The user who created the data access scope.
readOnlyTrue
typestring
createTime
descriptionOutput only. The time at which the data access scope was created.
formatgoogle-datetime
readOnlyTrue
typestring
deniedDataAccessLabels
descriptionOptional. The denied labels for the scope. The logical operator for evaluation of the denied labels is AND. E.g.: A customer with scope with denied labels A and B won't be able to see data labeled with A and data labeled with B and data with labels A and B.
items
$refDataAccessLabelReference
typearray
description
descriptionOptional. A description of the data access scope for a human reader.
typestring
displayName
descriptionOutput only. The name to be used for display to customers of the data access scope.
readOnlyTrue
typestring
lastEditor
descriptionOutput only. The user who last updated the data access scope.
readOnlyTrue
typestring
name
descriptionRequired. The unique full name of the data access scope. The name should comply with https://google.aip.dev/122 standards.
typestring
updateTime
descriptionOutput only. The time at which the data access scope was last updated.
formatgoogle-datetime
readOnlyTrue
typestring
typeobject
Date
descriptionRepresents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values. * A month and day, with a zero year (for example, an anniversary). * A year on its own, with a zero month and a zero day. * A year and month, with a zero day (for example, a credit card expiration date). Related types: * google.type.TimeOfDay * google.type.DateTime * google.protobuf.Timestamp
idDate
properties
day
descriptionDay of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.
formatint32
typeinteger
month
descriptionMonth of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.
formatint32
typeinteger
year
descriptionYear of the date. Must be from 1 to 9999, or 0 to specify a date without a year.
formatint32
typeinteger
typeobject
Detections
idDetections
properties
baselineAlertsCount
formatint32
typeinteger
complete
typeboolean
detectionFieldAggregations
$refAlertFieldAggregations
detections
items
$refCollection
typearray
filteredAlertsCount
formatint32
typeinteger
tooManyDetections
typeboolean
validSnapshotQuery
typeboolean
typeobject
Dhcp
descriptionDHCP information.
idDhcp
properties
chaddr
descriptionClient hardware address (chaddr).
typestring
ciaddr
descriptionClient IP address (ciaddr).
typestring
clientHostname
descriptionClient hostname. See RFC2132, section 3.14.
typestring
clientIdentifier
descriptionClient identifier. See RFC2132, section 9.14. Note: Make sure to update the client_identifier_string field as well if you update this field.
formatbyte
typestring
clientIdentifierString
descriptionClient identifier as string. See RFC2132, section 9.14. This field holds the string value of the client_identifier.
typestring
file
descriptionBoot image filename.
typestring
flags
descriptionFlags.
formatuint32
typeinteger
giaddr
descriptionRelay agent IP address (giaddr).
typestring
hlen
descriptionHardware address length.
formatuint32
typeinteger
hops
descriptionHardware ops.
formatuint32
typeinteger
htype
descriptionHardware address type.
formatuint32
typeinteger
leaseTimeSeconds
descriptionLease time in seconds. See RFC2132, section 9.2.
formatuint32
typeinteger
opcode
descriptionThe BOOTP op code.
enum
  • UNKNOWN_OPCODE
  • BOOTREQUEST
  • BOOTREPLY
enumDescriptions
  • Default opcode.
  • Request.
  • Reply.
typestring
options
descriptionList of DHCP options.
items
$refOption
typearray
requestedAddress
descriptionRequested IP address. See RFC2132, section 9.1.
typestring
seconds
descriptionSeconds elapsed since client began address acquisition/renewal process.
formatuint32
typeinteger
siaddr
descriptionIP address of the next bootstrap server.
typestring
sname
descriptionServer name that the client wishes to boot from.
typestring
transactionId
descriptionTransaction ID.
formatuint32
typeinteger
type
descriptionDHCP message type.
enum
  • UNKNOWN_MESSAGE_TYPE
  • DISCOVER
  • OFFER
  • REQUEST
  • DECLINE
  • ACK
  • NAK
  • RELEASE
  • INFORM
  • WIN_DELETED
  • WIN_EXPIRED
enumDescriptions
  • Default message type.
  • DHCPDISCOVER.
  • DHCPOFFER.
  • DHCPREQUEST.
  • DHCPDECLINE.
  • DHCPACK.
  • DHCPNAK.
  • DHCPRELEASE.
  • DHCPINFORM.
  • Microsoft Windows DHCP "lease deleted".
  • Microsoft Windows DHCP "lease expired".
typestring
yiaddr
descriptionYour IP address (yiaddr).
typestring
typeobject
Dns
descriptionDNS information.
idDns
properties
additional
descriptionA list of additional domain name servers that can be used to verify the answer to the domain.
items
$refResourceRecord
typearray
answers
descriptionA list of answers to the domain name query.
items
$refResourceRecord
typearray
authoritative
descriptionOther DNS header flags. See RFC1035, section 4.1.1.
typeboolean
authority
descriptionA list of domain name servers which verified the answers to the domain name queries.
items
$refResourceRecord
typearray
id
descriptionDNS query id.
formatuint32
typeinteger
opcode
descriptionThe DNS OpCode used to specify the type of DNS query (for example, QUERY, IQUERY, or STATUS).
formatuint32
typeinteger
questions
descriptionA list of domain protocol message questions.
items
$refQuestion
typearray
recursionAvailable
descriptionWhether a recursive DNS lookup is available.
typeboolean
recursionDesired
descriptionWhether a recursive DNS lookup is desired.
typeboolean
response
descriptionSet to true if the event is a DNS response. See QR field from RFC1035.
typeboolean
responseCode
descriptionResponse code. See RCODE from RFC1035.
formatuint32
typeinteger
truncated
descriptionWhether the DNS response was truncated.
typeboolean
typeobject
Domain
descriptionInformation about a domain.
idDomain
properties
admin
$refUser
descriptionParsed contact information for the administrative contact for the domain.
auditUpdateTime
descriptionAudit updated time.
formatgoogle-datetime
typestring
billing
$refUser
descriptionParsed contact information for the billing contact of the domain.
categories
descriptionCategories assign to the domain as retrieved from VirusTotal.
items
typestring
typearray
contactEmail
descriptionContact email address.
typestring
creationTime
descriptionDomain creation time.
formatgoogle-datetime
typestring
expirationTime
descriptionExpiration time.
formatgoogle-datetime
typestring
favicon
$refFavicon
descriptionIncludes difference hash and MD5 hash of the domain's favicon.
firstSeenTime
descriptionFirst seen timestamp of the domain in the customer's environment.
formatgoogle-datetime
typestring
ianaRegistrarId
descriptionIANA Registrar ID. See https://www.iana.org/assignments/registrar-ids/registrar-ids.xhtml
formatint32
typeinteger
jarm
descriptionDomain's JARM hash.
typestring
lastDnsRecords
descriptionDomain's DNS records from the last scan.
items
$refDNSRecord
typearray
lastDnsRecordsTime
descriptionDate when the DNS records list was retrieved by VirusTotal.
formatgoogle-datetime
typestring
lastHttpsCertificate
$refSSLCertificate
descriptionSSL certificate object retrieved last time the domain was analyzed.
lastHttpsCertificateTime
descriptionWhen the certificate was retrieved by VirusTotal.
formatgoogle-datetime
typestring
lastSeenTime
descriptionLast seen timestamp of the domain in the customer's environment.
formatgoogle-datetime
typestring
name
descriptionThe domain name. This field can be used as an entity indicator for Domain entities.
typestring
nameServer
descriptionRepeated list of name servers.
items
typestring
typearray
popularityRanks
descriptionDomain's position in popularity ranks such as Alexa, Quantcast, Statvoo, etc
items
$refPopularityRank
typearray
prevalence
$refPrevalence
descriptionThe prevalence of the domain within the customer's environment.
privateRegistration
descriptionIndicates whether the domain appears to be using a private registration service to mask the owner's contact information.
typeboolean
registrant
$refUser
descriptionParsed contact information for the registrant of the domain.
registrar
descriptionRegistrar name . FOr example, "Wild West Domains, Inc. (R120-LROR)", "GoDaddy.com, LLC", or "PDR LTD. D/B/A PUBLICDOMAINREGISTRY.COM".
typestring
registryDataRawText
descriptionRegistry Data raw text.
formatbyte
typestring
status
descriptionDomain status. See https://www.icann.org/resources/pages/epp-status-codes-2014-06-16-en for meanings of possible values
typestring
tags
descriptionList of representative attributes.
items
typestring
typearray
tech
$refUser
descriptionParsed contact information for the technical contact for the domain
updateTime
descriptionLast updated time.
formatgoogle-datetime
typestring
whoisRecordRawText
descriptionWHOIS raw text.
formatbyte
typestring
whoisServer
descriptionWhois server name.
typestring
whoisTime
descriptionDate of the last update of the WHOIS record.
formatgoogle-datetime
typestring
zone
$refUser
descriptionParsed contact information for the zone.
typeobject
DoubleSequence
descriptionDoubleSequence represents a sequence of doubles.
idDoubleSequence
properties
doubleVals
descriptiondouble sequence.
items
formatdouble
typenumber
typearray
typeobject
EC
descriptionEC public key information.
idEC
properties
oid
descriptionCurve name.
typestring
pub
descriptionPublic key hexdump.
typestring
typeobject
Element
descriptionNEXT TAG: 5
idElement
properties
association
$refSecurityResult
descriptionMetadata that provides the relevant association for the references in the element. For a detection, this can be the correlated aspect of the references that contributed to the overall detection. For example, may include sub-rule condition, machine learning model metadata, and/or indicators implicated in this component of the detection (using the .about field).
label
descriptionA name that labels the entire references group.
typestring
references
descriptionReferences to model primatives including events and entities that share a common association. Even though a reference can have both UDM and entity, a collection of references (of a single element) will only have one type of message in it (either UDM / Entity).
items
$refReference
typearray
referencesSampled
descriptionCopied from the detection event_sample.too_many_event_samples field. If true, the number of references will be capped at the sample limit (set at rule service). This is applicable to both UDM references and Entity references.
typeboolean
typeobject
Email
descriptionEmail info.
idEmail
properties
bcc
descriptionA list of 'bcc' addresses.
items
typestring
typearray
bounceAddress
descriptionThe envelope from address. https://en.wikipedia.org/wiki/Bounce_address
typestring
cc
descriptionA list of 'cc' addresses.
items
typestring
typearray
from
descriptionThe 'from' address.
typestring
mailId
descriptionThe mail (or message) ID.
typestring
replyTo
descriptionThe 'reply to' address.
typestring
subject
descriptionThe subject line(s) of the email.
items
typestring
typearray
to
descriptionA list of 'to' addresses.
items
typestring
typearray
typeobject
Empty
descriptionA generic empty message that you can re-use to avoid defining duplicated empty messages in your APIs. A typical example is to use it as the request or the response type of an API method. For instance: service Foo { rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty); }
idEmpty
properties
typeobject
EntityChangedCountTimelineBucket
idEntityChangedCountTimelineBucket
properties
entityChangedInfo
items
$refEntityChangedInfo
typearray
totalChangedEntitiesCount
formatint32
typeinteger
typeobject
EntityChangedInfo
idEntityChangedInfo
properties
artifacts
$refFieldAndValue
entityCount
formatint32
typeinteger
typeobject
EntityCount
descriptionCount of different types of entities in the watchlist.
idEntityCount
properties
asset
descriptionOutput only. Count of asset type entities in the watchlist.
formatint32
readOnlyTrue
typeinteger
user
descriptionOutput only. Count of user type entities in the watchlist.
formatint32
readOnlyTrue
typeinteger
typeobject
EntityMetadata
descriptionInformation about the Entity and the product where the entity was created. Next Tag: 17
idEntityMetadata
properties
collectedTimestamp
descriptionGMT timestamp when the entity information was collected by the vendor's local collection infrastructure.
formatgoogle-datetime
typestring
creationTimestamp
descriptionGMT timestamp when the entity described by the product_entity_id was created on the system where data was collected.
formatgoogle-datetime
typestring
description
descriptionHuman-readable description of the entity.
typestring
entityType
descriptionEntity type. If an entity has multiple possible types, this specifies the most specific type.
enum
  • UNKNOWN_ENTITYTYPE
  • ASSET
  • USER
  • GROUP
  • RESOURCE
  • IP_ADDRESS
  • FILE
  • DOMAIN_NAME
  • URL
  • MUTEX
  • METRIC
enumDescriptions
  • @hide_from_doc
  • An asset, such as workstation, laptop, phone, virtual machine, etc.
  • User.
  • Group.
  • Resource.
  • An external IP address.
  • A file.
  • A domain.
  • A url.
  • A mutex.
  • A metric.
typestring
eventMetadata
$refMetadata
descriptionMetadata field from the event.
extracted
additionalProperties
descriptionProperties of the object.
typeany
descriptionFlattened fields extracted from the log.
typeobject
feed
descriptionVendor feed name for a threat indicator feed.
typestring
interval
$refInterval
descriptionValid existence time range for the version of the entity represented by this entity data.
productEntityId
descriptionA vendor-specific identifier that uniquely identifies the entity (e.g. a GUID, LDAP, OID, or similar).
typestring
productName
descriptionProduct name that produced the entity information.
typestring
productVersion
descriptionVersion of the product that produced the entity information.
typestring
sourceLabels
descriptionEntity source metadata labels.
items
$refLabel
typearray
sourceType
descriptionThe source of the entity.
enum
  • SOURCE_TYPE_UNSPECIFIED
  • ENTITY_CONTEXT
  • DERIVED_CONTEXT
  • GLOBAL_CONTEXT
enumDescriptions
  • Default source type
  • Entities ingested from customers (e.g. AD_CONTEXT, DLP_CONTEXT)
  • Entities derived from customer data such as prevalence, artifact first/last seen, or asset/user first seen stats.
  • Global contextual entities such as WHOIS or Safe Browsing.
typestring
structuredFields
additionalProperties
descriptionProperties of the object.
typeany
deprecatedTrue
descriptionStructured fields extracted from the log.
typeobject
threat
descriptionMetadata provided by a threat intelligence feed that identified the entity as malicious.
items
$refSecurityResult
typearray
vendorName
descriptionVendor name of the product that produced the entity information.
typestring
typeobject
EntityPopulationMechanism
descriptionMechanism to populate entities in the watchlist.
idEntityPopulationMechanism
properties
manual
$refManual
descriptionOptional. Entities are added manually.
typeobject
EntityRisk
descriptionStores information related to the risk score of an entity. Next ID: 15
idEntityRisk
properties
DEPRECATEDRiskScore
deprecatedTrue
descriptionDeprecated risk score.
formatint32
typeinteger
detailUri
descriptionLink to the Google Security Operations UI with information about the entity risk score. If the SecOps instance has multiple frontend paths configured, this will be a relative path that can be used to construct the full URL.
typestring
detectionsCount
descriptionNumber of detections that make up the risk score within the time window.
formatint32
typeinteger
firstDetectionTime
descriptionTimestamp of the first detection within the specified time window. This field is empty when there are no detections.
formatgoogle-datetime
typestring
lastDetectionTime
descriptionTimestamp of the last detection within the specified time window. This field is empty when there are no detections.
formatgoogle-datetime
typestring
lastResetTime
descriptionTimestamp for UEBA risk score reset based deduplication. Used specifically for risk based meta rules.
formatgoogle-datetime
typestring
normalizedRiskScore
descriptionNormalized risk score for the entity. This value is between 0-1000.
formatint32
typeinteger
rawRiskDelta
$refRiskDelta
descriptionRepresents the change in raw risk score for an entity between the end of the previous time window and the end of the current time window.
riskDelta
$refRiskDelta
descriptionRepresents the change in risk score for an entity between the end of the previous time window and the end of the current time window.
riskScore
descriptionRaw risk score for the entity.
formatfloat
typenumber
riskVersion
descriptionVersion of the risk score calculation algorithm.
typestring
riskWindow
$refInterval
descriptionTime window used when computing the risk score for an entity, for example 24 hours or 7 days.
riskWindowHasNewDetections
descriptionWhether there are new detections for the risk window.
typeboolean
riskWindowSize
descriptionRisk window duration for the entity.
formatgoogle-duration
typestring
typeobject
ErrorMessage
idErrorMessage
properties
errorText
typestring
type
enum
  • UNDEFINED_ERROR_TYPE
  • INVALID_QUERY_TYPE
  • INVALID_FIELD_PATH_TYPE
  • UNCLOSED_BRACKET_TYPE
  • BACKEND_ERROR_TYPE
  • UNCLOSED_QUOTES_TYPE
  • QUERY_TOO_LARGE_TYPE
enumDescriptions
typestring
typeobject
EventCountTimeline
idEventCountTimeline
properties
buckets
items
$refEventCountTimelineBucket
typearray
sizeOfBucketMs
formatint64
typestring
typeobject
EventCountTimelineBucket
idEventCountTimelineBucket
properties
alertCount
formatint32
typeinteger
baselineAlertCount
formatint32
typeinteger
baselineEventCount
formatint32
typeinteger
baselineTimedEntityCount
formatint32
typeinteger
entityChangedCount
$refEntityChangedCountTimelineBucket
eventCount
formatint32
typeinteger
filteredTimedEntityCount
formatint32
typeinteger
typeobject
Execution
descriptionExecution can be used to store metadata required for what action the UI should execute.
idExecution
properties
metadata
additionalProperties
typestring
descriptionOutput only. The payload to use when executing the action.
readOnlyTrue
typeobject
typeobject
ExifInfo
descriptionExif information.
idExifInfo
properties
company
descriptioncompany name.
typestring
compilationTime
descriptionCompilation time.
formatgoogle-datetime
typestring
entryPoint
descriptionentry point.
formatint64
typestring
fileDescription
descriptiondescription of a file.
typestring
originalFile
descriptionoriginal file name.
typestring
product
descriptionproduct name.
typestring
typeobject
Extension
descriptionCertificate's extensions.
idExtension
properties
authorityKeyId
$refAuthorityKeyId
descriptionIdentifies the public key to be used to verify the signature on this certificate or CRL.
ca
descriptionWhether the subject acts as a certificate authority (CA) or not.
typeboolean
caInfoAccess
descriptionAuthority information access locations are URLs that are added to a certificate in its authority information access extension.
typestring
certTemplateNameDc
descriptionBMP data value "DomainController". See MS Q291010.
typestring
certificatePolicies
descriptionDifferent certificate policies will relate to different applications which may use the certified key.
typestring
crlDistributionPoints
descriptionCRL distribution points to which a certificate user should refer to ascertain if the certificate has been revoked.
typestring
extendedKeyUsage
descriptionOne or more purposes for which the certified public key may be used, in addition to or in place of the basic purposes indicated in the key usage extension field.
typestring
keyUsage
descriptionThe purpose for which the certified public key is used.
typestring
netscapeCertComment
descriptionUsed to include free-form text comments inside certificates.
typestring
netscapeCertificate
descriptionIdentify whether the certificate subject is an SSL client, an SSL server, or a CA.
typeboolean
oldAuthorityKeyId
descriptionWhether the certificate has an old authority key identifier extension.
typeboolean
peLogotype
descriptionWhether the certificate includes a logotype.
typeboolean
subjectAlternativeName
descriptionContains one or more alternative names, using any of a variety of name forms, for the entity that is bound by the CA to the certified public key.
typestring
subjectKeyId
descriptionIdentifies the public key being certified.
typestring
typeobject
Extensions
descriptionExtensions to a UDM event.
idExtensions
properties
auth
$refAuthentication
descriptionAn authentication extension.
entityRisk
$refEntityRisk
descriptionAn entity risk change extension.
vulns
$refVulnerabilities
descriptionA vulnerability extension.
typeobject
Favicon
descriptionDifference hash and MD5 hash of the domain's favicon.
idFavicon
properties
dhash
descriptionDifference hash.
typestring
rawMd5
descriptionFavicon's MD5 hash.
typestring
typeobject
Feedback
idFeedback
properties
comment
descriptionOptional.
typestring
confidenceScore
formatint32
typeinteger
createdTime
formatgoogle-datetime
typestring
disregarded
typeboolean
idpUserId
typestring
priority
descriptionOptional.
enum
  • PRIORITY_UNSPECIFIED
  • PRIORITY_INFO
  • PRIORITY_LOW
  • PRIORITY_MEDIUM
  • PRIORITY_HIGH
  • PRIORITY_CRITICAL
enumDescriptions
  • Default priority level.
  • Informational priority.
  • Low priority.
  • Medium priority.
  • High priority.
  • Critical priority.
typestring
priorityDisplay
descriptionOptional.
typestring
reason
descriptionOptional.
enum
  • REASON_UNSPECIFIED
  • REASON_NOT_MALICIOUS
  • REASON_MALICIOUS
  • REASON_MAINTENANCE
enumDescriptions
  • Default reason.
  • Case or Alert not malicious.
  • Case or Alert is malicious.
  • Case or Alert is under maintenance.
typestring
reputation
enum
  • REPUTATION_UNSPECIFIED
  • USEFUL
  • NOT_USEFUL
enumDescriptions
  • An unspecified reputation.
  • A categorization of the finding as useful.
  • A categorization of the finding as not useful.
typestring
riskScore
formatint32
typeinteger
rootCause
descriptionOptional.
typestring
severity
formatint32
typeinteger
severityDisplay
descriptionOptional.
typestring
status
descriptionOptional.
enum
  • STATUS_UNSPECIFIED
  • NEW
  • REVIEWED
  • CLOSED
  • OPEN
enumDescriptions
  • Unspecified finding status.
  • New finding.
  • When a finding has feedback.
  • When an analyst closes an finding.
  • Open. Used to indicate that a Case / Alert is open.
typestring
verdict
enum
  • VERDICT_UNSPECIFIED
  • TRUE_POSITIVE
  • FALSE_POSITIVE
enumDescriptions
  • An unspecified verdict.
  • A categorization of the finding as a "true positive".
  • A categorization of the finding as a "false positive".
typestring
typeobject
FieldAndValue
idFieldAndValue
properties
entityNamespace
typestring
fieldPath
typestring
kvalueType
enum
  • UNKNOWN
  • COLLECTOR_ID
  • EVENT_SHARD
  • ASSET_IP_ADDRESS
  • MAC
  • HOSTNAME
  • PRODUCT_SPECIFIC_ID
  • NAMESPACE
  • DOMAIN_NAME
  • RESOLVED_IP_ADDRESS
  • STEMMED_DOMAIN_NAME
  • PROCESS_ID
  • FULL_COMMAND_LINE
  • FILE_NAME
  • FILE_PATH
  • HASH_MD5
  • HASH_SHA256
  • HASH_SHA1
  • RAW_PID
  • PARENT_PROCESS_ID
  • EMAIL
  • USERNAME
  • WINDOWS_SID
  • EMPLOYEE_ID
  • PRODUCT_OBJECT_ID
  • USER_DISPLAY_NAME
  • CLOUD_RESOURCE_NAME
  • REGISTRY_KEY
  • REGISTRY_VALUE_DATA
  • REGISTRY_VALUE_NAME
enumDescriptions
typestring
value
typestring
typeobject
FileMetadata
descriptionMetadata about a file. Place metadata about different file types here, for example data from the Microsoft Windows VersionInfo block or digital signer details. Use a different sub-message per file type.
idFileMetadata
properties
pe
$refPeFileMetadata
deprecatedTrue
descriptionMetadata for Microsoft Windows PE files. Deprecate PeFileMetadata in favor of single File proto.
typeobject
FileMetadataCodesign
descriptionFile metadata from the codesign utility.
idFileMetadataCodesign
properties
compilationTime
descriptionCode sign timestamp
formatgoogle-datetime
typestring
format
descriptionCode sign format.
typestring
id
descriptionCode sign identifier.
typestring
teamId
descriptionThe assigned team identifier of the developer who signed the application.
typestring
typeobject
FileMetadataImports
descriptionFile metadata imports.
idFileMetadataImports
properties
functions
descriptionFunction field.
items
typestring
typearray
library
descriptionLibrary field.
typestring
typeobject
FileMetadataPE
descriptionMetadata about the Portable Executable (PE) file.
idFileMetadataPE
properties
compilationExiftoolTime
descriptioninfo.exiftool.TimeStamp.
formatgoogle-datetime
typestring
compilationTime
descriptioninfo.pe-timestamp.
formatgoogle-datetime
typestring
entryPoint
descriptioninfo.pe-entry-point.
formatint64
typestring
entryPointExiftool
descriptioninfo.exiftool.EntryPoint.
formatint64
typestring
imphash
descriptionImphash of the file.
typestring
imports
descriptionFilemetadataImports fields.
items
$refFileMetadataImports
typearray
resource
descriptionFilemetadataPeResourceInfo fields.
items
$refFileMetadataPeResourceInfo
typearray
resourcesLanguageCount
deprecatedTrue
descriptionDeprecated: use resources_language_count_str.
items
$refStringToInt64MapEntry
typearray
resourcesLanguageCountStr
descriptionNumber of resources by language. Example: NEUTRAL: 20, ENGLISH US: 10
items
$refLabel
typearray
resourcesTypeCount
deprecatedTrue
descriptionDeprecated: use resources_type_count_str.
items
$refStringToInt64MapEntry
typearray
resourcesTypeCountStr
descriptionNumber of resources by resource type. Example: RT_ICON: 10, RT_DIALOG: 5
items
$refLabel
typearray
section
descriptionFilemetadataSection fields.
items
$refFileMetadataSection
typearray
signatureInfo
$refFileMetadataSignatureInfo
deprecatedTrue
descriptionFilemetadataSignatureInfo field. deprecated, user File.signature_info instead.
typeobject
FileMetadataPeResourceInfo
descriptionFile metadata for PE resource.
idFileMetadataPeResourceInfo
properties
entropy
descriptionEntropy of the resource.
formatdouble
typenumber
fileType
descriptionFile type. Note that this value may not match any of the well-known type identifiers defined in the ResourceType enum.
typestring
filetypeMagic
descriptionType of resource content, as identified by the magic Python module.
typestring
languageCode
descriptionHuman-readable version of the language and sublanguage identifiers, as defined in the Microsoft Windows PE specification. Examples: | Language | Sublanguage | Field value | | LANG_NEUTRAL | SUBLANG_NEUTRAL | NEUTRAL | | LANG_FRENCH | - | FRENCH | | LANG_ENGLISH | SUBLANG_ENGLISH US | ENGLISH US |
typestring
sha256Hex
descriptionSHA256_hex field..
typestring
typeobject
FileMetadataSection
descriptionFile metadata section.
idFileMetadataSection
properties
entropy
descriptionEntropy of the section.
formatdouble
typenumber
md5Hex
descriptionMD5 hex of the file.
typestring
name
descriptionName of the section.
typestring
rawSizeBytes
descriptionRaw file size in bytes.
formatint64
typestring
virtualSizeBytes
descriptionVirtual file size in bytes.
formatint64
typestring
typeobject
FileMetadataSignatureInfo
descriptionSignature information.
idFileMetadataSignatureInfo
properties
signer
deprecatedTrue
descriptionDeprecated: use signers field.
items
typestring
typearray
signers
descriptionFile metadata signer information. The order of the signers matters. Each element is a higher level authority, being the last the root authority.
items
$refSignerInfo
typearray
verificationMessage
descriptionStatus of the certificate. Valid values are "Signed", "Unsigned" or a description of the certificate anomaly, if found.
typestring
verified
descriptionTrue if verification_message == "Signed"
typeboolean
x509
descriptionList of certificates.
items
$refX509
typearray
typeobject
FilterProperties
idFilterProperties
properties
hidden
typeboolean
stringProperties
additionalProperties
$refStringValues
typeobject
typeobject
FindingVariable
descriptionA structure that holds the value and associated metadata for values extracted while producing a Finding.
idFindingVariable
properties
boolSeq
$refBoolSequence
descriptionThe value in boolsequence format.
boolVal
descriptionThe value in boolean format.
typeboolean
bytesSeq
$refBytesSequence
descriptionThe value in bytessequence format.
bytesVal
descriptionThe value in bytes format.
formatbyte
typestring
doubleSeq
$refDoubleSequence
descriptionThe value in doublesequence format.
doubleVal
descriptionThe value in double format.
formatdouble
typenumber
int64Seq
$refInt64Sequence
descriptionThe value in int64sequence format.
int64Val
descriptionThe value in int64 format.
formatint64
typestring
nullVal
descriptionWhether the value is null.
typeboolean
sourcePath
descriptionThe UDM field path for the field which this value was derived from. Example: `principal.user.username`
typestring
stringSeq
$refStringSequence
descriptionThe value in stringsequence format.
stringVal
descriptionThe value in string format. Enum values are returned as strings.
typestring
type
descriptionThe type of the variable.
enum
  • TYPE_UNSPECIFIED
  • MATCH
  • OUTCOME
enumDescriptions
  • An unspecified variable type.
  • A variable coming from the match conditions.
  • A variable representing significant data that was found in the detection logic.
typestring
uint64Seq
$refUint64Sequence
descriptionThe value in uint64sequence format.
uint64Val
descriptionThe value in uint64 format.
formatuint64
typestring
value
descriptionThe value in string form.
typestring
typeobject
FollowUp
descriptionFollowUp can be used to store metadata required to send a follow up message by the UI.
idFollowUp
properties
followUp
descriptionOutput only. The text to use as input when generating the follow up message.
readOnlyTrue
typestring
typeobject
Ftp
descriptionFTP info.
idFtp
properties
command
descriptionThe FTP command.
typestring
typeobject
FunctionResponse
idFunctionResponse
properties
rows
items
$refFunctionResponseRow
typearray
tooManyRows
typeboolean
typeobject
FunctionResponseRow
idFunctionResponseRow
properties
values
items
$refUdmFieldValue
typearray
typeobject
GoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStats
descriptionLINT.IfChange(stats_data) Stats results when the query is for statistics NEXT TAG = 6;
idGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStats
properties
dataQueryExpression
descriptionExpression that represent the subset of the requested query used to filter data. The expression will be used to enable features such as drill-down from stats results to UDM events. In that case, the new query will be composed by this expression and the expression related to a stats result.
typestring
results
descriptionResult rows that are queried.
items
$refGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnData
typearray
sortOrder
descriptionIndicates the columns used for sorting and the order in which they are sorted. If no ORDER section is specified in the query, this will be empty.
items
$refGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnSort
typearray
tooManyResults
descriptionIf true, there are too many results to return and some have been omitted.
typeboolean
totalResults
descriptionThe total number of results returned.
formatint32
typeinteger
typeobject
GoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnData
descriptionRepresents a single column in the set of columns returned as the stats query result.
idGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnData
properties
column
descriptionUsed to store column names.
typestring
filterExpression
descriptionExpression used to compose a query for filtering/drill-downs related to the data in this column.
typestring
filterable
descriptionTo identify if the column can be used for filtering/drill-downs.
typeboolean
values
descriptionTo store store column data.
items
$refGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnType
typearray
typeobject
GoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnSort
descriptionContains the column name and which direction the column is sorted (ascending or descenging).
idGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnSort
properties
descending
descriptionWhether the column is sorted in descending order (ascending by default);
typeboolean
name
descriptionName of the column.
typestring
typeobject
GoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnType
descriptionSingular vs list of values in a column.
idGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnType
properties
list
$refGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnTypeList
descriptionList of values in a column e.g. IPs
value
$refGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnValue
descriptionSingle value in a column.
typeobject
GoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnTypeList
descriptionStore list of values in a column.
idGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnTypeList
properties
values
descriptionList of values in one cell of the column.
items
$refGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnValue
typearray
typeobject
GoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnValue
descriptionValue of the column based on data type
idGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnValue
properties
boolVal
descriptionBoolean value.
typeboolean
bytesVal
descriptionBytes value.
formatbyte
typestring
dateVal
$refDate
descriptionDate values.
doubleVal
descriptionDouble value.
formatdouble
typenumber
int64Val
descriptionInteger value (signed).
formatint64
typestring
nullVal
descriptionTrue if the value is NULL.
typeboolean
protoVal
additionalProperties
descriptionProperties of the object. Contains field @type with type URL.
typeany
descriptionFor any proto values that are not any of the above.
typeobject
stringVal
descriptionString value. Enum values are returned as strings.
typestring
timestampVal
descriptionTimestamp values.
formatgoogle-datetime
typestring
uint64Val
descriptionUn-signed integer value.
formatuint64
typestring
typeobject
Group
descriptionInformation about an organizational group.
idGroup
properties
attribute
$refAttribute
descriptionGeneric entity metadata attributes of the group.
creationTime
deprecatedTrue
descriptionGroup creation time. Deprecated: creation_time should be populated in Attribute as generic metadata.
formatgoogle-datetime
typestring
emailAddresses
descriptionEmail addresses of the group.
items
typestring
typearray
groupDisplayName
descriptionGroup display name. e.g. "Finance".
typestring
productObjectId
descriptionProduct globally unique user object identifier, such as an LDAP Object Identifier.
typestring
windowsSid
descriptionMicrosoft Windows SID of the group.
typestring
typeobject
GroupAggregationByField
idGroupAggregationByField
properties
baselineEventCount
formatint32
typeinteger
eventCount
formatint32
typeinteger
fieldName
typestring
fieldValue
$refUdmFieldValue
fields
items
$refUdmFieldAggregation
typearray
valueCount
formatint32
typeinteger
typeobject
Hardware
descriptionHardware specification details for a resource, including both physical and virtual hardware.
idHardware
properties
cpuClockSpeed
descriptionClock speed of the hardware CPU in MHz.
formatuint64
typestring
cpuMaxClockSpeed
descriptionMaximum possible clock speed of the hardware CPU in MHz.
formatuint64
typestring
cpuModel
descriptionModel description of the hardware CPU (e.g. "2.8 GHz Quad-Core Intel Core i5").
typestring
cpuNumberCores
descriptionNumber of CPU cores.
formatuint64
typestring
cpuPlatform
descriptionPlatform of the hardware CPU (e.g. "Intel Broadwell").
typestring
manufacturer
descriptionHardware manufacturer.
typestring
model
descriptionHardware model.
typestring
ram
descriptionAmount of the hardware ramdom access memory (RAM) in Mb.
formatuint64
typestring
serialNumber
descriptionHardware serial number.
typestring
typeobject
Http
descriptionSpecify the full URL of the HTTP request within "target". Also specify any uploaded or downloaded file information within "source" or "target".
idHttp
properties
method
descriptionThe HTTP request method (e.g. "GET", "POST", "PATCH", "DELETE").
typestring
parsedUserAgent
$refUserAgentProto
descriptionThe parsed user_agent string.
referralUrl
descriptionThe URL for the HTTP referer.
typestring
responseCode
descriptionThe response status code, for example 200, 302, 404, or 500.
formatint32
typeinteger
userAgent
descriptionThe User-Agent request header which includes the application type, operating system, software vendor or software version of the requesting software user agent.
typestring
typeobject
Id
descriptionIdentifier to identify a UDM object like a UDM event, Entity, Collection. The full identifier for persistence is created by setting the 32 most significant bits as the Id.Namespace enum and the rest according to go/udm:ids. This is a convenience wrapper to define the id space enum values and provide an easy interface for RPCs, most persistence use cases should use a denormalized form. See go/udm:ids for background and details.
idId
properties
id
descriptionFull raw ID.
formatbyte
typestring
namespace
descriptionNamespace the id belongs to.
enum
  • NORMALIZED_TELEMETRY
  • RAW_TELEMETRY
  • RULE_DETECTIONS
  • UPPERCASE
  • MACHINE_INTELLIGENCE
  • SECURITY_COMMAND_CENTER
  • UNSPECIFIED
  • SOAR_ALERT
  • VIRUS_TOTAL
enumDescriptions
  • Ingested and Normalized telemetry events
  • Ingested Raw telemetry
  • Chronicle Rules engine
  • Uppercase
  • DSML - Machine Intelligence
  • A normalized telemetry event from Google Security Command Center.
  • Unspecified Namespace
  • An alert coming from other SIEMs via Chronicle SOAR.
  • VirusTotal.
typestring
stringId
descriptionSome ids are stored as strings that are not able to be translated to bytes, so store these separately. Ex. detection id of the form de_aaaaaaaa-aaaa...
typestring
typeobject
IngestionLabel
descriptionRepresentation of an ingestion label type.
idIngestionLabel
properties
ingestionLabelKey
descriptionRequired. The key of the ingestion label. Always required.
typestring
ingestionLabelValue
descriptionOptional. The value of the ingestion label. Optional. An object with no provided value and some key provided would match against the given key and ANY value.
typestring
typeobject
InputsUsed
descriptionInputsUsed is a convenience field that tells us which sources of events (if any) were used in the rule. NEXT TAG: 4
idInputsUsed
properties
usesDetection
descriptionOptional. Whether the rule queries detections.
typeboolean
usesEntity
descriptionOptional. Whether the rule queries entity events.
typeboolean
usesUdm
descriptionOptional. Whether the rule queries UDM events.
typeboolean
typeobject
Instance
descriptionA Instance represents an instantiation of the Instance product.
idInstance
properties
name
descriptionOutput only. The resource name of this instance. Format: projects/{project}/locations/{location}/instances/{instance}
readOnlyTrue
typestring
typeobject
InstanceUdmSearchResponse
idInstanceUdmSearchResponse
properties
baselineEventsCount
formatint32
typeinteger
complete
typeboolean
detections
$refDetections
filteredEventsCount
formatint32
typeinteger
instanceId
typestring
prevalence
$refUdmPrevalenceResponse
progress
formatdouble
typenumber
runtimeErrors
$refRuntimeError
timeline
$refEventCountTimeline
tooManyEvents
typeboolean
typeobject
Int64Sequence
descriptionInt64Sequence represents a sequence of int64s.
idInt64Sequence
properties
int64Vals
descriptionint64 sequence.
items
formatint64
typestring
typearray
typeobject
Interval
descriptionRepresents a time interval, encoded as a Timestamp start (inclusive) and a Timestamp end (exclusive). The start must be less than or equal to the end. When the start equals the end, the interval is empty (matches no time). When both start and end are unspecified, the interval matches any time.
idInterval
properties
endTime
descriptionOptional. Exclusive end of the interval. If specified, a Timestamp matching this interval will have to be before the end.
formatgoogle-datetime
typestring
startTime
descriptionOptional. Inclusive start of the interval. If specified, a Timestamp matching this interval will have to be the same or after the start.
formatgoogle-datetime
typestring
typeobject
Investigation
descriptionRepresents the aggregated state of an investigation such as categorization, severity, and status. Can be expanded to include analyst assignment details and more.
idInvestigation
properties
comments
descriptionComment added by the Analyst.
items
typestring
typearray
priority
descriptionPriority of the Alert or Finding set by analyst.
enum
  • PRIORITY_UNSPECIFIED
  • PRIORITY_INFO
  • PRIORITY_LOW
  • PRIORITY_MEDIUM
  • PRIORITY_HIGH
  • PRIORITY_CRITICAL
enumDescriptions
  • Default priority level.
  • Informational priority.
  • Low priority.
  • Medium priority.
  • High priority.
  • Critical priority.
typestring
reason
descriptionReason for closing the Case or Alert.
enum
  • REASON_UNSPECIFIED
  • REASON_NOT_MALICIOUS
  • REASON_MALICIOUS
  • REASON_MAINTENANCE
enumDescriptions
  • Default reason.
  • Case or Alert not malicious.
  • Case or Alert is malicious.
  • Case or Alert is under maintenance.
typestring
reputation
descriptionDescribes whether a finding was useful or not-useful.
enum
  • REPUTATION_UNSPECIFIED
  • USEFUL
  • NOT_USEFUL
enumDescriptions
  • An unspecified reputation.
  • A categorization of the finding as useful.
  • A categorization of the finding as not useful.
typestring
riskScore
descriptionRisk score for a finding set by an analyst.
formatuint32
typeinteger
rootCause
descriptionRoot cause of the Alert or Finding set by analyst.
typestring
severityScore
descriptionSeverity score for a finding set by an analyst.
formatuint32
typeinteger
status
descriptionDescribes the workflow status of a finding.
enum
  • STATUS_UNSPECIFIED
  • NEW
  • REVIEWED
  • CLOSED
  • OPEN
enumDescriptions
  • Unspecified finding status.
  • New finding.
  • When a finding has feedback.
  • When an analyst closes an finding.
  • Open. Used to indicate that a Case / Alert is open.
typestring
verdict
descriptionDescribes reason a finding investigation was resolved.
enum
  • VERDICT_UNSPECIFIED
  • TRUE_POSITIVE
  • FALSE_POSITIVE
enumDescriptions
  • An unspecified verdict.
  • A categorization of the finding as a "true positive".
  • A categorization of the finding as a "false positive".
typestring
typeobject
IoCStats
descriptionInformation about the threat intelligence source. These fields are used to model Mandiant sources.
idIoCStats
properties
benignCount
descriptionCount of responses where the IoC was identified as benign.
formatint32
typeinteger
firstLevelSource
descriptionName of first level IoC source, for example Mandiant or a third-party.
typestring
iocStatsType
descriptionDescribes the source of the IoCStat.
enum
  • UNSPECIFIED_IOC_STATS_TYPE
  • MANDIANT_SOURCES
  • THIRD_PARTY_SOURCES
  • THREAT_INTELLIGENCE_IOC_STATS
enumDescriptions
  • IoCStat source is unidentified.
  • IoCStat is from a Mandiant Source.
  • IoCStat is from a third-party source.
  • IoCStat is from a threat intelligence feed.
typestring
maliciousCount
descriptionCount of responses where the IoC was identified as malicious.
formatint32
typeinteger
quality
descriptionLevel of confidence in the IoC mapping extracted from the source.
enum
  • UNKNOWN_CONFIDENCE
  • LOW_CONFIDENCE
  • MEDIUM_CONFIDENCE
  • HIGH_CONFIDENCE
enumDescriptions
  • The default confidence level.
  • Low confidence.
  • Medium confidence.
  • High confidence.
typestring
responseCount
descriptionTotal number of response from the source.
formatint32
typeinteger
secondLevelSource
descriptionName of the second-level IoC source, for example Crowdsourced Threat Analysis or Knowledge Graph.
typestring
sourceCount
descriptionNumber of sources from which information was extracted.
formatint32
typeinteger
typeobject
Label
descriptionKey value labels.
idLabel
properties
key
descriptionThe key.
typestring
rbacEnabled
descriptionIndicates whether this label can be used for Data RBAC
typeboolean
source
descriptionWhere the label is derived from.
typestring
value
descriptionThe value.
typestring
typeobject
LatLng
descriptionAn object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges.
idLatLng
properties
latitude
descriptionThe latitude in degrees. It must be in the range [-90.0, +90.0].
formatdouble
typenumber
longitude
descriptionThe longitude in degrees. It must be in the range [-180.0, +180.0].
formatdouble
typenumber
typeobject
LegacyFederatedUdmSearchViewResponse
descriptionResponse to a Federated UDM Search query. This will be used by StreamSearchOperation RPC to return the results of a federated search operation.
idLegacyFederatedUdmSearchViewResponse
properties
activityTimeline
$refEventCountTimeline
descriptionTimeline of event counts broken into hourly/daily buckets to identify activity.
aiOverview
$refAIOverview
descriptionLINT.ThenChange( //depot/google3/google/cloud/chronicle/v1main/dashboard_query.proto:data_sources, //depot/google3/googlex/security/malachite/proto/udm_search.proto:data_sources ) AI generated overview for the search results. Only populated if the AI features are enabled for the customer and generate_ai_overview is set to true in the request.
baselineEventsCount
descriptionThe number of events in the baseline query.
formatint32
typeinteger
complete
descriptionStreaming for this response is done. There will be no additional updates.
typeboolean
dataSources
descriptionDatasource of the query and results in case of a statistics query
items
enum
  • SEARCH_DATA_SOURCE_UNSPECIFIED
  • SEARCH_UDM
  • SEARCH_ENTITY
  • SEARCH_RULE_DETECTIONS
  • SEARCH_RULESETS
enumDescriptions
  • Unspecified data source.
  • Events
  • Entities
  • To be used for detections data source.
  • To be used for ruleset with detections datasource.
typestring
typearray
detectionFieldAggregations
$refAlertFieldAggregations
descriptionList of detection fields with aggregated values. This enabled filtering in the Alerts panel for federated search.
events
$refUdmEventList
descriptionList of UDM events. NOTE: After complete is set to true, the `UdmEventList` message will be omitted from the response. The latest message should be used as reference. If the `UdmEventList` message is returned again, then it should replace the previous value.
fieldAggregations
$refUdmFieldAggregations
descriptionList of UDM fields with aggregated values.
filteredEventsCount
descriptionThe number of events in the snapshot that match the snapshot_query. This is <= `baseline_events_count`. If the snapshot query is empty this will be equivalent to `baseline_events_count`.
formatint32
typeinteger
groupedFieldAggregations
$refUdmFieldAggregations
descriptionList of grouped fields with aggregated values.
instanceAggregations
$refUdmFieldAggregations
descriptionInstance aggregations for the search results. Provides information on the number of events per instance for the aggregations panel in the UI. This allows users to easily drill-down into the individual instances.
instanceUdmSearchResponses
descriptionAll the instance specific UDM search responses.
items
$refInstanceUdmSearchResponse
typearray
operation
descriptionThe name of the operation resource representing the UDM Search operation. This can be passed to `StreamSearchOperation` to fetch stored results or stream the results of an in-progress operation. The metadata type of the operation is `UdmSearchMetadata`. The response type is `LegacyFetchUdmSearchViewResponse`. Format: projects/{project}/locations/{location}/instances/{instance}/operations/{operation}
typestring
progress
descriptionProgress of the query represented as a double between 0 and 1.
formatdouble
typenumber
queryValidationErrors
descriptionParse error for the baseline_query and/or the snapshot_query.
items
$refErrorMessage
typearray
runtimeErrors
descriptionRuntime errors.
items
$refRuntimeError
typearray
stats
$refGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStats
descriptionStats results when the query is for statistics
statsFunctionParameterValidationErrorMessage
descriptionIf the request's stats_function_parameter` is invalid, this field will contain the detailed error message.
typestring
statsFunctionResponse
$refFunctionResponse
descriptionResult for statistical function.
timeline
$refEventCountTimeline
descriptionTimeline of event counts broken into buckets. This populates the trend-over-time chart in the UI.
tooLargeResponse
descriptionIf true, the response to be returned to the UI is too large and some events have been omitted.
typeboolean
tooManyEvents
descriptionIf true, there are too many events to return and some have been omitted.
typeboolean
validBaselineQuery
descriptionIndicates whether the request baseline_query is a valid structured query or not. If not, `query_validation_errors` will include the parse error.
typeboolean
validSnapshotQuery
descriptionIndicates whether the request baseline and snapshot queries are valid. If not, `query_validation_errors` will include the parse error.
typeboolean
typeobject
ListDataAccessLabelsResponse
descriptionResponse message for ListDataAccessLabels.
idListDataAccessLabelsResponse
properties
dataAccessLabels
descriptionList of data access labels.
items
$refDataAccessLabel
typearray
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
typeobject
ListDataAccessScopesResponse
descriptionResponse message for ListDataAccessScopes.
idListDataAccessScopesResponse
properties
dataAccessScopes
descriptionList of data access scopes.
items
$refDataAccessScope
typearray
globalDataAccessScopeGranted
descriptionWhether or not global scope is granted to the user.
typeboolean
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
typeobject
ListOperationsResponse
descriptionThe response message for Operations.ListOperations.
idListOperationsResponse
properties
nextPageToken
descriptionThe standard List next-page token.
typestring
operations
descriptionA list of operations that matches the specified filter in the request.
items
$refOperation
typearray
typeobject
ListReferenceListsResponse
descriptionA response to a request for a list of reference lists.
idListReferenceListsResponse
properties
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
referenceLists
descriptionThe reference lists. Ordered in ascending alphabetical order by name.
items
$refReferenceList
typearray
typeobject
ListRetrohuntsResponse
descriptionResponse message for ListRetrohunts method.
idListRetrohuntsResponse
properties
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
retrohunts
descriptionThe retrohunts from the specified rule.
items
$refRetrohunt
typearray
typeobject
ListRuleDeploymentsResponse
descriptionResponse message for ListRuleDeployments.
idListRuleDeploymentsResponse
properties
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
ruleDeployments
descriptionThe rule deployments from all rules.
items
$refRuleDeployment
typearray
typeobject
ListRuleRevisionsResponse
descriptionResponse message for ListRuleRevisions method.
idListRuleRevisionsResponse
properties
nextPageToken
descriptionA token that can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
rules
descriptionThe revisions of the rule.
items
$refRule
typearray
typeobject
ListRulesResponse
descriptionResponse message for ListRules method.
idListRulesResponse
properties
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
rules
descriptionThe rules from the specified instance.
items
$refRule
typearray
typeobject
ListWatchlistsResponse
descriptionResponse message for listing watchlists.
idListWatchlistsResponse
properties
nextPageToken
descriptionOptional. A token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
watchlists
descriptionOptional. The watchlists from the specified instance.
items
$refWatchlist
typearray
typeobject
Location
descriptionInformation about a location.
idLocation
properties
city
descriptionThe city.
typestring
countryOrRegion
descriptionThe country or region.
typestring
deskName
descriptionDesk name or individual location, typically for an employee in an office. (e.g. "IN-BLR-BCPC-11-1121D").
typestring
floorName
descriptionFloor name, number or a combination of the two for a building. (e.g. "1-A").
typestring
name
descriptionCustom location name (e.g. building or site name like "London Office"). For cloud environments, this is the region (e.g. "us-west2").
typestring
regionCoordinates
$refLatLng
descriptionCoordinates for the associated region. See https://cloud.google.com/vision/docs/reference/rest/v1/LatLng for a description of the fields.
regionLatitude
deprecatedTrue
descriptionDeprecated: use region_coordinates.
formatfloat
typenumber
regionLongitude
deprecatedTrue
descriptionDeprecated: use region_coordinates.
formatfloat
typenumber
state
descriptionThe state.
typestring
typeobject
Manual
descriptionEntities are added manually.
idManual
properties
typeobject
Measure
descriptionDescribes the precomputed measure.
idMeasure
properties
aggregateFunction
descriptionFunction used to calculate the aggregated measure.
enum
  • AGGREGATE_FUNCTION_UNSPECIFIED
  • MIN
  • MAX
  • COUNT
  • SUM
  • AVG
  • STDDEV
enumDescriptions
  • Default value.
  • Minimum.
  • Maximum.
  • Count.
  • Sum.
  • Average.
  • Standard Deviation.
typestring
value
descriptionValue of the aggregated measure.
formatdouble
typenumber
typeobject
Metadata
descriptionGeneral information associated with a UDM event.
idMetadata
properties
baseLabels
$refDataAccessLabels
descriptionData access labels on the base event.
collectedTimestamp
descriptionThe GMT timestamp when the event was collected by the vendor's local collection infrastructure.
formatgoogle-datetime
typestring
description
descriptionA human-readable unparsable description of the event.
typestring
enrichmentLabels
$refDataAccessLabels
descriptionData access labels from all the contextual events used to enrich the base event.
enrichmentState
descriptionThe enrichment state.
enum
  • ENRICHMENT_STATE_UNSPECIFIED
  • ENRICHED
  • UNENRICHED
enumDescriptions
  • Unspecified.
  • The event has been enriched by Chronicle.
  • The event has not been enriched by Chronicle.
typestring
eventTimestamp
descriptionThe GMT timestamp when the event was generated.
formatgoogle-datetime
typestring
eventType
descriptionThe event type. If an event has multiple possible types, this specifies the most specific type.
enum
  • EVENTTYPE_UNSPECIFIED
  • PROCESS_UNCATEGORIZED
  • PROCESS_LAUNCH
  • PROCESS_INJECTION
  • PROCESS_PRIVILEGE_ESCALATION
  • PROCESS_TERMINATION
  • PROCESS_OPEN
  • PROCESS_MODULE_LOAD
  • REGISTRY_UNCATEGORIZED
  • REGISTRY_CREATION
  • REGISTRY_MODIFICATION
  • REGISTRY_DELETION
  • SETTING_UNCATEGORIZED
  • SETTING_CREATION
  • SETTING_MODIFICATION
  • SETTING_DELETION
  • MUTEX_UNCATEGORIZED
  • MUTEX_CREATION
  • FILE_UNCATEGORIZED
  • FILE_CREATION
  • FILE_DELETION
  • FILE_MODIFICATION
  • FILE_READ
  • FILE_COPY
  • FILE_OPEN
  • FILE_MOVE
  • FILE_SYNC
  • USER_UNCATEGORIZED
  • USER_LOGIN
  • USER_LOGOUT
  • USER_CREATION
  • USER_CHANGE_PASSWORD
  • USER_CHANGE_PERMISSIONS
  • USER_STATS
  • USER_BADGE_IN
  • USER_DELETION
  • USER_RESOURCE_CREATION
  • USER_RESOURCE_UPDATE_CONTENT
  • USER_RESOURCE_UPDATE_PERMISSIONS
  • USER_COMMUNICATION
  • USER_RESOURCE_ACCESS
  • USER_RESOURCE_DELETION
  • GROUP_UNCATEGORIZED
  • GROUP_CREATION
  • GROUP_DELETION
  • GROUP_MODIFICATION
  • EMAIL_UNCATEGORIZED
  • EMAIL_TRANSACTION
  • EMAIL_URL_CLICK
  • NETWORK_UNCATEGORIZED
  • NETWORK_FLOW
  • NETWORK_CONNECTION
  • NETWORK_FTP
  • NETWORK_DHCP
  • NETWORK_DNS
  • NETWORK_HTTP
  • NETWORK_SMTP
  • STATUS_UNCATEGORIZED
  • STATUS_HEARTBEAT
  • STATUS_STARTUP
  • STATUS_SHUTDOWN
  • STATUS_UPDATE
  • SCAN_UNCATEGORIZED
  • SCAN_FILE
  • SCAN_PROCESS_BEHAVIORS
  • SCAN_PROCESS
  • SCAN_HOST
  • SCAN_VULN_HOST
  • SCAN_VULN_NETWORK
  • SCAN_NETWORK
  • SCHEDULED_TASK_UNCATEGORIZED
  • SCHEDULED_TASK_CREATION
  • SCHEDULED_TASK_DELETION
  • SCHEDULED_TASK_ENABLE
  • SCHEDULED_TASK_DISABLE
  • SCHEDULED_TASK_MODIFICATION
  • SYSTEM_AUDIT_LOG_UNCATEGORIZED
  • SYSTEM_AUDIT_LOG_WIPE
  • SERVICE_UNSPECIFIED
  • SERVICE_CREATION
  • SERVICE_DELETION
  • SERVICE_START
  • SERVICE_STOP
  • SERVICE_MODIFICATION
  • GENERIC_EVENT
  • RESOURCE_CREATION
  • RESOURCE_DELETION
  • RESOURCE_PERMISSIONS_CHANGE
  • RESOURCE_READ
  • RESOURCE_WRITTEN
  • DEVICE_FIRMWARE_UPDATE
  • DEVICE_CONFIG_UPDATE
  • DEVICE_PROGRAM_UPLOAD
  • DEVICE_PROGRAM_DOWNLOAD
  • ANALYST_UPDATE_VERDICT
  • ANALYST_UPDATE_REPUTATION
  • ANALYST_UPDATE_SEVERITY_SCORE
  • ANALYST_UPDATE_STATUS
  • ANALYST_ADD_COMMENT
  • ANALYST_UPDATE_PRIORITY
  • ANALYST_UPDATE_ROOT_CAUSE
  • ANALYST_UPDATE_REASON
  • ANALYST_UPDATE_RISK_SCORE
  • ENTITY_RISK_CHANGE
enumDeprecated
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • True
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • True
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • True
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
enumDescriptions
  • Default event type
  • Activity related to a process which does not match any other event types.
  • Process launch.
  • Process injecting into another process.
  • Process privilege escalation.
  • Process termination.
  • Process being opened.
  • Process loading a module.
  • Registry event which does not match any of the other event types.
  • Registry creation.
  • Registry modification.
  • Registry deletion.
  • Settings-related event which does not match any of the other event types.
  • Setting creation.
  • Setting modification.
  • Setting deletion.
  • Any mutex event other than creation.
  • Mutex creation.
  • File event which does not match any of the other event types.
  • File created.
  • File deleted.
  • File modified.
  • File read.
  • File copied. Used for file copies, for example, to a thumb drive.
  • File opened.
  • File moved or renamed.
  • File synced (for example, Google Drive, Dropbox, backup).
  • User activity which does not match any of the other event types.
  • User login.
  • User logout.
  • User creation.
  • User password change event.
  • Change in user permissions.
  • Deprecated. Used to update user info for an LDAP dump.
  • User physically badging into a location.
  • User deletion.
  • User creating a virtual resource. This is equivalent to RESOURCE_CREATION.
  • User updating content of a virtual resource. This is equivalent to RESOURCE_WRITTEN.
  • User updating permissions of a virtual resource. This is equivalent to RESOURCE_PERMISSIONS_CHANGE.
  • User initiating communication through a medium (for example, video).
  • User accessing a virtual resource. This is equivalent to RESOURCE_READ.
  • User deleting a virtual resource. This is equivalent to RESOURCE_DELETION.
  • A group activity that does not fall into one of the other event types.
  • A group creation.
  • A group deletion.
  • A group modification.
  • Email messages
  • An email transaction.
  • Deprecated: use NETWORK_HTTP instead. An email URL click event.
  • A network event that does not fit into one of the other event types.
  • Aggregated flow stats like netflow.
  • Network connection details like from a FW.
  • FTP telemetry.
  • DHCP payload.
  • DNS payload.
  • HTTP telemetry.
  • SMTP telemetry.
  • A status message that does not fit into one of the other event types.
  • Heartbeat indicating product is alive.
  • An agent startup.
  • An agent shutdown.
  • A software or fingerprint update.
  • Scan item that does not fit into one of the other event types.
  • A file scan.
  • Scan process behaviors. Please use SCAN_PROCESS instead.
  • Scan process.
  • Scan results from scanning an entire host device for threats/sensitive documents.
  • Vulnerability scan logs about host vulnerabilities (e.g., out of date software) and network vulnerabilities (e.g., unprotected service detected via a network scan).
  • Vulnerability scan logs about network vulnerabilities.
  • Scan network for suspicious activity
  • Scheduled task event that does not fall into one of the other event types.
  • Scheduled task creation.
  • Scheduled task deletion.
  • Scheduled task being enabled.
  • Scheduled task being disabled.
  • Scheduled task being modified.
  • A system audit log event that is not a wipe.
  • A system audit log wipe.
  • Service event that does not fit into one of the other event types.
  • A service creation.
  • A service deletion.
  • A service start.
  • A service stop.
  • A service modification.
  • Operating system events that are not described by any of the other event types. Might include uncategorized Microsoft Windows event logs.
  • The resource was created/provisioned. This is equivalent to USER_RESOURCE_CREATION.
  • The resource was deleted/deprovisioned. This is equivalent to USER_RESOURCE_DELETION.
  • The resource had it's permissions or ACLs updated. This is equivalent to USER_RESOURCE_UPDATE_PERMISSIONS.
  • The resource was read. This is equivalent to USER_RESOURCE_ACCESS.
  • The resource was written to. This is equivalent to USER_RESOURCE_UPDATE_CONTENT.
  • Firmware update.
  • Configuration update.
  • A program or application uploaded to a device.
  • A program or application downloaded to a device.
  • Analyst update about the Verdict (such as true positive, false positive, or disregard) of a finding.
  • Analyst update about the Reputation (such as useful or not useful) of a finding.
  • Analyst update about the Severity score (0-100) of a finding.
  • Analyst update about the finding status.
  • Analyst addition of a comment for a finding.
  • Analyst update about the priority (such as low, medium, or high) for a finding.
  • Analyst update about the root cause for a finding.
  • Analyst update about the reason (such as malicious or not malicious) for a finding.
  • Analyst update about the risk score (0-100) of a finding.
  • An update to an entity risk score. This event type is restricted to events published by Google Securit Operations Risk Analytics.
typestring
id
descriptionID of the UDM event. Can be used for raw and normalized event retrieval.
formatbyte
typestring
ingestedTimestamp
descriptionThe GMT timestamp when the event was ingested (received) by Chronicle.
formatgoogle-datetime
typestring
ingestionLabels
descriptionUser-configured ingestion metadata labels.
items
$refLabel
typearray
logType
descriptionThe string value of log type.
typestring
productDeploymentId
descriptionThe deployment identifier assigned by the vendor for a product deployment.
typestring
productEventType
descriptionA short, descriptive, human-readable, product-specific event name or type (e.g. "Scanned X", "User account created", "process_start").
typestring
productLogId
descriptionA vendor-specific event identifier to uniquely identify the event (e.g. a GUID).
typestring
productName
descriptionThe name of the product.
typestring
productVersion
descriptionThe version of the product.
typestring
structuredFields
additionalProperties
descriptionProperties of the object.
typeany
deprecatedTrue
descriptionFlattened fields extracted from the log.
typeobject
tags
$refTags
descriptionTags added by Chronicle after an event is parsed. It is an error to populate this field from within a parser.
urlBackToProduct
descriptionA URL that takes the user to the source product console for this event.
typestring
vendorName
descriptionThe name of the product vendor.
typestring
typeobject
Metric
descriptionStores precomputed aggregated analytic data for an entity.
idMetric
properties
dimensions
descriptionAll group by clauses used to calculate the metric.
items
enum
  • DIMENSION_UNSPECIFIED
  • PRINCIPAL_DEVICE
  • TARGET_USER
  • TARGET_DEVICE
  • PRINCIPAL_USER
  • TARGET_IP
  • PRINCIPAL_FILE_HASH
  • PRINCIPAL_COUNTRY
  • SECURITY_CATEGORY
  • NETWORK_ASN
  • CLIENT_CERTIFICATE_HASH
  • DNS_QUERY_TYPE
  • DNS_DOMAIN
  • HTTP_USER_AGENT
  • EVENT_TYPE
  • PRODUCT_NAME
  • PRODUCT_EVENT_TYPE
  • PARENT_FOLDER_PATH
  • TARGET_RESOURCE_NAME
  • PRINCIPAL_APPLICATION
  • TARGET_APPLICATION
  • EMAIL_TO_ADDRESS
  • EMAIL_FROM_ADDRESS
  • MAIL_ID
  • PRINCIPAL_IP
  • SECURITY_ACTION
  • SECURITY_RULE_ID
  • TARGET_NETWORK_ORGANIZATION_NAME
  • PRINCIPAL_NETWORK_ORGANIZATION_NAME
  • PRINCIPAL_PROCESS_FILE_PATH
  • PRINCIPAL_PROCESS_FILE_HASH
  • SECURITY_RESULT_RULE_NAME
  • TARGET_RESOURCE_LABEL_KEY
  • VENDOR_NAME
  • TARGET_RESOURCE_TYPE
  • TARGET_LOCATION_NAME
enumDescriptions
  • Default
  • Principal Device
  • Target User
  • Target Device
  • Principal User
  • Target IP
  • Principal File Hash
  • Principal Country
  • Security Category
  • Network ASN
  • Client Certificate Hash
  • DNS Query Type
  • DNS Domain
  • HTTP User Agent
  • Event Type
  • Product Name
  • Product Event Type
  • Parent Folder Path
  • Target resource Name
  • Principal Application.
  • Target Application.
  • Email To Address.
  • Email From Address.
  • Mail Id.
  • Principal IP.
  • Security Action.
  • Security Rule Id.
  • Target Network Organization name.
  • Principal Network Organization name.
  • Principal Process File Path.
  • Principal Process File SHA256 Hash.
  • Security Result rule name.
  • Target Resource label key.
  • Vendor name.
  • Target Resource type.
  • Target Location name.
typestring
typearray
exportWindow
descriptionExport window for which the metric was exported.
formatint64
typestring
firstSeen
descriptionTimestamp of the first time the entity was seen in the environment.
formatgoogle-datetime
typestring
lastSeen
descriptionTime stamp of the last time last time the entity was seen in the environment.
formatgoogle-datetime
typestring
metricName
descriptionName of the analytic.
enum
  • METRIC_NAME_UNSPECIFIED
  • NETWORK_BYTES_INBOUND
  • NETWORK_BYTES_OUTBOUND
  • NETWORK_BYTES_TOTAL
  • AUTH_ATTEMPTS_SUCCESS
  • AUTH_ATTEMPTS_FAIL
  • AUTH_ATTEMPTS_TOTAL
  • DNS_BYTES_OUTBOUND
  • NETWORK_FLOWS_INBOUND
  • NETWORK_FLOWS_OUTBOUND
  • NETWORK_FLOWS_TOTAL
  • DNS_QUERIES_SUCCESS
  • DNS_QUERIES_FAIL
  • DNS_QUERIES_TOTAL
  • FILE_EXECUTIONS_SUCCESS
  • FILE_EXECUTIONS_FAIL
  • FILE_EXECUTIONS_TOTAL
  • HTTP_QUERIES_SUCCESS
  • HTTP_QUERIES_FAIL
  • HTTP_QUERIES_TOTAL
  • WORKSPACE_EMAILS_SENT_TOTAL
  • WORKSPACE_TOTAL_DOWNLOAD_ACTIONS
  • WORKSPACE_TOTAL_CHANGE_ACTIONS
  • WORKSPACE_AUTH_ATTEMPTS_TOTAL
  • WORKSPACE_NETWORK_BYTES_OUTBOUND
  • WORKSPACE_NETWORK_BYTES_TOTAL
  • ALERT_EVENT_NAME_COUNT
  • RESOURCE_CREATION_TOTAL
  • RESOURCE_CREATION_SUCCESS
  • RESOURCE_READ_SUCCESS
  • RESOURCE_READ_FAIL
  • RESOURCE_DELETION_SUCCESS
enumDescriptions
  • Default
  • Total received network bytes.
  • Total network sent bytes.
  • Total network sent bytes and received bytes.
  • Successful authentication attempts.
  • Failed authentication attempts.
  • Total authentication attempts.
  • Total number of sent bytes for DNS events.
  • Total number of events having non-null received bytes.
  • Total number of events having non-null sent bytes.
  • Total events having non-null sent or received bytes.
  • DNS query success count - Number of events with response_code = 0.
  • Number of events with response_code != 0.
  • Total number of DNS queries made.
  • Number of successfule file executions.
  • Number of failed file executions.
  • Total number file executions.
  • Number of successful HTTP queries.
  • Number of failed HTTP queries.
  • Total number of HTTP queries.
  • Total number of emails sent in Google Workspace.
  • Total number of download actions in Google Workspace.
  • Total number of change actions in Google Workspace.
  • Total number of authentication attempts in Google Workspace.
  • Number of outbound network bytes (total sent) in Google Workspace.
  • Total number of network bytes (both sent and received) in Google Workspace.
  • Track number of alerts fired by EDR/SENTINEL/MICROSOFT_GRAPH.
  • First-time analytic tracking successful resource creations.
  • Volume-based analytic tracking successful resource creations.
  • Volume-based analytic tracking successful resource reads.
  • Volume-based analytic tracking failed resource reads.
  • Volume-based analytic tracking successful resource deletions.
typestring
sumMeasure
$refMeasure
descriptionSum of all precomputed measures for the given metric.
totalEvents
descriptionTotal number of events used to calculate the given precomputed metric.
formatint64
typestring
typeobject
Navigation
descriptionNavigation can be used to store the metadata required to navigate the user to a new URL.
idNavigation
properties
targetUri
descriptionOutput only. The URI to redirect the user to.
readOnlyTrue
typestring
typeobject
Network
descriptionA network event.
idNetwork
properties
applicationProtocol
descriptionThe application protocol.
enum
  • UNKNOWN_APPLICATION_PROTOCOL
  • AFP
  • APPC
  • AMQP
  • ATOM
  • BEEP
  • BITCOIN
  • BIT_TORRENT
  • CFDP
  • CIP
  • COAP
  • COTP
  • DCERPC
  • DDS
  • DEVICE_NET
  • DHCP
  • DICOM
  • DNP3
  • DNS
  • E_DONKEY
  • ENRP
  • FAST_TRACK
  • FINGER
  • FREENET
  • FTAM
  • GOOSE
  • GOPHER
  • GRPC
  • HL7
  • H323
  • HTTP
  • HTTPS
  • IEC104
  • IRCP
  • KADEMLIA
  • KRB5
  • LDAP
  • LPD
  • MIME
  • MMS
  • MODBUS
  • MQTT
  • NETCONF
  • NFS
  • NIS
  • NNTP
  • NTCIP
  • NTP
  • OSCAR
  • PNRP
  • PTP
  • QUIC
  • RDP
  • RELP
  • RIP
  • RLOGIN
  • RPC
  • RTMP
  • RTP
  • RTPS
  • RTSP
  • SAP
  • SDP
  • SIP
  • SLP
  • SMB
  • SMTP
  • SNMP
  • SNTP
  • SSH
  • SSMS
  • STYX
  • SV
  • TCAP
  • TDS
  • TOR
  • TSP
  • VTP
  • WHOIS
  • WEB_DAV
  • X400
  • X500
  • XMPP
enumDescriptions
  • The default application protocol.
  • Apple Filing Protocol.
  • Advanced Program-to-Program Communication.
  • Advanced Message Queuing Protocol.
  • Publishing Protocol.
  • Block Extensible Exchange Protocol.
  • Crypto currency protocol.
  • Peer-to-peer file sharing.
  • Coherent File Distribution Protocol.
  • Common Industrial Protocol.
  • Constrained Application Protocol.
  • Connection Oriented Transport Protocol.
  • DCE/RPC.
  • Data Distribution Service.
  • Automation industry protocol.
  • DHCP.
  • Digital Imaging and Communications in Medicine Protocol.
  • Distributed Network Protocol 3 (DNP3)
  • DNS.
  • Classic file sharing protocol.
  • Endpoint Handlespace Redundancy Protocol.
  • Filesharing peer-to-peer protocol.
  • User Information Protocol.
  • Censorship resistant peer-to-peer network.
  • File Transfer Access and Management.
  • GOOSE Protocol.
  • Gopher protocol.
  • gRPC Remote Procedure Call.
  • Health Level Seven.
  • Packet-based multimedia communications system.
  • HTTP.
  • HTTPS.
  • IEC 60870-5-104 (IEC 104) Protocol.
  • Internet Relay Chat Protocol.
  • Peer-to-peer hashtables.
  • Kerberos 5.
  • Lightweight Directory Access Protocol.
  • Line Printer Daemon Protocol.
  • Multipurpose Internet Mail Extensions and Secure MIME.
  • Multimedia Messaging Service.
  • Serial communications protocol.
  • Message Queuing Telemetry Transport.
  • Network Configuration.
  • Network File System.
  • Network Information Service.
  • Network News Transfer Protocol.
  • National Transportation Communications for Intelligent Transportation System.
  • Network Time Protocol.
  • AOL Instant Messenger Protocol.
  • Peer Name Resolution Protocol.
  • Precision Time Protocol.
  • QUIC.
  • Remote Desktop Protocol.
  • Reliable Event Logging Protocol.
  • Routing Information Protocol.
  • Remote Login in UNIX Systems.
  • Remote Procedure Call.
  • Real Time Messaging Protocol.
  • Real-time Transport Protocol.
  • Real Time Publish Subscribe.
  • Real Time Streaming Protocol.
  • Session Announcement Protocol.
  • Session Description Protocol.
  • Session Initiation Protocol.
  • Service Location Protocol.
  • Server Message Block.
  • Simple Mail Transfer Protocol.
  • Simple Network Management Protocol.
  • Simple Network Time Protocol.
  • Secure Shell.
  • Secure SMS Messaging Protocol.
  • Styx/9P - Plan 9 from Bell Labs distributed file system protocol.
  • Sampled Values Protocol.
  • Transaction Capabilities Application Part.
  • Tabular Data Stream.
  • Anonymity network.
  • Time Stamp Protocol.
  • Virtual Terminal Protocol.
  • Remote Directory Access Protocol.
  • Web Distributed Authoring and Versioning.
  • Message Handling Service Protocol.
  • Directory Access Protocol (DAP).
  • Extensible Messaging and Presence Protocol.
typestring
applicationProtocolVersion
descriptionThe version of the application protocol. e.g. "1.1, 2.0"
typestring
asn
descriptionAutonomous system number.
typestring
carrierName
descriptionCarrier identification.
typestring
communityId
descriptionCommunity ID network flow value.
typestring
dhcp
$refDhcp
descriptionDHCP info.
direction
descriptionThe direction of network traffic.
enum
  • UNKNOWN_DIRECTION
  • INBOUND
  • OUTBOUND
  • BROADCAST
enumDescriptions
  • The default direction.
  • An inbound request.
  • An outbound request.
  • A broadcast.
typestring
dns
$refDns
descriptionDNS info.
dnsDomain
descriptionDNS domain name.
typestring
email
$refEmail
descriptionEmail info for the sender/recipient.
ftp
$refFtp
descriptionFTP info.
http
$refHttp
descriptionHTTP info.
ipProtocol
descriptionThe IP protocol.
enum
  • UNKNOWN_IP_PROTOCOL
  • ICMP
  • IGMP
  • TCP
  • UDP
  • IP6IN4
  • GRE
  • ESP
  • ICMP6
  • EIGRP
  • ETHERIP
  • PIM
  • VRRP
  • SCTP
enumDescriptions
  • The default protocol.
  • ICMP.
  • IGMP
  • TCP.
  • UDP.
  • IPv6 Encapsulation
  • Generic Routing Encapsulation
  • Encapsulating Security Payload
  • ICMPv6
  • Enhanced Interior Gateway Routing
  • Ethernet-within-IP Encapsulation
  • Protocol Independent Multicast
  • Virtual Router Redundancy Protocol
  • Stream Control Transmission Protocol
typestring
ipSubnetRange
descriptionAssociated human-readable IP subnet range (e.g. 10.1.2.0/24).
typestring
organizationName
descriptionOrganization name (e.g Google).
typestring
parentSessionId
descriptionThe ID of the parent network session.
typestring
receivedBytes
descriptionThe number of bytes received.
formatuint64
typestring
receivedPackets
descriptionThe number of packets received.
formatint64
typestring
sentBytes
descriptionThe number of bytes sent.
formatuint64
typestring
sentPackets
descriptionThe number of packets sent.
formatint64
typestring
sessionDuration
descriptionThe duration of the session as the number of seconds and nanoseconds. For seconds, network.session_duration.seconds, the type is a 64-bit integer. For nanoseconds, network.session_duration.nanos, the type is a 32-bit integer.
formatgoogle-duration
typestring
sessionId
descriptionThe ID of the network session.
typestring
smtp
$refSmtp
descriptionSMTP info. Store fields specific to SMTP not covered by Email.
tls
$refTls
descriptionTLS info.
typeobject
Noun
descriptionThe Noun type is used to represent the different entities in an event: principal, src, target, observer, intermediary, and about. It stores attributes known about the entity. For example, if the entity is a device with multiple IP or MAC addresses, it stores the IP and MAC addresses that are relevant to the event.
idNoun
properties
administrativeDomain
descriptionDomain which the device belongs to (for example, the Microsoft Windows domain).
typestring
application
descriptionThe name of an application or service. Some SSO solutions only capture the name of a target application such as "Atlassian" or "Chronicle".
typestring
artifact
$refArtifact
descriptionInformation about an artifact.
asset
$refAsset
descriptionInformation about the asset.
assetId
descriptionThe asset ID. This field can be used as an entity indicator for asset entities.
typestring
cloud
$refCloud
deprecatedTrue
descriptionCloud metadata. Deprecated: cloud should be populated in entity Attribute as generic metadata (e.g. asset.attribute.cloud).
domain
$refDomain
descriptionInformation about the domain.
email
descriptionEmail address. Only filled in for security_result.about
typestring
file
$refBackstoryFile
descriptionInformation about the file.
group
$refGroup
descriptionInformation about the group.
hostname
descriptionClient hostname or domain name field. Hostname also doubles as the domain for remote entities. This field can be used as an entity indicator for asset entities.
typestring
investigation
$refInvestigation
descriptionAnalyst feedback/investigation for alerts.
ip
descriptionA list of IP addresses associated with a network connection. This field can be used as an entity indicator for asset entities.
items
typestring
typearray
ipGeoArtifact
descriptionEnriched geographic information corresponding to an IP address. Specifically, location and network data.
items
$refArtifact
typearray
ipLocation
deprecatedTrue
descriptionDeprecated: use ip_geo_artifact.location instead.
items
$refLocation
typearray
labels
deprecatedTrue
descriptionLabels are key-value pairs. For example: key = "env", value = "prod". Deprecated: labels should be populated in entity Attribute as generic metadata (e.g. user.attribute.labels).
items
$refLabel
typearray
location
$refLocation
descriptionPhysical location. For cloud environments, set the region in location.name.
mac
descriptionList of MAC addresses associated with a device. This field can be used as an entity indicator for asset entities.
items
typestring
typearray
namespace
descriptionNamespace which the device belongs to, such as "AD forest". Uses for this field include Microsoft Windows AD forest, the name of subsidiary, or the name of acquisition. This field can be used along with an asset indicator to identify an asset.
typestring
natIp
descriptionA list of NAT translated IP addresses associated with a network connection.
items
typestring
typearray
natPort
descriptionNAT external network port number when a specific network connection is described within an event.
formatint32
typeinteger
network
$refNetwork
descriptionNetwork details, including sub-messages with details on each protocol (for example, DHCP, DNS, or HTTP).
objectReference
$refId
descriptionFinding to which the Analyst updated the feedback.
platform
descriptionPlatform.
enum
  • UNKNOWN_PLATFORM
  • WINDOWS
  • MAC
  • LINUX
  • GCP
  • AWS
  • AZURE
  • IOS
  • ANDROID
  • CHROME_OS
enumDeprecated
  • False
  • False
  • False
  • False
  • True
  • True
  • True
  • False
  • False
  • False
enumDescriptions
  • Default value.
  • Microsoft Windows.
  • macOS.
  • Linux.
  • Deprecated: see cloud.environment.
  • Deprecated: see cloud.environment.
  • Deprecated: see cloud.environment.
  • IOS
  • Android
  • Chrome OS
typestring
platformPatchLevel
descriptionPlatform patch level. For example, "Build 17134.48"
typestring
platformVersion
descriptionPlatform version. For example, "Microsoft Windows 1803".
typestring
port
descriptionSource or destination network port number when a specific network connection is described within an event.
formatint32
typeinteger
process
$refProcess
descriptionInformation about the process.
processAncestors
descriptionInformation about the process's ancestors ordered from immediate ancestor (parent process) to root. Note: process_ancestors is only populated when data is exported to BigQuery since recursive fields (e.g. process.parent_process) are not supported by BigQuery.
items
$refProcess
typearray
registry
$refRegistry
descriptionRegistry information.
resource
$refResource
descriptionInformation about the resource (e.g. scheduled task, calendar entry). This field should not be used for files, registry, or processes because these objects are already part of Noun.
resourceAncestors
descriptionInformation about the resource's ancestors ordered from immediate ancestor (starting with parent resource).
items
$refResource
typearray
securityResult
descriptionA list of security results.
items
$refSecurityResult
typearray
url
descriptionThe URL.
typestring
urlMetadata
$refUrl
descriptionInformation about the URL.
user
$refUser
descriptionInformation about the user.
userManagementChain
descriptionInformation about the user's management chain (reporting hierarchy). Note: user_management_chain is only populated when data is exported to BigQuery since recursive fields (e.g. user.managers) are not supported by BigQuery.
items
$refUser
typearray
typeobject
NtfsFileMetadata
descriptionNTFS-specific file metadata.
idNtfsFileMetadata
properties
changeTime
descriptionNTFS MFT entry changed timestamp.
formatgoogle-datetime
typestring
filenameAccessTime
descriptionNTFS $FILE_NAME attribute accessed timestamp.
formatgoogle-datetime
typestring
filenameChangeTime
descriptionNTFS $FILE_NAME attribute changed timestamp.
formatgoogle-datetime
typestring
filenameCreateTime
descriptionNTFS $FILE_NAME attribute created timestamp.
formatgoogle-datetime
typestring
filenameModifyTime
descriptionNTFS $FILE_NAME attribute modified timestamp.
formatgoogle-datetime
typestring
typeobject
Operation
descriptionThis resource represents a long-running operation that is the result of a network API call.
idOperation
properties
done
descriptionIf the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available.
typeboolean
error
$refStatus
descriptionThe error result of the operation in case of failure or cancellation.
metadata
additionalProperties
descriptionProperties of the object. Contains field @type with type URL.
typeany
descriptionService-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any.
typeobject
name
descriptionThe server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`.
typestring
response
additionalProperties
descriptionProperties of the object. Contains field @type with type URL.
typeany
descriptionThe normal, successful response of the operation. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`.
typeobject
typeobject
Option
descriptionDHCP options.
idOption
properties
code
descriptionCode. See RFC1533.
formatuint32
typeinteger
data
descriptionData.
formatbyte
typestring
typeobject
PDFInfo
descriptionInformation about the PDF file structure. See https://developers.virustotal.com/reference/pdf_info
idPDFInfo
properties
acroform
descriptionNumber of /AcroForm tags found in the PDF.
formatint64
typestring
autoaction
descriptionNumber of /AA tags found in the PDF.
formatint64
typestring
embeddedFile
descriptionNumber of /EmbeddedFile tags found in the PDF.
formatint64
typestring
encrypted
descriptionWhether the document is encrypted or not. This is defined by the /Encrypt tag.
formatint64
typestring
endobjCount
descriptionNumber of object definitions (endobj keyword).
formatint64
typestring
endstreamCount
descriptionNumber of defined stream objects (stream keyword).
formatint64
typestring
flash
descriptionNumber of /RichMedia tags found in the PDF.
formatint64
typestring
header
descriptionPDF version.
typestring
javascript
descriptionNumber of /JavaScript tags found in the PDF file. Should be the same as the js field in normal scenarios.
formatint64
typestring
jbig2Compression
descriptionNumber of /JBIG2Decode tags found in the PDF.
formatint64
typestring
js
descriptionNumber of /JS tags found in the PDF file. Should be the same as javascript field in normal scenarios.
formatint64
typestring
launchActionCount
descriptionNumber of /Launch tags found in the PDF file.
formatint64
typestring
objCount
descriptionNumber of objects definitions (obj keyword).
formatint64
typestring
objectStreamCount
descriptionNumber of object streams.
formatint64
typestring
openaction
descriptionNumber of /OpenAction tags found in the PDF.
formatint64
typestring
pageCount
descriptionNumber of pages in the PDF.
formatint64
typestring
startxref
descriptionNumber of startxref keywords in the PDF.
formatint64
typestring
streamCount
descriptionNumber of defined stream objects (stream keyword).
formatint64
typestring
suspiciousColors
descriptionNumber of colors expressed with more than 3 bytes (CVE-2009-3459).
formatint64
typestring
trailer
descriptionNumber of trailer keywords in the PDF.
formatint64
typestring
xfa
descriptionNumber of \XFA tags found in the PDF.
formatint64
typestring
xref
descriptionNumber of xref keywords in the PDF.
formatint64
typestring
typeobject
PeFileMetadata
descriptionMetadata about a Microsoft Windows Portable Executable.
idPeFileMetadata
properties
importHash
descriptionHash of PE imports.
typestring
typeobject
Permission
descriptionSystem permission for resource access and modification.
idPermission
properties
description
descriptionDescription of the permission (e.g. 'Ability to update detect rules').
typestring
name
descriptionName of the permission (e.g. chronicle.analyst.updateRule).
typestring
type
descriptionType of the permission.
enum
  • UNKNOWN_PERMISSION_TYPE
  • ADMIN_WRITE
  • ADMIN_READ
  • DATA_WRITE
  • DATA_READ
enumDescriptions
  • Default permission type.
  • Administrator write permission.
  • Administrator read permission.
  • Data resource access write permission.
  • Data resource access read permission.
typestring
typeobject
PlatformSoftware
descriptionPlatform software information about an operating system.
idPlatformSoftware
properties
platform
descriptionThe platform operating system.
enum
  • UNKNOWN_PLATFORM
  • WINDOWS
  • MAC
  • LINUX
  • GCP
  • AWS
  • AZURE
  • IOS
  • ANDROID
  • CHROME_OS
enumDeprecated
  • False
  • False
  • False
  • False
  • True
  • True
  • True
  • False
  • False
  • False
enumDescriptions
  • Default value.
  • Microsoft Windows.
  • macOS.
  • Linux.
  • Deprecated: see cloud.environment.
  • Deprecated: see cloud.environment.
  • Deprecated: see cloud.environment.
  • IOS
  • Android
  • Chrome OS
typestring
platformPatchLevel
descriptionThe platform software patch level ( e.g. "Build 17134.48", "SP1").
typestring
platformVersion
descriptionThe platform software version ( e.g. "Microsoft Windows 1803").
typestring
typeobject
PopularityRank
descriptionDomain's position in popularity ranks for sources such as Alexa, Quantcast, or Statvoo.
idPopularityRank
properties
giver
descriptionName of the rank serial number hexdump.
typestring
ingestionTime
descriptionTimestamp when the rank was ingested.
formatgoogle-datetime
typestring
rank
descriptionRank position.
formatint64
typestring
typeobject
Prevalence
descriptionThe prevalence of a resource within the customer's environment. This measures how common it is for assets to access the resource.
idPrevalence
properties
dayCount
descriptionThe number of days over which rolling_max is calculated.
formatint32
typeinteger
dayMax
descriptionThe max prevalence score in a day interval window.
formatint32
typeinteger
dayMaxSubDomains
descriptionThe max prevalence score in a day interval window across sub-domains. This field is only valid for domains.
formatint32
typeinteger
rollingMax
descriptionThe maximum number of assets per day accessing the resource over the trailing day_count days.
formatint32
typeinteger
rollingMaxSubDomains
descriptionThe maximum number of assets per day accessing the domain along with sub-domains over the trailing day_count days. This field is only valid for domains.
formatint32
typeinteger
typeobject
Process
descriptionInformation about a process.
idProcess
properties
accessMask
descriptionA bit mask representing the level of access.
formatuint64
typestring
commandLine
descriptionThe command line command that created the process. This field can be used as an entity indicator for process entities.
typestring
commandLineHistory
descriptionThe command line history of the process.
items
typestring
typearray
egid
descriptionThe effective group ID of the process.
typestring
euid
descriptionThe effective user ID of the process.
typestring
file
$refBackstoryFile
descriptionInformation about the file in use by the process.
integrityLevelRid
descriptionThe Microsoft Windows integrity level relative ID (RID) of the process.
formatuint64
typestring
parentPid
deprecatedTrue
descriptionThe ID of the parent process. Deprecated: use parent_process.pid instead.
typestring
parentProcess
$refProcess
descriptionInformation about the parent process.
pgid
descriptionThe identifier that points to the process group ID leader.
typestring
pid
descriptionThe process ID. This field can be used as an entity indicator for process entities.
typestring
productSpecificParentProcessId
deprecatedTrue
descriptionA product specific id for the parent process. Please use parent_process.product_specific_process_id instead.
typestring
productSpecificProcessId
descriptionA product specific process id.
typestring
rgid
descriptionThe real group ID of the process.
typestring
ruid
descriptionThe real user ID of the process.
typestring
sessionLeaderPid
descriptionThe process ID of the session leader process.
typestring
tokenElevationType
descriptionThe elevation type of the process on Microsoft Windows. This determines if any privileges are removed when UAC is enabled.
enum
  • UNKNOWN
  • TYPE_1
  • TYPE_2
  • TYPE_3
enumDescriptions
  • An undetermined token type.
  • A full token with no privileges removed or groups disabled.
  • An elevated token with no privileges removed or groups disabled. Used when running as administrator.
  • A limited token with administrative privileges removed and administrative groups disabled.
typestring
tty
descriptionThe teletype terminal which the command was executed within.
typestring
typeobject
ProviderMLVerdict
descriptionDeprecated. MLVerdict result provided from threat providers, like Mandiant. These fields are used to model Mandiant sources.
idProviderMLVerdict
properties
benignCount
descriptionCount of responses where this IoC was marked benign.
formatint32
typeinteger
confidenceScore
descriptionConfidence score of the verdict.
formatint32
typeinteger
maliciousCount
descriptionCount of responses where this IoC was marked malicious.
formatint32
typeinteger
mandiantSources
descriptionList of mandiant sources from which the verdict was generated.
items
$refSource
typearray
sourceProvider
descriptionSource provider giving the ML verdict.
typestring
thirdPartySources
descriptionList of third-party sources from which the verdict was generated.
items
$refSource
typearray
typeobject
PublicKey
descriptionSubject public key info.
idPublicKey
properties
algorithm
descriptionAny of "RSA", "DSA" or "EC". Indicates the algorithm used to generate the certificate.
typestring
rsa
$refRSA
descriptionRSA public key information.
typeobject
Question
descriptionDNS Questions. See RFC1035, section 4.1.2.
idQuestion
properties
class
descriptionThe code specifying the class of the query.
formatuint32
typeinteger
name
descriptionThe domain name.
typestring
prevalence
$refPrevalence
descriptionThe prevalence of the domain within the customer's environment.
type
descriptionThe code specifying the type of the query.
formatuint32
typeinteger
typeobject
RSA
descriptionRSA public key information.
idRSA
properties
exponent
descriptionKey exponent hexdump.
typestring
keySize
descriptionKey size.
formatint64
typestring
modulus
descriptionKey modulus hexdump.
typestring
typeobject
Reference
descriptionReference to model primatives including event and entity. As support is added for fast retrieval of objects by identifiers, this will be expanded to include ID references rather than full object copies. BEGIN GOOGLE-INTERNAL See go/udm:ids for additional details. END GOOGLE-INTERNAL
idReference
properties
entity
$refBackstoryEntity
descriptionEntity being referenced. End one-of
event
$refUDM
descriptionOnly one of event or entity will be populated for a single reference. Start one-of Event being referenced.
id
$refId
descriptionId being referenced. This field will also be populated for both event and entity with the event id. For detections, only this field will be populated.
typeobject
ReferenceList
descriptionA reference list. Reference lists are user-defined lists of values which users can use in multiple Rules.
idReferenceList
properties
description
descriptionRequired. A user-provided description of the reference list.
typestring
displayName
descriptionOutput only. The unique display name of the reference list.
readOnlyTrue
typestring
entries
descriptionRequired. The entries of the reference list. When listed, they are returned in the order that was specified at creation or update. The combined size of the values of the reference list may not exceed 6MB. This is returned only when the view is REFERENCE_LIST_VIEW_FULL.
items
$refReferenceListEntry
typearray
name
descriptionOutput only. The resource name of the reference list. Format: projects/{project}/locations/{location}/instances/{instance}/referenceLists/{reference_list}
readOnlyTrue
typestring
revisionCreateTime
descriptionOutput only. The timestamp when the reference list was last updated.
formatgoogle-datetime
readOnlyTrue
typestring
ruleAssociationsCount
descriptionOutput only. The count of self-authored rules using the reference list.
formatint32
readOnlyTrue
typeinteger
rules
descriptionOutput only. The resource names for the associated self-authored Rules that use this reference list. This is returned only when the view is REFERENCE_LIST_VIEW_FULL.
items
typestring
readOnlyTrue
typearray
scopeInfo
$refScopeInfo
descriptionOutput only. The scope info of the reference list. During reference list creation, if this field is not set, the reference list without scopes (an unscoped list) will be created for an unscoped user. For a scoped user, this field must be set. During reference list update, if scope_info is requested to be updated, this field must be set.
readOnlyTrue
syntaxType
descriptionRequired. The syntax type indicating how list entries should be validated.
enum
  • REFERENCE_LIST_SYNTAX_TYPE_UNSPECIFIED
  • REFERENCE_LIST_SYNTAX_TYPE_PLAIN_TEXT_STRING
  • REFERENCE_LIST_SYNTAX_TYPE_REGEX
  • REFERENCE_LIST_SYNTAX_TYPE_CIDR
enumDescriptions
  • Defaults to REFERENCE_LIST_SYNTAX_TYPE_PLAIN_TEXT_STRING.
  • List contains plain text patterns.
  • List contains only Regular Expression patterns.
  • List contains only CIDR patterns.
typestring
typeobject
ReferenceListEntry
descriptionAn entry in a reference list.
idReferenceListEntry
properties
value
descriptionRequired. The value of the entry. Maximum length is 512 characters.
typestring
typeobject
ReferenceListScope
descriptionReferenceListScope specifies the list of scope names of the reference list.
idReferenceListScope
properties
scopeNames
descriptionOptional. The list of scope names of the reference list. The scope names should be full resource names and should be of the format: "projects/{project}/locations/{location}/instances/{instance}/dataAccessScopes/{scope_name}".
items
typestring
typearray
typeobject
Registry
descriptionInformation about a registry key or value.
idRegistry
properties
registryKey
descriptionRegistry key associated with an application or system component (e.g., HKEY_, HKCU\Environment...).
typestring
registryValueData
descriptionData associated with a registry value (e.g. %USERPROFILE%\Local Settings\Temp).
typestring
registryValueName
descriptionName of the registry value associated with an application or system component (e.g. TEMP).
typestring
registryValueType
descriptionType of the registry value.
enum
  • TYPE_UNSPECIFIED
  • NONE
  • SZ
  • EXPAND_SZ
  • BINARY
  • DWORD
  • DWORD_LITTLE_ENDIAN
  • DWORD_BIG_ENDIAN
  • LINK
  • MULTI_SZ
  • RESOURCE_LIST
  • QWORD
  • QWORD_LITTLE_ENDIAN
enumDescriptions
  • Default registry value type used when the type is unknown.
  • The registry value is not set and only the key exists.
  • A null-terminated string.
  • A null-terminated string that contains unexpanded references to environment variables
  • Binary data in any form.
  • A 32-bit number.
  • A 32-bit number in little-endian format.
  • A 32-bit number in big-endian format.
  • A null-terminated Unicode string that contains the target path of a symbolic link.
  • A sequence of null-terminated strings, terminated by an empty string
  • A device driver resource list.
  • A 64-bit number.
  • A 64-bit number in little-endian format.
typestring
typeobject
Relation
descriptionDefines the relationship between the entity (a) and another entity (b).
idRelation
properties
direction
descriptionDirectionality of relationship between primary entity (a) and the related entity (b).
enum
  • DIRECTIONALITY_UNSPECIFIED
  • BIDIRECTIONAL
  • UNIDIRECTIONAL
enumDescriptions
  • Default value.
  • Modeled in both directions. Primary entity (a) to related entity (b) and related entity (b) to primary entity (a).
  • Modeled in a single direction. Primary entity (a) to related entity (b).
typestring
entity
$refNoun
descriptionEntity (b) that the primary entity (a) is related to.
entityLabel
descriptionLabel to identify the Noun of the relation.
enum
  • ENTITY_LABEL_UNSPECIFIED
  • PRINCIPAL
  • TARGET
  • OBSERVER
  • SRC
  • NETWORK
  • SECURITY_RESULT
  • INTERMEDIARY
enumDescriptions
  • Default value.
  • The Noun represents a principal type object.
  • The Noun represents a target type object.
  • The Noun represents an observer type object.
  • The Noun represents src type object.
  • The Noun represents a network type object.
  • The Noun represents a SecurityResult object.
  • The Noun represents an intermediary type object.
typestring
entityType
descriptionType of the related entity (b) in this relationship.
enum
  • UNKNOWN_ENTITYTYPE
  • ASSET
  • USER
  • GROUP
  • RESOURCE
  • IP_ADDRESS
  • FILE
  • DOMAIN_NAME
  • URL
  • MUTEX
  • METRIC
enumDescriptions
  • @hide_from_doc
  • An asset, such as workstation, laptop, phone, virtual machine, etc.
  • User.
  • Group.
  • Resource.
  • An external IP address.
  • A file.
  • A domain.
  • A url.
  • A mutex.
  • A metric.
typestring
relationship
descriptionType of relationship.
enum
  • RELATIONSHIP_UNSPECIFIED
  • OWNS
  • ADMINISTERS
  • MEMBER
  • EXECUTES
  • DOWNLOADED_FROM
  • CONTACTS
enumDescriptions
  • Default value
  • Related entity is owned by the primary entity (e.g. user owns device asset).
  • Related entity is administered by the primary entity (e.g. user administers a group).
  • Primary entity is a member of the related entity (e.g. user is a member of a group).
  • Primary entity may have executed the related entity.
  • Primary entity may have been downloaded from the related entity.
  • Primary entity contacts the related entity.
typestring
uid
descriptionUID of the relationship.
formatbyte
typestring
typeobject
Resource
descriptionInformation about a resource such as a task, Cloud Storage bucket, database, disk, logical policy, or something similar.
idResource
properties
attribute
$refAttribute
descriptionGeneric entity metadata attributes of the resource.
id
deprecatedTrue
descriptionDeprecated: Use resource.name or resource.product_object_id.
typestring
name
descriptionThe full name of the resource. For example, Google Cloud: //cloudresourcemanager.googleapis.com/projects/wombat-123, and AWS: arn:aws:iam::123456789012:user/johndoe.
typestring
parent
deprecatedTrue
descriptionThe parent of the resource. For a database table, the parent is the database. For a storage object, the bucket name. Deprecated: use resource_ancestors.name.
typestring
productObjectId
descriptionA vendor-specific identifier to uniquely identify the entity (a GUID, OID, or similar) This field can be used as an entity indicator for a Resource entity.
typestring
resourceSubtype
descriptionResource sub-type (e.g. "BigQuery", "Bigtable").
typestring
resourceType
descriptionResource type.
enum
  • UNSPECIFIED
  • MUTEX
  • TASK
  • PIPE
  • DEVICE
  • FIREWALL_RULE
  • MAILBOX_FOLDER
  • VPC_NETWORK
  • VIRTUAL_MACHINE
  • STORAGE_BUCKET
  • STORAGE_OBJECT
  • DATABASE
  • TABLE
  • CLOUD_PROJECT
  • CLOUD_ORGANIZATION
  • SERVICE_ACCOUNT
  • ACCESS_POLICY
  • CLUSTER
  • SETTING
  • DATASET
  • BACKEND_SERVICE
  • POD
  • CONTAINER
  • FUNCTION
  • RUNTIME
  • IP_ADDRESS
  • DISK
  • VOLUME
  • IMAGE
  • SNAPSHOT
  • REPOSITORY
  • CREDENTIAL
  • LOAD_BALANCER
  • GATEWAY
  • SUBNET
  • USER
enumDescriptions
  • Default type.
  • Mutex.
  • Task.
  • Named pipe.
  • Device.
  • Firewall rule.
  • Mailbox folder.
  • VPC Network.
  • Virtual machine.
  • Storage bucket.
  • Storage object.
  • Database.
  • Data table.
  • Cloud project.
  • Cloud organization.
  • Service account.
  • Access policy.
  • Cluster.
  • Settings.
  • Dataset.
  • Endpoint that receive traffic from a load balancer or proxy.
  • Pod, which is a collection of containers. Often used in Kubernetes.
  • Container.
  • Cloud function.
  • Runtime.
  • IP address.
  • Disk.
  • Volume.
  • Machine image.
  • Snapshot.
  • Repository.
  • Credential, e.g. access keys, ssh keys, tokens, certificates.
  • Load balancer.
  • Gateway.
  • Subnet.
  • User.
typestring
type
deprecatedTrue
descriptionDeprecated: use resource_type instead.
typestring
typeobject
ResourceRecord
descriptionDNS Resource Records. See RFC1035, section 4.1.3.
idResourceRecord
properties
binaryData
descriptionThe raw bytes of any non-UTF8 strings that might be included as part of a DNS response.
formatbyte
typestring
class
descriptionThe code specifying the class of the resource record.
formatuint32
typeinteger
data
descriptionThe payload or response to the DNS question for all responses encoded in UTF-8 format
typestring
name
descriptionThe name of the owner of the resource record.
typestring
ttl
descriptionThe time interval for which the resource record can be cached before the source of the information should again be queried.
formatuint32
typeinteger
type
descriptionThe code specifying the type of the resource record.
formatuint32
typeinteger
typeobject
ResponsePlatformInfo
descriptionRelated info of an Alert in customer's SOAR platform.
idResponsePlatformInfo
properties
alertId
descriptionId of the alert in SOAR product.
typestring
responsePlatformType
descriptionType of SOAR product.
enum
  • RESPONSE_PLATFORM_TYPE_UNSPECIFIED
  • RESPONSE_PLATFORM_TYPE_SIEMPLIFY
enumDescriptions
  • Response platform not specified.
  • Siemplify
typestring
typeobject
Retrohunt
descriptionRetrohunt is an execution of a Rule over a time range in the past.
idRetrohunt
properties
executionInterval
$refInterval
descriptionOutput only. The start and end time of the retrohunt execution. If the retrohunt is not yet finished, the end time of the interval will not be populated.
readOnlyTrue
name
descriptionThe resource name of the retrohunt. Retrohunt is the child of a rule revision. {rule} in the format below is structured as {rule_id@revision_id}. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}/retrohunts/{retrohunt}
typestring
processInterval
$refInterval
descriptionRequired. The start and end time of the event time range this retrohunt processes.
progressPercentage
descriptionOutput only. Percent progress of the retrohunt towards completion, from 0.00 to 100.00.
formatfloat
readOnlyTrue
typenumber
state
descriptionOutput only. The state of the retrohunt.
enum
  • STATE_UNSPECIFIED
  • RUNNING
  • DONE
  • CANCELLED
  • FAILED
enumDescriptions
  • Unspecified or unknown retrohunt state.
  • Running state.
  • Done state.
  • Cancelled state.
  • Failed state.
readOnlyTrue
typestring
typeobject
RetrohuntMetadata
descriptionOperation Metadata for Retrohunts.
idRetrohuntMetadata
properties
executionInterval
$refInterval
descriptionThe start and end time of the retrohunt execution. If the retrohunt is not yet finished, the end time of the interval will not be filled.
progressPercentage
descriptionPercent progress of the retrohunt towards completion, from 0.00 to 100.00.
formatfloat
typenumber
retrohunt
descriptionThe name of the retrohunt. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}/retrohunts/{retrohunt}
typestring
typeobject
RiskDelta
descriptionDescribes the difference in risk score between two points in time.
idRiskDelta
properties
previousRangeEndTime
descriptionEnd time of the previous time window.
formatgoogle-datetime
typestring
previousRiskScore
descriptionRisk score from previous risk window
formatint32
typeinteger
riskScoreDelta
descriptionDifference in the normalized risk score from the previous recorded value.
formatint32
typeinteger
riskScoreNumericDelta
descriptionNumeric change between current and previous risk score
formatint32
typeinteger
typeobject
Role
descriptionSystem role for resource access and modification.
idRole
properties
description
descriptionSystem role description for user.
typestring
name
descriptionSystem role name for user.
typestring
type
descriptionSystem role type for well known roles.
enum
  • TYPE_UNSPECIFIED
  • ADMINISTRATOR
  • SERVICE_ACCOUNT
enumDescriptions
  • Default user role.
  • Product administrator with elevated privileges.
  • System service account for automated privilege access.
typestring
typeobject
Rule
descriptionThe Rule resource represents a user-created rule. NEXT TAG: 21
idRule
properties
allowedRunFrequencies
descriptionOutput only. The run frequencies that are allowed for the rule. Populated in BASIC view and FULL view.
items
enum
  • RUN_FREQUENCY_UNSPECIFIED
  • LIVE
  • HOURLY
  • DAILY
enumDescriptions
  • The run frequency is unspecified/unknown.
  • Executes in real time.
  • Executes once per hour.
  • Executes once per day.
typestring
readOnlyTrue
typearray
author
descriptionOutput only. The author of the rule. Extracted from the meta section of text. Populated in BASIC view and FULL view.
readOnlyTrue
typestring
compilationDiagnostics
descriptionOutput only. A list of a rule's corresponding compilation diagnostic messages such as compilation errors and compilation warnings. Populated in FULL view.
items
$refCompilationDiagnostic
readOnlyTrue
typearray
compilationState
descriptionOutput only. The current compilation state of the rule. Populated in FULL view.
enum
  • COMPILATION_STATE_UNSPECIFIED
  • SUCCEEDED
  • FAILED
enumDescriptions
  • The compilation state is unspecified/unknown.
  • The Rule can successfully compile.
  • The Rule cannot successfully compile. This is possible if a backwards-incompatible change was made to the compiler.
readOnlyTrue
typestring
createTime
descriptionOutput only. The timestamp of when the rule was created. Populated in FULL view.
formatgoogle-datetime
readOnlyTrue
typestring
dataTables
descriptionOutput only. Resource names of the data tables used in this rule.
items
typestring
readOnlyTrue
typearray
displayName
descriptionOutput only. Display name of the rule. Populated in BASIC view and FULL view.
readOnlyTrue
typestring
etag
descriptionThe etag for this rule. If this is provided on update, the request will succeed if and only if it matches the server-computed value, and will fail with an ABORTED error otherwise. Populated in BASIC view and FULL view.
typestring
inputsUsed
$refInputsUsed
descriptionOutput only. The set of inputs used in the rule. For example, if the rule uses $e.principal.hostname, then the uses_udm field will be true.
readOnlyTrue
metadata
additionalProperties
typestring
descriptionOutput only. Additional metadata specified in the meta section of text. Populated in FULL view.
readOnlyTrue
typeobject
name
descriptionFull resource name for the rule. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}
typestring
nearRealTimeLiveRuleEligible
descriptionOutput only. Indicate the rule can run in near real time live rule. If this is true, the rule uses the near real time live rule when the run frequency is set to LIVE.
readOnlyTrue
typeboolean
referenceLists
descriptionOutput only. Resource names of the reference lists used in this rule. Populated in FULL view.
items
typestring
readOnlyTrue
typearray
revisionCreateTime
descriptionOutput only. The timestamp of when the rule revision was created. Populated in FULL, REVISION_METADATA_ONLY views.
formatgoogle-datetime
readOnlyTrue
typestring
revisionId
descriptionOutput only. The revision ID of the rule. A new revision is created whenever the rule text is changed in any way. Format: v_{10 digits}_{9 digits} Populated in REVISION_METADATA_ONLY view and FULL view.
readOnlyTrue
typestring
scope
descriptionResource name of the DataAccessScope bound to this rule. Populated in BASIC view and FULL view. If reference lists are used in the rule, validations will be performed against this scope to ensure that the reference lists are compatible with both the user's and the rule's scopes. The scope should be in the format: "projects/{project}/locations/{location}/instances/{instance}/dataAccessScopes/{scope}".
typestring
severity
$refSeverity
descriptionOutput only. The severity of the rule as specified in the meta section of text. Populated in BASIC view and FULL view.
readOnlyTrue
text
descriptionThe YARA-L content of the rule. Populated in FULL view.
typestring
type
descriptionOutput only. User-facing type of the rule. Extracted from the events section of rule text. Populated in BASIC view and FULL view.
enum
  • RULE_TYPE_UNSPECIFIED
  • SINGLE_EVENT
  • MULTI_EVENT
enumDescriptions
  • The rule type is unspecified/unknown.
  • Rule checks for the existence of a single event.
  • Rule checks for correlation between multiple events
readOnlyTrue
typestring
typeobject
RuleDeployment
descriptionThe RuleDeployment resource represents the deployment state of a Rule.
idRuleDeployment
properties
alerting
descriptionWhether detections resulting from this deployment should be considered alerts.
typeboolean
archiveTime
descriptionOutput only. The timestamp when the rule deployment archive state was last set to true. If the rule deployment's current archive state is not set to true, the field will be empty.
formatgoogle-datetime
readOnlyTrue
typestring
archived
descriptionThe archive state of the rule deployment. Cannot be set to true unless enabled is set to false. If set to true, alerting will automatically be set to false. If currently set to true, enabled, alerting, and run_frequency cannot be updated.
typeboolean
consumerRules
descriptionOutput only. The names of the associated/chained consumer rules. Rules are considered consumers of this rule if their rule text explicitly filters on this rule's ruleid. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}
items
typestring
readOnlyTrue
typearray
enabled
descriptionWhether the rule is currently deployed continuously against incoming data.
typeboolean
executionState
descriptionOutput only. The execution state of the rule deployment.
enum
  • EXECUTION_STATE_UNSPECIFIED
  • DEFAULT
  • LIMITED
  • PAUSED
enumDescriptions
  • Unspecified or unknown execution state.
  • Default execution state.
  • Rules in limited state may not have their executions guaranteed.
  • Paused rules are not executed at all.
readOnlyTrue
typestring
lastAlertStatusChangeTime
descriptionOutput only. The timestamp when the rule deployment alert state was lastly changed. This is filled regardless of the current alert state. E.g. if the current alert status is false, this timestamp will be the timestamp when the alert status was changed to false.
formatgoogle-datetime
readOnlyTrue
typestring
name
descriptionRequired. The resource name of the rule deployment. Note that RuleDeployment is a child of the overall Rule, not any individual revision, so the resource ID segment for the Rule resource must not reference a specific revision. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}/deployment
typestring
producerRules
descriptionOutput only. The names of the associated/chained producer rules. Rules are considered producers for this rule if this rule explicitly filters on their ruleid. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}
items
typestring
readOnlyTrue
typearray
runFrequency
descriptionThe run frequency of the rule deployment.
enum
  • RUN_FREQUENCY_UNSPECIFIED
  • LIVE
  • HOURLY
  • DAILY
enumDescriptions
  • The run frequency is unspecified/unknown.
  • Executes in real time.
  • Executes once per hour.
  • Executes once per day.
typestring
typeobject
RuntimeError
idRuntimeError
properties
errorText
typestring
timeRange
$refInterval
typeobject
SSLCertificate
descriptionSSL certificate.
idSSLCertificate
properties
certExtensions
additionalProperties
descriptionProperties of the object.
typeany
descriptionCertificate's extensions.
typeobject
certSignature
$refCertSignature
descriptionCertificate's signature and algorithm.
ec
$refEC
descriptionEC public key information.
extension
$refExtension
deprecatedTrue
description(DEPRECATED) certificate's extension.
firstSeenTime
descriptionDate the certificate was first retrieved by VirusTotal.
formatgoogle-datetime
typestring
issuer
$refSubject
descriptionCertificate's issuer data.
publicKey
$refPublicKey
descriptionPublic key information.
serialNumber
descriptionCertificate's serial number hexdump.
typestring
signatureAlgorithm
descriptionAlgorithm used for the signature (for example, "sha1RSA").
typestring
size
descriptionCertificate content length.
formatint64
typestring
subject
$refSubject
descriptionCertificate's subject data.
thumbprint
descriptionCertificate's content SHA1 hash.
typestring
thumbprintSha256
descriptionCertificate's content SHA256 hash.
typestring
validity
$refValidity
descriptionCertificate's validity period.
version
descriptionCertificate version (typically "V1", "V2" or "V3").
typestring
typeobject
ScopeInfo
descriptionScopeInfo specifies the scope info of the reference list.
idScopeInfo
properties
referenceListScope
$refReferenceListScope
descriptionRequired. The list of scope names of the reference list, if the list is empty the reference list is treated as unscoped.
typeobject
SearchDataTableColumnInfo
idSearchDataTableColumnInfo
properties
isDefault
typeboolean
originalColumn
typestring
typeobject
SearchDataTableInfo
idSearchDataTableInfo
properties
columnInfo
items
$refSearchDataTableColumnInfo
typearray
dataTable
typestring
typeobject
SearchDataTableRow
idSearchDataTableRow
properties
column
typestring
value
typestring
typeobject
SearchDataTableRowInfo
idSearchDataTableRowInfo
properties
dataTable
typestring
rows
items
$refSearchDataTableRow
typearray
typeobject
SecurityResult
descriptionSecurity related metadata for the event. A security result might be something like "virus detected and quarantined," "malicious connection blocked," or "sensitive data included in document foo.doc." Each security result, of which there may be more than one, may either pertain to the whole event, or to a specific object or device referenced in the event (e.g. a malicious file that was detected, or a sensitive document sent as an email attachment). For security results that apply to a particular object referenced in the event, the security_results message MUST contain details about the implicated object (such as process, user, IP, domain, URL, IP, or email address) in the about field. For security results that apply to the entire event (e.g. SPAM found in this email), the about field must remain empty.
idSecurityResult
properties
about
$refNoun
descriptionIf the security result is about a specific entity (Noun), add it here. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
action
descriptionActions taken for this event. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
items
enum
  • UNKNOWN_ACTION
  • ALLOW
  • BLOCK
  • ALLOW_WITH_MODIFICATION
  • QUARANTINE
  • FAIL
  • CHALLENGE
enumDescriptions
  • The default action.
  • Allowed.
  • Blocked.
  • Strip, modify something (e.g. File or email was disinfected or rewritten and still forwarded).
  • Put somewhere for later analysis (does NOT imply block).
  • Failed (e.g. the event was allowed but failed).
  • Challenged (e.g. the user was challenged by a Captcha, 2FA).
typestring
typearray
actionDetails
descriptionThe detail of the action taken as provided by the vendor. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
typestring
alertState
descriptionThe alerting types of this security result. This is primarily set for rule-generated detections and alerts.
enum
  • UNSPECIFIED
  • NOT_ALERTING
  • ALERTING
enumDescriptions
  • The security result type is not known.
  • The security result is not an alert.
  • The security result is an alert.
typestring
analyticsMetadata
descriptionStores metadata about each risk analytic metric the rule uses. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
items
$refAnalyticsMetadata
typearray
associations
descriptionAssociations related to the threat. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
items
$refAssociation
typearray
attackDetails
$refAttackDetails
descriptionMITRE ATT&CK details. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
campaigns
descriptionCampaigns using this IOC threat. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
items
typestring
typearray
category
descriptionThe security category. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
items
enum
  • UNKNOWN_CATEGORY
  • SOFTWARE_MALICIOUS
  • SOFTWARE_SUSPICIOUS
  • SOFTWARE_PUA
  • NETWORK_MALICIOUS
  • NETWORK_SUSPICIOUS
  • NETWORK_CATEGORIZED_CONTENT
  • NETWORK_DENIAL_OF_SERVICE
  • NETWORK_RECON
  • NETWORK_COMMAND_AND_CONTROL
  • ACL_VIOLATION
  • AUTH_VIOLATION
  • EXPLOIT
  • DATA_EXFILTRATION
  • DATA_AT_REST
  • DATA_DESTRUCTION
  • TOR_EXIT_NODE
  • MAIL_SPAM
  • MAIL_PHISHING
  • MAIL_SPOOFING
  • POLICY_VIOLATION
  • SOCIAL_ENGINEERING
  • PHISHING
enumDescriptions
  • The default category.
  • Malware, spyware, rootkit.
  • Below the conviction threshold; probably bad.
  • Potentially Unwanted App (such as adware).
  • Includes C&C or network exploit.
  • Suspicious activity, such as potential reverse tunnel.
  • Non-security related: URL has category like gambling or porn.
  • DoS, DDoS.
  • Port scan detected by an IDS, probing of web app.
  • If we know this is a C&C channel.
  • Unauthorized access attempted, including attempted access to files, web services, processes, web objects, etc.
  • Authentication failed (e.g. bad password or bad 2-factor authentication).
  • Exploit: For all manner of exploits including attempted overflows, bad protocol encodings, ROP, SQL injection, etc. For both network and host- based exploits.
  • DLP: Sensitive data transmission, copy to thumb drive.
  • DLP: Sensitive data found at rest in a scan.
  • Attempt to destroy/delete data.
  • TOR Exit Nodes.
  • Spam email, message, etc.
  • Phishing email, chat messages, etc.
  • Spoofed source email address, etc.
  • Security-related policy violation (e.g. firewall/proxy/HIPS rule violated, NAC block action).
  • Threats which manipulate to break normal security procedures.
  • Phishing pages, pops, https phishing etc.
typestring
typearray
categoryDetails
descriptionFor vendor-specific categories. For web categorization, put type in here such as "gambling" or "porn". This field is not populated when the SecurityResult appears in a finding (a detection or alert).
items
typestring
typearray
confidence
descriptionThe confidence level of the result as estimated by the product. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
enum
  • UNKNOWN_CONFIDENCE
  • LOW_CONFIDENCE
  • MEDIUM_CONFIDENCE
  • HIGH_CONFIDENCE
enumDescriptions
  • The default confidence level.
  • Low confidence.
  • Medium confidence.
  • High confidence.
typestring
confidenceDetails
descriptionAdditional detail with regards to the confidence of a security event as estimated by the product vendor. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
typestring
confidenceScore
descriptionThe confidence score of the security result. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
formatfloat
typenumber
description
descriptionA human-readable description (e.g. "user password was wrong"). This can be more detailed than the summary.
typestring
detectionDepth
descriptionThe depth of the detection chain. Applies only to composite detections.
formatint64
typestring
detectionFields
descriptionAn ordered list of values, that represent fields in detections for a security finding. This list represents mapping of names of requested entities to their values (the security result matched variables). This is only populated when the SecurityResult appears in a finding (a detection or alert).
items
$refLabel
typearray
firstDiscoveredTime
descriptionFirst time the IoC threat was discovered in the provider. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
formatgoogle-datetime
typestring
lastDiscoveredTime
descriptionLast time the IoC was seen in the provider data. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
formatgoogle-datetime
typestring
lastUpdatedTime
descriptionLast time the IoC threat was updated in the provider. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
formatgoogle-datetime
typestring
outcomes
descriptionA list of outcomes that represent the results of this security finding. This list represents a mapping of names of the requested outcomes, to a stringified version of their values. This is only populated when the SecurityResult appears in a finding (a detection or alert).
items
$refLabel
typearray
priority
descriptionThe priority of the result. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
enum
  • UNKNOWN_PRIORITY
  • LOW_PRIORITY
  • MEDIUM_PRIORITY
  • HIGH_PRIORITY
enumDescriptions
  • Default priority level.
  • Low priority.
  • Medium priority.
  • High priority.
typestring
priorityDetails
descriptionVendor-specific information about the security result priority. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
typestring
reports
descriptionReports that reference this IOC threat. These are the report IDs. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
items
typestring
typearray
riskScore
descriptionThe risk score of the security result.
formatfloat
typenumber
ruleAuthor
descriptionAuthor of the security rule. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
typestring
ruleId
descriptionA vendor-specific ID for a rule, varying by observer type (e.g. "08123", "5d2b44d0-5ef6-40f5-a704-47d61d3babbe").
typestring
ruleLabels
descriptionA list of rule labels that can't be captured by the other fields in security result (e.g. "reference : AnotherRule", "contributor : John"). This is primarily set in rule-generated detections and alerts.
items
$refLabel
typearray
ruleName
descriptionName of the security rule (e.g. "BlockInboundToOracle").
typestring
ruleSet
descriptionThe curated detection's rule set identifier. (for example, "windows-threats") This is primarily set in rule-generated detections and alerts.
typestring
ruleSetDisplayName
descriptionThe curated detections rule set display name. This is primarily set in rule-generated detections and alerts.
typestring
ruleType
descriptionThe type of security rule.
typestring
ruleVersion
descriptionVersion of the security rule. (e.g. "v1.1", "00001", "1604709794", "2020-11-16T23:04:19+00:00"). Note that rule versions are source-dependant and lexical ordering should not be assumed.
typestring
rulesetCategoryDisplayName
descriptionThe curated detection rule set category display name. (for example, if rule_set_display_name is "CDIR SCC Enhanced Exfiltration", the rule_set_category is "Cloud Threats"). This is primarily set in rule-generated detections and alerts.
typestring
severity
descriptionThe severity of the result.
enum
  • UNKNOWN_SEVERITY
  • INFORMATIONAL
  • ERROR
  • NONE
  • LOW
  • MEDIUM
  • HIGH
  • CRITICAL
enumDescriptions
  • The default severity level.
  • Info severity.
  • An error.
  • No malicious result.
  • Low-severity malicious result.
  • Medium-severity malicious result.
  • High-severity malicious result.
  • Critical-severity malicious result.
typestring
severityDetails
descriptionVendor-specific severity. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
typestring
summary
descriptionA short human-readable summary (e.g. "failed login occurred")
typestring
threatFeedName
descriptionVendor feed name for a threat indicator feed. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
typestring
threatId
descriptionVendor-specific ID for a threat. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
typestring
threatIdNamespace
descriptionThe attribute threat_id_namespace qualifies threat_id with an id namespace to get an unique id. The attribute threat_id by itself is not unique across Chronicle as it is a vendor specific id. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
enum
  • NORMALIZED_TELEMETRY
  • RAW_TELEMETRY
  • RULE_DETECTIONS
  • UPPERCASE
  • MACHINE_INTELLIGENCE
  • SECURITY_COMMAND_CENTER
  • UNSPECIFIED
  • SOAR_ALERT
  • VIRUS_TOTAL
enumDescriptions
  • Ingested and Normalized telemetry events
  • Ingested Raw telemetry
  • Chronicle Rules engine
  • Uppercase
  • DSML - Machine Intelligence
  • A normalized telemetry event from Google Security Command Center.
  • Unspecified Namespace
  • An alert coming from other SIEMs via Chronicle SOAR.
  • VirusTotal.
typestring
threatName
descriptionA vendor-assigned classification common across multiple customers (for example, "W32/File-A", "Slammer"). This field is not populated when the SecurityResult appears in a finding (a detection or alert).
typestring
threatStatus
descriptionCurrent status of the threat This field is not populated when the SecurityResult appears in a finding (a detection or alert).
enum
  • THREAT_STATUS_UNSPECIFIED
  • ACTIVE
  • CLEARED
  • FALSE_POSITIVE
enumDescriptions
  • Default threat status
  • Active threat.
  • Cleared threat.
  • False positive.
typestring
threatVerdict
descriptionGCTI threat verdict on the security result entity. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
enum
  • THREAT_VERDICT_UNSPECIFIED
  • UNDETECTED
  • SUSPICIOUS
  • MALICIOUS
enumDescriptions
  • Unspecified threat verdict level.
  • Undetected threat verdict level.
  • Suspicious threat verdict level.
  • Malicious threat verdict level.
typestring
urlBackToProduct
descriptionURL that takes the user to the source product console for this event. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
typestring
variables
additionalProperties
$refFindingVariable
descriptionA list of outcomes and match variables that represent the results of this security finding. This list represents a mapping of names of the requested outcomes or match variables, to their values. This is only populated when the SecurityResult appears in a finding (a detection or alert).
typeobject
verdict
$refVerdict
deprecatedTrue
descriptionVerdict about the IoC from the provider. This field is now deprecated. Use VerdictInfo instead.
verdictInfo
descriptionVerdict information about the IoC from the provider. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
items
$refVerdictInfo
typearray
typeobject
Server
descriptionTransport Layer Security (TLS) information associated with the server (for example, Certificate or JA3 hash).
idServer
properties
certificate
$refCertificate
descriptionServer certificate.
ja3s
descriptionJA3 hash from the TLS ServerHello, as a hex-encoded string.
typestring
typeobject
Severity
descriptionSeverity represents the severity level of the rule.
idSeverity
properties
displayName
descriptionThe display name of the severity level. Extracted from the meta section of the rule text.
typestring
typeobject
SignatureInfo
descriptionFile signature information extracted from different tools.
idSignatureInfo
properties
codesign
$refFileMetadataCodesign
descriptionSignature information extracted from the codesign utility.
sigcheck
$refFileMetadataSignatureInfo
descriptionSignature information extracted from the sigcheck tool.
typeobject
SignerInfo
descriptionFile metadata related to the signer information.
idSignerInfo
properties
certIssuer
descriptionCompany that issued the certificate.
typestring
name
descriptionCommon name of the signers/certificate. The order of the signers matters. Each element is a higher level authority, the last being the root authority.
typestring
status
descriptionIt can say "Valid" or state the problem with the certificate if any (e.g. "This certificate or one of the certificates in the certificate chain is not time valid.").
typestring
validUsage
descriptionIndicates which situations the certificate is valid for (e.g. "Code Signing").
typestring
typeobject
Smtp
descriptionSMTP info. See RFC 2821.
idSmtp
properties
helo
descriptionThe client's 'HELO'/'EHLO' string.
typestring
isTls
descriptionIf the connection switched to TLS.
typeboolean
isWebmail
descriptionIf the message was sent via a webmail client.
typeboolean
mailFrom
descriptionThe client's 'MAIL FROM' string.
typestring
messagePath
descriptionThe message's path (extracted from the headers).
typestring
rcptTo
descriptionThe client's 'RCPT TO' string(s).
items
typestring
typearray
serverResponse
descriptionThe server's response(s) to the client.
items
typestring
typearray
typeobject
SoarAlertMetadata
descriptionMetadata fields of alerts coming from other SIEM systems.
idSoarAlertMetadata
properties
alertId
descriptionAlert ID in the source SIEM system.
typestring
product
descriptionName of the product the alert is coming from.
typestring
sourceRule
descriptionName of the rule triggering the alert in the source SIEM.
typestring
sourceSystem
descriptionName of the Source SIEM system.
typestring
sourceSystemTicketId
descriptionTicket id for the alert in the source system.
typestring
sourceSystemUri
descriptionUrl to the source SIEM system.
typestring
vendor
descriptionName of the vendor.
typestring
typeobject
Software
descriptionInformation about a software package or application.
idSoftware
properties
description
descriptionThe description of the software.
typestring
name
descriptionThe name of the software.
typestring
permissions
descriptionSystem permissions granted to the software. For example, "android.permission.WRITE_EXTERNAL_STORAGE"
items
$refPermission
typearray
vendorName
descriptionThe name of the software vendor.
typestring
version
descriptionThe version of the software.
typestring
typeobject
Source
descriptionDeprecated. Information about the threat intelligence source. These fields are used to model Mandiant sources.
idSource
properties
benignCount
descriptionCount of responses where this IoC was marked benign.
formatint32
typeinteger
maliciousCount
descriptionCount of responses where this IoC was marked malicious.
formatint32
typeinteger
name
descriptionName of the IoC source.
typestring
quality
descriptionQuality of the IoC mapping extracted from the source.
enum
  • UNKNOWN_CONFIDENCE
  • LOW_CONFIDENCE
  • MEDIUM_CONFIDENCE
  • HIGH_CONFIDENCE
enumDescriptions
  • The default confidence level.
  • Low confidence.
  • Medium confidence.
  • High confidence.
typestring
responseCount
descriptionTotal response count from this source.
formatint32
typeinteger
sourceCount
descriptionNumber of sources from which intelligence was extracted.
formatint32
typeinteger
threatIntelligenceSources
descriptionDifferent threat intelligence sources from which IoC info was extracted.
items
$refSource
typearray
typeobject
Status
descriptionThe `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors).
idStatus
properties
code
descriptionThe status code, which should be an enum value of google.rpc.Code.
formatint32
typeinteger
details
descriptionA list of messages that carry the error details. There is a common set of message types for APIs to use.
items
additionalProperties
descriptionProperties of the object. Contains field @type with type URL.
typeany
typeobject
typearray
message
descriptionA developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
typestring
typeobject
StringSequence
descriptionStringSequence represents a sequence of string.
idStringSequence
properties
stringVals
descriptionstring sequence.
items
typestring
typearray
typeobject
StringToInt64MapEntry
idStringToInt64MapEntry
properties
key
descriptionKey field.
typestring
value
descriptionValue field.
formatint64
typestring
typeobject
StringValue
idStringValue
properties
displayValue
typestring
rawValue
typestring
typeobject
StringValues
idStringValues
properties
values
items
$refStringValue
typearray
typeobject
Subject
descriptionSubject data.
idSubject
properties
commonName
descriptionCN: CommonName.
typestring
countryName
descriptionC: Country name.
typestring
locality
descriptionL: Locality.
typestring
organization
descriptionO: Organization.
typestring
organizationalUnit
descriptionOU: OrganizationalUnit.
typestring
stateOrProvinceName
descriptionST: StateOrProvinceName.
typestring
typeobject
Tactic
descriptionTactic information related to an attack or threat.
idTactic
properties
id
descriptionTactic ID (e.g. "TA0043").
typestring
name
descriptionTactic Name (e.g. "Reconnaissance")
typestring
typeobject
Tags
descriptionTags are event metadata which is set by examining event contents post-parsing. For example, a UDM event may be assigned a tenant_id based on certain customer-defined parameters.
idTags
properties
dataTapConfigName
descriptionA list of sink name values defined in DataTap configurations.
items
typestring
typearray
tenantId
descriptionA list of subtenant ids that this event belongs to.
items
formatbyte
typestring
typearray
typeobject
Technique
descriptionTechnique information related to an attack or threat.
idTechnique
properties
id
descriptionTechnique ID (e.g. "T1595").
typestring
name
descriptionTechnique Name (e.g. "Active Scanning").
typestring
subtechniqueId
descriptionSubtechnique ID (e.g. "T1595.001").
typestring
subtechniqueName
descriptionSubtechnique Name (e.g. "Scanning IP Blocks").
typestring
typeobject
TimeOff
descriptionSystem record for leave/time-off from a Human Capital Management (HCM) system.
idTimeOff
properties
description
descriptionDescription of the leave if available (e.g. 'Vacation').
typestring
interval
$refInterval
descriptionInterval duration of the leave.
typeobject
Tls
descriptionTransport Layer Security (TLS) information.
idTls
properties
cipher
descriptionCipher used during the connection.
typestring
client
$refClient
descriptionCertificate information for the client certificate.
curve
descriptionElliptical curve used for a given cipher.
typestring
established
descriptionIndicates whether the TLS negotiation was successful.
typeboolean
nextProtocol
descriptionProtocol to be used for tunnel.
typestring
resumed
descriptionIndicates whether the TLS connection was resumed from a previous TLS negotiation.
typeboolean
server
$refServer
descriptionCertificate information for the server certificate.
version
descriptionTLS version.
typestring
versionProtocol
descriptionProtocol.
typestring
typeobject
Tracker
descriptionURL Tracker.
idTracker
properties
id
descriptionTracker ID, if available.
typestring
timestamp
descriptionTracker ingestion date.
formatgoogle-datetime
typestring
tracker
descriptionTracker name.
typestring
url
descriptionTracker script URL.
typestring
typeobject
Tunnels
descriptionVPN tunnels.
idTunnels
properties
provider
descriptionThe provider of the VPN tunnels being used.
typestring
type
descriptionThe type of the VPN tunnels.
typestring
typeobject
UDM
descriptionA Unified Data Model event.
idUDM
properties
about
descriptionRepresents entities referenced by the event that are not otherwise described in principal, src, target, intermediary or observer. For example, it could be used to track email file attachments, domains/URLs/IPs embedded within an email body, and DLLs that are loaded during a PROCESS_LAUNCH event.
items
$refNoun
typearray
additional
additionalProperties
descriptionProperties of the object.
typeany
descriptionAny important vendor-specific event data that cannot be adequately represented within the formal sections of the UDM model.
typeobject
extensions
$refExtensions
descriptionAll other first-class, event-specific metadata goes in this message. Do not place protocol metadata in Extensions; put it in Network.
extracted
additionalProperties
descriptionProperties of the object.
typeany
descriptionFlattened fields extracted from the log.
typeobject
intermediary
descriptionRepresents details on one or more intermediate entities processing activity described in the event. This includes device details about a proxy server or SMTP relay server. If an active event (that has a principal and possibly target) passes through any intermediaries, they're added here. Intermediaries can impact the overall action, for example blocking or modifying an ongoing request. A rule of thumb here is that 'principal', 'target', and description of the initial action should be the same regardless of the intermediary or its action. A successful network connection from A->B should look the same in principal/target/intermediary as one blocked by firewall C: principal: A, target: B (intermediary: C).
items
$refNoun
typearray
metadata
$refMetadata
descriptionEvent metadata such as timestamp, source product, etc.
network
$refNetwork
descriptionAll network details go here, including sub-messages with details on each protocol (for example, DHCP, DNS, or HTTP).
observer
$refNoun
descriptionRepresents an observer entity (for example, a packet sniffer or network-based vulnerability scanner), which is not a direct intermediary, but which observes and reports on the event in question.
principal
$refNoun
descriptionRepresents the acting entity that originates the activity described in the event. The principal must include at least one machine detail (hostname, MACs, IPs, port, product-specific identifiers like an EDR asset ID) or user detail (for example, username), and optionally include process details. It must NOT include any of the following fields: email, files, registry keys or values.
securityResult
descriptionA list of security results.
items
$refSecurityResult
typearray
src
$refNoun
descriptionRepresents a source entity being acted upon by the participant along with the device or process context for the source object (the machine where the source object resides). For example, if user U copies file A on machine X to file B on machine Y, both file A and machine X would be specified in the src portion of the UDM event.
target
$refNoun
descriptionRepresents a target entity being referenced by the event or an object on the target entity. For example, in a firewall connection from device A to device B, A is described as the principal and B is described as the target. For a process injection by process C into target process D, process C is described as the principal and process D is described as the target.
typeobject
UdmColumnList
idUdmColumnList
properties
values
items
$refUdmColumnValue
typearray
typeobject
UdmColumnType
idUdmColumnType
properties
list
$refUdmColumnList
value
$refUdmColumnValue
typeobject
UdmColumnValue
idUdmColumnValue
properties
boolVal
typeboolean
bytesVal
formatbyte
typestring
dateVal
$refDate
doubleVal
formatdouble
typenumber
int64Val
formatint64
typestring
nullVal
typeboolean
protoVal
additionalProperties
descriptionProperties of the object. Contains field @type with type URL.
typeany
typeobject
stringVal
typestring
timestampVal
formatgoogle-datetime
typestring
uint64Val
formatuint64
typestring
typeobject
UdmEventInfo
idUdmEventInfo
properties
alertNumber
formatint32
typeinteger
annotations
items
enum
  • ANNOTATION_UNSPECIFIED
  • ANNOTATION_ALERT
enumDescriptions
typestring
typearray
chip
$refChip
deprecatedTrue
connectedComponentLabel
descriptionOptional.
formatbyte
typestring
datatableRowInfo
items
$refSearchDataTableRowInfo
typearray
detections
items
$refCollection
typearray
displayName
deprecatedTrue
typestring
entity
$refBackstoryEntity
event
$refUDM
eventLogToken
typestring
filterProperties
$refFilterProperties
deprecatedTrue
outcomes
items
$refUdmColumnType
typearray
tenantId
descriptionOptional.
typestring
uid
formatbyte
typestring
typeobject
UdmEventList
idUdmEventList
properties
columnNames
$refColumnNames
complete
typeboolean
datatableInfo
items
$refSearchDataTableInfo
typearray
events
items
$refUdmEventInfo
typearray
progress
formatdouble
typenumber
tooManyEvents
typeboolean
typeobject
UdmFieldAggregation
idUdmFieldAggregation
properties
aggregationType
enum
  • UNSPECIFIED_FIELD_AGGREGATION_TYPE
  • UDM_FIELD_AGGREGATION_TYPE
  • ENTITY_FIELD_AGGREGATION_TYPE
enumDescriptions
typestring
allValues
items
$refUdmValueCount
typearray
baselineEventCount
formatint32
typeinteger
bottomValues
items
$refUdmValueCount
typearray
eventCount
formatint32
typeinteger
fieldName
typestring
tooManyValues
typeboolean
topValues
items
$refUdmValueCount
typearray
valueCount
formatint32
typeinteger
typeobject
UdmFieldAggregations
idUdmFieldAggregations
properties
complete
typeboolean
fields
items
$refUdmFieldAggregation
typearray
groupByFields
items
$refGroupAggregationByField
typearray
typeobject
UdmFieldValue
idUdmFieldValue
properties
boolValue
typeboolean
bytesValue
formatbyte
typestring
doubleValue
formatdouble
typenumber
enumValue
typestring
floatValue
formatfloat
typenumber
int32Value
formatint32
typeinteger
int64Value
formatint64
typestring
isNull
typeboolean
stringValue
typestring
timestampValue
formatgoogle-datetime
typestring
uint32Value
formatuint32
typeinteger
uint64Value
formatuint64
typestring
typeobject
UdmPrevalence
idUdmPrevalence
properties
artifacts
items
$refFieldAndValue
typearray
prevalence
formatint32
typeinteger
typeobject
UdmPrevalenceBucket
idUdmPrevalenceBucket
properties
prevalence
items
$refUdmPrevalence
typearray
typeobject
UdmPrevalenceResponse
idUdmPrevalenceResponse
properties
buckets
items
$refUdmPrevalenceBucket
typearray
partialPrevalence
typeboolean
typeobject
UdmSearchOperationMetadata
descriptionInformation about a UDM Search operation. This message is used to populate the `metadata` field of `Operation` resources created by UDM Search.
idUdmSearchOperationMetadata
properties
baselineEventsCount
descriptionThe number of events matching the baseline query so far.
formatint32
typeinteger
baselineQuery
descriptionQuery used to search for events.
typestring
baselineTimeRange
$refInterval
descriptionThe time range used for the baseline query [inclusive start time, exclusive end time).
caseInsensitive
descriptionIf true, the search was performed in a case-insensitive manner.
typeboolean
endTime
descriptionThe end time of the operation, if done.
formatgoogle-datetime
typestring
expireTime
descriptionThe time when the operation results expire. This time may change while the operation is in progress. If unset, the results never expire.
formatgoogle-datetime
typestring
filteredEventsCount
descriptionThe number of events matching the snapshot query so far. This is <= `baseline_events_count`. If the snapshot query is empty, this will be equal to `baseline_events_count`.
formatint32
typeinteger
progress
descriptionA value from 0 to 1 representing the progress of the operation.
formatdouble
typenumber
snapshotQuery
descriptionQuery used to filter the baseline query's events.
typestring
snapshotTimeRange
$refInterval
descriptionTime range used to filter the baseline query's events [inclusive start time, exclusive end time). This time range is completely within `baseline_time_range`. If not set, it is assumed to match `baseline_time_range`.
startTime
descriptionThe start time of the operation.
formatgoogle-datetime
typestring
statsRowsCount
descriptionThe total number of rows returned for a stats query.
formatint32
typeinteger
typeobject
UdmValueCount
idUdmValueCount
properties
baselineEventCount
formatint32
typeinteger
eventCount
formatint32
typeinteger
value
$refUdmFieldValue
typeobject
Uint64Sequence
descriptionUint64Sequence represents a sequence of uint64s.
idUint64Sequence
properties
uint64Vals
descriptionuint64 sequence.
items
formatuint64
typestring
typearray
typeobject
Url
descriptionUrl.
idUrl
properties
categories
descriptionCategorisation done by VirusTotal partners.
items
typestring
typearray
favicon
$refFavicon
descriptionDifference hash and MD5 hash of the URL's.
htmlMeta
additionalProperties
descriptionProperties of the object.
typeany
descriptionMeta tags (only for URLs downloading HTML).
typeobject
lastFinalUrl
descriptionIf the original URL redirects, where does it end.
typestring
lastHttpResponseCode
descriptionHTTP response code of the last response.
formatint32
typeinteger
lastHttpResponseContentLength
descriptionLength in bytes of the content received.
formatint64
typestring
lastHttpResponseContentSha256
descriptionURL response body's SHA256 hash.
typestring
lastHttpResponseCookies
additionalProperties
descriptionProperties of the object.
typeany
descriptionWebsite's cookies.
typeobject
lastHttpResponseHeaders
additionalProperties
descriptionProperties of the object.
typeany
descriptionHeaders and values of the last HTTP response.
typeobject
tags
descriptionTags.
items
typestring
typearray
title
descriptionWebpage title.
typestring
trackers
descriptionTrackers found in the URL in a historical manner.
items
$refTracker
typearray
url
descriptionURL.
typestring
typeobject
User
descriptionInformation about a user.
idUser
properties
accountExpirationTime
descriptionUser account expiration timestamp.
formatgoogle-datetime
typestring
accountLockoutTime
descriptionUser account lockout timestamp.
formatgoogle-datetime
typestring
accountType
descriptionType of user account (for example, service, domain, or cloud). This is somewhat aligned to: https://attack.mitre.org/techniques/T1078/
enum
  • ACCOUNT_TYPE_UNSPECIFIED
  • DOMAIN_ACCOUNT_TYPE
  • LOCAL_ACCOUNT_TYPE
  • CLOUD_ACCOUNT_TYPE
  • SERVICE_ACCOUNT_TYPE
  • DEFAULT_ACCOUNT_TYPE
enumDescriptions
  • Default user account type.
  • A human account part of some domain in directory services.
  • A local machine account.
  • A SaaS service account type (such as Slack or GitHub).
  • A non-human account for data access.
  • A system built in default account.
typestring
attribute
$refAttribute
descriptionGeneric entity metadata attributes of the user.
companyName
descriptionUser job company name.
typestring
department
descriptionUser job department
items
typestring
typearray
emailAddresses
descriptionEmail addresses of the user. This field can be used as an entity indicator for user entities.
items
typestring
typearray
employeeId
descriptionHuman capital management identifier. This field can be used as an entity indicator for user entities.
typestring
firstName
descriptionFirst name of the user (e.g. "John").
typestring
firstSeenTime
descriptionThe first observed time for a user. The value is calculated on the basis of the first time the identifier was observed.
formatgoogle-datetime
typestring
groupIdentifiers
descriptionProduct object identifiers of the group(s) the user belongs to A vendor-specific identifier to uniquely identify the group(s) the user belongs to (a GUID, LDAP OID, or similar).
items
typestring
typearray
groupid
deprecatedTrue
descriptionThe ID of the group that the user belongs to. Deprecated in favor of the repeated group_identifiers field.
typestring
hireDate
descriptionUser job employment hire date.
formatgoogle-datetime
typestring
lastBadPasswordAttemptTime
descriptionUser last bad password attempt timestamp.
formatgoogle-datetime
typestring
lastLoginTime
descriptionUser last login timestamp.
formatgoogle-datetime
typestring
lastName
descriptionLast name of the user (e.g. "Locke").
typestring
lastPasswordChangeTime
descriptionUser last password change timestamp.
formatgoogle-datetime
typestring
managers
descriptionUser job manager(s).
items
$refUser
typearray
middleName
descriptionMiddle name of the user.
typestring
officeAddress
$refLocation
descriptionUser job office location.
passwordExpirationTime
descriptionUser password expiration timestamp.
formatgoogle-datetime
typestring
personalAddress
$refLocation
descriptionPersonal address of the user.
phoneNumbers
descriptionPhone numbers for the user.
items
typestring
typearray
productObjectId
descriptionA vendor-specific identifier to uniquely identify the entity (e.g. a GUID, LDAP, OID, or similar). This field can be used as an entity indicator for user entities.
typestring
roleDescription
deprecatedTrue
descriptionSystem role description for user. Deprecated: use attribute.roles.
typestring
roleName
deprecatedTrue
descriptionSystem role name for user. Deprecated: use attribute.roles.
typestring
terminationDate
descriptionUser job employment termination date.
formatgoogle-datetime
typestring
timeOff
descriptionUser time off leaves from active work.
items
$refTimeOff
typearray
title
descriptionUser job title.
typestring
userAuthenticationStatus
descriptionSystem authentication status for user.
enum
  • UNKNOWN_AUTHENTICATION_STATUS
  • ACTIVE
  • SUSPENDED
  • NO_ACTIVE_CREDENTIALS
  • DELETED
enumDescriptions
  • The default authentication status.
  • The authentication method is in active state.
  • The authentication method is in suspended/disabled state.
  • The authentication method has no active credentials.
  • The authentication method has been deleted.
typestring
userDisplayName
descriptionThe display name of the user (e.g. "John Locke").
typestring
userRole
deprecatedTrue
descriptionSystem role for user. Deprecated: use attribute.roles.
enum
  • UNKNOWN_ROLE
  • ADMINISTRATOR
  • SERVICE_ACCOUNT
enumDeprecated
  • False
  • False
  • True
enumDescriptions
  • Default user role.
  • Product administrator with elevated privileges.
  • System service account for automated privilege access. Deprecated: not a role, instead set User.account_type.
typestring
userid
descriptionThe ID of the user. This field can be used as an entity indicator for user entities.
typestring
windowsSid
descriptionThe Microsoft Windows SID of the user. This field can be used as an entity indicator for user entities.
typestring
typeobject
UserAgentProto
idUserAgentProto
properties
annotation
items
$refAnnotation
typearray
browser
descriptionProduct brand within the family: Firefox, Netscape, Camino etc.. Or Earth, Windows-Media-Player etc.. for non-browser user agents.
typestring
browserEngineVersion
descriptionVersion of the rendering engine e.g. "8.01" for "Opera/8.01"
typestring
browserVersion
descriptionMinor and lower versions unavailable with reduced User-Agent and no client hints (go/ua-reduction-ua-string-reference).
typestring
carrier
descriptionMobile specific: name of mobile carrier
typestring
device
description(Usually) Mobile specific: name of hardware device, may or may not contain the full model name. e.g. iPhone, Palm750, SPH-M800. Reduced to "K" for Android devices with reduced User-Agent and no client hints (go/ua-reduction-ua-string-reference).
typestring
deviceVersion
description(Usually) Mobile specific: version of hardware device Unavailable with reduced User-Agent and no client hints (go/ua-reduction-ua-string-reference).
typestring
family
descriptionUser agent family captures the type of browser/app at a high-level e.g. MSIE, Gecko, Safari etc..
enum
  • USER_DEFINED
  • MSIE
  • GECKO
  • APPLEWEBKIT
  • OPERA
  • KHTML
  • OTHER
  • APPLE
  • BLACKBERRY
  • DOCOMO
  • GOOGLE
  • OPENWAVE
  • POLARIS
  • OBIGO
  • TELECA
  • MICROSOFT
  • NOKIA
  • NETFRONT
  • SEMC
  • SMIT
  • KOREAN
  • CLIENT_HINTS
enumDescriptions
  • Used to represent new families supported by user-defined parsers
  • Desktop user agent families
  • WebKit based browsers e.g. Safari
  • e.g. Konqueror
  • Mobile and non-browser user agent families UA's w/o enough data to fit into a family
  • Apple apps e.g. YouTube on iPhone
  • Google Earth, Sketchup, UpdateChecker etc...
  • UP.Browser
  • Windows Media Player, RSS platform etc...
  • Sony Ericsson Mobile Communications
  • SKT, LGT
  • Constructed from UA-CH instead of UserAgent string.
typestring
googleToolbarVersion
descriptionVersion number of GoogleToolbar, if installed. Applies only to MSIE and Firefox at this time.
typestring
javaConfiguration
descriptionMobile specific: e.g. Configuration/CLDC-1.1
typestring
javaConfigurationVersion
typestring
javaProfile
descriptionMobile specific: e.g. Profile/MIDP-2.0
typestring
javaProfileVersion
typestring
locale
descriptionLocale in which the browser is running as country code and optionally language pair. Unavailable with reduced User-Agent and no client hints (go/ua-reduction-ua-string-reference).
typestring
messaging
descriptionMobile specific: e.g. MMP/2.0
typestring
messagingVersion
typestring
os
descriptionFull name of the operating system e.g. "Darwin/9.7.0", "Android 1.5", "Windows 98" Version is reduced, and other data might also be missing, for reduced User-Agent and no client hints (go/ua-reduction-ua-string-reference).
typestring
osVariant
descriptionExtra qualifier for the OS e.g. "(i386)", "Build/CUPCAKE", "PalmSource/Palm-D061" Unavailable with reduced User-Agent and no client hints (go/ua-reduction-ua-string-reference).
typestring
platform
descriptionThe platform describes the environment in which the browser or app runs. For desktop user agents, Platform is a string describing the OS family e.g. Windows, Macintosh, Linux. For mobile user agents, Platform either describes the OS family (if available) or the hardware maker. e.g. Linux, or HTC, LG, Palm.
typestring
security
descriptionSecurity level reported by user agent, either U, I or N. Unavailable with reduced User-Agent and no client hints (go/ua-reduction-ua-string-reference).
typestring
subFamily
descriptionSub-family identifies individual regexps when a family has more than 1. This is used to generate the right UA string from a protobuf. Examples in the AppleWebKit family: Chrome and Safari. Can also be an arbitrary identifier.
typestring
typeobject
UserError
descriptionThis message exists solely to get the `UserErrorReason` enum to appear in the service discovery document.
idUserError
properties
reason
descriptionThe reason for a specific error that should be shown to the app user.
enum
  • USER_ERROR_REASON_UNSPECIFIED
  • RULE_REFERENCES_OUT_OF_SCOPE
  • RULE_ARCHIVED
  • RULE_STALE_VERSION
  • RULE_ACTIVE
  • RULE_RETROHUNT_RUNNING
  • RULE_LIVE
  • RULE_ALREADY_DISABLED
  • EXPENSIVE_RULE_LARGE_WINDOW
  • RULE_LIMITED_PAUSED
  • REFERENCE_LIST_NOT_FOUND
  • UEBA_RULES_NO_SCOPE
  • RULE_TESTING_INTERVAL_TOO_SHORT
  • SEARCH_CSV_FIELDS_NOT_SUPPORTED
  • INVALID_ARGUMENT_FOR_DASHBOARD_FILTER
  • INVALID_CONFIG_FOR_DASHBOARD_IMPORT
  • RETROHUNT_LIMIT_REACHED
enumDescriptions
  • Do not use this default value.
  • The rule text references resources, such as reference lists, that are out of scope for the rule. Example of an ErrorInfo for this reason: { "reason": "RULE_REFERENCES_OUT_OF_SCOPE", "domain": "chronicle.googleapis.com", "metadata": { "reference_lists": "list_name1,list_name2,list_name3,", } }
  • The rule being operated on (saving or setting run frequency) is archived, and so the operation can't be done.
  • The rule version being operated on is not the latest, and so the operation can't be done.
  • The rule can't be archived because it is live (detecting) and a retrohunt is running.
  • The rule can't be archived because a retrohunt is running against it.
  • The rule can't be archived because it is live (detecting).
  • The rule can't be disabled because is is already disabled.
  • The rule's match time window is too large for its current run frequency.
  • The rule can't be enabled because it has been limited or paused because of high resource use.
  • The list being referred to doesn't exist.
  • UEBA rules may not be assigned a data access scope.
  • The rule's match window is longer than the time range it's being tested over. Returns the match window duration and testing interval duration as metadata labeled `match_window_duration` and `testing_interval_duration`, formatted as Go durations. Example ErrorInfo: { "reason": "RULE_TESTING_INTERVAL_TOO_SHORT", "domain": "chronicle.googleapis.com", "metadata": { "match_window_duration": "24h", "testing_interval_duration": "12h", } }
  • The CSV fields are not supported for download. Returns the unsupported fields as metadata labeled `unsupported_fields`. Example ErrorInfo: { "reason": "SEARCH_CSV_FIELDS_NOT_SUPPORTED", "domain": "chronicle.googleapis.com", "metadata": { "unsupported_fields": "udm.about.security_result.variables,udm.network.http.parsed_user_agent.family", } }
  • Invalid argument for dashboard chart filters. Returns the filter name, filter value, operator, and expected type as metadata labeled `filter_name`, `filter_value`, `operator`, and `expected_type`, respectively. Example ErrorInfo: { "reason": "INVALID_ARGUMENT_FOR_DASHBOARD_FILTER", "domain": "chronicle.googleapis.com", "metadata": { "filter_name": "filter_name", "filter_value": "filter_value", "operater": "operator", "expected_type": "expected_type", } }
  • Invalid config for dashboard import. Example ErrorInfo: { "reason": "INVALID_CONFIG_FOR_DASHBOARD_IMPORT", "domain": "chronicle.googleapis.com", }
  • The user has reached the limit of retrohunts that can be run. Returns the retrohunt limit as metadata labeled `retrohunt_limit`. Example ErrorInfo: { "reason": "RETROHUNT_LIMIT_REACHED", "domain": "chronicle.googleapis.com", "metadata": { "retrohunt_limit": "10", } }
typestring
typeobject
Validity
descriptionDefines certificate's validity period.
idValidity
properties
expiryTime
descriptionExpiry date.
formatgoogle-datetime
typestring
issueTime
descriptionIssue date.
formatgoogle-datetime
typestring
typeobject
Verdict
descriptionDeprecated. Encapsulates the threat verdict provided by human analysts and ML models. These fields are used to model Mandiant sources.
idVerdict
properties
analystVerdict
$refAnalystVerdict
descriptionHuman analyst verdict provided by sources like Mandiant.
neighbourInfluence
descriptionDescribes the neighbour influence of the verdict.
typestring
responseCount
descriptionTotal response count across all sources.
formatint32
typeinteger
sourceCount
descriptionNumber of sources from which intelligence was extracted.
formatint32
typeinteger
verdict
$refProviderMLVerdict
descriptionML Verdict provided by sources like Mandiant.
typeobject
VerdictInfo
descriptionDescribes the threat verdict provided by human analysts and machine learning models. These fields are used to model Mandiant sources.
idVerdictInfo
properties
benignCount
descriptionCount of responses where this IoC was marked as benign.
formatint32
typeinteger
categoryDetails
descriptionTags related to the verdict.
typestring
confidenceScore
descriptionConfidence score of the verdict.
formatint32
typeinteger
globalCustomerCount
descriptionGlobal customer count over the last 30 days
formatint32
typeinteger
globalHitsCount
descriptionGlobal hit count over the last 30 days.
formatint32
typeinteger
iocStats
descriptionList of IoCStats from which the verdict was generated.
items
$refIoCStats
typearray
maliciousCount
descriptionCount of responses where this IoC was marked as malicious.
formatint32
typeinteger
neighbourInfluence
descriptionDescribes the near neighbor influence of the verdict.
typestring
pwn
descriptionWhether one or more Mandiant incident response customers had this indicator in their environment.
typeboolean
pwnFirstTaggedTime
descriptionThe timestamp of the first time a pwn was associated to this entity.
formatgoogle-datetime
typestring
responseCount
descriptionTotal response count across all sources.
formatint32
typeinteger
sourceCount
descriptionNumber of sources from which intelligence was extracted.
formatint32
typeinteger
sourceProvider
descriptionSource provider giving the machine learning verdict.
typestring
verdictResponse
descriptionDetails about the verdict.
enum
  • VERDICT_RESPONSE_UNSPECIFIED
  • MALICIOUS
  • BENIGN
enumDescriptions
  • The default verdict response type.
  • VerdictResponse resulted a threat as malicious.
  • VerdictResponse resulted a threat as benign.
typestring
verdictTime
descriptionTimestamp when the verdict was generated.
formatgoogle-datetime
typestring
verdictType
descriptionType of verdict.
enum
  • VERDICT_TYPE_UNSPECIFIED
  • PROVIDER_ML_VERDICT
  • ANALYST_VERDICT
enumDescriptions
  • Verdict category not specified.
  • MLVerdict result provided from threat providers, like Mandiant. These fields are used to model Mandiant sources.
  • Verdict provided by the human analyst. These fields are used to model Mandiant sources.
typestring
typeobject
Vulnerabilities
descriptionThe Vulnerabilities extension captures details on observed/detected vulnerabilities.
idVulnerabilities
properties
vulnerabilities
descriptionA list of vulnerabilities.
items
$refVulnerability
typearray
typeobject
Vulnerability
descriptionA vulnerability.
idVulnerability
properties
about
$refNoun
descriptionIf the vulnerability is about a specific noun (e.g. executable), then add it here.
cveDescription
descriptionCommon Vulnerabilities and Exposures Description. https://cve.mitre.org/about/faqs.html#what_is_cve_record
typestring
cveId
descriptionCommon Vulnerabilities and Exposures Id. https://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures https://cve.mitre.org/about/faqs.html#what_is_cve_id
typestring
cvssBaseScore
descriptionCVSS Base Score in the range of 0.0 to 10.0. Useful for sorting.
formatfloat
typenumber
cvssVector
descriptionVector of CVSS properties (e.g. "AV:L/AC:H/Au:N/C:N/I:P/A:C") Can be linked to via: https://nvd.nist.gov/vuln-metrics/cvss/v2-calculator
typestring
cvssVersion
descriptionVersion of CVSS Vector/Score.
typestring
description
descriptionDescription of the vulnerability.
typestring
firstFound
descriptionProducts that maintain a history of vuln scans should populate first_found with the time that a scan first detected the vulnerability on this asset.
formatgoogle-datetime
typestring
lastFound
descriptionProducts that maintain a history of vuln scans should populate last_found with the time that a scan last detected the vulnerability on this asset.
formatgoogle-datetime
typestring
name
descriptionName of the vulnerability (e.g. "Unsupported OS Version detected").
typestring
scanEndTime
descriptionIf the vulnerability was discovered during an asset scan, then this field should be populated with the time the scan ended. This field can be left unset if the end time is not available or not applicable.
formatgoogle-datetime
typestring
scanStartTime
descriptionIf the vulnerability was discovered during an asset scan, then this field should be populated with the time the scan started. This field can be left unset if the start time is not available or not applicable.
formatgoogle-datetime
typestring
severity
descriptionThe severity of the vulnerability.
enum
  • UNKNOWN_SEVERITY
  • LOW
  • MEDIUM
  • HIGH
  • CRITICAL
enumDescriptions
  • The default severity level.
  • Low severity.
  • Medium severity.
  • High severity.
  • Critical severity.
typestring
severityDetails
descriptionVendor-specific severity
typestring
vendor
descriptionVendor of scan that discovered vulnerability.
typestring
vendorKnowledgeBaseArticleId
descriptionVendor specific knowledge base article (e.g. "KBXXXXXX" from Microsoft). https://en.wikipedia.org/wiki/Microsoft_Knowledge_Base https://access.redhat.com/knowledgebase
typestring
vendorVulnerabilityId
descriptionVendor specific vulnerability id (e.g. Microsoft security bulletin id).
typestring
typeobject
Watchlist
descriptionA watchlist is a list of entities that allows for bulk operations over the included entities.
idWatchlist
properties
createTime
descriptionOutput only. Time the watchlist was created.
formatgoogle-datetime
readOnlyTrue
typestring
description
descriptionOptional. Description of the watchlist.
typestring
displayName
descriptionRequired. Display name of the watchlist. Note that it must be at least one character and less than 63 characters (https://google.aip.dev/148).
typestring
entityCount
$refEntityCount
descriptionOutput only. Entity count in the watchlist.
readOnlyTrue
entityPopulationMechanism
$refEntityPopulationMechanism
descriptionRequired. Mechanism to populate entities in the watchlist.
multiplyingFactor
descriptionOptional. Weight applied to the risk score for entities in this watchlist. The default is 1.0 if it is not specified.
formatfloat
typenumber
name
descriptionIdentifier. Resource name of the watchlist. Format: projects/{project}/locations/{location}/instances/{instance}/watchlists/{watchlist}
typestring
updateTime
descriptionOutput only. Time the watchlist was last updated.
formatgoogle-datetime
readOnlyTrue
typestring
watchlistUserPreferences
$refWatchlistUserPreferences
descriptionOptional. User preferences for watchlist configuration.
typeobject
WatchlistUserPreferences
descriptionA collection of user preferences for watchlist UI configuration.
idWatchlistUserPreferences
properties
pinned
descriptionOptional. Whether the watchlist is pinned on the dashboard.
typeboolean
typeobject
X509
descriptionFile certificate.
idX509
properties
algorithm
descriptionCertificate algorithm.
typestring
certIssuer
descriptionIssuer of the certificate.
typestring
name
descriptionCertificate name.
typestring
serialNumber
descriptionCertificate serial number.
typestring
thumbprint
descriptionCertificate thumbprint.
typestring
typeobject
old_value
CancelOperationRequest
descriptionThe request message for Operations.CancelOperation.
idCancelOperationRequest
properties
typeobject
CompilationDiagnostic
descriptionCompilationDiagnostic represents a compilation diagnostic generated during a rule's compilation, such as a compilation error or a compilation warning.
idCompilationDiagnostic
properties
message
descriptionOutput only. The diagnostic message.
readOnlyTrue
typestring
position
$refCompilationPosition
descriptionOutput only. The approximate position in the rule text associated with the compilation diagnostic. Compilation Position may be empty.
readOnlyTrue
severity
descriptionOutput only. The severity of a rule's compilation diagnostic.
enum
  • SEVERITY_UNSPECIFIED
  • WARNING
  • ERROR
enumDescriptions
  • An unspecified severity level.
  • A compilation warning.
  • A compilation error.
readOnlyTrue
typestring
uri
descriptionOutput only. Link to documentation that describes a diagnostic in more detail.
readOnlyTrue
typestring
typeobject
CompilationPosition
descriptionCompilationPosition represents the location of a compilation diagnostic in rule text.
idCompilationPosition
properties
endColumn
descriptionOutput only. End column number, beginning at 1.
formatint32
readOnlyTrue
typeinteger
endLine
descriptionOutput only. End line number, beginning at 1.
formatint32
readOnlyTrue
typeinteger
startColumn
descriptionOutput only. Start column number, beginning at 1.
formatint32
readOnlyTrue
typeinteger
startLine
descriptionOutput only. Start line number, beginning at 1.
formatint32
readOnlyTrue
typeinteger
typeobject
CreateParserExtensionMetadata
descriptionOperation metadata for creating a parser extension.
idCreateParserExtensionMetadata
properties
state
descriptionThe state of the parser extension creation process.
enum
  • STATE_UNSPECIFIED
  • NEW
  • VALIDATING
  • LIVE
  • REJECTED
  • INTERNAL_ERROR
  • VALIDATED
  • ARCHIVED
enumDescriptions
  • The state for this parser extension was not specified.
  • The parser extension has been newly submitted and is waiting to be validated.
  • The parser extension is currently going through the validation pipeline.
  • The parser extension is live in production. Only configs that have successfully passed the validation stage will be set to LIVE.
  • Validation completed, but the parser extension was rejected with errors.
  • An error occurred when processing this parser extension.
  • Extension is validated.
  • Extension is archived and is no more being used.
typestring
stateLastChangedTime
descriptionThe time the config state was last changed.
formatgoogle-datetime
typestring
validationErrors
descriptionAny validation error while validating the extension, this have cap of size 10
items
typestring
typearray
validationReport
descriptionThe validation report generated during validation of the parser extension.
typestring
typeobject
CreateParserMetadata
descriptionOperation metadata for creating a parser.
idCreateParserMetadata
properties
stage
descriptionThe validation stage of the parser creation process.
enum
  • VALIDATION_STAGE_UNSPECIFIED
  • NEW
  • VALIDATING
  • PASSED
  • FAILED
  • DELETE_CANDIDATE
enumDescriptions
  • The validation stage is not specified.
  • The custom parser is submitted for validation.
  • The custom parser is currently going through the validation pipeline
  • The custom parser has successfully passed the validation.
  • The custom parser has failed validation.
  • The parser is no good, It is available for auto deletion.
typestring
validationReport
descriptionThe validation report generated during validation of the parser.
typestring
typeobject
DataAccessLabel
descriptionA DataAccessLabel is a label on events to define user access to data.
idDataAccessLabel
properties
author
descriptionOutput only. The user who created the data access label.
readOnlyTrue
typestring
createTime
descriptionOutput only. The time at which the data access label was created.
formatgoogle-datetime
readOnlyTrue
typestring
description
descriptionOptional. A description of the data access label for a human reader.
typestring
displayName
descriptionOutput only. The short name displayed for the label as it appears on event data.
readOnlyTrue
typestring
lastEditor
descriptionOutput only. The user who last updated the data access label.
readOnlyTrue
typestring
name
descriptionRequired. The unique resource name of the data access label.
typestring
udmQuery
descriptionA UDM query over event data.
typestring
updateTime
descriptionOutput only. The time at which the data access label was last updated.
formatgoogle-datetime
readOnlyTrue
typestring
typeobject
DataAccessLabelReference
descriptionReference object to a data access label.
idDataAccessLabelReference
properties
assetNamespace
descriptionThe asset namespace configured in the forwarder of the customer's events.
typestring
dataAccessLabel
descriptionThe name of the data access label.
typestring
displayName
descriptionOutput only. The display name of the label. Data access label and log types's name will match the display name of the resource. The asset namespace will match the namespace itself. The ingestion key value pair will match the key of the tuple.
readOnlyTrue
typestring
ingestionLabel
$refIngestionLabel
descriptionThe ingestion label configured in the forwarder of the customer's events.
logType
descriptionThe name of the log type.
typestring
typeobject
DataAccessScope
descriptionA DataAccessScope is a boolean expression of data access labels used to restrict access to data for users.
idDataAccessScope
properties
allowAll
descriptionOptional. Whether or not the scope allows all labels, allow_all and allowed_data_access_labels are mutually exclusive and one of them must be present. denied_data_access_labels can still be used along with allow_all. When combined with denied_data_access_labels, access will be granted to all data that doesn't have labels mentioned in denied_data_access_labels. E.g.: A customer with scope with denied labels A and B and allow_all will be able to see all data except data labeled with A and data labeled with B and data with labels A and B.
typeboolean
allowedDataAccessLabels
descriptionOptional. The allowed labels for the scope. Either allow_all or allowed_data_access_labels needs to be provided. When provided, there has to be at least one label allowed for the scope to be valid. The logical operator for evaluation of the allowed labels is OR. E.g.: A customer with scope with allowed labels A and B will be able to see data with labeled with A or B or (A and B).
items
$refDataAccessLabelReference
typearray
author
descriptionOutput only. The user who created the data access scope.
readOnlyTrue
typestring
createTime
descriptionOutput only. The time at which the data access scope was created.
formatgoogle-datetime
readOnlyTrue
typestring
deniedDataAccessLabels
descriptionOptional. The denied labels for the scope. The logical operator for evaluation of the denied labels is AND. E.g.: A customer with scope with denied labels A and B won't be able to see data labeled with A and data labeled with B and data with labels A and B.
items
$refDataAccessLabelReference
typearray
description
descriptionOptional. A description of the data access scope for a human reader.
typestring
displayName
descriptionOutput only. The name to be used for display to customers of the data access scope.
readOnlyTrue
typestring
lastEditor
descriptionOutput only. The user who last updated the data access scope.
readOnlyTrue
typestring
name
descriptionRequired. The unique full name of the data access scope. The name should comply with https://google.aip.dev/122 standards.
typestring
updateTime
descriptionOutput only. The time at which the data access scope was last updated.
formatgoogle-datetime
readOnlyTrue
typestring
typeobject
Empty
descriptionA generic empty message that you can re-use to avoid defining duplicated empty messages in your APIs. A typical example is to use it as the request or the response type of an API method. For instance: service Foo { rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty); }
idEmpty
properties
typeobject
EntityCount
descriptionCount of different types of entities in the watchlist.
idEntityCount
properties
asset
descriptionOutput only. Count of asset type entities in the watchlist.
formatint32
readOnlyTrue
typeinteger
user
descriptionOutput only. Count of user type entities in the watchlist.
formatint32
readOnlyTrue
typeinteger
typeobject
EntityPopulationMechanism
descriptionMechanism to populate entities in the watchlist.
idEntityPopulationMechanism
properties
manual
$refManual
descriptionOptional. Entities are added manually.
typeobject
IngestionLabel
descriptionRepresentation of an ingestion label type.
idIngestionLabel
properties
ingestionLabelKey
descriptionRequired. The key of the ingestion label. Always required.
typestring
ingestionLabelValue
descriptionOptional. The value of the ingestion label. Optional. An object with no provided value and some key provided would match against the given key and ANY value.
typestring
typeobject
InputsUsed
descriptionInputsUsed is a convenience field that tells us which sources of events (if any) were used in the rule. NEXT TAG: 4
idInputsUsed
properties
usesDetection
descriptionOptional. Whether the rule queries detections.
typeboolean
usesEntity
descriptionOptional. Whether the rule queries entity events.
typeboolean
usesUdm
descriptionOptional. Whether the rule queries UDM events.
typeboolean
typeobject
Instance
descriptionA Instance represents an instantiation of the Instance product.
idInstance
properties
name
descriptionOutput only. The resource name of this instance. Format: projects/{project}/locations/{region}/instances/{instance}
readOnlyTrue
typestring
typeobject
Interval
descriptionRepresents a time interval, encoded as a Timestamp start (inclusive) and a Timestamp end (exclusive). The start must be less than or equal to the end. When the start equals the end, the interval is empty (matches no time). When both start and end are unspecified, the interval matches any time.
idInterval
properties
endTime
descriptionOptional. Exclusive end of the interval. If specified, a Timestamp matching this interval will have to be before the end.
formatgoogle-datetime
typestring
startTime
descriptionOptional. Inclusive start of the interval. If specified, a Timestamp matching this interval will have to be the same or after the start.
formatgoogle-datetime
typestring
typeobject
ListDataAccessLabelsResponse
descriptionResponse message for ListDataAccessLabels.
idListDataAccessLabelsResponse
properties
dataAccessLabels
descriptionList of data access labels.
items
$refDataAccessLabel
typearray
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
typeobject
ListDataAccessScopesResponse
descriptionResponse message for ListDataAccessScopes.
idListDataAccessScopesResponse
properties
dataAccessScopes
descriptionList of data access scopes.
items
$refDataAccessScope
typearray
globalDataAccessScopeGranted
descriptionWhether or not global scope is granted to the user.
typeboolean
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
typeobject
ListOperationsResponse
descriptionThe response message for Operations.ListOperations.
idListOperationsResponse
properties
nextPageToken
descriptionThe standard List next-page token.
typestring
operations
descriptionA list of operations that matches the specified filter in the request.
items
$refOperation
typearray
typeobject
ListReferenceListsResponse
descriptionA response to a request for a list of reference lists.
idListReferenceListsResponse
properties
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
referenceLists
descriptionThe reference lists. Ordered in ascending alphabetical order by name.
items
$refReferenceList
typearray
typeobject
ListRetrohuntsResponse
descriptionResponse message for ListRetrohunts method.
idListRetrohuntsResponse
properties
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
retrohunts
descriptionThe retrohunts from the specified rule.
items
$refRetrohunt
typearray
typeobject
ListRuleDeploymentsResponse
descriptionResponse message for ListRuleDeployments.
idListRuleDeploymentsResponse
properties
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
ruleDeployments
descriptionThe rule deployments from all rules.
items
$refRuleDeployment
typearray
typeobject
ListRuleRevisionsResponse
descriptionResponse message for ListRuleRevisions method.
idListRuleRevisionsResponse
properties
nextPageToken
descriptionA token that can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
rules
descriptionThe revisions of the rule.
items
$refRule
typearray
typeobject
ListRulesResponse
descriptionResponse message for ListRules method.
idListRulesResponse
properties
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
rules
descriptionThe rules from the specified instance.
items
$refRule
typearray
typeobject
ListWatchlistsResponse
descriptionResponse message for listing watchlists.
idListWatchlistsResponse
properties
nextPageToken
descriptionOptional. A token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
watchlists
descriptionOptional. The watchlists from the specified instance.
items
$refWatchlist
typearray
typeobject
Manual
descriptionEntities are added manually.
idManual
properties
typeobject
Operation
descriptionThis resource represents a long-running operation that is the result of a network API call.
idOperation
properties
done
descriptionIf the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available.
typeboolean
error
$refStatus
descriptionThe error result of the operation in case of failure or cancellation.
metadata
additionalProperties
descriptionProperties of the object. Contains field @type with type URL.
typeany
descriptionService-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any.
typeobject
name
descriptionThe server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`.
typestring
response
additionalProperties
descriptionProperties of the object. Contains field @type with type URL.
typeany
descriptionThe normal, successful response of the operation. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`.
typeobject
typeobject
ReferenceList
descriptionA reference list. Reference lists are user-defined lists of values which users can use in multiple Rules.
idReferenceList
properties
description
descriptionRequired. A user-provided description of the reference list.
typestring
displayName
descriptionOutput only. The unique display name of the reference list.
readOnlyTrue
typestring
entries
descriptionRequired. The entries of the reference list. When listed, they are returned in the order that was specified at creation or update. The combined size of the values of the reference list may not exceed 6MB. This is returned only when the view is REFERENCE_LIST_VIEW_FULL.
items
$refReferenceListEntry
typearray
name
descriptionOutput only. The resource name of the reference list. Format: projects/{project}/locations/{location}/instances/{instance}/referenceLists/{reference_list}
readOnlyTrue
typestring
revisionCreateTime
descriptionOutput only. The timestamp when the reference list was last updated.
formatgoogle-datetime
readOnlyTrue
typestring
ruleAssociationsCount
descriptionOutput only. The count of self-authored rules using the reference list.
formatint32
readOnlyTrue
typeinteger
rules
descriptionOutput only. The resource names for the associated self-authored Rules that use this reference list. This is returned only when the view is REFERENCE_LIST_VIEW_FULL.
items
typestring
readOnlyTrue
typearray
scopeInfo
$refScopeInfo
descriptionOutput only. The scope info of the reference list. During reference list creation, if this field is not set, the reference list without scopes (an unscoped list) will be created for an unscoped user. For a scoped user, this field must be set. During reference list update, if scope_info is requested to be updated, this field must be set.
readOnlyTrue
syntaxType
descriptionRequired. The syntax type indicating how list entries should be validated.
enum
  • REFERENCE_LIST_SYNTAX_TYPE_UNSPECIFIED
  • REFERENCE_LIST_SYNTAX_TYPE_PLAIN_TEXT_STRING
  • REFERENCE_LIST_SYNTAX_TYPE_REGEX
  • REFERENCE_LIST_SYNTAX_TYPE_CIDR
enumDescriptions
  • Defaults to REFERENCE_LIST_SYNTAX_TYPE_PLAIN_TEXT_STRING.
  • List contains plain text patterns.
  • List contains only Regular Expression patterns.
  • List contains only CIDR patterns.
typestring
typeobject
ReferenceListEntry
descriptionAn entry in a reference list.
idReferenceListEntry
properties
value
descriptionRequired. The value of the entry. Maximum length is 512 characters.
typestring
typeobject
ReferenceListScope
descriptionReferenceListScope specifies the list of scope names of the reference list.
idReferenceListScope
properties
scopeNames
descriptionOptional. The list of scope names of the reference list. The scope names should be full resource names and should be of the format: "projects/{project}/locations/{location}/instances/{instance}/dataAccessScopes/{scope_name}".
items
typestring
typearray
typeobject
Retrohunt
descriptionRetrohunt is an execution of a Rule over a time range in the past.
idRetrohunt
properties
executionInterval
$refInterval
descriptionOutput only. The start and end time of the retrohunt execution. If the retrohunt is not yet finished, the end time of the interval will not be populated.
readOnlyTrue
name
descriptionThe resource name of the retrohunt. Retrohunt is the child of a rule revision. {rule} in the format below is structured as {rule_id@revision_id}. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}/retrohunts/{retrohunt}
typestring
processInterval
$refInterval
descriptionRequired. The start and end time of the event time range this retrohunt processes.
progressPercentage
descriptionOutput only. Percent progress of the retrohunt towards completion, from 0.00 to 100.00.
formatfloat
readOnlyTrue
typenumber
state
descriptionOutput only. The state of the retrohunt.
enum
  • STATE_UNSPECIFIED
  • RUNNING
  • DONE
  • CANCELLED
  • FAILED
enumDescriptions
  • Unspecified or unknown retrohunt state.
  • Running state.
  • Done state.
  • Cancelled state.
  • Failed state.
readOnlyTrue
typestring
typeobject
RetrohuntMetadata
descriptionOperation Metadata for Retrohunts.
idRetrohuntMetadata
properties
executionInterval
$refInterval
descriptionThe start and end time of the retrohunt execution. If the retrohunt is not yet finished, the end time of the interval will not be filled.
progressPercentage
descriptionPercent progress of the retrohunt towards completion, from 0.00 to 100.00.
formatfloat
typenumber
retrohunt
descriptionThe name of the retrohunt. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}/retrohunts/{retrohunt}
typestring
typeobject
Rule
descriptionThe Rule resource represents a user-created rule. NEXT TAG: 21
idRule
properties
allowedRunFrequencies
descriptionOutput only. The run frequencies that are allowed for the rule. Populated in BASIC view and FULL view.
items
enum
  • RUN_FREQUENCY_UNSPECIFIED
  • LIVE
  • HOURLY
  • DAILY
enumDescriptions
  • The run frequency is unspecified/unknown.
  • Executes in real time.
  • Executes once per hour.
  • Executes once per day.
typestring
readOnlyTrue
typearray
author
descriptionOutput only. The author of the rule. Extracted from the meta section of text. Populated in BASIC view and FULL view.
readOnlyTrue
typestring
compilationDiagnostics
descriptionOutput only. A list of a rule's corresponding compilation diagnostic messages such as compilation errors and compilation warnings. Populated in FULL view.
items
$refCompilationDiagnostic
readOnlyTrue
typearray
compilationState
descriptionOutput only. The current compilation state of the rule. Populated in FULL view.
enum
  • COMPILATION_STATE_UNSPECIFIED
  • SUCCEEDED
  • FAILED
enumDescriptions
  • The compilation state is unspecified/unknown.
  • The Rule can successfully compile.
  • The Rule cannot successfully compile. This is possible if a backwards-incompatible change was made to the compiler.
readOnlyTrue
typestring
createTime
descriptionOutput only. The timestamp of when the rule was created. Populated in FULL view.
formatgoogle-datetime
readOnlyTrue
typestring
dataTables
descriptionOutput only. Resource names of the data tables used in this rule.
items
typestring
readOnlyTrue
typearray
displayName
descriptionOutput only. Display name of the rule. Populated in BASIC view and FULL view.
readOnlyTrue
typestring
etag
descriptionThe etag for this rule. If this is provided on update, the request will succeed if and only if it matches the server-computed value, and will fail with an ABORTED error otherwise. Populated in BASIC view and FULL view.
typestring
inputsUsed
$refInputsUsed
descriptionOutput only. The set of inputs used in the rule. For example, if the rule uses $e.principal.hostname, then the uses_udm field will be true.
readOnlyTrue
metadata
additionalProperties
typestring
descriptionOutput only. Additional metadata specified in the meta section of text. Populated in FULL view.
readOnlyTrue
typeobject
name
descriptionFull resource name for the rule. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}
typestring
nearRealTimeLiveRuleEligible
descriptionOutput only. Indicate the rule can run in near real time live rule. If this is true, the rule uses the near real time live rule when the run frequency is set to LIVE.
readOnlyTrue
typeboolean
referenceLists
descriptionOutput only. Resource names of the reference lists used in this rule. Populated in FULL view.
items
typestring
readOnlyTrue
typearray
revisionCreateTime
descriptionOutput only. The timestamp of when the rule revision was created. Populated in FULL, REVISION_METADATA_ONLY views.
formatgoogle-datetime
readOnlyTrue
typestring
revisionId
descriptionOutput only. The revision ID of the rule. A new revision is created whenever the rule text is changed in any way. Format: v_{10 digits}_{9 digits} Populated in REVISION_METADATA_ONLY view and FULL view.
readOnlyTrue
typestring
scope
descriptionResource name of the DataAccessScope bound to this rule. Populated in BASIC view and FULL view. If reference lists are used in the rule, validations will be performed against this scope to ensure that the reference lists are compatible with both the user's and the rule's scopes. The scope should be in the format: "projects/{project}/locations/{location}/instances/{instance}/dataAccessScopes/{scope}".
typestring
severity
$refSeverity
descriptionOutput only. The severity of the rule as specified in the meta section of text. Populated in BASIC view and FULL view.
readOnlyTrue
text
descriptionThe YARA-L content of the rule. Populated in FULL view.
typestring
type
descriptionOutput only. User-facing type of the rule. Extracted from the events section of rule text. Populated in BASIC view and FULL view.
enum
  • RULE_TYPE_UNSPECIFIED
  • SINGLE_EVENT
  • MULTI_EVENT
enumDescriptions
  • The rule type is unspecified/unknown.
  • Rule checks for the existence of a single event.
  • Rule checks for correlation between multiple events
readOnlyTrue
typestring
typeobject
RuleDeployment
descriptionThe RuleDeployment resource represents the deployment state of a Rule.
idRuleDeployment
properties
alerting
descriptionWhether detections resulting from this deployment should be considered alerts.
typeboolean
archiveTime
descriptionOutput only. The timestamp when the rule deployment archive state was last set to true. If the rule deployment's current archive state is not set to true, the field will be empty.
formatgoogle-datetime
readOnlyTrue
typestring
archived
descriptionThe archive state of the rule deployment. Cannot be set to true unless enabled is set to false. If set to true, alerting will automatically be set to false. If currently set to true, enabled, alerting, and run_frequency cannot be updated.
typeboolean
consumerRules
descriptionOutput only. The names of the associated/chained consumer rules. Rules are considered consumers of this rule if their rule text explicitly filters on this rule's ruleid. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}
items
typestring
readOnlyTrue
typearray
enabled
descriptionWhether the rule is currently deployed continuously against incoming data.
typeboolean
executionState
descriptionOutput only. The execution state of the rule deployment.
enum
  • EXECUTION_STATE_UNSPECIFIED
  • DEFAULT
  • LIMITED
  • PAUSED
enumDescriptions
  • Unspecified or unknown execution state.
  • Default execution state.
  • Rules in limited state may not have their executions guaranteed.
  • Paused rules are not executed at all.
readOnlyTrue
typestring
lastAlertStatusChangeTime
descriptionOutput only. The timestamp when the rule deployment alert state was lastly changed. This is filled regardless of the current alert state. E.g. if the current alert status is false, this timestamp will be the timestamp when the alert status was changed to false.
formatgoogle-datetime
readOnlyTrue
typestring
name
descriptionRequired. The resource name of the rule deployment. Note that RuleDeployment is a child of the overall Rule, not any individual revision, so the resource ID segment for the Rule resource must not reference a specific revision. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}/deployment
typestring
producerRules
descriptionOutput only. The names of the associated/chained producer rules. Rules are considered producers for this rule if this rule explicitly filters on their ruleid. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}
items
typestring
readOnlyTrue
typearray
runFrequency
descriptionThe run frequency of the rule deployment.
enum
  • RUN_FREQUENCY_UNSPECIFIED
  • LIVE
  • HOURLY
  • DAILY
enumDescriptions
  • The run frequency is unspecified/unknown.
  • Executes in real time.
  • Executes once per hour.
  • Executes once per day.
typestring
typeobject
ScopeInfo
descriptionScopeInfo specifies the scope info of the reference list.
idScopeInfo
properties
referenceListScope
$refReferenceListScope
descriptionRequired. The list of scope names of the reference list, if the list is empty the reference list is treated as unscoped.
typeobject
Severity
descriptionSeverity represents the severity level of the rule.
idSeverity
properties
displayName
descriptionThe display name of the severity level. Extracted from the meta section of the rule text.
typestring
typeobject
Status
descriptionThe `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors).
idStatus
properties
code
descriptionThe status code, which should be an enum value of google.rpc.Code.
formatint32
typeinteger
details
descriptionA list of messages that carry the error details. There is a common set of message types for APIs to use.
items
additionalProperties
descriptionProperties of the object. Contains field @type with type URL.
typeany
typeobject
typearray
message
descriptionA developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
typestring
typeobject
UdmSearchOperationMetadata
descriptionInformation about a UDM Search operation. This message is used to populate the `metadata` field of `Operation` resources created by UDM Search.
idUdmSearchOperationMetadata
properties
baselineEventsCount
descriptionThe number of events matching the baseline query so far.
formatint32
typeinteger
baselineQuery
descriptionQuery used to search for events.
typestring
baselineTimeRange
$refInterval
descriptionThe time range used for the baseline query [inclusive start time, exclusive end time).
caseInsensitive
descriptionIf true, the search was performed in a case-insensitive manner.
typeboolean
endTime
descriptionThe end time of the operation, if done.
formatgoogle-datetime
typestring
expireTime
descriptionThe time when the operation results expire. This time may change while the operation is in progress. If unset, the results never expire.
formatgoogle-datetime
typestring
filteredEventsCount
descriptionThe number of events matching the snapshot query so far. This is <= `baseline_events_count`. If the snapshot query is empty, this will be equal to `baseline_events_count`.
formatint32
typeinteger
progress
descriptionA value from 0 to 1 representing the progress of the operation.
formatdouble
typenumber
snapshotQuery
descriptionQuery used to filter the baseline query's events.
typestring
snapshotTimeRange
$refInterval
descriptionTime range used to filter the baseline query's events [inclusive start time, exclusive end time). This time range is completely within `baseline_time_range`. If not set, it is assumed to match `baseline_time_range`.
startTime
descriptionThe start time of the operation.
formatgoogle-datetime
typestring
statsRowsCount
descriptionThe total number of rows returned for a stats query.
formatint32
typeinteger
typeobject
UserError
descriptionThis message exists solely to get the `UserErrorReason` enum to appear in the service discovery document.
idUserError
properties
reason
descriptionThe reason for a specific error that should be shown to the app user.
enum
  • USER_ERROR_REASON_UNSPECIFIED
  • RULE_REFERENCES_OUT_OF_SCOPE
  • RULE_ARCHIVED
  • RULE_STALE_VERSION
  • RULE_ACTIVE
  • RULE_RETROHUNT_RUNNING
  • RULE_LIVE
  • RULE_ALREADY_DISABLED
  • EXPENSIVE_RULE_LARGE_WINDOW
  • RULE_LIMITED_PAUSED
  • REFERENCE_LIST_NOT_FOUND
  • UEBA_RULES_NO_SCOPE
  • RULE_TESTING_INTERVAL_TOO_SHORT
  • SEARCH_CSV_FIELDS_NOT_SUPPORTED
  • INVALID_ARGUMENT_FOR_DASHBOARD_FILTER
  • INVALID_CONFIG_FOR_DASHBOARD_IMPORT
  • RETROHUNT_LIMIT_REACHED
enumDescriptions
  • Do not use this default value.
  • The rule text references resources, such as reference lists, that are out of scope for the rule. Example of an ErrorInfo for this reason: { "reason": "RULE_REFERENCES_OUT_OF_SCOPE", "domain": "chronicle.googleapis.com", "metadata": { "reference_lists": "list_name1,list_name2,list_name3,", } }
  • The rule being operated on (saving or setting run frequency) is archived, and so the operation can't be done.
  • The rule version being operated on is not the latest, and so the operation can't be done.
  • The rule can't be archived because it is live (detecting) and a retrohunt is running.
  • The rule can't be archived because a retrohunt is running against it.
  • The rule can't be archived because it is live (detecting).
  • The rule can't be disabled because is is already disabled.
  • The rule's match time window is too large for its current run frequency.
  • The rule can't be enabled because it has been limited or paused because of high resource use.
  • The list being referred to doesn't exist.
  • UEBA rules may not be assigned a data access scope.
  • The rule's match window is longer than the time range it's being tested over. Returns the match window duration and testing interval duration as metadata labeled `match_window_duration` and `testing_interval_duration`, formatted as Go durations. Example ErrorInfo: { "reason": "RULE_TESTING_INTERVAL_TOO_SHORT", "domain": "chronicle.googleapis.com", "metadata": { "match_window_duration": "24h", "testing_interval_duration": "12h", } }
  • The CSV fields are not supported for download. Returns the unsupported fields as metadata labeled `unsupported_fields`. Example ErrorInfo: { "reason": "SEARCH_CSV_FIELDS_NOT_SUPPORTED", "domain": "chronicle.googleapis.com", "metadata": { "unsupported_fields": "udm.about.security_result.variables,udm.network.http.parsed_user_agent.family", } }
  • Invalid argument for dashboard chart filters. Returns the filter name, filter value, operator, and expected type as metadata labeled `filter_name`, `filter_value`, `operator`, and `expected_type`, respectively. Example ErrorInfo: { "reason": "INVALID_ARGUMENT_FOR_DASHBOARD_FILTER", "domain": "chronicle.googleapis.com", "metadata": { "filter_name": "filter_name", "filter_value": "filter_value", "operater": "operator", "expected_type": "expected_type", } }
  • Invalid config for dashboard import. Example ErrorInfo: { "reason": "INVALID_CONFIG_FOR_DASHBOARD_IMPORT", "domain": "chronicle.googleapis.com", }
  • The user has reached the limit of retrohunts that can be run. Returns the retrohunt limit as metadata labeled `retrohunt_limit`. Example ErrorInfo: { "reason": "RETROHUNT_LIMIT_REACHED", "domain": "chronicle.googleapis.com", "metadata": { "retrohunt_limit": "10", } }
typestring
typeobject
Watchlist
descriptionA watchlist is a list of entities that allows for bulk operations over the included entities.
idWatchlist
properties
createTime
descriptionOutput only. Time the watchlist was created.
formatgoogle-datetime
readOnlyTrue
typestring
description
descriptionOptional. Description of the watchlist.
typestring
displayName
descriptionRequired. Display name of the watchlist. Note that it must be at least one character and less than 63 characters (https://google.aip.dev/148).
typestring
entityCount
$refEntityCount
descriptionOutput only. Entity count in the watchlist.
readOnlyTrue
entityPopulationMechanism
$refEntityPopulationMechanism
descriptionRequired. Mechanism to populate entities in the watchlist.
multiplyingFactor
descriptionOptional. Weight applied to the risk score for entities in this watchlist. The default is 1.0 if it is not specified.
formatfloat
typenumber
name
descriptionIdentifier. Resource name of the watchlist. Format: projects/{project}/locations/{location}/instances/{instance}/watchlists/{watchlist}
typestring
updateTime
descriptionOutput only. Time the watchlist was last updated.
formatgoogle-datetime
readOnlyTrue
typestring
watchlistUserPreferences
$refWatchlistUserPreferences
descriptionOptional. User preferences for watchlist configuration.
typeobject
WatchlistUserPreferences
descriptionA collection of user preferences for watchlist UI configuration.
idWatchlistUserPreferences
properties
pinned
descriptionOptional. Whether the watchlist is pinned on the dashboard.
typeboolean
typeobject
prod/eu-rbmopenmaap-
values_changed
root['revision']
new_value20250313
old_value20250310
prod/eu-rbmopenmaap-v1
values_changed
root['revision']
new_value20250313
old_value20250310
prod/eu-taskassist-pa-
dictionary_item_added
  • root['schemas']['SourceId']['properties']['threadLocator']
values_changed
root['revision']
new_value20250310
old_value20250303
prod/eu-taskassist-pa-v1
values_changed
root['revision']
new_value20250310
old_value20250303
prod/eu-taskassist-pa-v2
dictionary_item_added
  • root['schemas']['SourceId']['properties']['threadLocator']
values_changed
root['revision']
new_value20250310
old_value20250303
prod/europe-west1-connectgateway-
values_changed
root['revision']
new_value20250310
old_value20250303
prod/europe-west1-connectgateway-v1
values_changed
root['revision']
new_value20250310
old_value20250303
prod/europe-west1-connectgateway-v1beta1
values_changed
root['revision']
new_value20250310
old_value20250303
prod/europe-west1-containerfilesystem-
values_changed
root['revision']
new_value20250307
old_value20250221
prod/europe-west1-containerfilesystem-v1
values_changed
root['revision']
new_value20250307
old_value20250221
prod/europe-west2-chronicle-
values_changed
root['resources']['projects']['resources']['locations']['resources']['instances']['methods']['get']['parameters']['name']['description']
new_valueRequired. The name of the instance to retrieve. Format: projects/{project_id}/locations/{location}/instances/{instance}
old_valueRequired. The name of the instance to retrieve. Format: projects/{project_id}/locations/{region}/instances/{instance}
root['revision']
new_value20250310
old_value20250227
root['schemas']
new_value
AIOverview
descriptionAI generated overview for the search results.
idAIOverview
properties
aiSummary
descriptionAI summary for the search results. Markdown formatted.
typestring
complete
descriptionWhether AI overview generation is complete.
typeboolean
suggestions
descriptionSuggested actions to continue the investigation in chat.
items
$refAction
typearray
typeobject
Action
descriptionAction represents an action that can be performed in the host UI.
idAction
properties
actionType
descriptionOutput only. Type of action.
enum
  • ACTION_TYPE_UNSPECIFIED
  • FOLLOW_UP
  • NAVIGATION
  • EXECUTION
enumDescriptions
  • The action type is unspecified.
  • The action is a follow up action.
  • The action is a navigation action.
  • The action is an execution action.
readOnlyTrue
typestring
displayText
descriptionOutput only. The text that'll be displayed to the user if this is rendered in the UI as a suggested action.
readOnlyTrue
typestring
execution
$refExecution
descriptionMetadata for execution action.
followUp
$refFollowUp
descriptionMetadata for follow up action.
navigation
$refNavigation
descriptionMetadata for navigation action.
useCaseId
descriptionOutput only. The use case ID of the action. It's used internally to identify in which context the action is used.
readOnlyTrue
typestring
typeobject
AlertFieldAggregation
idAlertFieldAggregation
properties
alertCount
formatint32
typeinteger
allValues
items
$refAlertFieldValueCount
typearray
baselineAlertCount
formatint32
typeinteger
bottomValues
items
$refAlertFieldValueCount
typearray
fieldName
typestring
tooManyValues
typeboolean
topValues
items
$refAlertFieldValueCount
typearray
valueCount
formatint32
typeinteger
typeobject
AlertFieldAggregations
idAlertFieldAggregations
properties
fields
items
$refAlertFieldAggregation
typearray
typeobject
AlertFieldValue
idAlertFieldValue
properties
boolValue
typeboolean
bytesValue
formatbyte
typestring
doubleValue
formatdouble
typenumber
enumValue
typestring
floatValue
formatfloat
typenumber
int32Value
formatint32
typeinteger
int64Value
formatint64
typestring
stringValue
typestring
uint32Value
formatuint32
typeinteger
uint64Value
formatuint64
typestring
typeobject
AlertFieldValueCount
idAlertFieldValueCount
properties
alertCount
formatint32
typeinteger
baselineAlertCount
formatint32
typeinteger
value
$refAlertFieldValue
typeobject
AnalystVerdict
descriptionVerdict provided by the human analyst. These fields are used to model Mandiant sources.
idAnalystVerdict
properties
confidenceScore
descriptionConfidence score of the verdict.
formatint32
typeinteger
verdictResponse
descriptionDetails of the verdict.
enum
  • VERDICT_RESPONSE_UNSPECIFIED
  • MALICIOUS
  • BENIGN
enumDescriptions
  • The default verdict response type.
  • VerdictResponse resulted a threat as malicious.
  • VerdictResponse resulted a threat as benign.
typestring
verdictTime
descriptionTimestamp at which the verdict was generated.
formatgoogle-datetime
typestring
typeobject
AnalyticsMetadata
descriptionStores information about an analytics metric used in a rule.
idAnalyticsMetadata
properties
analytic
descriptionName of the analytic.
typestring
typeobject
Annotation
descriptionExtra parameters that don't fit anywhere else, captured as key/value. For example "VendorID/42" in BlackBerry user agents. The following keys are modified with reduced User-Agent and no client hints (go/ua-reduction-ua-string-reference): * "Chrome" (see `browser_version`) * "ChromiumBrowser" (unavailable) * "ChromeWebview" (unavailable) * "OS_VERSION" (see `os`) * "Rest" (unavailable) * "misc" (see `device`)
idAnnotation
properties
key
typestring
value
typestring
typeobject
Artifact
descriptionInformation about an artifact. The artifact can only be an IP.
idArtifact
properties
anonymous
descriptionWhether the VPN tunnels are configured for anonymous browsing or not.
typeboolean
artifactClient
$refArtifactClient
descriptionEntity or software accessing or utilizing network resources.
asOwner
descriptionOwner of the Autonomous System to which the IP address belongs.
typestring
asn
descriptionAutonomous System Number to which the IP address belongs.
formatint64
typestring
firstSeenTime
descriptionFirst seen timestamp of the IP in the customer's environment.
formatgoogle-datetime
typestring
ip
descriptionIP address of the artifact. This field can be used as an entity indicator for an external destination IP entity.
typestring
jarm
descriptionThe JARM hash for the IP address. (https://engineering.salesforce.com/easily-identify-malicious-servers-on-the-internet-with-jarm-e095edac525a).
typestring
lastHttpsCertificate
$refSSLCertificate
descriptionSSL certificate information about the IP address.
lastHttpsCertificateDate
descriptionMost recent date for the certificate in VirusTotal.
formatgoogle-datetime
typestring
lastSeenTime
descriptionLast seen timestamp of the IP address in the customer's environment.
formatgoogle-datetime
typestring
location
$refLocation
descriptionLocation of the Artifact's IP address.
network
$refNetwork
descriptionNetwork information related to the Artifact's IP address.
prevalence
$refPrevalence
descriptionThe prevalence of the artifact within the customer's environment.
regionalInternetRegistry
descriptionRIR (one of the current RIRs: AFRINIC, ARIN, APNIC, LACNIC or RIPE NCC).
typestring
risks
descriptionThis field lists potential risks associated with the network activity.
items
typestring
typearray
tags
descriptionIdentification attributes
items
typestring
typearray
tunnels
descriptionVPN tunnels.
items
$refTunnels
typearray
whois
descriptionWHOIS information as returned from the pertinent WHOIS server.
typestring
whoisDate
descriptionDate of the last update of the WHOIS record in VirusTotal.
formatgoogle-datetime
typestring
typeobject
ArtifactClient
descriptionEntity or software accessing or utilizing network resources.
idArtifactClient
properties
behaviors
descriptionThe behaviors of the client accessing the network.
items
typestring
typearray
proxies
descriptionThe type of proxies used by the client.
items
typestring
typearray
typeobject
Asset
descriptionInformation about a compute asset such as a workstation, laptop, phone, virtual desktop, or VM.
idAsset
properties
assetId
descriptionThe asset ID. Value must contain the ':' character. For example, cs:abcdd23434. This field can be used as an entity indicator for asset entities.
typestring
attribute
$refAttribute
descriptionGeneric entity metadata attributes of the asset.
category
descriptionThe category of the asset (e.g. "End User Asset", "Workstation", "Server").
typestring
creationTime
deprecatedTrue
descriptionTime the asset was created or provisioned. Deprecate: creation_time should be populated in Attribute as generic metadata.
formatgoogle-datetime
typestring
deploymentStatus
descriptionThe deployment status of the asset for device lifecycle purposes.
enum
  • DEPLOYMENT_STATUS_UNSPECIFIED
  • ACTIVE
  • PENDING_DECOMISSION
  • DECOMISSIONED
enumDescriptions
  • Unspecified deployment status.
  • Asset is active, functional and deployed.
  • Asset is pending decommission and no longer deployed.
  • Asset is decommissioned.
typestring
firstDiscoverTime
descriptionTime the asset was first discovered (by asset management/discoverability software).
formatgoogle-datetime
typestring
firstSeenTime
descriptionThe first observed time for an asset. The value is calculated on the basis of the first time the identifier was observed.
formatgoogle-datetime
typestring
hardware
descriptionThe asset hardware specifications.
items
$refHardware
typearray
hostname
descriptionAsset hostname or domain name field. This field can be used as an entity indicator for asset entities.
typestring
ip
descriptionA list of IP addresses associated with an asset. This field can be used as an entity indicator for asset entities.
items
typestring
typearray
labels
deprecatedTrue
descriptionMetadata labels for the asset. Deprecated: labels should be populated in Attribute as generic metadata.
items
$refLabel
typearray
lastBootTime
descriptionTime the asset was last boot started.
formatgoogle-datetime
typestring
lastDiscoverTime
descriptionTime the asset was last discovered (by asset management/discoverability software).
formatgoogle-datetime
typestring
location
$refLocation
descriptionLocation of the asset.
mac
descriptionList of MAC addresses associated with an asset. This field can be used as an entity indicator for asset entities.
items
typestring
typearray
natIp
descriptionList of NAT IP addresses associated with an asset.
items
typestring
typearray
networkDomain
descriptionThe network domain of the asset (e.g. "corp.acme.com")
typestring
platformSoftware
$refPlatformSoftware
descriptionThe asset operating system platform software.
productObjectId
descriptionA vendor-specific identifier to uniquely identify the entity (a GUID or similar). This field can be used as an entity indicator for asset entities.
typestring
software
descriptionThe asset software details.
items
$refSoftware
typearray
systemLastUpdateTime
descriptionTime the asset system or OS was last updated. For all other operations that are not system updates (such as resizing a VM), use Attribute.last_update_time.
formatgoogle-datetime
typestring
type
descriptionThe type of the asset (e.g. workstation or laptop or server).
enum
  • ROLE_UNSPECIFIED
  • WORKSTATION
  • LAPTOP
  • IOT
  • NETWORK_ATTACHED_STORAGE
  • PRINTER
  • SCANNER
  • SERVER
  • TAPE_LIBRARY
  • MOBILE
enumDescriptions
  • Unspecified asset role.
  • A workstation or desktop.
  • A laptop computer.
  • An IOT asset.
  • A network attached storage device.
  • A printer.
  • A scanner.
  • A server.
  • A tape library device.
  • A mobile device such as a mobile phone or PDA.
typestring
vulnerabilities
descriptionVulnerabilities discovered on asset.
items
$refVulnerability
typearray
typeobject
Association
descriptionAssociations represents different metadata about malware and threat actors involved with an IoC.
idAssociation
properties
alias
descriptionDifferent aliases of the threat actor given by different sources.
items
$refAssociationAlias
typearray
associatedActors
descriptionList of associated threat actors for a malware. Not applicable for threat actors.
items
$refAssociation
typearray
countryCode
descriptionCountry from which the threat actor/ malware is originated.
items
typestring
typearray
description
descriptionHuman readable description about the association.
typestring
firstReferenceTime
descriptionFirst time the threat actor was referenced or seen.
formatgoogle-datetime
typestring
id
descriptionUnique association id generated by mandiant.
typestring
industriesAffected
descriptionList of industries the threat actor affects.
items
typestring
typearray
lastReferenceTime
descriptionLast time the threat actor was referenced or seen.
formatgoogle-datetime
typestring
name
descriptionName of the threat actor/malware.
typestring
regionCode
$refLocation
descriptionName of the country, the threat is originating from.
role
descriptionRole of the malware. Not applicable for threat actor.
typestring
sourceCountry
deprecatedTrue
descriptionName of the country the threat originated from.
typestring
sponsorRegion
$refLocation
descriptionSponsor region of the threat actor.
tags
descriptionTags.
items
typestring
typearray
targetedRegions
descriptionTargeted regions.
items
$refLocation
typearray
type
descriptionSignifies the type of association.
enum
  • ASSOCIATION_TYPE_UNSPECIFIED
  • THREAT_ACTOR
  • MALWARE
enumDescriptions
  • The default Association Type.
  • Association type Threat actor.
  • Association type Malware.
typestring
typeobject
AssociationAlias
descriptionAssociation Alias used to represent Mandiant Threat Intelligence.
idAssociationAlias
properties
company
descriptionName of the provider who gave the association's name.
typestring
name
descriptionName of the alias.
typestring
typeobject
AttackDetails
descriptionMITRE ATT&CK details.
idAttackDetails
properties
tactics
descriptionTactics employed.
items
$refTactic
typearray
techniques
descriptionTechniques employed.
items
$refTechnique
typearray
version
descriptionATT&CK version (e.g. 12.1).
typestring
typeobject
Attribute
descriptionAttribute is a container for generic entity attributes including common attributes across core entities (such as, user or asset). For example, Cloud is a generic entity attribute since it can apply to an asset (for example, a VM) or a user (for example, an identity service account).
idAttribute
properties
cloud
$refCloud
descriptionCloud metadata attributes such as project ID, account ID, or organizational hierarchy.
creationTime
descriptionTime the resource or entity was created or provisioned.
formatgoogle-datetime
typestring
labels
descriptionSet of labels for the entity. Should only be used for product labels (for example, Google Cloud resource labels or Azure AD sensitivity labels. Should not be used for arbitrary key-value mappings.
items
$refLabel
typearray
lastUpdateTime
descriptionTime the resource or entity was last updated.
formatgoogle-datetime
typestring
permissions
descriptionSystem permissions for IAM entity (human principal, service account, group).
items
$refPermission
typearray
roles
descriptionSystem IAM roles to be assumed by resources to use the role's permissions for access control.
items
$refRole
typearray
typeobject
Authentication
descriptionThe Authentication extension captures details specific to authentication events. General guidelines for authentication events: * Details about the source of the authentication event (for example, client IP or hostname), should be captured in principal. The principal may be empty if we have no details about the source of the login. * Details about the target of the authentication event (for example, details about the machine that is being logged into or logged out of) should be captured in target. * Some authentication events may involve a third-party. For example, a user logs into a cloud service (for example, Chronicle) via their company's SSO (the event is logged by their SSO solution). In this case, the principal captures information about the user's device, the target captures details about the cloud service they logged into, and the intermediary captures details about the SSO solution.
idAuthentication
properties
authDetails
descriptionThe vendor defined details of the authentication.
typestring
mechanism
descriptionThe authentication mechanism.
items
enum
  • MECHANISM_UNSPECIFIED
  • USERNAME_PASSWORD
  • OTP
  • HARDWARE_KEY
  • LOCAL
  • REMOTE
  • REMOTE_INTERACTIVE
  • MECHANISM_OTHER
  • BADGE_READER
  • NETWORK
  • BATCH
  • SERVICE
  • UNLOCK
  • NETWORK_CLEAR_TEXT
  • NEW_CREDENTIALS
  • INTERACTIVE
  • CACHED_INTERACTIVE
  • CACHED_REMOTE_INTERACTIVE
  • CACHED_UNLOCK
  • BIOMETRIC
  • WEARABLE
enumDescriptions
  • The default mechanism.
  • Username + password authentication.
  • OTP authentication.
  • Hardware key authentication.
  • Local authentication.
  • Remote authentication.
  • RDP, Terminal Services, or VNC.
  • Some other mechanism that is not defined here.
  • Badge reader authentication
  • Network authentication.
  • Batch authentication.
  • Service authentication
  • Direct human-interactive unlock authentication.
  • Network clear text authentication.
  • Authentication with new credentials.
  • Interactive authentication.
  • Interactive authentication using cached credentials.
  • Cached Remote Interactive authentication using cached credentials.
  • Cached Remote Interactive authentication using cached credentials.
  • Biometric device such as a fingerprint reader.
  • Wearable such as an Apple Watch.
typestring
typearray
type
descriptionThe type of authentication.
enum
  • AUTHTYPE_UNSPECIFIED
  • MACHINE
  • SSO
  • VPN
  • PHYSICAL
  • TACACS
enumDescriptions
  • The default type.
  • A machine authentication.
  • An SSO authentication.
  • A VPN authentication.
  • A Physical authentication (e.g. "Badge reader").
  • A TACACS family protocol for networked systems authentication (e.g. TACACS, TACACS+).
typestring
typeobject
AuthorityKeyId
descriptionIdentifies the public key to be used to verify the signature on this certificate or CRL.
idAuthorityKeyId
properties
keyid
descriptionKey hexdump.
typestring
serialNumber
descriptionSerial number hexdump.
typestring
typeobject
BackstoryEntity
descriptionAn Entity provides additional context about an item in a UDM event. For example, a PROCESS_LAUNCH event describes that user 'abc@example.corp' launched process 'shady.exe'. The event does not include information that user 'abc@example.com' is a recently terminated employee who administers a server storing finance data. Information stored in one or more Entities can add this additional context.
idBackstoryEntity
properties
additional
additionalProperties
descriptionProperties of the object.
typeany
descriptionImportant entity data that cannot be adequately represented within the formal sections of the Entity.
typeobject
entity
$refNoun
descriptionNoun in the UDM event that this entity represents.
metadata
$refEntityMetadata
descriptionEntity metadata such as timestamp, product, etc.
metric
$refMetric
descriptionStores statistical metrics about the entity. Used if metadata.entity_type is METRIC.
relations
descriptionOne or more relationships between the entity (a) and other entities, including the relationship type and related entity.
items
$refRelation
typearray
riskScore
$refEntityRisk
descriptionStores information related to the entity's risk score.
typeobject
BackstoryFile
descriptionInformation about a file.
idBackstoryFile
properties
ahash
deprecatedTrue
descriptionDeprecated. Use authentihash instead.
typestring
authentihash
descriptionAuthentihash of the file.
typestring
capabilitiesTags
descriptionCapabilities tags.
items
typestring
typearray
createTime
descriptionTimestamp when the file was created.
formatgoogle-datetime
typestring
embeddedDomains
descriptionEmbedded domains found in the file.
items
typestring
typearray
embeddedIps
descriptionEmbedded IP addresses found in the file.
items
typestring
typearray
embeddedUrls
descriptionEmbedded urls found in the file.
items
typestring
typearray
exifInfo
$refExifInfo
descriptionExif metadata from different file formats extracted by exiftool.
fileMetadata
$refFileMetadata
deprecatedTrue
descriptionMetadata associated with the file. Deprecate FileMetadata in favor of using fields in File.
fileType
descriptionFileType field.
enum
  • FILE_TYPE_UNSPECIFIED
  • FILE_TYPE_PE_EXE
  • FILE_TYPE_PE_DLL
  • FILE_TYPE_MSI
  • FILE_TYPE_NE_EXE
  • FILE_TYPE_NE_DLL
  • FILE_TYPE_DOS_EXE
  • FILE_TYPE_DOS_COM
  • FILE_TYPE_COFF
  • FILE_TYPE_ELF
  • FILE_TYPE_LINUX_KERNEL
  • FILE_TYPE_RPM
  • FILE_TYPE_LINUX
  • FILE_TYPE_MACH_O
  • FILE_TYPE_JAVA_BYTECODE
  • FILE_TYPE_DMG
  • FILE_TYPE_DEB
  • FILE_TYPE_PKG
  • FILE_TYPE_PYC
  • FILE_TYPE_LNK
  • FILE_TYPE_DESKTOP_ENTRY
  • FILE_TYPE_JPEG
  • FILE_TYPE_TIFF
  • FILE_TYPE_GIF
  • FILE_TYPE_PNG
  • FILE_TYPE_BMP
  • FILE_TYPE_GIMP
  • FILE_TYPE_IN_DESIGN
  • FILE_TYPE_PSD
  • FILE_TYPE_TARGA
  • FILE_TYPE_XWD
  • FILE_TYPE_DIB
  • FILE_TYPE_JNG
  • FILE_TYPE_ICO
  • FILE_TYPE_FPX
  • FILE_TYPE_EPS
  • FILE_TYPE_SVG
  • FILE_TYPE_EMF
  • FILE_TYPE_WEBP
  • FILE_TYPE_DWG
  • FILE_TYPE_DXF
  • FILE_TYPE_THREEDS
  • FILE_TYPE_OGG
  • FILE_TYPE_FLC
  • FILE_TYPE_FLI
  • FILE_TYPE_MP3
  • FILE_TYPE_FLAC
  • FILE_TYPE_WAV
  • FILE_TYPE_MIDI
  • FILE_TYPE_AVI
  • FILE_TYPE_MPEG
  • FILE_TYPE_QUICKTIME
  • FILE_TYPE_ASF
  • FILE_TYPE_DIVX
  • FILE_TYPE_FLV
  • FILE_TYPE_WMA
  • FILE_TYPE_WMV
  • FILE_TYPE_RM
  • FILE_TYPE_MOV
  • FILE_TYPE_MP4
  • FILE_TYPE_T3GP
  • FILE_TYPE_WEBM
  • FILE_TYPE_MKV
  • FILE_TYPE_PDF
  • FILE_TYPE_PS
  • FILE_TYPE_DOC
  • FILE_TYPE_DOCX
  • FILE_TYPE_PPT
  • FILE_TYPE_PPTX
  • FILE_TYPE_XLS
  • FILE_TYPE_XLSX
  • FILE_TYPE_RTF
  • FILE_TYPE_PPSX
  • FILE_TYPE_ODP
  • FILE_TYPE_ODS
  • FILE_TYPE_ODT
  • FILE_TYPE_HWP
  • FILE_TYPE_GUL
  • FILE_TYPE_ODF
  • FILE_TYPE_ODG
  • FILE_TYPE_ONE_NOTE
  • FILE_TYPE_OOXML
  • FILE_TYPE_SLK
  • FILE_TYPE_EBOOK
  • FILE_TYPE_LATEX
  • FILE_TYPE_TTF
  • FILE_TYPE_EOT
  • FILE_TYPE_WOFF
  • FILE_TYPE_CHM
  • FILE_TYPE_ZIP
  • FILE_TYPE_GZIP
  • FILE_TYPE_BZIP
  • FILE_TYPE_RZIP
  • FILE_TYPE_DZIP
  • FILE_TYPE_SEVENZIP
  • FILE_TYPE_CAB
  • FILE_TYPE_JAR
  • FILE_TYPE_RAR
  • FILE_TYPE_MSCOMPRESS
  • FILE_TYPE_ACE
  • FILE_TYPE_ARC
  • FILE_TYPE_ARJ
  • FILE_TYPE_ASD
  • FILE_TYPE_BLACKHOLE
  • FILE_TYPE_KGB
  • FILE_TYPE_ZLIB
  • FILE_TYPE_TAR
  • FILE_TYPE_ZST
  • FILE_TYPE_LZFSE
  • FILE_TYPE_PYTHON_WHL
  • FILE_TYPE_PYTHON_PKG
  • FILE_TYPE_MSIX
  • FILE_TYPE_TEXT
  • FILE_TYPE_SCRIPT
  • FILE_TYPE_PHP
  • FILE_TYPE_PYTHON
  • FILE_TYPE_PERL
  • FILE_TYPE_RUBY
  • FILE_TYPE_C
  • FILE_TYPE_CPP
  • FILE_TYPE_JAVA
  • FILE_TYPE_SHELLSCRIPT
  • FILE_TYPE_PASCAL
  • FILE_TYPE_AWK
  • FILE_TYPE_DYALOG
  • FILE_TYPE_FORTRAN
  • FILE_TYPE_JAVASCRIPT
  • FILE_TYPE_POWERSHELL
  • FILE_TYPE_VBA
  • FILE_TYPE_M4
  • FILE_TYPE_OBJETIVEC
  • FILE_TYPE_JMOD
  • FILE_TYPE_MAKEFILE
  • FILE_TYPE_INI
  • FILE_TYPE_CLJ
  • FILE_TYPE_PDB
  • FILE_TYPE_SQL
  • FILE_TYPE_NEKO
  • FILE_TYPE_WER
  • FILE_TYPE_GOLANG
  • FILE_TYPE_M3U
  • FILE_TYPE_BAT
  • FILE_TYPE_MSC
  • FILE_TYPE_RDP
  • FILE_TYPE_SYMBIAN
  • FILE_TYPE_PALMOS
  • FILE_TYPE_WINCE
  • FILE_TYPE_ANDROID
  • FILE_TYPE_IPHONE
  • FILE_TYPE_HTML
  • FILE_TYPE_XML
  • FILE_TYPE_SWF
  • FILE_TYPE_FLA
  • FILE_TYPE_COOKIE
  • FILE_TYPE_TORRENT
  • FILE_TYPE_EMAIL_TYPE
  • FILE_TYPE_OUTLOOK
  • FILE_TYPE_SGML
  • FILE_TYPE_JSON
  • FILE_TYPE_CSV
  • FILE_TYPE_HTA
  • FILE_TYPE_INTERNET_SHORTCUT
  • FILE_TYPE_CAP
  • FILE_TYPE_ISOIMAGE
  • FILE_TYPE_SQUASHFS
  • FILE_TYPE_VHD
  • FILE_TYPE_APPLE
  • FILE_TYPE_MACINTOSH
  • FILE_TYPE_APPLESINGLE
  • FILE_TYPE_APPLEDOUBLE
  • FILE_TYPE_MACINTOSH_HFS
  • FILE_TYPE_APPLE_PLIST
  • FILE_TYPE_MACINTOSH_LIB
  • FILE_TYPE_APPLESCRIPT
  • FILE_TYPE_APPLESCRIPT_COMPILED
  • FILE_TYPE_CRX
  • FILE_TYPE_XPI
  • FILE_TYPE_ROM
  • FILE_TYPE_IPS
  • FILE_TYPE_PEM
  • FILE_TYPE_PGP
  • FILE_TYPE_CRT
enumDescriptions
  • File type is UNSPECIFIED.
  • File type is PE_EXE.
  • Although DLLs are actually portable executables, this value enables the file type to be identified separately. File type is PE_DLL.
  • File type is MSI.
  • File type is NE_EXE.
  • File type is NE_DLL.
  • File type is DOS_EXE.
  • File type is DOS_COM.
  • File type is COFF.
  • File type is ELF.
  • File type is LINUX_KERNEL.
  • File type is RPM.
  • File type is LINUX.
  • File type is MACH_O.
  • File type is JAVA_BYTECODE.
  • File type is DMG.
  • File type is DEB.
  • File type is PKG.
  • File type is PYC.
  • File type is LNK.
  • File type is DESKTOP_ENTRY.
  • File type is JPEG.
  • File type is TIFF.
  • File type is GIF.
  • File type is PNG.
  • File type is BMP.
  • File type is GIMP.
  • File type is Adobe InDesign.
  • File type is PSD. Adobe Photoshop.
  • File type is TARGA.
  • File type is XWD.
  • File type is DIB.
  • File type is JNG.
  • File type is ICO.
  • File type is FPX.
  • File type is EPS.
  • File type is SVG.
  • File type is EMF.
  • File type is WEBP.
  • File type is DWG.
  • File type is DXF.
  • File type is 3DS.
  • File type is OGG.
  • File type is FLC.
  • File type is FLI.
  • File type is MP3.
  • File type is FLAC.
  • File type is WAV.
  • File type is MIDI.
  • File type is AVI.
  • File type is MPEG.
  • File type is QUICKTIME.
  • File type is ASF.
  • File type is DIVX.
  • File type is FLV.
  • File type is WMA.
  • File type is WMV.
  • File type is RM. RealMedia type.
  • File type is MOV.
  • File type is MP4.
  • File type is T3GP.
  • File type is WEBM.
  • File type is MKV.
  • File type is PDF.
  • File type is PS.
  • File type is DOC.
  • File type is DOCX.
  • File type is PPT.
  • File type is PPTX.
  • File type is XLS.
  • File type is XLSX.
  • File type is RTF.
  • File type is PPSX.
  • File type is ODP.
  • File type is ODS.
  • File type is ODT.
  • File type is HWP.
  • File type is GUL.
  • File type is ODF.
  • File type is ODG.
  • File type is ONE_NOTE.
  • File type is OOXML.
  • File type is SLK.
  • File type is EBOOK.
  • File type is LATEX.
  • File type is TTF.
  • File type is EOT.
  • File type is WOFF.
  • File type is CHM.
  • File type is ZIP.
  • File type is GZIP.
  • File type is BZIP.
  • File type is RZIP.
  • File type is DZIP.
  • File type is SEVENZIP.
  • File type is CAB.
  • File type is JAR.
  • File type is RAR.
  • File type is MSCOMPRESS.
  • File type is ACE.
  • File type is ARC.
  • File type is ARJ.
  • File type is ASD.
  • File type is BLACKHOLE.
  • File type is KGB.
  • File type is ZLIB.
  • File type is TAR.
  • File type is ZST.
  • File type is LZFSE.
  • File type is PYTHON_WHL.
  • File type is PYTHON_PKG.
  • File type is MSIX, new Windows app package format.
  • File type is TEXT.
  • File type is SCRIPT.
  • File type is PHP.
  • File type is PYTHON.
  • File type is PERL.
  • File type is RUBY.
  • File type is C.
  • File type is CPP.
  • File type is JAVA.
  • File type is SHELLSCRIPT.
  • File type is PASCAL.
  • File type is AWK.
  • File type is DYALOG.
  • File type is FORTRAN.
  • File type is JAVASCRIPT.
  • File type is POWERSHELL.
  • File type is VBA.
  • File type is M4.
  • File type is OBJETIVEC.
  • File type is JMOD.
  • File type is MAKEFILE.
  • File type is INI.
  • File type is CLJ.
  • File type is PDB.
  • File type is SQL.
  • File type is NEKO.
  • File type is WER.
  • File type is GOLANG.
  • File type is M3U.
  • File type is BAT, Windows .bat/.cmd (old files are tagged as SHELLSCRIPT).
  • File type is MSC, Microsoft Management Console (MMC).
  • File type is RDP, Microsoft Remote Desktop Protocol (RDP) file.
  • File type is SYMBIAN.
  • File type is PALMOS.
  • File type is WINCE.
  • File type is ANDROID.
  • File type is IPHONE.
  • File type is HTML.
  • File type is XML.
  • File type is SWF.
  • File type is FLA.
  • File type is COOKIE.
  • File type is TORRENT.
  • File type is EMAIL_TYPE.
  • File type is OUTLOOK.
  • File type is SGML.
  • File type is JSON.
  • File type is CSV.
  • File type is HTA (HTML Application).
  • File type is MSHTML .url.
  • File type is CAP.
  • File type is ISOIMAGE.
  • File type is SQUASHFS.
  • File type is VHD.
  • File type is APPLE.
  • File type is MACINTOSH.
  • File type is APPLESINGLE.
  • File type is APPLEDOUBLE.
  • File type is MACINTOSH_HFS.
  • File type is APPLE_PLIST.
  • File type is MACINTOSH_LIB.
  • File type is APPLESCRIPT.
  • File type is APPLESCRIPT_COMPILED .
  • File type is CRX.
  • File type is XPI.
  • File type is ROM.
  • File type is IPS.
  • File type is PEM.
  • File type is PGP.
  • File type is CRT.
typestring
firstSeenTime
descriptionTimestamp the file was first seen in the customer's environment.
formatgoogle-datetime
typestring
firstSubmissionTime
descriptionFirst submission time of the file.
formatgoogle-datetime
typestring
fullPath
descriptionThe full path identifying the location of the file on the system. This field can be used as an entity indicator for file entities.
typestring
lastAccessTime
descriptionTimestamp when the file was accessed.
formatgoogle-datetime
typestring
lastAnalysisTime
descriptionTimestamp the file was last analysed.
formatgoogle-datetime
typestring
lastModificationTime
descriptionTimestamp when the file was last updated.
formatgoogle-datetime
typestring
lastSeenTime
descriptionTimestamp the file was last seen in the customer's environment.
formatgoogle-datetime
typestring
lastSubmissionTime
descriptionLast submission time of the file.
formatgoogle-datetime
typestring
mainIcon
$refFavicon
descriptionIcon's relevant hashes.
md5
descriptionThe MD5 hash of the file, as a hex-encoded string. This field can be used as an entity indicator for file entities.
typestring
mimeType
descriptionThe MIME (Multipurpose Internet Mail Extensions) type of the file, for example "PE", "PDF", or "powershell script".
typestring
names
descriptionNames fields.
items
typestring
typearray
ntfs
$refNtfsFileMetadata
descriptionNTFS metadata.
pdfInfo
$refPDFInfo
descriptionInformation about the PDF file structure.
peFile
$refFileMetadataPE
descriptionMetadata about the Portable Executable (PE) file.
prevalence
$refPrevalence
descriptionPrevalence of the file hash in the customer's environment.
securityResult
$refSecurityResult
descriptionGoogle Cloud Threat Intelligence (GCTI) security result for the file including threat context and detection metadata.
sha1
descriptionThe SHA1 hash of the file, as a hex-encoded string. This field can be used as an entity indicator for file entities.
typestring
sha256
descriptionThe SHA256 hash of the file, as a hex-encoded string. This field can be used as an entity indicator for file entities.
typestring
signatureInfo
$refSignatureInfo
descriptionFile signature information extracted from different tools.
size
descriptionThe size of the file in bytes.
formatuint64
typestring
ssdeep
descriptionSsdeep of the file
typestring
statDev
descriptionThe file system identifier to which the object belongs.
formatuint64
typestring
statFlags
descriptionUser defined flags for file.
formatuint32
typeinteger
statInode
descriptionThe file identifier. Unique identifier of object within a file system.
formatuint64
typestring
statMode
descriptionThe mode of the file. A bit string indicating the permissions and privileges of the file.
formatuint64
typestring
statNlink
descriptionNumber of links to file.
formatuint64
typestring
symhash
descriptionSymHash of the file. Used for Mach-O (e.g. MacOS) binaries, to identify similar files based on their symbol table.
typestring
tags
descriptionTags for the file.
items
typestring
typearray
vhash
descriptionVhash of the file.
typestring
typeobject
BoolSequence
descriptionBoolSequence represents a sequence of bools.
idBoolSequence
properties
boolVals
descriptionbool sequence.
items
typeboolean
typearray
typeobject
BytesSequence
descriptionBytesSequence represents a sequence of bytes.
idBytesSequence
properties
bytesVals
descriptionbytes sequence.
items
formatbyte
typestring
typearray
typeobject
CancelOperationRequest
descriptionThe request message for Operations.CancelOperation.
idCancelOperationRequest
properties
typeobject
CertSignature
descriptionCertificate's signature and algorithm.
idCertSignature
properties
signature
descriptionSignature.
typestring
signatureAlgorithm
descriptionAlgorithm.
typestring
typeobject
Certificate
descriptionCertificate information
idCertificate
properties
issuer
descriptionIssuer of the certificate.
typestring
md5
descriptionThe MD5 hash of the certificate, as a hex-encoded string.
typestring
notAfter
descriptionIndicates when the certificate is no longer valid.
formatgoogle-datetime
typestring
notBefore
descriptionIndicates when the certificate is first valid.
formatgoogle-datetime
typestring
serial
descriptionCertificate serial number.
typestring
sha1
descriptionThe SHA1 hash of the certificate, as a hex-encoded string.
typestring
sha256
descriptionThe SHA256 hash of the certificate, as a hex-encoded string.
typestring
subject
descriptionSubject of the certificate.
typestring
version
descriptionCertificate version.
typestring
typeobject
Chip
idChip
properties
text
typestring
type
enum
  • UNSPECIFIED
  • ALERT
  • NETWORK_CONNECTION
  • EDR
  • UNPARSED_RAW_LOG
  • LOGIN_EVENT
  • EMAIL_EVENT
  • GENERIC
  • TELEMETRY
enumDescriptions
typestring
typeobject
Client
descriptionTransport Layer Security (TLS) information associated with the client (for example, Certificate or JA3 hash).
idClient
properties
certificate
$refCertificate
descriptionClient certificate.
ja3
descriptionJA3 hash from the TLS ClientHello, as a hex-encoded string.
typestring
serverName
descriptionHost name of the server, that the client is connecting to.
typestring
supportedCiphers
descriptionCiphers supported by the client during client hello.
items
typestring
typearray
typeobject
Cloud
descriptionMetadata related to the cloud environment.
idCloud
properties
availabilityZone
descriptionThe cloud environment availability zone (different from region which is location.name).
typestring
environment
descriptionThe Cloud environment.
enum
  • UNSPECIFIED_CLOUD_ENVIRONMENT
  • GOOGLE_CLOUD_PLATFORM
  • AMAZON_WEB_SERVICES
  • MICROSOFT_AZURE
enumDescriptions
  • Default.
  • Google Cloud Platform.
  • Amazon Web Services.
  • Microsoft Azure.
typestring
project
$refResource
deprecatedTrue
descriptionThe cloud environment project information. Deprecated: Use Resource.resource_ancestors
vpc
$refResource
deprecatedTrue
descriptionThe cloud environment VPC. Deprecated.
typeobject
Collection
descriptionCollection represents a container of objects (such as events, entity context metadata, detection finding metadata) and state (such as investigation details). BEGIN GOOGLE-INTERNAL See go/udm:collections for additional details. END GOOGLE-INTERNAL An example use case for Collection is to model a detection and investigation from detection finding metadata to investigative state collected in the course of the investigation. For more complex investigation and response workflows a Collection could represent an incident consisting of multiple child findings or incidents. This can be expanded on to model remediation elements of a full detection and response workflow. NEXT TAG: 20
idCollection
properties
caseName
descriptionThe resource name of the Case that this collection belongs to. Example: projects/{project id}/locations/{region}/chronicle/cases/{internal_case_id}
typestring
collectionElements
descriptionConstituent elements of the collection. Each element shares an association that groups it together and is a component of the overall collection. For example, a detection collection may have several constituent elements that each share a correlation association that together represent a particular pattern or behavior.
items
$refElement
typearray
createdTime
descriptionTime the collection was created.
formatgoogle-datetime
typestring
dataAccessScope
descriptionThe resource name of the DataAccessScope of this collection. BEGIN GOOGLE-INTERNAL We may change this name based on the final resource design of the scope. END GOOGLE-INTERNAL
typestring
detection
descriptionDetection metadata for findings that represent detections, can include rule details, machine learning model metadata, and indicators implicated in the detection (using the .about field).
items
$refSecurityResult
typearray
detectionTime
descriptionTimestamp within the time_window related to the time of the collection_elements. For Rule Detections, this timestamp is the end of the the time_window for multi-event rules or the time of the event for single event rules. For late-arriving events that trigger new alerts, the detection_time will be the event time of the event.
formatgoogle-datetime
typestring
feedbackHistory
descriptionThe history of feedback submitted by analysts for this finding, in descending order by timestamp. This field is limited to the most recent 1000 feedback events. The primary feedback will also be included in this list.
items
$refFeedback
typearray
feedbackSummary
$refFeedback
descriptionThe current primary analyst feedback. This does not include the history of feedback given, which may be supplied in `feedback`.
id
descriptionUnique ID for the collection. The ID is specific to the type of collection. For example, with rule detections this is the detection ID.
typestring
idNamespace
descriptionThe ID namespace used for the Collection.
enum
  • NORMALIZED_TELEMETRY
  • RAW_TELEMETRY
  • RULE_DETECTIONS
  • UPPERCASE
  • MACHINE_INTELLIGENCE
  • SECURITY_COMMAND_CENTER
  • UNSPECIFIED
  • SOAR_ALERT
  • VIRUS_TOTAL
enumDescriptions
  • Ingested and Normalized telemetry events
  • Ingested Raw telemetry
  • Chronicle Rules engine
  • Uppercase
  • DSML - Machine Intelligence
  • A normalized telemetry event from Google Security Command Center.
  • Unspecified Namespace
  • An alert coming from other SIEMs via Chronicle SOAR.
  • VirusTotal.
typestring
investigation
$refInvestigation
descriptionConsolidated investigation details (categorization, status, etc) typically for collections that begin as detection findings and then evolve with analyst action and feedback into investigations around the detection output.
lastUpdatedTime
descriptionTime the collection was last updated.
formatgoogle-datetime
typestring
responsePlatformInfo
$refResponsePlatformInfo
descriptionAlert related info of this same alert in customer's SOAR platform.
soarAlert
descriptionA boolean field indicating that the alert is present in SOAR.
typeboolean
soarAlertMetadata
$refSoarAlertMetadata
descriptionMetadata fields of alerts coming from other SIEM systems via SOAR.
tags
descriptionTags set by UC/DSML/RE for the Finding during creation.
items
typestring
typearray
timeWindow
$refInterval
descriptionTime interval that the collection represents.
type
descriptionWhat the collection represents.
enum
  • COLLECTION_TYPE_UNSPECIFIED
  • TELEMETRY_ALERT
  • GCTI_FINDING
  • UPPERCASE_ALERT
  • RULE_DETECTION
  • MACHINE_INTELLIGENCE_ALERT
  • SOAR_ALERT
enumDescriptions
  • An unspecified collection type.
  • An alert reported in customer telemetry.
  • A finding from the Uppercase team.
  • A detection found by applying a rule.
  • An alert generated by Chronicle machine learning models.
  • An alert coming from other SIEMs via Chronicle SOAR.
typestring
typeobject
ColumnNames
idColumnNames
properties
names
items
typestring
typearray
typeobject
CompilationDiagnostic
descriptionCompilationDiagnostic represents a compilation diagnostic generated during a rule's compilation, such as a compilation error or a compilation warning.
idCompilationDiagnostic
properties
message
descriptionOutput only. The diagnostic message.
readOnlyTrue
typestring
position
$refCompilationPosition
descriptionOutput only. The approximate position in the rule text associated with the compilation diagnostic. Compilation Position may be empty.
readOnlyTrue
severity
descriptionOutput only. The severity of a rule's compilation diagnostic.
enum
  • SEVERITY_UNSPECIFIED
  • WARNING
  • ERROR
enumDescriptions
  • An unspecified severity level.
  • A compilation warning.
  • A compilation error.
readOnlyTrue
typestring
uri
descriptionOutput only. Link to documentation that describes a diagnostic in more detail.
readOnlyTrue
typestring
typeobject
CompilationPosition
descriptionCompilationPosition represents the location of a compilation diagnostic in rule text.
idCompilationPosition
properties
endColumn
descriptionOutput only. End column number, beginning at 1.
formatint32
readOnlyTrue
typeinteger
endLine
descriptionOutput only. End line number, beginning at 1.
formatint32
readOnlyTrue
typeinteger
startColumn
descriptionOutput only. Start column number, beginning at 1.
formatint32
readOnlyTrue
typeinteger
startLine
descriptionOutput only. Start line number, beginning at 1.
formatint32
readOnlyTrue
typeinteger
typeobject
CreateParserExtensionMetadata
descriptionOperation metadata for creating a parser extension.
idCreateParserExtensionMetadata
properties
state
descriptionThe state of the parser extension creation process.
enum
  • STATE_UNSPECIFIED
  • NEW
  • VALIDATING
  • LIVE
  • REJECTED
  • INTERNAL_ERROR
  • VALIDATED
  • ARCHIVED
enumDescriptions
  • The state for this parser extension was not specified.
  • The parser extension has been newly submitted and is waiting to be validated.
  • The parser extension is currently going through the validation pipeline.
  • The parser extension is live in production. Only configs that have successfully passed the validation stage will be set to LIVE.
  • Validation completed, but the parser extension was rejected with errors.
  • An error occurred when processing this parser extension.
  • Extension is validated.
  • Extension is archived and is no more being used.
typestring
stateLastChangedTime
descriptionThe time the config state was last changed.
formatgoogle-datetime
typestring
validationErrors
descriptionAny validation error while validating the extension, this have cap of size 10
items
typestring
typearray
validationReport
descriptionThe validation report generated during validation of the parser extension.
typestring
typeobject
CreateParserMetadata
descriptionOperation metadata for creating a parser.
idCreateParserMetadata
properties
stage
descriptionThe validation stage of the parser creation process.
enum
  • VALIDATION_STAGE_UNSPECIFIED
  • NEW
  • VALIDATING
  • PASSED
  • FAILED
  • DELETE_CANDIDATE
enumDescriptions
  • The validation stage is not specified.
  • The custom parser is submitted for validation.
  • The custom parser is currently going through the validation pipeline
  • The custom parser has successfully passed the validation.
  • The custom parser has failed validation.
  • The parser is no good, It is available for auto deletion.
typestring
validationReport
descriptionThe validation report generated during validation of the parser.
typestring
typeobject
DNSRecord
descriptionDNS record.
idDNSRecord
properties
expire
descriptionExpire.
formatgoogle-duration
typestring
minimum
descriptionMinimum.
formatgoogle-duration
typestring
priority
descriptionPriority.
formatint64
typestring
refresh
descriptionRefresh.
formatgoogle-duration
typestring
retry
descriptionRetry.
formatint64
typestring
rname
descriptionRname.
typestring
serial
descriptionSerial.
formatint64
typestring
ttl
descriptionTime to live.
formatgoogle-duration
typestring
type
descriptionType.
typestring
value
descriptionValue.
typestring
typeobject
DataAccessIngestionLabel
idDataAccessIngestionLabel
properties
key
descriptionThe key.
typestring
value
descriptionThe value.
typestring
typeobject
DataAccessLabel
descriptionA DataAccessLabel is a label on events to define user access to data.
idDataAccessLabel
properties
author
descriptionOutput only. The user who created the data access label.
readOnlyTrue
typestring
createTime
descriptionOutput only. The time at which the data access label was created.
formatgoogle-datetime
readOnlyTrue
typestring
description
descriptionOptional. A description of the data access label for a human reader.
typestring
displayName
descriptionOutput only. The short name displayed for the label as it appears on event data.
readOnlyTrue
typestring
lastEditor
descriptionOutput only. The user who last updated the data access label.
readOnlyTrue
typestring
name
descriptionRequired. The unique resource name of the data access label.
typestring
udmQuery
descriptionA UDM query over event data.
typestring
updateTime
descriptionOutput only. The time at which the data access label was last updated.
formatgoogle-datetime
readOnlyTrue
typestring
typeobject
DataAccessLabelReference
descriptionReference object to a data access label.
idDataAccessLabelReference
properties
assetNamespace
descriptionThe asset namespace configured in the forwarder of the customer's events.
typestring
dataAccessLabel
descriptionThe name of the data access label.
typestring
displayName
descriptionOutput only. The display name of the label. Data access label and log types's name will match the display name of the resource. The asset namespace will match the namespace itself. The ingestion key value pair will match the key of the tuple.
readOnlyTrue
typestring
ingestionLabel
$refIngestionLabel
descriptionThe ingestion label configured in the forwarder of the customer's events.
logType
descriptionThe name of the log type.
typestring
typeobject
DataAccessLabels
idDataAccessLabels
properties
allowScopedAccess
descriptionAre the labels ready for scoped access
typeboolean
customLabels
descriptionAll the complex labels (UDM search syntax based).
items
typestring
typearray
ingestionKvLabels
descriptionAll the ingestion labels (key/value pairs).
items
$refDataAccessIngestionLabel
typearray
ingestionLabels
deprecatedTrue
descriptionAll the ingestion labels.
items
typestring
typearray
logTypes
descriptionAll the LogType labels.
items
typestring
typearray
namespaces
descriptionAll the namespaces.
items
typestring
typearray
typeobject
DataAccessScope
descriptionA DataAccessScope is a boolean expression of data access labels used to restrict access to data for users.
idDataAccessScope
properties
allowAll
descriptionOptional. Whether or not the scope allows all labels, allow_all and allowed_data_access_labels are mutually exclusive and one of them must be present. denied_data_access_labels can still be used along with allow_all. When combined with denied_data_access_labels, access will be granted to all data that doesn't have labels mentioned in denied_data_access_labels. E.g.: A customer with scope with denied labels A and B and allow_all will be able to see all data except data labeled with A and data labeled with B and data with labels A and B.
typeboolean
allowedDataAccessLabels
descriptionOptional. The allowed labels for the scope. Either allow_all or allowed_data_access_labels needs to be provided. When provided, there has to be at least one label allowed for the scope to be valid. The logical operator for evaluation of the allowed labels is OR. E.g.: A customer with scope with allowed labels A and B will be able to see data with labeled with A or B or (A and B).
items
$refDataAccessLabelReference
typearray
author
descriptionOutput only. The user who created the data access scope.
readOnlyTrue
typestring
createTime
descriptionOutput only. The time at which the data access scope was created.
formatgoogle-datetime
readOnlyTrue
typestring
deniedDataAccessLabels
descriptionOptional. The denied labels for the scope. The logical operator for evaluation of the denied labels is AND. E.g.: A customer with scope with denied labels A and B won't be able to see data labeled with A and data labeled with B and data with labels A and B.
items
$refDataAccessLabelReference
typearray
description
descriptionOptional. A description of the data access scope for a human reader.
typestring
displayName
descriptionOutput only. The name to be used for display to customers of the data access scope.
readOnlyTrue
typestring
lastEditor
descriptionOutput only. The user who last updated the data access scope.
readOnlyTrue
typestring
name
descriptionRequired. The unique full name of the data access scope. The name should comply with https://google.aip.dev/122 standards.
typestring
updateTime
descriptionOutput only. The time at which the data access scope was last updated.
formatgoogle-datetime
readOnlyTrue
typestring
typeobject
Date
descriptionRepresents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values. * A month and day, with a zero year (for example, an anniversary). * A year on its own, with a zero month and a zero day. * A year and month, with a zero day (for example, a credit card expiration date). Related types: * google.type.TimeOfDay * google.type.DateTime * google.protobuf.Timestamp
idDate
properties
day
descriptionDay of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.
formatint32
typeinteger
month
descriptionMonth of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.
formatint32
typeinteger
year
descriptionYear of the date. Must be from 1 to 9999, or 0 to specify a date without a year.
formatint32
typeinteger
typeobject
Detections
idDetections
properties
baselineAlertsCount
formatint32
typeinteger
complete
typeboolean
detectionFieldAggregations
$refAlertFieldAggregations
detections
items
$refCollection
typearray
filteredAlertsCount
formatint32
typeinteger
tooManyDetections
typeboolean
validSnapshotQuery
typeboolean
typeobject
Dhcp
descriptionDHCP information.
idDhcp
properties
chaddr
descriptionClient hardware address (chaddr).
typestring
ciaddr
descriptionClient IP address (ciaddr).
typestring
clientHostname
descriptionClient hostname. See RFC2132, section 3.14.
typestring
clientIdentifier
descriptionClient identifier. See RFC2132, section 9.14. Note: Make sure to update the client_identifier_string field as well if you update this field.
formatbyte
typestring
clientIdentifierString
descriptionClient identifier as string. See RFC2132, section 9.14. This field holds the string value of the client_identifier.
typestring
file
descriptionBoot image filename.
typestring
flags
descriptionFlags.
formatuint32
typeinteger
giaddr
descriptionRelay agent IP address (giaddr).
typestring
hlen
descriptionHardware address length.
formatuint32
typeinteger
hops
descriptionHardware ops.
formatuint32
typeinteger
htype
descriptionHardware address type.
formatuint32
typeinteger
leaseTimeSeconds
descriptionLease time in seconds. See RFC2132, section 9.2.
formatuint32
typeinteger
opcode
descriptionThe BOOTP op code.
enum
  • UNKNOWN_OPCODE
  • BOOTREQUEST
  • BOOTREPLY
enumDescriptions
  • Default opcode.
  • Request.
  • Reply.
typestring
options
descriptionList of DHCP options.
items
$refOption
typearray
requestedAddress
descriptionRequested IP address. See RFC2132, section 9.1.
typestring
seconds
descriptionSeconds elapsed since client began address acquisition/renewal process.
formatuint32
typeinteger
siaddr
descriptionIP address of the next bootstrap server.
typestring
sname
descriptionServer name that the client wishes to boot from.
typestring
transactionId
descriptionTransaction ID.
formatuint32
typeinteger
type
descriptionDHCP message type.
enum
  • UNKNOWN_MESSAGE_TYPE
  • DISCOVER
  • OFFER
  • REQUEST
  • DECLINE
  • ACK
  • NAK
  • RELEASE
  • INFORM
  • WIN_DELETED
  • WIN_EXPIRED
enumDescriptions
  • Default message type.
  • DHCPDISCOVER.
  • DHCPOFFER.
  • DHCPREQUEST.
  • DHCPDECLINE.
  • DHCPACK.
  • DHCPNAK.
  • DHCPRELEASE.
  • DHCPINFORM.
  • Microsoft Windows DHCP "lease deleted".
  • Microsoft Windows DHCP "lease expired".
typestring
yiaddr
descriptionYour IP address (yiaddr).
typestring
typeobject
Dns
descriptionDNS information.
idDns
properties
additional
descriptionA list of additional domain name servers that can be used to verify the answer to the domain.
items
$refResourceRecord
typearray
answers
descriptionA list of answers to the domain name query.
items
$refResourceRecord
typearray
authoritative
descriptionOther DNS header flags. See RFC1035, section 4.1.1.
typeboolean
authority
descriptionA list of domain name servers which verified the answers to the domain name queries.
items
$refResourceRecord
typearray
id
descriptionDNS query id.
formatuint32
typeinteger
opcode
descriptionThe DNS OpCode used to specify the type of DNS query (for example, QUERY, IQUERY, or STATUS).
formatuint32
typeinteger
questions
descriptionA list of domain protocol message questions.
items
$refQuestion
typearray
recursionAvailable
descriptionWhether a recursive DNS lookup is available.
typeboolean
recursionDesired
descriptionWhether a recursive DNS lookup is desired.
typeboolean
response
descriptionSet to true if the event is a DNS response. See QR field from RFC1035.
typeboolean
responseCode
descriptionResponse code. See RCODE from RFC1035.
formatuint32
typeinteger
truncated
descriptionWhether the DNS response was truncated.
typeboolean
typeobject
Domain
descriptionInformation about a domain.
idDomain
properties
admin
$refUser
descriptionParsed contact information for the administrative contact for the domain.
auditUpdateTime
descriptionAudit updated time.
formatgoogle-datetime
typestring
billing
$refUser
descriptionParsed contact information for the billing contact of the domain.
categories
descriptionCategories assign to the domain as retrieved from VirusTotal.
items
typestring
typearray
contactEmail
descriptionContact email address.
typestring
creationTime
descriptionDomain creation time.
formatgoogle-datetime
typestring
expirationTime
descriptionExpiration time.
formatgoogle-datetime
typestring
favicon
$refFavicon
descriptionIncludes difference hash and MD5 hash of the domain's favicon.
firstSeenTime
descriptionFirst seen timestamp of the domain in the customer's environment.
formatgoogle-datetime
typestring
ianaRegistrarId
descriptionIANA Registrar ID. See https://www.iana.org/assignments/registrar-ids/registrar-ids.xhtml
formatint32
typeinteger
jarm
descriptionDomain's JARM hash.
typestring
lastDnsRecords
descriptionDomain's DNS records from the last scan.
items
$refDNSRecord
typearray
lastDnsRecordsTime
descriptionDate when the DNS records list was retrieved by VirusTotal.
formatgoogle-datetime
typestring
lastHttpsCertificate
$refSSLCertificate
descriptionSSL certificate object retrieved last time the domain was analyzed.
lastHttpsCertificateTime
descriptionWhen the certificate was retrieved by VirusTotal.
formatgoogle-datetime
typestring
lastSeenTime
descriptionLast seen timestamp of the domain in the customer's environment.
formatgoogle-datetime
typestring
name
descriptionThe domain name. This field can be used as an entity indicator for Domain entities.
typestring
nameServer
descriptionRepeated list of name servers.
items
typestring
typearray
popularityRanks
descriptionDomain's position in popularity ranks such as Alexa, Quantcast, Statvoo, etc
items
$refPopularityRank
typearray
prevalence
$refPrevalence
descriptionThe prevalence of the domain within the customer's environment.
privateRegistration
descriptionIndicates whether the domain appears to be using a private registration service to mask the owner's contact information.
typeboolean
registrant
$refUser
descriptionParsed contact information for the registrant of the domain.
registrar
descriptionRegistrar name . FOr example, "Wild West Domains, Inc. (R120-LROR)", "GoDaddy.com, LLC", or "PDR LTD. D/B/A PUBLICDOMAINREGISTRY.COM".
typestring
registryDataRawText
descriptionRegistry Data raw text.
formatbyte
typestring
status
descriptionDomain status. See https://www.icann.org/resources/pages/epp-status-codes-2014-06-16-en for meanings of possible values
typestring
tags
descriptionList of representative attributes.
items
typestring
typearray
tech
$refUser
descriptionParsed contact information for the technical contact for the domain
updateTime
descriptionLast updated time.
formatgoogle-datetime
typestring
whoisRecordRawText
descriptionWHOIS raw text.
formatbyte
typestring
whoisServer
descriptionWhois server name.
typestring
whoisTime
descriptionDate of the last update of the WHOIS record.
formatgoogle-datetime
typestring
zone
$refUser
descriptionParsed contact information for the zone.
typeobject
DoubleSequence
descriptionDoubleSequence represents a sequence of doubles.
idDoubleSequence
properties
doubleVals
descriptiondouble sequence.
items
formatdouble
typenumber
typearray
typeobject
EC
descriptionEC public key information.
idEC
properties
oid
descriptionCurve name.
typestring
pub
descriptionPublic key hexdump.
typestring
typeobject
Element
descriptionNEXT TAG: 5
idElement
properties
association
$refSecurityResult
descriptionMetadata that provides the relevant association for the references in the element. For a detection, this can be the correlated aspect of the references that contributed to the overall detection. For example, may include sub-rule condition, machine learning model metadata, and/or indicators implicated in this component of the detection (using the .about field).
label
descriptionA name that labels the entire references group.
typestring
references
descriptionReferences to model primatives including events and entities that share a common association. Even though a reference can have both UDM and entity, a collection of references (of a single element) will only have one type of message in it (either UDM / Entity).
items
$refReference
typearray
referencesSampled
descriptionCopied from the detection event_sample.too_many_event_samples field. If true, the number of references will be capped at the sample limit (set at rule service). This is applicable to both UDM references and Entity references.
typeboolean
typeobject
Email
descriptionEmail info.
idEmail
properties
bcc
descriptionA list of 'bcc' addresses.
items
typestring
typearray
bounceAddress
descriptionThe envelope from address. https://en.wikipedia.org/wiki/Bounce_address
typestring
cc
descriptionA list of 'cc' addresses.
items
typestring
typearray
from
descriptionThe 'from' address.
typestring
mailId
descriptionThe mail (or message) ID.
typestring
replyTo
descriptionThe 'reply to' address.
typestring
subject
descriptionThe subject line(s) of the email.
items
typestring
typearray
to
descriptionA list of 'to' addresses.
items
typestring
typearray
typeobject
Empty
descriptionA generic empty message that you can re-use to avoid defining duplicated empty messages in your APIs. A typical example is to use it as the request or the response type of an API method. For instance: service Foo { rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty); }
idEmpty
properties
typeobject
EntityChangedCountTimelineBucket
idEntityChangedCountTimelineBucket
properties
entityChangedInfo
items
$refEntityChangedInfo
typearray
totalChangedEntitiesCount
formatint32
typeinteger
typeobject
EntityChangedInfo
idEntityChangedInfo
properties
artifacts
$refFieldAndValue
entityCount
formatint32
typeinteger
typeobject
EntityCount
descriptionCount of different types of entities in the watchlist.
idEntityCount
properties
asset
descriptionOutput only. Count of asset type entities in the watchlist.
formatint32
readOnlyTrue
typeinteger
user
descriptionOutput only. Count of user type entities in the watchlist.
formatint32
readOnlyTrue
typeinteger
typeobject
EntityMetadata
descriptionInformation about the Entity and the product where the entity was created. Next Tag: 17
idEntityMetadata
properties
collectedTimestamp
descriptionGMT timestamp when the entity information was collected by the vendor's local collection infrastructure.
formatgoogle-datetime
typestring
creationTimestamp
descriptionGMT timestamp when the entity described by the product_entity_id was created on the system where data was collected.
formatgoogle-datetime
typestring
description
descriptionHuman-readable description of the entity.
typestring
entityType
descriptionEntity type. If an entity has multiple possible types, this specifies the most specific type.
enum
  • UNKNOWN_ENTITYTYPE
  • ASSET
  • USER
  • GROUP
  • RESOURCE
  • IP_ADDRESS
  • FILE
  • DOMAIN_NAME
  • URL
  • MUTEX
  • METRIC
enumDescriptions
  • @hide_from_doc
  • An asset, such as workstation, laptop, phone, virtual machine, etc.
  • User.
  • Group.
  • Resource.
  • An external IP address.
  • A file.
  • A domain.
  • A url.
  • A mutex.
  • A metric.
typestring
eventMetadata
$refMetadata
descriptionMetadata field from the event.
extracted
additionalProperties
descriptionProperties of the object.
typeany
descriptionFlattened fields extracted from the log.
typeobject
feed
descriptionVendor feed name for a threat indicator feed.
typestring
interval
$refInterval
descriptionValid existence time range for the version of the entity represented by this entity data.
productEntityId
descriptionA vendor-specific identifier that uniquely identifies the entity (e.g. a GUID, LDAP, OID, or similar).
typestring
productName
descriptionProduct name that produced the entity information.
typestring
productVersion
descriptionVersion of the product that produced the entity information.
typestring
sourceLabels
descriptionEntity source metadata labels.
items
$refLabel
typearray
sourceType
descriptionThe source of the entity.
enum
  • SOURCE_TYPE_UNSPECIFIED
  • ENTITY_CONTEXT
  • DERIVED_CONTEXT
  • GLOBAL_CONTEXT
enumDescriptions
  • Default source type
  • Entities ingested from customers (e.g. AD_CONTEXT, DLP_CONTEXT)
  • Entities derived from customer data such as prevalence, artifact first/last seen, or asset/user first seen stats.
  • Global contextual entities such as WHOIS or Safe Browsing.
typestring
structuredFields
additionalProperties
descriptionProperties of the object.
typeany
deprecatedTrue
descriptionStructured fields extracted from the log.
typeobject
threat
descriptionMetadata provided by a threat intelligence feed that identified the entity as malicious.
items
$refSecurityResult
typearray
vendorName
descriptionVendor name of the product that produced the entity information.
typestring
typeobject
EntityPopulationMechanism
descriptionMechanism to populate entities in the watchlist.
idEntityPopulationMechanism
properties
manual
$refManual
descriptionOptional. Entities are added manually.
typeobject
EntityRisk
descriptionStores information related to the risk score of an entity. Next ID: 15
idEntityRisk
properties
DEPRECATEDRiskScore
deprecatedTrue
descriptionDeprecated risk score.
formatint32
typeinteger
detailUri
descriptionLink to the Google Security Operations UI with information about the entity risk score. If the SecOps instance has multiple frontend paths configured, this will be a relative path that can be used to construct the full URL.
typestring
detectionsCount
descriptionNumber of detections that make up the risk score within the time window.
formatint32
typeinteger
firstDetectionTime
descriptionTimestamp of the first detection within the specified time window. This field is empty when there are no detections.
formatgoogle-datetime
typestring
lastDetectionTime
descriptionTimestamp of the last detection within the specified time window. This field is empty when there are no detections.
formatgoogle-datetime
typestring
lastResetTime
descriptionTimestamp for UEBA risk score reset based deduplication. Used specifically for risk based meta rules.
formatgoogle-datetime
typestring
normalizedRiskScore
descriptionNormalized risk score for the entity. This value is between 0-1000.
formatint32
typeinteger
rawRiskDelta
$refRiskDelta
descriptionRepresents the change in raw risk score for an entity between the end of the previous time window and the end of the current time window.
riskDelta
$refRiskDelta
descriptionRepresents the change in risk score for an entity between the end of the previous time window and the end of the current time window.
riskScore
descriptionRaw risk score for the entity.
formatfloat
typenumber
riskVersion
descriptionVersion of the risk score calculation algorithm.
typestring
riskWindow
$refInterval
descriptionTime window used when computing the risk score for an entity, for example 24 hours or 7 days.
riskWindowHasNewDetections
descriptionWhether there are new detections for the risk window.
typeboolean
riskWindowSize
descriptionRisk window duration for the entity.
formatgoogle-duration
typestring
typeobject
ErrorMessage
idErrorMessage
properties
errorText
typestring
type
enum
  • UNDEFINED_ERROR_TYPE
  • INVALID_QUERY_TYPE
  • INVALID_FIELD_PATH_TYPE
  • UNCLOSED_BRACKET_TYPE
  • BACKEND_ERROR_TYPE
  • UNCLOSED_QUOTES_TYPE
  • QUERY_TOO_LARGE_TYPE
enumDescriptions
typestring
typeobject
EventCountTimeline
idEventCountTimeline
properties
buckets
items
$refEventCountTimelineBucket
typearray
sizeOfBucketMs
formatint64
typestring
typeobject
EventCountTimelineBucket
idEventCountTimelineBucket
properties
alertCount
formatint32
typeinteger
baselineAlertCount
formatint32
typeinteger
baselineEventCount
formatint32
typeinteger
baselineTimedEntityCount
formatint32
typeinteger
entityChangedCount
$refEntityChangedCountTimelineBucket
eventCount
formatint32
typeinteger
filteredTimedEntityCount
formatint32
typeinteger
typeobject
Execution
descriptionExecution can be used to store metadata required for what action the UI should execute.
idExecution
properties
metadata
additionalProperties
typestring
descriptionOutput only. The payload to use when executing the action.
readOnlyTrue
typeobject
typeobject
ExifInfo
descriptionExif information.
idExifInfo
properties
company
descriptioncompany name.
typestring
compilationTime
descriptionCompilation time.
formatgoogle-datetime
typestring
entryPoint
descriptionentry point.
formatint64
typestring
fileDescription
descriptiondescription of a file.
typestring
originalFile
descriptionoriginal file name.
typestring
product
descriptionproduct name.
typestring
typeobject
Extension
descriptionCertificate's extensions.
idExtension
properties
authorityKeyId
$refAuthorityKeyId
descriptionIdentifies the public key to be used to verify the signature on this certificate or CRL.
ca
descriptionWhether the subject acts as a certificate authority (CA) or not.
typeboolean
caInfoAccess
descriptionAuthority information access locations are URLs that are added to a certificate in its authority information access extension.
typestring
certTemplateNameDc
descriptionBMP data value "DomainController". See MS Q291010.
typestring
certificatePolicies
descriptionDifferent certificate policies will relate to different applications which may use the certified key.
typestring
crlDistributionPoints
descriptionCRL distribution points to which a certificate user should refer to ascertain if the certificate has been revoked.
typestring
extendedKeyUsage
descriptionOne or more purposes for which the certified public key may be used, in addition to or in place of the basic purposes indicated in the key usage extension field.
typestring
keyUsage
descriptionThe purpose for which the certified public key is used.
typestring
netscapeCertComment
descriptionUsed to include free-form text comments inside certificates.
typestring
netscapeCertificate
descriptionIdentify whether the certificate subject is an SSL client, an SSL server, or a CA.
typeboolean
oldAuthorityKeyId
descriptionWhether the certificate has an old authority key identifier extension.
typeboolean
peLogotype
descriptionWhether the certificate includes a logotype.
typeboolean
subjectAlternativeName
descriptionContains one or more alternative names, using any of a variety of name forms, for the entity that is bound by the CA to the certified public key.
typestring
subjectKeyId
descriptionIdentifies the public key being certified.
typestring
typeobject
Extensions
descriptionExtensions to a UDM event.
idExtensions
properties
auth
$refAuthentication
descriptionAn authentication extension.
entityRisk
$refEntityRisk
descriptionAn entity risk change extension.
vulns
$refVulnerabilities
descriptionA vulnerability extension.
typeobject
Favicon
descriptionDifference hash and MD5 hash of the domain's favicon.
idFavicon
properties
dhash
descriptionDifference hash.
typestring
rawMd5
descriptionFavicon's MD5 hash.
typestring
typeobject
Feedback
idFeedback
properties
comment
descriptionOptional.
typestring
confidenceScore
formatint32
typeinteger
createdTime
formatgoogle-datetime
typestring
disregarded
typeboolean
idpUserId
typestring
priority
descriptionOptional.
enum
  • PRIORITY_UNSPECIFIED
  • PRIORITY_INFO
  • PRIORITY_LOW
  • PRIORITY_MEDIUM
  • PRIORITY_HIGH
  • PRIORITY_CRITICAL
enumDescriptions
  • Default priority level.
  • Informational priority.
  • Low priority.
  • Medium priority.
  • High priority.
  • Critical priority.
typestring
priorityDisplay
descriptionOptional.
typestring
reason
descriptionOptional.
enum
  • REASON_UNSPECIFIED
  • REASON_NOT_MALICIOUS
  • REASON_MALICIOUS
  • REASON_MAINTENANCE
enumDescriptions
  • Default reason.
  • Case or Alert not malicious.
  • Case or Alert is malicious.
  • Case or Alert is under maintenance.
typestring
reputation
enum
  • REPUTATION_UNSPECIFIED
  • USEFUL
  • NOT_USEFUL
enumDescriptions
  • An unspecified reputation.
  • A categorization of the finding as useful.
  • A categorization of the finding as not useful.
typestring
riskScore
formatint32
typeinteger
rootCause
descriptionOptional.
typestring
severity
formatint32
typeinteger
severityDisplay
descriptionOptional.
typestring
status
descriptionOptional.
enum
  • STATUS_UNSPECIFIED
  • NEW
  • REVIEWED
  • CLOSED
  • OPEN
enumDescriptions
  • Unspecified finding status.
  • New finding.
  • When a finding has feedback.
  • When an analyst closes an finding.
  • Open. Used to indicate that a Case / Alert is open.
typestring
verdict
enum
  • VERDICT_UNSPECIFIED
  • TRUE_POSITIVE
  • FALSE_POSITIVE
enumDescriptions
  • An unspecified verdict.
  • A categorization of the finding as a "true positive".
  • A categorization of the finding as a "false positive".
typestring
typeobject
FieldAndValue
idFieldAndValue
properties
entityNamespace
typestring
fieldPath
typestring
kvalueType
enum
  • UNKNOWN
  • COLLECTOR_ID
  • EVENT_SHARD
  • ASSET_IP_ADDRESS
  • MAC
  • HOSTNAME
  • PRODUCT_SPECIFIC_ID
  • NAMESPACE
  • DOMAIN_NAME
  • RESOLVED_IP_ADDRESS
  • STEMMED_DOMAIN_NAME
  • PROCESS_ID
  • FULL_COMMAND_LINE
  • FILE_NAME
  • FILE_PATH
  • HASH_MD5
  • HASH_SHA256
  • HASH_SHA1
  • RAW_PID
  • PARENT_PROCESS_ID
  • EMAIL
  • USERNAME
  • WINDOWS_SID
  • EMPLOYEE_ID
  • PRODUCT_OBJECT_ID
  • USER_DISPLAY_NAME
  • CLOUD_RESOURCE_NAME
  • REGISTRY_KEY
  • REGISTRY_VALUE_DATA
  • REGISTRY_VALUE_NAME
enumDescriptions
typestring
value
typestring
typeobject
FileMetadata
descriptionMetadata about a file. Place metadata about different file types here, for example data from the Microsoft Windows VersionInfo block or digital signer details. Use a different sub-message per file type.
idFileMetadata
properties
pe
$refPeFileMetadata
deprecatedTrue
descriptionMetadata for Microsoft Windows PE files. Deprecate PeFileMetadata in favor of single File proto.
typeobject
FileMetadataCodesign
descriptionFile metadata from the codesign utility.
idFileMetadataCodesign
properties
compilationTime
descriptionCode sign timestamp
formatgoogle-datetime
typestring
format
descriptionCode sign format.
typestring
id
descriptionCode sign identifier.
typestring
teamId
descriptionThe assigned team identifier of the developer who signed the application.
typestring
typeobject
FileMetadataImports
descriptionFile metadata imports.
idFileMetadataImports
properties
functions
descriptionFunction field.
items
typestring
typearray
library
descriptionLibrary field.
typestring
typeobject
FileMetadataPE
descriptionMetadata about the Portable Executable (PE) file.
idFileMetadataPE
properties
compilationExiftoolTime
descriptioninfo.exiftool.TimeStamp.
formatgoogle-datetime
typestring
compilationTime
descriptioninfo.pe-timestamp.
formatgoogle-datetime
typestring
entryPoint
descriptioninfo.pe-entry-point.
formatint64
typestring
entryPointExiftool
descriptioninfo.exiftool.EntryPoint.
formatint64
typestring
imphash
descriptionImphash of the file.
typestring
imports
descriptionFilemetadataImports fields.
items
$refFileMetadataImports
typearray
resource
descriptionFilemetadataPeResourceInfo fields.
items
$refFileMetadataPeResourceInfo
typearray
resourcesLanguageCount
deprecatedTrue
descriptionDeprecated: use resources_language_count_str.
items
$refStringToInt64MapEntry
typearray
resourcesLanguageCountStr
descriptionNumber of resources by language. Example: NEUTRAL: 20, ENGLISH US: 10
items
$refLabel
typearray
resourcesTypeCount
deprecatedTrue
descriptionDeprecated: use resources_type_count_str.
items
$refStringToInt64MapEntry
typearray
resourcesTypeCountStr
descriptionNumber of resources by resource type. Example: RT_ICON: 10, RT_DIALOG: 5
items
$refLabel
typearray
section
descriptionFilemetadataSection fields.
items
$refFileMetadataSection
typearray
signatureInfo
$refFileMetadataSignatureInfo
deprecatedTrue
descriptionFilemetadataSignatureInfo field. deprecated, user File.signature_info instead.
typeobject
FileMetadataPeResourceInfo
descriptionFile metadata for PE resource.
idFileMetadataPeResourceInfo
properties
entropy
descriptionEntropy of the resource.
formatdouble
typenumber
fileType
descriptionFile type. Note that this value may not match any of the well-known type identifiers defined in the ResourceType enum.
typestring
filetypeMagic
descriptionType of resource content, as identified by the magic Python module.
typestring
languageCode
descriptionHuman-readable version of the language and sublanguage identifiers, as defined in the Microsoft Windows PE specification. Examples: | Language | Sublanguage | Field value | | LANG_NEUTRAL | SUBLANG_NEUTRAL | NEUTRAL | | LANG_FRENCH | - | FRENCH | | LANG_ENGLISH | SUBLANG_ENGLISH US | ENGLISH US |
typestring
sha256Hex
descriptionSHA256_hex field..
typestring
typeobject
FileMetadataSection
descriptionFile metadata section.
idFileMetadataSection
properties
entropy
descriptionEntropy of the section.
formatdouble
typenumber
md5Hex
descriptionMD5 hex of the file.
typestring
name
descriptionName of the section.
typestring
rawSizeBytes
descriptionRaw file size in bytes.
formatint64
typestring
virtualSizeBytes
descriptionVirtual file size in bytes.
formatint64
typestring
typeobject
FileMetadataSignatureInfo
descriptionSignature information.
idFileMetadataSignatureInfo
properties
signer
deprecatedTrue
descriptionDeprecated: use signers field.
items
typestring
typearray
signers
descriptionFile metadata signer information. The order of the signers matters. Each element is a higher level authority, being the last the root authority.
items
$refSignerInfo
typearray
verificationMessage
descriptionStatus of the certificate. Valid values are "Signed", "Unsigned" or a description of the certificate anomaly, if found.
typestring
verified
descriptionTrue if verification_message == "Signed"
typeboolean
x509
descriptionList of certificates.
items
$refX509
typearray
typeobject
FilterProperties
idFilterProperties
properties
hidden
typeboolean
stringProperties
additionalProperties
$refStringValues
typeobject
typeobject
FindingVariable
descriptionA structure that holds the value and associated metadata for values extracted while producing a Finding.
idFindingVariable
properties
boolSeq
$refBoolSequence
descriptionThe value in boolsequence format.
boolVal
descriptionThe value in boolean format.
typeboolean
bytesSeq
$refBytesSequence
descriptionThe value in bytessequence format.
bytesVal
descriptionThe value in bytes format.
formatbyte
typestring
doubleSeq
$refDoubleSequence
descriptionThe value in doublesequence format.
doubleVal
descriptionThe value in double format.
formatdouble
typenumber
int64Seq
$refInt64Sequence
descriptionThe value in int64sequence format.
int64Val
descriptionThe value in int64 format.
formatint64
typestring
nullVal
descriptionWhether the value is null.
typeboolean
sourcePath
descriptionThe UDM field path for the field which this value was derived from. Example: `principal.user.username`
typestring
stringSeq
$refStringSequence
descriptionThe value in stringsequence format.
stringVal
descriptionThe value in string format. Enum values are returned as strings.
typestring
type
descriptionThe type of the variable.
enum
  • TYPE_UNSPECIFIED
  • MATCH
  • OUTCOME
enumDescriptions
  • An unspecified variable type.
  • A variable coming from the match conditions.
  • A variable representing significant data that was found in the detection logic.
typestring
uint64Seq
$refUint64Sequence
descriptionThe value in uint64sequence format.
uint64Val
descriptionThe value in uint64 format.
formatuint64
typestring
value
descriptionThe value in string form.
typestring
typeobject
FollowUp
descriptionFollowUp can be used to store metadata required to send a follow up message by the UI.
idFollowUp
properties
followUp
descriptionOutput only. The text to use as input when generating the follow up message.
readOnlyTrue
typestring
typeobject
Ftp
descriptionFTP info.
idFtp
properties
command
descriptionThe FTP command.
typestring
typeobject
FunctionResponse
idFunctionResponse
properties
rows
items
$refFunctionResponseRow
typearray
tooManyRows
typeboolean
typeobject
FunctionResponseRow
idFunctionResponseRow
properties
values
items
$refUdmFieldValue
typearray
typeobject
GoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStats
descriptionLINT.IfChange(stats_data) Stats results when the query is for statistics NEXT TAG = 6;
idGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStats
properties
dataQueryExpression
descriptionExpression that represent the subset of the requested query used to filter data. The expression will be used to enable features such as drill-down from stats results to UDM events. In that case, the new query will be composed by this expression and the expression related to a stats result.
typestring
results
descriptionResult rows that are queried.
items
$refGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnData
typearray
sortOrder
descriptionIndicates the columns used for sorting and the order in which they are sorted. If no ORDER section is specified in the query, this will be empty.
items
$refGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnSort
typearray
tooManyResults
descriptionIf true, there are too many results to return and some have been omitted.
typeboolean
totalResults
descriptionThe total number of results returned.
formatint32
typeinteger
typeobject
GoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnData
descriptionRepresents a single column in the set of columns returned as the stats query result.
idGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnData
properties
column
descriptionUsed to store column names.
typestring
filterExpression
descriptionExpression used to compose a query for filtering/drill-downs related to the data in this column.
typestring
filterable
descriptionTo identify if the column can be used for filtering/drill-downs.
typeboolean
values
descriptionTo store store column data.
items
$refGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnType
typearray
typeobject
GoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnSort
descriptionContains the column name and which direction the column is sorted (ascending or descenging).
idGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnSort
properties
descending
descriptionWhether the column is sorted in descending order (ascending by default);
typeboolean
name
descriptionName of the column.
typestring
typeobject
GoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnType
descriptionSingular vs list of values in a column.
idGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnType
properties
list
$refGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnTypeList
descriptionList of values in a column e.g. IPs
value
$refGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnValue
descriptionSingle value in a column.
typeobject
GoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnTypeList
descriptionStore list of values in a column.
idGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnTypeList
properties
values
descriptionList of values in one cell of the column.
items
$refGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnValue
typearray
typeobject
GoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnValue
descriptionValue of the column based on data type
idGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnValue
properties
boolVal
descriptionBoolean value.
typeboolean
bytesVal
descriptionBytes value.
formatbyte
typestring
dateVal
$refDate
descriptionDate values.
doubleVal
descriptionDouble value.
formatdouble
typenumber
int64Val
descriptionInteger value (signed).
formatint64
typestring
nullVal
descriptionTrue if the value is NULL.
typeboolean
protoVal
additionalProperties
descriptionProperties of the object. Contains field @type with type URL.
typeany
descriptionFor any proto values that are not any of the above.
typeobject
stringVal
descriptionString value. Enum values are returned as strings.
typestring
timestampVal
descriptionTimestamp values.
formatgoogle-datetime
typestring
uint64Val
descriptionUn-signed integer value.
formatuint64
typestring
typeobject
Group
descriptionInformation about an organizational group.
idGroup
properties
attribute
$refAttribute
descriptionGeneric entity metadata attributes of the group.
creationTime
deprecatedTrue
descriptionGroup creation time. Deprecated: creation_time should be populated in Attribute as generic metadata.
formatgoogle-datetime
typestring
emailAddresses
descriptionEmail addresses of the group.
items
typestring
typearray
groupDisplayName
descriptionGroup display name. e.g. "Finance".
typestring
productObjectId
descriptionProduct globally unique user object identifier, such as an LDAP Object Identifier.
typestring
windowsSid
descriptionMicrosoft Windows SID of the group.
typestring
typeobject
GroupAggregationByField
idGroupAggregationByField
properties
baselineEventCount
formatint32
typeinteger
eventCount
formatint32
typeinteger
fieldName
typestring
fieldValue
$refUdmFieldValue
fields
items
$refUdmFieldAggregation
typearray
valueCount
formatint32
typeinteger
typeobject
Hardware
descriptionHardware specification details for a resource, including both physical and virtual hardware.
idHardware
properties
cpuClockSpeed
descriptionClock speed of the hardware CPU in MHz.
formatuint64
typestring
cpuMaxClockSpeed
descriptionMaximum possible clock speed of the hardware CPU in MHz.
formatuint64
typestring
cpuModel
descriptionModel description of the hardware CPU (e.g. "2.8 GHz Quad-Core Intel Core i5").
typestring
cpuNumberCores
descriptionNumber of CPU cores.
formatuint64
typestring
cpuPlatform
descriptionPlatform of the hardware CPU (e.g. "Intel Broadwell").
typestring
manufacturer
descriptionHardware manufacturer.
typestring
model
descriptionHardware model.
typestring
ram
descriptionAmount of the hardware ramdom access memory (RAM) in Mb.
formatuint64
typestring
serialNumber
descriptionHardware serial number.
typestring
typeobject
Http
descriptionSpecify the full URL of the HTTP request within "target". Also specify any uploaded or downloaded file information within "source" or "target".
idHttp
properties
method
descriptionThe HTTP request method (e.g. "GET", "POST", "PATCH", "DELETE").
typestring
parsedUserAgent
$refUserAgentProto
descriptionThe parsed user_agent string.
referralUrl
descriptionThe URL for the HTTP referer.
typestring
responseCode
descriptionThe response status code, for example 200, 302, 404, or 500.
formatint32
typeinteger
userAgent
descriptionThe User-Agent request header which includes the application type, operating system, software vendor or software version of the requesting software user agent.
typestring
typeobject
Id
descriptionIdentifier to identify a UDM object like a UDM event, Entity, Collection. The full identifier for persistence is created by setting the 32 most significant bits as the Id.Namespace enum and the rest according to go/udm:ids. This is a convenience wrapper to define the id space enum values and provide an easy interface for RPCs, most persistence use cases should use a denormalized form. See go/udm:ids for background and details.
idId
properties
id
descriptionFull raw ID.
formatbyte
typestring
namespace
descriptionNamespace the id belongs to.
enum
  • NORMALIZED_TELEMETRY
  • RAW_TELEMETRY
  • RULE_DETECTIONS
  • UPPERCASE
  • MACHINE_INTELLIGENCE
  • SECURITY_COMMAND_CENTER
  • UNSPECIFIED
  • SOAR_ALERT
  • VIRUS_TOTAL
enumDescriptions
  • Ingested and Normalized telemetry events
  • Ingested Raw telemetry
  • Chronicle Rules engine
  • Uppercase
  • DSML - Machine Intelligence
  • A normalized telemetry event from Google Security Command Center.
  • Unspecified Namespace
  • An alert coming from other SIEMs via Chronicle SOAR.
  • VirusTotal.
typestring
stringId
descriptionSome ids are stored as strings that are not able to be translated to bytes, so store these separately. Ex. detection id of the form de_aaaaaaaa-aaaa...
typestring
typeobject
IngestionLabel
descriptionRepresentation of an ingestion label type.
idIngestionLabel
properties
ingestionLabelKey
descriptionRequired. The key of the ingestion label. Always required.
typestring
ingestionLabelValue
descriptionOptional. The value of the ingestion label. Optional. An object with no provided value and some key provided would match against the given key and ANY value.
typestring
typeobject
InputsUsed
descriptionInputsUsed is a convenience field that tells us which sources of events (if any) were used in the rule. NEXT TAG: 4
idInputsUsed
properties
usesDetection
descriptionOptional. Whether the rule queries detections.
typeboolean
usesEntity
descriptionOptional. Whether the rule queries entity events.
typeboolean
usesUdm
descriptionOptional. Whether the rule queries UDM events.
typeboolean
typeobject
Instance
descriptionA Instance represents an instantiation of the Instance product.
idInstance
properties
name
descriptionOutput only. The resource name of this instance. Format: projects/{project}/locations/{location}/instances/{instance}
readOnlyTrue
typestring
typeobject
InstanceUdmSearchResponse
idInstanceUdmSearchResponse
properties
baselineEventsCount
formatint32
typeinteger
complete
typeboolean
detections
$refDetections
filteredEventsCount
formatint32
typeinteger
instanceId
typestring
prevalence
$refUdmPrevalenceResponse
progress
formatdouble
typenumber
runtimeErrors
$refRuntimeError
timeline
$refEventCountTimeline
tooManyEvents
typeboolean
typeobject
Int64Sequence
descriptionInt64Sequence represents a sequence of int64s.
idInt64Sequence
properties
int64Vals
descriptionint64 sequence.
items
formatint64
typestring
typearray
typeobject
Interval
descriptionRepresents a time interval, encoded as a Timestamp start (inclusive) and a Timestamp end (exclusive). The start must be less than or equal to the end. When the start equals the end, the interval is empty (matches no time). When both start and end are unspecified, the interval matches any time.
idInterval
properties
endTime
descriptionOptional. Exclusive end of the interval. If specified, a Timestamp matching this interval will have to be before the end.
formatgoogle-datetime
typestring
startTime
descriptionOptional. Inclusive start of the interval. If specified, a Timestamp matching this interval will have to be the same or after the start.
formatgoogle-datetime
typestring
typeobject
Investigation
descriptionRepresents the aggregated state of an investigation such as categorization, severity, and status. Can be expanded to include analyst assignment details and more.
idInvestigation
properties
comments
descriptionComment added by the Analyst.
items
typestring
typearray
priority
descriptionPriority of the Alert or Finding set by analyst.
enum
  • PRIORITY_UNSPECIFIED
  • PRIORITY_INFO
  • PRIORITY_LOW
  • PRIORITY_MEDIUM
  • PRIORITY_HIGH
  • PRIORITY_CRITICAL
enumDescriptions
  • Default priority level.
  • Informational priority.
  • Low priority.
  • Medium priority.
  • High priority.
  • Critical priority.
typestring
reason
descriptionReason for closing the Case or Alert.
enum
  • REASON_UNSPECIFIED
  • REASON_NOT_MALICIOUS
  • REASON_MALICIOUS
  • REASON_MAINTENANCE
enumDescriptions
  • Default reason.
  • Case or Alert not malicious.
  • Case or Alert is malicious.
  • Case or Alert is under maintenance.
typestring
reputation
descriptionDescribes whether a finding was useful or not-useful.
enum
  • REPUTATION_UNSPECIFIED
  • USEFUL
  • NOT_USEFUL
enumDescriptions
  • An unspecified reputation.
  • A categorization of the finding as useful.
  • A categorization of the finding as not useful.
typestring
riskScore
descriptionRisk score for a finding set by an analyst.
formatuint32
typeinteger
rootCause
descriptionRoot cause of the Alert or Finding set by analyst.
typestring
severityScore
descriptionSeverity score for a finding set by an analyst.
formatuint32
typeinteger
status
descriptionDescribes the workflow status of a finding.
enum
  • STATUS_UNSPECIFIED
  • NEW
  • REVIEWED
  • CLOSED
  • OPEN
enumDescriptions
  • Unspecified finding status.
  • New finding.
  • When a finding has feedback.
  • When an analyst closes an finding.
  • Open. Used to indicate that a Case / Alert is open.
typestring
verdict
descriptionDescribes reason a finding investigation was resolved.
enum
  • VERDICT_UNSPECIFIED
  • TRUE_POSITIVE
  • FALSE_POSITIVE
enumDescriptions
  • An unspecified verdict.
  • A categorization of the finding as a "true positive".
  • A categorization of the finding as a "false positive".
typestring
typeobject
IoCStats
descriptionInformation about the threat intelligence source. These fields are used to model Mandiant sources.
idIoCStats
properties
benignCount
descriptionCount of responses where the IoC was identified as benign.
formatint32
typeinteger
firstLevelSource
descriptionName of first level IoC source, for example Mandiant or a third-party.
typestring
iocStatsType
descriptionDescribes the source of the IoCStat.
enum
  • UNSPECIFIED_IOC_STATS_TYPE
  • MANDIANT_SOURCES
  • THIRD_PARTY_SOURCES
  • THREAT_INTELLIGENCE_IOC_STATS
enumDescriptions
  • IoCStat source is unidentified.
  • IoCStat is from a Mandiant Source.
  • IoCStat is from a third-party source.
  • IoCStat is from a threat intelligence feed.
typestring
maliciousCount
descriptionCount of responses where the IoC was identified as malicious.
formatint32
typeinteger
quality
descriptionLevel of confidence in the IoC mapping extracted from the source.
enum
  • UNKNOWN_CONFIDENCE
  • LOW_CONFIDENCE
  • MEDIUM_CONFIDENCE
  • HIGH_CONFIDENCE
enumDescriptions
  • The default confidence level.
  • Low confidence.
  • Medium confidence.
  • High confidence.
typestring
responseCount
descriptionTotal number of response from the source.
formatint32
typeinteger
secondLevelSource
descriptionName of the second-level IoC source, for example Crowdsourced Threat Analysis or Knowledge Graph.
typestring
sourceCount
descriptionNumber of sources from which information was extracted.
formatint32
typeinteger
typeobject
Label
descriptionKey value labels.
idLabel
properties
key
descriptionThe key.
typestring
rbacEnabled
descriptionIndicates whether this label can be used for Data RBAC
typeboolean
source
descriptionWhere the label is derived from.
typestring
value
descriptionThe value.
typestring
typeobject
LatLng
descriptionAn object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges.
idLatLng
properties
latitude
descriptionThe latitude in degrees. It must be in the range [-90.0, +90.0].
formatdouble
typenumber
longitude
descriptionThe longitude in degrees. It must be in the range [-180.0, +180.0].
formatdouble
typenumber
typeobject
LegacyFederatedUdmSearchViewResponse
descriptionResponse to a Federated UDM Search query. This will be used by StreamSearchOperation RPC to return the results of a federated search operation.
idLegacyFederatedUdmSearchViewResponse
properties
activityTimeline
$refEventCountTimeline
descriptionTimeline of event counts broken into hourly/daily buckets to identify activity.
aiOverview
$refAIOverview
descriptionLINT.ThenChange( //depot/google3/google/cloud/chronicle/v1main/dashboard_query.proto:data_sources, //depot/google3/googlex/security/malachite/proto/udm_search.proto:data_sources ) AI generated overview for the search results. Only populated if the AI features are enabled for the customer and generate_ai_overview is set to true in the request.
baselineEventsCount
descriptionThe number of events in the baseline query.
formatint32
typeinteger
complete
descriptionStreaming for this response is done. There will be no additional updates.
typeboolean
dataSources
descriptionDatasource of the query and results in case of a statistics query
items
enum
  • SEARCH_DATA_SOURCE_UNSPECIFIED
  • SEARCH_UDM
  • SEARCH_ENTITY
  • SEARCH_RULE_DETECTIONS
  • SEARCH_RULESETS
enumDescriptions
  • Unspecified data source.
  • Events
  • Entities
  • To be used for detections data source.
  • To be used for ruleset with detections datasource.
typestring
typearray
detectionFieldAggregations
$refAlertFieldAggregations
descriptionList of detection fields with aggregated values. This enabled filtering in the Alerts panel for federated search.
events
$refUdmEventList
descriptionList of UDM events. NOTE: After complete is set to true, the `UdmEventList` message will be omitted from the response. The latest message should be used as reference. If the `UdmEventList` message is returned again, then it should replace the previous value.
fieldAggregations
$refUdmFieldAggregations
descriptionList of UDM fields with aggregated values.
filteredEventsCount
descriptionThe number of events in the snapshot that match the snapshot_query. This is <= `baseline_events_count`. If the snapshot query is empty this will be equivalent to `baseline_events_count`.
formatint32
typeinteger
groupedFieldAggregations
$refUdmFieldAggregations
descriptionList of grouped fields with aggregated values.
instanceAggregations
$refUdmFieldAggregations
descriptionInstance aggregations for the search results. Provides information on the number of events per instance for the aggregations panel in the UI. This allows users to easily drill-down into the individual instances.
instanceUdmSearchResponses
descriptionAll the instance specific UDM search responses.
items
$refInstanceUdmSearchResponse
typearray
operation
descriptionThe name of the operation resource representing the UDM Search operation. This can be passed to `StreamSearchOperation` to fetch stored results or stream the results of an in-progress operation. The metadata type of the operation is `UdmSearchMetadata`. The response type is `LegacyFetchUdmSearchViewResponse`. Format: projects/{project}/locations/{location}/instances/{instance}/operations/{operation}
typestring
progress
descriptionProgress of the query represented as a double between 0 and 1.
formatdouble
typenumber
queryValidationErrors
descriptionParse error for the baseline_query and/or the snapshot_query.
items
$refErrorMessage
typearray
runtimeErrors
descriptionRuntime errors.
items
$refRuntimeError
typearray
stats
$refGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStats
descriptionStats results when the query is for statistics
statsFunctionParameterValidationErrorMessage
descriptionIf the request's stats_function_parameter` is invalid, this field will contain the detailed error message.
typestring
statsFunctionResponse
$refFunctionResponse
descriptionResult for statistical function.
timeline
$refEventCountTimeline
descriptionTimeline of event counts broken into buckets. This populates the trend-over-time chart in the UI.
tooLargeResponse
descriptionIf true, the response to be returned to the UI is too large and some events have been omitted.
typeboolean
tooManyEvents
descriptionIf true, there are too many events to return and some have been omitted.
typeboolean
validBaselineQuery
descriptionIndicates whether the request baseline_query is a valid structured query or not. If not, `query_validation_errors` will include the parse error.
typeboolean
validSnapshotQuery
descriptionIndicates whether the request baseline and snapshot queries are valid. If not, `query_validation_errors` will include the parse error.
typeboolean
typeobject
ListDataAccessLabelsResponse
descriptionResponse message for ListDataAccessLabels.
idListDataAccessLabelsResponse
properties
dataAccessLabels
descriptionList of data access labels.
items
$refDataAccessLabel
typearray
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
typeobject
ListDataAccessScopesResponse
descriptionResponse message for ListDataAccessScopes.
idListDataAccessScopesResponse
properties
dataAccessScopes
descriptionList of data access scopes.
items
$refDataAccessScope
typearray
globalDataAccessScopeGranted
descriptionWhether or not global scope is granted to the user.
typeboolean
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
typeobject
ListOperationsResponse
descriptionThe response message for Operations.ListOperations.
idListOperationsResponse
properties
nextPageToken
descriptionThe standard List next-page token.
typestring
operations
descriptionA list of operations that matches the specified filter in the request.
items
$refOperation
typearray
typeobject
ListReferenceListsResponse
descriptionA response to a request for a list of reference lists.
idListReferenceListsResponse
properties
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
referenceLists
descriptionThe reference lists. Ordered in ascending alphabetical order by name.
items
$refReferenceList
typearray
typeobject
ListRetrohuntsResponse
descriptionResponse message for ListRetrohunts method.
idListRetrohuntsResponse
properties
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
retrohunts
descriptionThe retrohunts from the specified rule.
items
$refRetrohunt
typearray
typeobject
ListRuleDeploymentsResponse
descriptionResponse message for ListRuleDeployments.
idListRuleDeploymentsResponse
properties
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
ruleDeployments
descriptionThe rule deployments from all rules.
items
$refRuleDeployment
typearray
typeobject
ListRuleRevisionsResponse
descriptionResponse message for ListRuleRevisions method.
idListRuleRevisionsResponse
properties
nextPageToken
descriptionA token that can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
rules
descriptionThe revisions of the rule.
items
$refRule
typearray
typeobject
ListRulesResponse
descriptionResponse message for ListRules method.
idListRulesResponse
properties
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
rules
descriptionThe rules from the specified instance.
items
$refRule
typearray
typeobject
ListWatchlistsResponse
descriptionResponse message for listing watchlists.
idListWatchlistsResponse
properties
nextPageToken
descriptionOptional. A token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
watchlists
descriptionOptional. The watchlists from the specified instance.
items
$refWatchlist
typearray
typeobject
Location
descriptionInformation about a location.
idLocation
properties
city
descriptionThe city.
typestring
countryOrRegion
descriptionThe country or region.
typestring
deskName
descriptionDesk name or individual location, typically for an employee in an office. (e.g. "IN-BLR-BCPC-11-1121D").
typestring
floorName
descriptionFloor name, number or a combination of the two for a building. (e.g. "1-A").
typestring
name
descriptionCustom location name (e.g. building or site name like "London Office"). For cloud environments, this is the region (e.g. "us-west2").
typestring
regionCoordinates
$refLatLng
descriptionCoordinates for the associated region. See https://cloud.google.com/vision/docs/reference/rest/v1/LatLng for a description of the fields.
regionLatitude
deprecatedTrue
descriptionDeprecated: use region_coordinates.
formatfloat
typenumber
regionLongitude
deprecatedTrue
descriptionDeprecated: use region_coordinates.
formatfloat
typenumber
state
descriptionThe state.
typestring
typeobject
Manual
descriptionEntities are added manually.
idManual
properties
typeobject
Measure
descriptionDescribes the precomputed measure.
idMeasure
properties
aggregateFunction
descriptionFunction used to calculate the aggregated measure.
enum
  • AGGREGATE_FUNCTION_UNSPECIFIED
  • MIN
  • MAX
  • COUNT
  • SUM
  • AVG
  • STDDEV
enumDescriptions
  • Default value.
  • Minimum.
  • Maximum.
  • Count.
  • Sum.
  • Average.
  • Standard Deviation.
typestring
value
descriptionValue of the aggregated measure.
formatdouble
typenumber
typeobject
Metadata
descriptionGeneral information associated with a UDM event.
idMetadata
properties
baseLabels
$refDataAccessLabels
descriptionData access labels on the base event.
collectedTimestamp
descriptionThe GMT timestamp when the event was collected by the vendor's local collection infrastructure.
formatgoogle-datetime
typestring
description
descriptionA human-readable unparsable description of the event.
typestring
enrichmentLabels
$refDataAccessLabels
descriptionData access labels from all the contextual events used to enrich the base event.
enrichmentState
descriptionThe enrichment state.
enum
  • ENRICHMENT_STATE_UNSPECIFIED
  • ENRICHED
  • UNENRICHED
enumDescriptions
  • Unspecified.
  • The event has been enriched by Chronicle.
  • The event has not been enriched by Chronicle.
typestring
eventTimestamp
descriptionThe GMT timestamp when the event was generated.
formatgoogle-datetime
typestring
eventType
descriptionThe event type. If an event has multiple possible types, this specifies the most specific type.
enum
  • EVENTTYPE_UNSPECIFIED
  • PROCESS_UNCATEGORIZED
  • PROCESS_LAUNCH
  • PROCESS_INJECTION
  • PROCESS_PRIVILEGE_ESCALATION
  • PROCESS_TERMINATION
  • PROCESS_OPEN
  • PROCESS_MODULE_LOAD
  • REGISTRY_UNCATEGORIZED
  • REGISTRY_CREATION
  • REGISTRY_MODIFICATION
  • REGISTRY_DELETION
  • SETTING_UNCATEGORIZED
  • SETTING_CREATION
  • SETTING_MODIFICATION
  • SETTING_DELETION
  • MUTEX_UNCATEGORIZED
  • MUTEX_CREATION
  • FILE_UNCATEGORIZED
  • FILE_CREATION
  • FILE_DELETION
  • FILE_MODIFICATION
  • FILE_READ
  • FILE_COPY
  • FILE_OPEN
  • FILE_MOVE
  • FILE_SYNC
  • USER_UNCATEGORIZED
  • USER_LOGIN
  • USER_LOGOUT
  • USER_CREATION
  • USER_CHANGE_PASSWORD
  • USER_CHANGE_PERMISSIONS
  • USER_STATS
  • USER_BADGE_IN
  • USER_DELETION
  • USER_RESOURCE_CREATION
  • USER_RESOURCE_UPDATE_CONTENT
  • USER_RESOURCE_UPDATE_PERMISSIONS
  • USER_COMMUNICATION
  • USER_RESOURCE_ACCESS
  • USER_RESOURCE_DELETION
  • GROUP_UNCATEGORIZED
  • GROUP_CREATION
  • GROUP_DELETION
  • GROUP_MODIFICATION
  • EMAIL_UNCATEGORIZED
  • EMAIL_TRANSACTION
  • EMAIL_URL_CLICK
  • NETWORK_UNCATEGORIZED
  • NETWORK_FLOW
  • NETWORK_CONNECTION
  • NETWORK_FTP
  • NETWORK_DHCP
  • NETWORK_DNS
  • NETWORK_HTTP
  • NETWORK_SMTP
  • STATUS_UNCATEGORIZED
  • STATUS_HEARTBEAT
  • STATUS_STARTUP
  • STATUS_SHUTDOWN
  • STATUS_UPDATE
  • SCAN_UNCATEGORIZED
  • SCAN_FILE
  • SCAN_PROCESS_BEHAVIORS
  • SCAN_PROCESS
  • SCAN_HOST
  • SCAN_VULN_HOST
  • SCAN_VULN_NETWORK
  • SCAN_NETWORK
  • SCHEDULED_TASK_UNCATEGORIZED
  • SCHEDULED_TASK_CREATION
  • SCHEDULED_TASK_DELETION
  • SCHEDULED_TASK_ENABLE
  • SCHEDULED_TASK_DISABLE
  • SCHEDULED_TASK_MODIFICATION
  • SYSTEM_AUDIT_LOG_UNCATEGORIZED
  • SYSTEM_AUDIT_LOG_WIPE
  • SERVICE_UNSPECIFIED
  • SERVICE_CREATION
  • SERVICE_DELETION
  • SERVICE_START
  • SERVICE_STOP
  • SERVICE_MODIFICATION
  • GENERIC_EVENT
  • RESOURCE_CREATION
  • RESOURCE_DELETION
  • RESOURCE_PERMISSIONS_CHANGE
  • RESOURCE_READ
  • RESOURCE_WRITTEN
  • DEVICE_FIRMWARE_UPDATE
  • DEVICE_CONFIG_UPDATE
  • DEVICE_PROGRAM_UPLOAD
  • DEVICE_PROGRAM_DOWNLOAD
  • ANALYST_UPDATE_VERDICT
  • ANALYST_UPDATE_REPUTATION
  • ANALYST_UPDATE_SEVERITY_SCORE
  • ANALYST_UPDATE_STATUS
  • ANALYST_ADD_COMMENT
  • ANALYST_UPDATE_PRIORITY
  • ANALYST_UPDATE_ROOT_CAUSE
  • ANALYST_UPDATE_REASON
  • ANALYST_UPDATE_RISK_SCORE
  • ENTITY_RISK_CHANGE
enumDeprecated
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • True
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • True
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • True
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
enumDescriptions
  • Default event type
  • Activity related to a process which does not match any other event types.
  • Process launch.
  • Process injecting into another process.
  • Process privilege escalation.
  • Process termination.
  • Process being opened.
  • Process loading a module.
  • Registry event which does not match any of the other event types.
  • Registry creation.
  • Registry modification.
  • Registry deletion.
  • Settings-related event which does not match any of the other event types.
  • Setting creation.
  • Setting modification.
  • Setting deletion.
  • Any mutex event other than creation.
  • Mutex creation.
  • File event which does not match any of the other event types.
  • File created.
  • File deleted.
  • File modified.
  • File read.
  • File copied. Used for file copies, for example, to a thumb drive.
  • File opened.
  • File moved or renamed.
  • File synced (for example, Google Drive, Dropbox, backup).
  • User activity which does not match any of the other event types.
  • User login.
  • User logout.
  • User creation.
  • User password change event.
  • Change in user permissions.
  • Deprecated. Used to update user info for an LDAP dump.
  • User physically badging into a location.
  • User deletion.
  • User creating a virtual resource. This is equivalent to RESOURCE_CREATION.
  • User updating content of a virtual resource. This is equivalent to RESOURCE_WRITTEN.
  • User updating permissions of a virtual resource. This is equivalent to RESOURCE_PERMISSIONS_CHANGE.
  • User initiating communication through a medium (for example, video).
  • User accessing a virtual resource. This is equivalent to RESOURCE_READ.
  • User deleting a virtual resource. This is equivalent to RESOURCE_DELETION.
  • A group activity that does not fall into one of the other event types.
  • A group creation.
  • A group deletion.
  • A group modification.
  • Email messages
  • An email transaction.
  • Deprecated: use NETWORK_HTTP instead. An email URL click event.
  • A network event that does not fit into one of the other event types.
  • Aggregated flow stats like netflow.
  • Network connection details like from a FW.
  • FTP telemetry.
  • DHCP payload.
  • DNS payload.
  • HTTP telemetry.
  • SMTP telemetry.
  • A status message that does not fit into one of the other event types.
  • Heartbeat indicating product is alive.
  • An agent startup.
  • An agent shutdown.
  • A software or fingerprint update.
  • Scan item that does not fit into one of the other event types.
  • A file scan.
  • Scan process behaviors. Please use SCAN_PROCESS instead.
  • Scan process.
  • Scan results from scanning an entire host device for threats/sensitive documents.
  • Vulnerability scan logs about host vulnerabilities (e.g., out of date software) and network vulnerabilities (e.g., unprotected service detected via a network scan).
  • Vulnerability scan logs about network vulnerabilities.
  • Scan network for suspicious activity
  • Scheduled task event that does not fall into one of the other event types.
  • Scheduled task creation.
  • Scheduled task deletion.
  • Scheduled task being enabled.
  • Scheduled task being disabled.
  • Scheduled task being modified.
  • A system audit log event that is not a wipe.
  • A system audit log wipe.
  • Service event that does not fit into one of the other event types.
  • A service creation.
  • A service deletion.
  • A service start.
  • A service stop.
  • A service modification.
  • Operating system events that are not described by any of the other event types. Might include uncategorized Microsoft Windows event logs.
  • The resource was created/provisioned. This is equivalent to USER_RESOURCE_CREATION.
  • The resource was deleted/deprovisioned. This is equivalent to USER_RESOURCE_DELETION.
  • The resource had it's permissions or ACLs updated. This is equivalent to USER_RESOURCE_UPDATE_PERMISSIONS.
  • The resource was read. This is equivalent to USER_RESOURCE_ACCESS.
  • The resource was written to. This is equivalent to USER_RESOURCE_UPDATE_CONTENT.
  • Firmware update.
  • Configuration update.
  • A program or application uploaded to a device.
  • A program or application downloaded to a device.
  • Analyst update about the Verdict (such as true positive, false positive, or disregard) of a finding.
  • Analyst update about the Reputation (such as useful or not useful) of a finding.
  • Analyst update about the Severity score (0-100) of a finding.
  • Analyst update about the finding status.
  • Analyst addition of a comment for a finding.
  • Analyst update about the priority (such as low, medium, or high) for a finding.
  • Analyst update about the root cause for a finding.
  • Analyst update about the reason (such as malicious or not malicious) for a finding.
  • Analyst update about the risk score (0-100) of a finding.
  • An update to an entity risk score. This event type is restricted to events published by Google Securit Operations Risk Analytics.
typestring
id
descriptionID of the UDM event. Can be used for raw and normalized event retrieval.
formatbyte
typestring
ingestedTimestamp
descriptionThe GMT timestamp when the event was ingested (received) by Chronicle.
formatgoogle-datetime
typestring
ingestionLabels
descriptionUser-configured ingestion metadata labels.
items
$refLabel
typearray
logType
descriptionThe string value of log type.
typestring
productDeploymentId
descriptionThe deployment identifier assigned by the vendor for a product deployment.
typestring
productEventType
descriptionA short, descriptive, human-readable, product-specific event name or type (e.g. "Scanned X", "User account created", "process_start").
typestring
productLogId
descriptionA vendor-specific event identifier to uniquely identify the event (e.g. a GUID).
typestring
productName
descriptionThe name of the product.
typestring
productVersion
descriptionThe version of the product.
typestring
structuredFields
additionalProperties
descriptionProperties of the object.
typeany
deprecatedTrue
descriptionFlattened fields extracted from the log.
typeobject
tags
$refTags
descriptionTags added by Chronicle after an event is parsed. It is an error to populate this field from within a parser.
urlBackToProduct
descriptionA URL that takes the user to the source product console for this event.
typestring
vendorName
descriptionThe name of the product vendor.
typestring
typeobject
Metric
descriptionStores precomputed aggregated analytic data for an entity.
idMetric
properties
dimensions
descriptionAll group by clauses used to calculate the metric.
items
enum
  • DIMENSION_UNSPECIFIED
  • PRINCIPAL_DEVICE
  • TARGET_USER
  • TARGET_DEVICE
  • PRINCIPAL_USER
  • TARGET_IP
  • PRINCIPAL_FILE_HASH
  • PRINCIPAL_COUNTRY
  • SECURITY_CATEGORY
  • NETWORK_ASN
  • CLIENT_CERTIFICATE_HASH
  • DNS_QUERY_TYPE
  • DNS_DOMAIN
  • HTTP_USER_AGENT
  • EVENT_TYPE
  • PRODUCT_NAME
  • PRODUCT_EVENT_TYPE
  • PARENT_FOLDER_PATH
  • TARGET_RESOURCE_NAME
  • PRINCIPAL_APPLICATION
  • TARGET_APPLICATION
  • EMAIL_TO_ADDRESS
  • EMAIL_FROM_ADDRESS
  • MAIL_ID
  • PRINCIPAL_IP
  • SECURITY_ACTION
  • SECURITY_RULE_ID
  • TARGET_NETWORK_ORGANIZATION_NAME
  • PRINCIPAL_NETWORK_ORGANIZATION_NAME
  • PRINCIPAL_PROCESS_FILE_PATH
  • PRINCIPAL_PROCESS_FILE_HASH
  • SECURITY_RESULT_RULE_NAME
  • TARGET_RESOURCE_LABEL_KEY
  • VENDOR_NAME
  • TARGET_RESOURCE_TYPE
  • TARGET_LOCATION_NAME
enumDescriptions
  • Default
  • Principal Device
  • Target User
  • Target Device
  • Principal User
  • Target IP
  • Principal File Hash
  • Principal Country
  • Security Category
  • Network ASN
  • Client Certificate Hash
  • DNS Query Type
  • DNS Domain
  • HTTP User Agent
  • Event Type
  • Product Name
  • Product Event Type
  • Parent Folder Path
  • Target resource Name
  • Principal Application.
  • Target Application.
  • Email To Address.
  • Email From Address.
  • Mail Id.
  • Principal IP.
  • Security Action.
  • Security Rule Id.
  • Target Network Organization name.
  • Principal Network Organization name.
  • Principal Process File Path.
  • Principal Process File SHA256 Hash.
  • Security Result rule name.
  • Target Resource label key.
  • Vendor name.
  • Target Resource type.
  • Target Location name.
typestring
typearray
exportWindow
descriptionExport window for which the metric was exported.
formatint64
typestring
firstSeen
descriptionTimestamp of the first time the entity was seen in the environment.
formatgoogle-datetime
typestring
lastSeen
descriptionTime stamp of the last time last time the entity was seen in the environment.
formatgoogle-datetime
typestring
metricName
descriptionName of the analytic.
enum
  • METRIC_NAME_UNSPECIFIED
  • NETWORK_BYTES_INBOUND
  • NETWORK_BYTES_OUTBOUND
  • NETWORK_BYTES_TOTAL
  • AUTH_ATTEMPTS_SUCCESS
  • AUTH_ATTEMPTS_FAIL
  • AUTH_ATTEMPTS_TOTAL
  • DNS_BYTES_OUTBOUND
  • NETWORK_FLOWS_INBOUND
  • NETWORK_FLOWS_OUTBOUND
  • NETWORK_FLOWS_TOTAL
  • DNS_QUERIES_SUCCESS
  • DNS_QUERIES_FAIL
  • DNS_QUERIES_TOTAL
  • FILE_EXECUTIONS_SUCCESS
  • FILE_EXECUTIONS_FAIL
  • FILE_EXECUTIONS_TOTAL
  • HTTP_QUERIES_SUCCESS
  • HTTP_QUERIES_FAIL
  • HTTP_QUERIES_TOTAL
  • WORKSPACE_EMAILS_SENT_TOTAL
  • WORKSPACE_TOTAL_DOWNLOAD_ACTIONS
  • WORKSPACE_TOTAL_CHANGE_ACTIONS
  • WORKSPACE_AUTH_ATTEMPTS_TOTAL
  • WORKSPACE_NETWORK_BYTES_OUTBOUND
  • WORKSPACE_NETWORK_BYTES_TOTAL
  • ALERT_EVENT_NAME_COUNT
  • RESOURCE_CREATION_TOTAL
  • RESOURCE_CREATION_SUCCESS
  • RESOURCE_READ_SUCCESS
  • RESOURCE_READ_FAIL
  • RESOURCE_DELETION_SUCCESS
enumDescriptions
  • Default
  • Total received network bytes.
  • Total network sent bytes.
  • Total network sent bytes and received bytes.
  • Successful authentication attempts.
  • Failed authentication attempts.
  • Total authentication attempts.
  • Total number of sent bytes for DNS events.
  • Total number of events having non-null received bytes.
  • Total number of events having non-null sent bytes.
  • Total events having non-null sent or received bytes.
  • DNS query success count - Number of events with response_code = 0.
  • Number of events with response_code != 0.
  • Total number of DNS queries made.
  • Number of successfule file executions.
  • Number of failed file executions.
  • Total number file executions.
  • Number of successful HTTP queries.
  • Number of failed HTTP queries.
  • Total number of HTTP queries.
  • Total number of emails sent in Google Workspace.
  • Total number of download actions in Google Workspace.
  • Total number of change actions in Google Workspace.
  • Total number of authentication attempts in Google Workspace.
  • Number of outbound network bytes (total sent) in Google Workspace.
  • Total number of network bytes (both sent and received) in Google Workspace.
  • Track number of alerts fired by EDR/SENTINEL/MICROSOFT_GRAPH.
  • First-time analytic tracking successful resource creations.
  • Volume-based analytic tracking successful resource creations.
  • Volume-based analytic tracking successful resource reads.
  • Volume-based analytic tracking failed resource reads.
  • Volume-based analytic tracking successful resource deletions.
typestring
sumMeasure
$refMeasure
descriptionSum of all precomputed measures for the given metric.
totalEvents
descriptionTotal number of events used to calculate the given precomputed metric.
formatint64
typestring
typeobject
Navigation
descriptionNavigation can be used to store the metadata required to navigate the user to a new URL.
idNavigation
properties
targetUri
descriptionOutput only. The URI to redirect the user to.
readOnlyTrue
typestring
typeobject
Network
descriptionA network event.
idNetwork
properties
applicationProtocol
descriptionThe application protocol.
enum
  • UNKNOWN_APPLICATION_PROTOCOL
  • AFP
  • APPC
  • AMQP
  • ATOM
  • BEEP
  • BITCOIN
  • BIT_TORRENT
  • CFDP
  • CIP
  • COAP
  • COTP
  • DCERPC
  • DDS
  • DEVICE_NET
  • DHCP
  • DICOM
  • DNP3
  • DNS
  • E_DONKEY
  • ENRP
  • FAST_TRACK
  • FINGER
  • FREENET
  • FTAM
  • GOOSE
  • GOPHER
  • GRPC
  • HL7
  • H323
  • HTTP
  • HTTPS
  • IEC104
  • IRCP
  • KADEMLIA
  • KRB5
  • LDAP
  • LPD
  • MIME
  • MMS
  • MODBUS
  • MQTT
  • NETCONF
  • NFS
  • NIS
  • NNTP
  • NTCIP
  • NTP
  • OSCAR
  • PNRP
  • PTP
  • QUIC
  • RDP
  • RELP
  • RIP
  • RLOGIN
  • RPC
  • RTMP
  • RTP
  • RTPS
  • RTSP
  • SAP
  • SDP
  • SIP
  • SLP
  • SMB
  • SMTP
  • SNMP
  • SNTP
  • SSH
  • SSMS
  • STYX
  • SV
  • TCAP
  • TDS
  • TOR
  • TSP
  • VTP
  • WHOIS
  • WEB_DAV
  • X400
  • X500
  • XMPP
enumDescriptions
  • The default application protocol.
  • Apple Filing Protocol.
  • Advanced Program-to-Program Communication.
  • Advanced Message Queuing Protocol.
  • Publishing Protocol.
  • Block Extensible Exchange Protocol.
  • Crypto currency protocol.
  • Peer-to-peer file sharing.
  • Coherent File Distribution Protocol.
  • Common Industrial Protocol.
  • Constrained Application Protocol.
  • Connection Oriented Transport Protocol.
  • DCE/RPC.
  • Data Distribution Service.
  • Automation industry protocol.
  • DHCP.
  • Digital Imaging and Communications in Medicine Protocol.
  • Distributed Network Protocol 3 (DNP3)
  • DNS.
  • Classic file sharing protocol.
  • Endpoint Handlespace Redundancy Protocol.
  • Filesharing peer-to-peer protocol.
  • User Information Protocol.
  • Censorship resistant peer-to-peer network.
  • File Transfer Access and Management.
  • GOOSE Protocol.
  • Gopher protocol.
  • gRPC Remote Procedure Call.
  • Health Level Seven.
  • Packet-based multimedia communications system.
  • HTTP.
  • HTTPS.
  • IEC 60870-5-104 (IEC 104) Protocol.
  • Internet Relay Chat Protocol.
  • Peer-to-peer hashtables.
  • Kerberos 5.
  • Lightweight Directory Access Protocol.
  • Line Printer Daemon Protocol.
  • Multipurpose Internet Mail Extensions and Secure MIME.
  • Multimedia Messaging Service.
  • Serial communications protocol.
  • Message Queuing Telemetry Transport.
  • Network Configuration.
  • Network File System.
  • Network Information Service.
  • Network News Transfer Protocol.
  • National Transportation Communications for Intelligent Transportation System.
  • Network Time Protocol.
  • AOL Instant Messenger Protocol.
  • Peer Name Resolution Protocol.
  • Precision Time Protocol.
  • QUIC.
  • Remote Desktop Protocol.
  • Reliable Event Logging Protocol.
  • Routing Information Protocol.
  • Remote Login in UNIX Systems.
  • Remote Procedure Call.
  • Real Time Messaging Protocol.
  • Real-time Transport Protocol.
  • Real Time Publish Subscribe.
  • Real Time Streaming Protocol.
  • Session Announcement Protocol.
  • Session Description Protocol.
  • Session Initiation Protocol.
  • Service Location Protocol.
  • Server Message Block.
  • Simple Mail Transfer Protocol.
  • Simple Network Management Protocol.
  • Simple Network Time Protocol.
  • Secure Shell.
  • Secure SMS Messaging Protocol.
  • Styx/9P - Plan 9 from Bell Labs distributed file system protocol.
  • Sampled Values Protocol.
  • Transaction Capabilities Application Part.
  • Tabular Data Stream.
  • Anonymity network.
  • Time Stamp Protocol.
  • Virtual Terminal Protocol.
  • Remote Directory Access Protocol.
  • Web Distributed Authoring and Versioning.
  • Message Handling Service Protocol.
  • Directory Access Protocol (DAP).
  • Extensible Messaging and Presence Protocol.
typestring
applicationProtocolVersion
descriptionThe version of the application protocol. e.g. "1.1, 2.0"
typestring
asn
descriptionAutonomous system number.
typestring
carrierName
descriptionCarrier identification.
typestring
communityId
descriptionCommunity ID network flow value.
typestring
dhcp
$refDhcp
descriptionDHCP info.
direction
descriptionThe direction of network traffic.
enum
  • UNKNOWN_DIRECTION
  • INBOUND
  • OUTBOUND
  • BROADCAST
enumDescriptions
  • The default direction.
  • An inbound request.
  • An outbound request.
  • A broadcast.
typestring
dns
$refDns
descriptionDNS info.
dnsDomain
descriptionDNS domain name.
typestring
email
$refEmail
descriptionEmail info for the sender/recipient.
ftp
$refFtp
descriptionFTP info.
http
$refHttp
descriptionHTTP info.
ipProtocol
descriptionThe IP protocol.
enum
  • UNKNOWN_IP_PROTOCOL
  • ICMP
  • IGMP
  • TCP
  • UDP
  • IP6IN4
  • GRE
  • ESP
  • ICMP6
  • EIGRP
  • ETHERIP
  • PIM
  • VRRP
  • SCTP
enumDescriptions
  • The default protocol.
  • ICMP.
  • IGMP
  • TCP.
  • UDP.
  • IPv6 Encapsulation
  • Generic Routing Encapsulation
  • Encapsulating Security Payload
  • ICMPv6
  • Enhanced Interior Gateway Routing
  • Ethernet-within-IP Encapsulation
  • Protocol Independent Multicast
  • Virtual Router Redundancy Protocol
  • Stream Control Transmission Protocol
typestring
ipSubnetRange
descriptionAssociated human-readable IP subnet range (e.g. 10.1.2.0/24).
typestring
organizationName
descriptionOrganization name (e.g Google).
typestring
parentSessionId
descriptionThe ID of the parent network session.
typestring
receivedBytes
descriptionThe number of bytes received.
formatuint64
typestring
receivedPackets
descriptionThe number of packets received.
formatint64
typestring
sentBytes
descriptionThe number of bytes sent.
formatuint64
typestring
sentPackets
descriptionThe number of packets sent.
formatint64
typestring
sessionDuration
descriptionThe duration of the session as the number of seconds and nanoseconds. For seconds, network.session_duration.seconds, the type is a 64-bit integer. For nanoseconds, network.session_duration.nanos, the type is a 32-bit integer.
formatgoogle-duration
typestring
sessionId
descriptionThe ID of the network session.
typestring
smtp
$refSmtp
descriptionSMTP info. Store fields specific to SMTP not covered by Email.
tls
$refTls
descriptionTLS info.
typeobject
Noun
descriptionThe Noun type is used to represent the different entities in an event: principal, src, target, observer, intermediary, and about. It stores attributes known about the entity. For example, if the entity is a device with multiple IP or MAC addresses, it stores the IP and MAC addresses that are relevant to the event.
idNoun
properties
administrativeDomain
descriptionDomain which the device belongs to (for example, the Microsoft Windows domain).
typestring
application
descriptionThe name of an application or service. Some SSO solutions only capture the name of a target application such as "Atlassian" or "Chronicle".
typestring
artifact
$refArtifact
descriptionInformation about an artifact.
asset
$refAsset
descriptionInformation about the asset.
assetId
descriptionThe asset ID. This field can be used as an entity indicator for asset entities.
typestring
cloud
$refCloud
deprecatedTrue
descriptionCloud metadata. Deprecated: cloud should be populated in entity Attribute as generic metadata (e.g. asset.attribute.cloud).
domain
$refDomain
descriptionInformation about the domain.
email
descriptionEmail address. Only filled in for security_result.about
typestring
file
$refBackstoryFile
descriptionInformation about the file.
group
$refGroup
descriptionInformation about the group.
hostname
descriptionClient hostname or domain name field. Hostname also doubles as the domain for remote entities. This field can be used as an entity indicator for asset entities.
typestring
investigation
$refInvestigation
descriptionAnalyst feedback/investigation for alerts.
ip
descriptionA list of IP addresses associated with a network connection. This field can be used as an entity indicator for asset entities.
items
typestring
typearray
ipGeoArtifact
descriptionEnriched geographic information corresponding to an IP address. Specifically, location and network data.
items
$refArtifact
typearray
ipLocation
deprecatedTrue
descriptionDeprecated: use ip_geo_artifact.location instead.
items
$refLocation
typearray
labels
deprecatedTrue
descriptionLabels are key-value pairs. For example: key = "env", value = "prod". Deprecated: labels should be populated in entity Attribute as generic metadata (e.g. user.attribute.labels).
items
$refLabel
typearray
location
$refLocation
descriptionPhysical location. For cloud environments, set the region in location.name.
mac
descriptionList of MAC addresses associated with a device. This field can be used as an entity indicator for asset entities.
items
typestring
typearray
namespace
descriptionNamespace which the device belongs to, such as "AD forest". Uses for this field include Microsoft Windows AD forest, the name of subsidiary, or the name of acquisition. This field can be used along with an asset indicator to identify an asset.
typestring
natIp
descriptionA list of NAT translated IP addresses associated with a network connection.
items
typestring
typearray
natPort
descriptionNAT external network port number when a specific network connection is described within an event.
formatint32
typeinteger
network
$refNetwork
descriptionNetwork details, including sub-messages with details on each protocol (for example, DHCP, DNS, or HTTP).
objectReference
$refId
descriptionFinding to which the Analyst updated the feedback.
platform
descriptionPlatform.
enum
  • UNKNOWN_PLATFORM
  • WINDOWS
  • MAC
  • LINUX
  • GCP
  • AWS
  • AZURE
  • IOS
  • ANDROID
  • CHROME_OS
enumDeprecated
  • False
  • False
  • False
  • False
  • True
  • True
  • True
  • False
  • False
  • False
enumDescriptions
  • Default value.
  • Microsoft Windows.
  • macOS.
  • Linux.
  • Deprecated: see cloud.environment.
  • Deprecated: see cloud.environment.
  • Deprecated: see cloud.environment.
  • IOS
  • Android
  • Chrome OS
typestring
platformPatchLevel
descriptionPlatform patch level. For example, "Build 17134.48"
typestring
platformVersion
descriptionPlatform version. For example, "Microsoft Windows 1803".
typestring
port
descriptionSource or destination network port number when a specific network connection is described within an event.
formatint32
typeinteger
process
$refProcess
descriptionInformation about the process.
processAncestors
descriptionInformation about the process's ancestors ordered from immediate ancestor (parent process) to root. Note: process_ancestors is only populated when data is exported to BigQuery since recursive fields (e.g. process.parent_process) are not supported by BigQuery.
items
$refProcess
typearray
registry
$refRegistry
descriptionRegistry information.
resource
$refResource
descriptionInformation about the resource (e.g. scheduled task, calendar entry). This field should not be used for files, registry, or processes because these objects are already part of Noun.
resourceAncestors
descriptionInformation about the resource's ancestors ordered from immediate ancestor (starting with parent resource).
items
$refResource
typearray
securityResult
descriptionA list of security results.
items
$refSecurityResult
typearray
url
descriptionThe URL.
typestring
urlMetadata
$refUrl
descriptionInformation about the URL.
user
$refUser
descriptionInformation about the user.
userManagementChain
descriptionInformation about the user's management chain (reporting hierarchy). Note: user_management_chain is only populated when data is exported to BigQuery since recursive fields (e.g. user.managers) are not supported by BigQuery.
items
$refUser
typearray
typeobject
NtfsFileMetadata
descriptionNTFS-specific file metadata.
idNtfsFileMetadata
properties
changeTime
descriptionNTFS MFT entry changed timestamp.
formatgoogle-datetime
typestring
filenameAccessTime
descriptionNTFS $FILE_NAME attribute accessed timestamp.
formatgoogle-datetime
typestring
filenameChangeTime
descriptionNTFS $FILE_NAME attribute changed timestamp.
formatgoogle-datetime
typestring
filenameCreateTime
descriptionNTFS $FILE_NAME attribute created timestamp.
formatgoogle-datetime
typestring
filenameModifyTime
descriptionNTFS $FILE_NAME attribute modified timestamp.
formatgoogle-datetime
typestring
typeobject
Operation
descriptionThis resource represents a long-running operation that is the result of a network API call.
idOperation
properties
done
descriptionIf the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available.
typeboolean
error
$refStatus
descriptionThe error result of the operation in case of failure or cancellation.
metadata
additionalProperties
descriptionProperties of the object. Contains field @type with type URL.
typeany
descriptionService-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any.
typeobject
name
descriptionThe server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`.
typestring
response
additionalProperties
descriptionProperties of the object. Contains field @type with type URL.
typeany
descriptionThe normal, successful response of the operation. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`.
typeobject
typeobject
Option
descriptionDHCP options.
idOption
properties
code
descriptionCode. See RFC1533.
formatuint32
typeinteger
data
descriptionData.
formatbyte
typestring
typeobject
PDFInfo
descriptionInformation about the PDF file structure. See https://developers.virustotal.com/reference/pdf_info
idPDFInfo
properties
acroform
descriptionNumber of /AcroForm tags found in the PDF.
formatint64
typestring
autoaction
descriptionNumber of /AA tags found in the PDF.
formatint64
typestring
embeddedFile
descriptionNumber of /EmbeddedFile tags found in the PDF.
formatint64
typestring
encrypted
descriptionWhether the document is encrypted or not. This is defined by the /Encrypt tag.
formatint64
typestring
endobjCount
descriptionNumber of object definitions (endobj keyword).
formatint64
typestring
endstreamCount
descriptionNumber of defined stream objects (stream keyword).
formatint64
typestring
flash
descriptionNumber of /RichMedia tags found in the PDF.
formatint64
typestring
header
descriptionPDF version.
typestring
javascript
descriptionNumber of /JavaScript tags found in the PDF file. Should be the same as the js field in normal scenarios.
formatint64
typestring
jbig2Compression
descriptionNumber of /JBIG2Decode tags found in the PDF.
formatint64
typestring
js
descriptionNumber of /JS tags found in the PDF file. Should be the same as javascript field in normal scenarios.
formatint64
typestring
launchActionCount
descriptionNumber of /Launch tags found in the PDF file.
formatint64
typestring
objCount
descriptionNumber of objects definitions (obj keyword).
formatint64
typestring
objectStreamCount
descriptionNumber of object streams.
formatint64
typestring
openaction
descriptionNumber of /OpenAction tags found in the PDF.
formatint64
typestring
pageCount
descriptionNumber of pages in the PDF.
formatint64
typestring
startxref
descriptionNumber of startxref keywords in the PDF.
formatint64
typestring
streamCount
descriptionNumber of defined stream objects (stream keyword).
formatint64
typestring
suspiciousColors
descriptionNumber of colors expressed with more than 3 bytes (CVE-2009-3459).
formatint64
typestring
trailer
descriptionNumber of trailer keywords in the PDF.
formatint64
typestring
xfa
descriptionNumber of \XFA tags found in the PDF.
formatint64
typestring
xref
descriptionNumber of xref keywords in the PDF.
formatint64
typestring
typeobject
PeFileMetadata
descriptionMetadata about a Microsoft Windows Portable Executable.
idPeFileMetadata
properties
importHash
descriptionHash of PE imports.
typestring
typeobject
Permission
descriptionSystem permission for resource access and modification.
idPermission
properties
description
descriptionDescription of the permission (e.g. 'Ability to update detect rules').
typestring
name
descriptionName of the permission (e.g. chronicle.analyst.updateRule).
typestring
type
descriptionType of the permission.
enum
  • UNKNOWN_PERMISSION_TYPE
  • ADMIN_WRITE
  • ADMIN_READ
  • DATA_WRITE
  • DATA_READ
enumDescriptions
  • Default permission type.
  • Administrator write permission.
  • Administrator read permission.
  • Data resource access write permission.
  • Data resource access read permission.
typestring
typeobject
PlatformSoftware
descriptionPlatform software information about an operating system.
idPlatformSoftware
properties
platform
descriptionThe platform operating system.
enum
  • UNKNOWN_PLATFORM
  • WINDOWS
  • MAC
  • LINUX
  • GCP
  • AWS
  • AZURE
  • IOS
  • ANDROID
  • CHROME_OS
enumDeprecated
  • False
  • False
  • False
  • False
  • True
  • True
  • True
  • False
  • False
  • False
enumDescriptions
  • Default value.
  • Microsoft Windows.
  • macOS.
  • Linux.
  • Deprecated: see cloud.environment.
  • Deprecated: see cloud.environment.
  • Deprecated: see cloud.environment.
  • IOS
  • Android
  • Chrome OS
typestring
platformPatchLevel
descriptionThe platform software patch level ( e.g. "Build 17134.48", "SP1").
typestring
platformVersion
descriptionThe platform software version ( e.g. "Microsoft Windows 1803").
typestring
typeobject
PopularityRank
descriptionDomain's position in popularity ranks for sources such as Alexa, Quantcast, or Statvoo.
idPopularityRank
properties
giver
descriptionName of the rank serial number hexdump.
typestring
ingestionTime
descriptionTimestamp when the rank was ingested.
formatgoogle-datetime
typestring
rank
descriptionRank position.
formatint64
typestring
typeobject
Prevalence
descriptionThe prevalence of a resource within the customer's environment. This measures how common it is for assets to access the resource.
idPrevalence
properties
dayCount
descriptionThe number of days over which rolling_max is calculated.
formatint32
typeinteger
dayMax
descriptionThe max prevalence score in a day interval window.
formatint32
typeinteger
dayMaxSubDomains
descriptionThe max prevalence score in a day interval window across sub-domains. This field is only valid for domains.
formatint32
typeinteger
rollingMax
descriptionThe maximum number of assets per day accessing the resource over the trailing day_count days.
formatint32
typeinteger
rollingMaxSubDomains
descriptionThe maximum number of assets per day accessing the domain along with sub-domains over the trailing day_count days. This field is only valid for domains.
formatint32
typeinteger
typeobject
Process
descriptionInformation about a process.
idProcess
properties
accessMask
descriptionA bit mask representing the level of access.
formatuint64
typestring
commandLine
descriptionThe command line command that created the process. This field can be used as an entity indicator for process entities.
typestring
commandLineHistory
descriptionThe command line history of the process.
items
typestring
typearray
egid
descriptionThe effective group ID of the process.
typestring
euid
descriptionThe effective user ID of the process.
typestring
file
$refBackstoryFile
descriptionInformation about the file in use by the process.
integrityLevelRid
descriptionThe Microsoft Windows integrity level relative ID (RID) of the process.
formatuint64
typestring
parentPid
deprecatedTrue
descriptionThe ID of the parent process. Deprecated: use parent_process.pid instead.
typestring
parentProcess
$refProcess
descriptionInformation about the parent process.
pgid
descriptionThe identifier that points to the process group ID leader.
typestring
pid
descriptionThe process ID. This field can be used as an entity indicator for process entities.
typestring
productSpecificParentProcessId
deprecatedTrue
descriptionA product specific id for the parent process. Please use parent_process.product_specific_process_id instead.
typestring
productSpecificProcessId
descriptionA product specific process id.
typestring
rgid
descriptionThe real group ID of the process.
typestring
ruid
descriptionThe real user ID of the process.
typestring
sessionLeaderPid
descriptionThe process ID of the session leader process.
typestring
tokenElevationType
descriptionThe elevation type of the process on Microsoft Windows. This determines if any privileges are removed when UAC is enabled.
enum
  • UNKNOWN
  • TYPE_1
  • TYPE_2
  • TYPE_3
enumDescriptions
  • An undetermined token type.
  • A full token with no privileges removed or groups disabled.
  • An elevated token with no privileges removed or groups disabled. Used when running as administrator.
  • A limited token with administrative privileges removed and administrative groups disabled.
typestring
tty
descriptionThe teletype terminal which the command was executed within.
typestring
typeobject
ProviderMLVerdict
descriptionDeprecated. MLVerdict result provided from threat providers, like Mandiant. These fields are used to model Mandiant sources.
idProviderMLVerdict
properties
benignCount
descriptionCount of responses where this IoC was marked benign.
formatint32
typeinteger
confidenceScore
descriptionConfidence score of the verdict.
formatint32
typeinteger
maliciousCount
descriptionCount of responses where this IoC was marked malicious.
formatint32
typeinteger
mandiantSources
descriptionList of mandiant sources from which the verdict was generated.
items
$refSource
typearray
sourceProvider
descriptionSource provider giving the ML verdict.
typestring
thirdPartySources
descriptionList of third-party sources from which the verdict was generated.
items
$refSource
typearray
typeobject
PublicKey
descriptionSubject public key info.
idPublicKey
properties
algorithm
descriptionAny of "RSA", "DSA" or "EC". Indicates the algorithm used to generate the certificate.
typestring
rsa
$refRSA
descriptionRSA public key information.
typeobject
Question
descriptionDNS Questions. See RFC1035, section 4.1.2.
idQuestion
properties
class
descriptionThe code specifying the class of the query.
formatuint32
typeinteger
name
descriptionThe domain name.
typestring
prevalence
$refPrevalence
descriptionThe prevalence of the domain within the customer's environment.
type
descriptionThe code specifying the type of the query.
formatuint32
typeinteger
typeobject
RSA
descriptionRSA public key information.
idRSA
properties
exponent
descriptionKey exponent hexdump.
typestring
keySize
descriptionKey size.
formatint64
typestring
modulus
descriptionKey modulus hexdump.
typestring
typeobject
Reference
descriptionReference to model primatives including event and entity. As support is added for fast retrieval of objects by identifiers, this will be expanded to include ID references rather than full object copies. BEGIN GOOGLE-INTERNAL See go/udm:ids for additional details. END GOOGLE-INTERNAL
idReference
properties
entity
$refBackstoryEntity
descriptionEntity being referenced. End one-of
event
$refUDM
descriptionOnly one of event or entity will be populated for a single reference. Start one-of Event being referenced.
id
$refId
descriptionId being referenced. This field will also be populated for both event and entity with the event id. For detections, only this field will be populated.
typeobject
ReferenceList
descriptionA reference list. Reference lists are user-defined lists of values which users can use in multiple Rules.
idReferenceList
properties
description
descriptionRequired. A user-provided description of the reference list.
typestring
displayName
descriptionOutput only. The unique display name of the reference list.
readOnlyTrue
typestring
entries
descriptionRequired. The entries of the reference list. When listed, they are returned in the order that was specified at creation or update. The combined size of the values of the reference list may not exceed 6MB. This is returned only when the view is REFERENCE_LIST_VIEW_FULL.
items
$refReferenceListEntry
typearray
name
descriptionOutput only. The resource name of the reference list. Format: projects/{project}/locations/{location}/instances/{instance}/referenceLists/{reference_list}
readOnlyTrue
typestring
revisionCreateTime
descriptionOutput only. The timestamp when the reference list was last updated.
formatgoogle-datetime
readOnlyTrue
typestring
ruleAssociationsCount
descriptionOutput only. The count of self-authored rules using the reference list.
formatint32
readOnlyTrue
typeinteger
rules
descriptionOutput only. The resource names for the associated self-authored Rules that use this reference list. This is returned only when the view is REFERENCE_LIST_VIEW_FULL.
items
typestring
readOnlyTrue
typearray
scopeInfo
$refScopeInfo
descriptionOutput only. The scope info of the reference list. During reference list creation, if this field is not set, the reference list without scopes (an unscoped list) will be created for an unscoped user. For a scoped user, this field must be set. During reference list update, if scope_info is requested to be updated, this field must be set.
readOnlyTrue
syntaxType
descriptionRequired. The syntax type indicating how list entries should be validated.
enum
  • REFERENCE_LIST_SYNTAX_TYPE_UNSPECIFIED
  • REFERENCE_LIST_SYNTAX_TYPE_PLAIN_TEXT_STRING
  • REFERENCE_LIST_SYNTAX_TYPE_REGEX
  • REFERENCE_LIST_SYNTAX_TYPE_CIDR
enumDescriptions
  • Defaults to REFERENCE_LIST_SYNTAX_TYPE_PLAIN_TEXT_STRING.
  • List contains plain text patterns.
  • List contains only Regular Expression patterns.
  • List contains only CIDR patterns.
typestring
typeobject
ReferenceListEntry
descriptionAn entry in a reference list.
idReferenceListEntry
properties
value
descriptionRequired. The value of the entry. Maximum length is 512 characters.
typestring
typeobject
ReferenceListScope
descriptionReferenceListScope specifies the list of scope names of the reference list.
idReferenceListScope
properties
scopeNames
descriptionOptional. The list of scope names of the reference list. The scope names should be full resource names and should be of the format: "projects/{project}/locations/{location}/instances/{instance}/dataAccessScopes/{scope_name}".
items
typestring
typearray
typeobject
Registry
descriptionInformation about a registry key or value.
idRegistry
properties
registryKey
descriptionRegistry key associated with an application or system component (e.g., HKEY_, HKCU\Environment...).
typestring
registryValueData
descriptionData associated with a registry value (e.g. %USERPROFILE%\Local Settings\Temp).
typestring
registryValueName
descriptionName of the registry value associated with an application or system component (e.g. TEMP).
typestring
registryValueType
descriptionType of the registry value.
enum
  • TYPE_UNSPECIFIED
  • NONE
  • SZ
  • EXPAND_SZ
  • BINARY
  • DWORD
  • DWORD_LITTLE_ENDIAN
  • DWORD_BIG_ENDIAN
  • LINK
  • MULTI_SZ
  • RESOURCE_LIST
  • QWORD
  • QWORD_LITTLE_ENDIAN
enumDescriptions
  • Default registry value type used when the type is unknown.
  • The registry value is not set and only the key exists.
  • A null-terminated string.
  • A null-terminated string that contains unexpanded references to environment variables
  • Binary data in any form.
  • A 32-bit number.
  • A 32-bit number in little-endian format.
  • A 32-bit number in big-endian format.
  • A null-terminated Unicode string that contains the target path of a symbolic link.
  • A sequence of null-terminated strings, terminated by an empty string
  • A device driver resource list.
  • A 64-bit number.
  • A 64-bit number in little-endian format.
typestring
typeobject
Relation
descriptionDefines the relationship between the entity (a) and another entity (b).
idRelation
properties
direction
descriptionDirectionality of relationship between primary entity (a) and the related entity (b).
enum
  • DIRECTIONALITY_UNSPECIFIED
  • BIDIRECTIONAL
  • UNIDIRECTIONAL
enumDescriptions
  • Default value.
  • Modeled in both directions. Primary entity (a) to related entity (b) and related entity (b) to primary entity (a).
  • Modeled in a single direction. Primary entity (a) to related entity (b).
typestring
entity
$refNoun
descriptionEntity (b) that the primary entity (a) is related to.
entityLabel
descriptionLabel to identify the Noun of the relation.
enum
  • ENTITY_LABEL_UNSPECIFIED
  • PRINCIPAL
  • TARGET
  • OBSERVER
  • SRC
  • NETWORK
  • SECURITY_RESULT
  • INTERMEDIARY
enumDescriptions
  • Default value.
  • The Noun represents a principal type object.
  • The Noun represents a target type object.
  • The Noun represents an observer type object.
  • The Noun represents src type object.
  • The Noun represents a network type object.
  • The Noun represents a SecurityResult object.
  • The Noun represents an intermediary type object.
typestring
entityType
descriptionType of the related entity (b) in this relationship.
enum
  • UNKNOWN_ENTITYTYPE
  • ASSET
  • USER
  • GROUP
  • RESOURCE
  • IP_ADDRESS
  • FILE
  • DOMAIN_NAME
  • URL
  • MUTEX
  • METRIC
enumDescriptions
  • @hide_from_doc
  • An asset, such as workstation, laptop, phone, virtual machine, etc.
  • User.
  • Group.
  • Resource.
  • An external IP address.
  • A file.
  • A domain.
  • A url.
  • A mutex.
  • A metric.
typestring
relationship
descriptionType of relationship.
enum
  • RELATIONSHIP_UNSPECIFIED
  • OWNS
  • ADMINISTERS
  • MEMBER
  • EXECUTES
  • DOWNLOADED_FROM
  • CONTACTS
enumDescriptions
  • Default value
  • Related entity is owned by the primary entity (e.g. user owns device asset).
  • Related entity is administered by the primary entity (e.g. user administers a group).
  • Primary entity is a member of the related entity (e.g. user is a member of a group).
  • Primary entity may have executed the related entity.
  • Primary entity may have been downloaded from the related entity.
  • Primary entity contacts the related entity.
typestring
uid
descriptionUID of the relationship.
formatbyte
typestring
typeobject
Resource
descriptionInformation about a resource such as a task, Cloud Storage bucket, database, disk, logical policy, or something similar.
idResource
properties
attribute
$refAttribute
descriptionGeneric entity metadata attributes of the resource.
id
deprecatedTrue
descriptionDeprecated: Use resource.name or resource.product_object_id.
typestring
name
descriptionThe full name of the resource. For example, Google Cloud: //cloudresourcemanager.googleapis.com/projects/wombat-123, and AWS: arn:aws:iam::123456789012:user/johndoe.
typestring
parent
deprecatedTrue
descriptionThe parent of the resource. For a database table, the parent is the database. For a storage object, the bucket name. Deprecated: use resource_ancestors.name.
typestring
productObjectId
descriptionA vendor-specific identifier to uniquely identify the entity (a GUID, OID, or similar) This field can be used as an entity indicator for a Resource entity.
typestring
resourceSubtype
descriptionResource sub-type (e.g. "BigQuery", "Bigtable").
typestring
resourceType
descriptionResource type.
enum
  • UNSPECIFIED
  • MUTEX
  • TASK
  • PIPE
  • DEVICE
  • FIREWALL_RULE
  • MAILBOX_FOLDER
  • VPC_NETWORK
  • VIRTUAL_MACHINE
  • STORAGE_BUCKET
  • STORAGE_OBJECT
  • DATABASE
  • TABLE
  • CLOUD_PROJECT
  • CLOUD_ORGANIZATION
  • SERVICE_ACCOUNT
  • ACCESS_POLICY
  • CLUSTER
  • SETTING
  • DATASET
  • BACKEND_SERVICE
  • POD
  • CONTAINER
  • FUNCTION
  • RUNTIME
  • IP_ADDRESS
  • DISK
  • VOLUME
  • IMAGE
  • SNAPSHOT
  • REPOSITORY
  • CREDENTIAL
  • LOAD_BALANCER
  • GATEWAY
  • SUBNET
  • USER
enumDescriptions
  • Default type.
  • Mutex.
  • Task.
  • Named pipe.
  • Device.
  • Firewall rule.
  • Mailbox folder.
  • VPC Network.
  • Virtual machine.
  • Storage bucket.
  • Storage object.
  • Database.
  • Data table.
  • Cloud project.
  • Cloud organization.
  • Service account.
  • Access policy.
  • Cluster.
  • Settings.
  • Dataset.
  • Endpoint that receive traffic from a load balancer or proxy.
  • Pod, which is a collection of containers. Often used in Kubernetes.
  • Container.
  • Cloud function.
  • Runtime.
  • IP address.
  • Disk.
  • Volume.
  • Machine image.
  • Snapshot.
  • Repository.
  • Credential, e.g. access keys, ssh keys, tokens, certificates.
  • Load balancer.
  • Gateway.
  • Subnet.
  • User.
typestring
type
deprecatedTrue
descriptionDeprecated: use resource_type instead.
typestring
typeobject
ResourceRecord
descriptionDNS Resource Records. See RFC1035, section 4.1.3.
idResourceRecord
properties
binaryData
descriptionThe raw bytes of any non-UTF8 strings that might be included as part of a DNS response.
formatbyte
typestring
class
descriptionThe code specifying the class of the resource record.
formatuint32
typeinteger
data
descriptionThe payload or response to the DNS question for all responses encoded in UTF-8 format
typestring
name
descriptionThe name of the owner of the resource record.
typestring
ttl
descriptionThe time interval for which the resource record can be cached before the source of the information should again be queried.
formatuint32
typeinteger
type
descriptionThe code specifying the type of the resource record.
formatuint32
typeinteger
typeobject
ResponsePlatformInfo
descriptionRelated info of an Alert in customer's SOAR platform.
idResponsePlatformInfo
properties
alertId
descriptionId of the alert in SOAR product.
typestring
responsePlatformType
descriptionType of SOAR product.
enum
  • RESPONSE_PLATFORM_TYPE_UNSPECIFIED
  • RESPONSE_PLATFORM_TYPE_SIEMPLIFY
enumDescriptions
  • Response platform not specified.
  • Siemplify
typestring
typeobject
Retrohunt
descriptionRetrohunt is an execution of a Rule over a time range in the past.
idRetrohunt
properties
executionInterval
$refInterval
descriptionOutput only. The start and end time of the retrohunt execution. If the retrohunt is not yet finished, the end time of the interval will not be populated.
readOnlyTrue
name
descriptionThe resource name of the retrohunt. Retrohunt is the child of a rule revision. {rule} in the format below is structured as {rule_id@revision_id}. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}/retrohunts/{retrohunt}
typestring
processInterval
$refInterval
descriptionRequired. The start and end time of the event time range this retrohunt processes.
progressPercentage
descriptionOutput only. Percent progress of the retrohunt towards completion, from 0.00 to 100.00.
formatfloat
readOnlyTrue
typenumber
state
descriptionOutput only. The state of the retrohunt.
enum
  • STATE_UNSPECIFIED
  • RUNNING
  • DONE
  • CANCELLED
  • FAILED
enumDescriptions
  • Unspecified or unknown retrohunt state.
  • Running state.
  • Done state.
  • Cancelled state.
  • Failed state.
readOnlyTrue
typestring
typeobject
RetrohuntMetadata
descriptionOperation Metadata for Retrohunts.
idRetrohuntMetadata
properties
executionInterval
$refInterval
descriptionThe start and end time of the retrohunt execution. If the retrohunt is not yet finished, the end time of the interval will not be filled.
progressPercentage
descriptionPercent progress of the retrohunt towards completion, from 0.00 to 100.00.
formatfloat
typenumber
retrohunt
descriptionThe name of the retrohunt. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}/retrohunts/{retrohunt}
typestring
typeobject
RiskDelta
descriptionDescribes the difference in risk score between two points in time.
idRiskDelta
properties
previousRangeEndTime
descriptionEnd time of the previous time window.
formatgoogle-datetime
typestring
previousRiskScore
descriptionRisk score from previous risk window
formatint32
typeinteger
riskScoreDelta
descriptionDifference in the normalized risk score from the previous recorded value.
formatint32
typeinteger
riskScoreNumericDelta
descriptionNumeric change between current and previous risk score
formatint32
typeinteger
typeobject
Role
descriptionSystem role for resource access and modification.
idRole
properties
description
descriptionSystem role description for user.
typestring
name
descriptionSystem role name for user.
typestring
type
descriptionSystem role type for well known roles.
enum
  • TYPE_UNSPECIFIED
  • ADMINISTRATOR
  • SERVICE_ACCOUNT
enumDescriptions
  • Default user role.
  • Product administrator with elevated privileges.
  • System service account for automated privilege access.
typestring
typeobject
Rule
descriptionThe Rule resource represents a user-created rule. NEXT TAG: 21
idRule
properties
allowedRunFrequencies
descriptionOutput only. The run frequencies that are allowed for the rule. Populated in BASIC view and FULL view.
items
enum
  • RUN_FREQUENCY_UNSPECIFIED
  • LIVE
  • HOURLY
  • DAILY
enumDescriptions
  • The run frequency is unspecified/unknown.
  • Executes in real time.
  • Executes once per hour.
  • Executes once per day.
typestring
readOnlyTrue
typearray
author
descriptionOutput only. The author of the rule. Extracted from the meta section of text. Populated in BASIC view and FULL view.
readOnlyTrue
typestring
compilationDiagnostics
descriptionOutput only. A list of a rule's corresponding compilation diagnostic messages such as compilation errors and compilation warnings. Populated in FULL view.
items
$refCompilationDiagnostic
readOnlyTrue
typearray
compilationState
descriptionOutput only. The current compilation state of the rule. Populated in FULL view.
enum
  • COMPILATION_STATE_UNSPECIFIED
  • SUCCEEDED
  • FAILED
enumDescriptions
  • The compilation state is unspecified/unknown.
  • The Rule can successfully compile.
  • The Rule cannot successfully compile. This is possible if a backwards-incompatible change was made to the compiler.
readOnlyTrue
typestring
createTime
descriptionOutput only. The timestamp of when the rule was created. Populated in FULL view.
formatgoogle-datetime
readOnlyTrue
typestring
dataTables
descriptionOutput only. Resource names of the data tables used in this rule.
items
typestring
readOnlyTrue
typearray
displayName
descriptionOutput only. Display name of the rule. Populated in BASIC view and FULL view.
readOnlyTrue
typestring
etag
descriptionThe etag for this rule. If this is provided on update, the request will succeed if and only if it matches the server-computed value, and will fail with an ABORTED error otherwise. Populated in BASIC view and FULL view.
typestring
inputsUsed
$refInputsUsed
descriptionOutput only. The set of inputs used in the rule. For example, if the rule uses $e.principal.hostname, then the uses_udm field will be true.
readOnlyTrue
metadata
additionalProperties
typestring
descriptionOutput only. Additional metadata specified in the meta section of text. Populated in FULL view.
readOnlyTrue
typeobject
name
descriptionFull resource name for the rule. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}
typestring
nearRealTimeLiveRuleEligible
descriptionOutput only. Indicate the rule can run in near real time live rule. If this is true, the rule uses the near real time live rule when the run frequency is set to LIVE.
readOnlyTrue
typeboolean
referenceLists
descriptionOutput only. Resource names of the reference lists used in this rule. Populated in FULL view.
items
typestring
readOnlyTrue
typearray
revisionCreateTime
descriptionOutput only. The timestamp of when the rule revision was created. Populated in FULL, REVISION_METADATA_ONLY views.
formatgoogle-datetime
readOnlyTrue
typestring
revisionId
descriptionOutput only. The revision ID of the rule. A new revision is created whenever the rule text is changed in any way. Format: v_{10 digits}_{9 digits} Populated in REVISION_METADATA_ONLY view and FULL view.
readOnlyTrue
typestring
scope
descriptionResource name of the DataAccessScope bound to this rule. Populated in BASIC view and FULL view. If reference lists are used in the rule, validations will be performed against this scope to ensure that the reference lists are compatible with both the user's and the rule's scopes. The scope should be in the format: "projects/{project}/locations/{location}/instances/{instance}/dataAccessScopes/{scope}".
typestring
severity
$refSeverity
descriptionOutput only. The severity of the rule as specified in the meta section of text. Populated in BASIC view and FULL view.
readOnlyTrue
text
descriptionThe YARA-L content of the rule. Populated in FULL view.
typestring
type
descriptionOutput only. User-facing type of the rule. Extracted from the events section of rule text. Populated in BASIC view and FULL view.
enum
  • RULE_TYPE_UNSPECIFIED
  • SINGLE_EVENT
  • MULTI_EVENT
enumDescriptions
  • The rule type is unspecified/unknown.
  • Rule checks for the existence of a single event.
  • Rule checks for correlation between multiple events
readOnlyTrue
typestring
typeobject
RuleDeployment
descriptionThe RuleDeployment resource represents the deployment state of a Rule.
idRuleDeployment
properties
alerting
descriptionWhether detections resulting from this deployment should be considered alerts.
typeboolean
archiveTime
descriptionOutput only. The timestamp when the rule deployment archive state was last set to true. If the rule deployment's current archive state is not set to true, the field will be empty.
formatgoogle-datetime
readOnlyTrue
typestring
archived
descriptionThe archive state of the rule deployment. Cannot be set to true unless enabled is set to false. If set to true, alerting will automatically be set to false. If currently set to true, enabled, alerting, and run_frequency cannot be updated.
typeboolean
consumerRules
descriptionOutput only. The names of the associated/chained consumer rules. Rules are considered consumers of this rule if their rule text explicitly filters on this rule's ruleid. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}
items
typestring
readOnlyTrue
typearray
enabled
descriptionWhether the rule is currently deployed continuously against incoming data.
typeboolean
executionState
descriptionOutput only. The execution state of the rule deployment.
enum
  • EXECUTION_STATE_UNSPECIFIED
  • DEFAULT
  • LIMITED
  • PAUSED
enumDescriptions
  • Unspecified or unknown execution state.
  • Default execution state.
  • Rules in limited state may not have their executions guaranteed.
  • Paused rules are not executed at all.
readOnlyTrue
typestring
lastAlertStatusChangeTime
descriptionOutput only. The timestamp when the rule deployment alert state was lastly changed. This is filled regardless of the current alert state. E.g. if the current alert status is false, this timestamp will be the timestamp when the alert status was changed to false.
formatgoogle-datetime
readOnlyTrue
typestring
name
descriptionRequired. The resource name of the rule deployment. Note that RuleDeployment is a child of the overall Rule, not any individual revision, so the resource ID segment for the Rule resource must not reference a specific revision. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}/deployment
typestring
producerRules
descriptionOutput only. The names of the associated/chained producer rules. Rules are considered producers for this rule if this rule explicitly filters on their ruleid. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}
items
typestring
readOnlyTrue
typearray
runFrequency
descriptionThe run frequency of the rule deployment.
enum
  • RUN_FREQUENCY_UNSPECIFIED
  • LIVE
  • HOURLY
  • DAILY
enumDescriptions
  • The run frequency is unspecified/unknown.
  • Executes in real time.
  • Executes once per hour.
  • Executes once per day.
typestring
typeobject
RuntimeError
idRuntimeError
properties
errorText
typestring
timeRange
$refInterval
typeobject
SSLCertificate
descriptionSSL certificate.
idSSLCertificate
properties
certExtensions
additionalProperties
descriptionProperties of the object.
typeany
descriptionCertificate's extensions.
typeobject
certSignature
$refCertSignature
descriptionCertificate's signature and algorithm.
ec
$refEC
descriptionEC public key information.
extension
$refExtension
deprecatedTrue
description(DEPRECATED) certificate's extension.
firstSeenTime
descriptionDate the certificate was first retrieved by VirusTotal.
formatgoogle-datetime
typestring
issuer
$refSubject
descriptionCertificate's issuer data.
publicKey
$refPublicKey
descriptionPublic key information.
serialNumber
descriptionCertificate's serial number hexdump.
typestring
signatureAlgorithm
descriptionAlgorithm used for the signature (for example, "sha1RSA").
typestring
size
descriptionCertificate content length.
formatint64
typestring
subject
$refSubject
descriptionCertificate's subject data.
thumbprint
descriptionCertificate's content SHA1 hash.
typestring
thumbprintSha256
descriptionCertificate's content SHA256 hash.
typestring
validity
$refValidity
descriptionCertificate's validity period.
version
descriptionCertificate version (typically "V1", "V2" or "V3").
typestring
typeobject
ScopeInfo
descriptionScopeInfo specifies the scope info of the reference list.
idScopeInfo
properties
referenceListScope
$refReferenceListScope
descriptionRequired. The list of scope names of the reference list, if the list is empty the reference list is treated as unscoped.
typeobject
SearchDataTableColumnInfo
idSearchDataTableColumnInfo
properties
isDefault
typeboolean
originalColumn
typestring
typeobject
SearchDataTableInfo
idSearchDataTableInfo
properties
columnInfo
items
$refSearchDataTableColumnInfo
typearray
dataTable
typestring
typeobject
SearchDataTableRow
idSearchDataTableRow
properties
column
typestring
value
typestring
typeobject
SearchDataTableRowInfo
idSearchDataTableRowInfo
properties
dataTable
typestring
rows
items
$refSearchDataTableRow
typearray
typeobject
SecurityResult
descriptionSecurity related metadata for the event. A security result might be something like "virus detected and quarantined," "malicious connection blocked," or "sensitive data included in document foo.doc." Each security result, of which there may be more than one, may either pertain to the whole event, or to a specific object or device referenced in the event (e.g. a malicious file that was detected, or a sensitive document sent as an email attachment). For security results that apply to a particular object referenced in the event, the security_results message MUST contain details about the implicated object (such as process, user, IP, domain, URL, IP, or email address) in the about field. For security results that apply to the entire event (e.g. SPAM found in this email), the about field must remain empty.
idSecurityResult
properties
about
$refNoun
descriptionIf the security result is about a specific entity (Noun), add it here. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
action
descriptionActions taken for this event. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
items
enum
  • UNKNOWN_ACTION
  • ALLOW
  • BLOCK
  • ALLOW_WITH_MODIFICATION
  • QUARANTINE
  • FAIL
  • CHALLENGE
enumDescriptions
  • The default action.
  • Allowed.
  • Blocked.
  • Strip, modify something (e.g. File or email was disinfected or rewritten and still forwarded).
  • Put somewhere for later analysis (does NOT imply block).
  • Failed (e.g. the event was allowed but failed).
  • Challenged (e.g. the user was challenged by a Captcha, 2FA).
typestring
typearray
actionDetails
descriptionThe detail of the action taken as provided by the vendor. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
typestring
alertState
descriptionThe alerting types of this security result. This is primarily set for rule-generated detections and alerts.
enum
  • UNSPECIFIED
  • NOT_ALERTING
  • ALERTING
enumDescriptions
  • The security result type is not known.
  • The security result is not an alert.
  • The security result is an alert.
typestring
analyticsMetadata
descriptionStores metadata about each risk analytic metric the rule uses. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
items
$refAnalyticsMetadata
typearray
associations
descriptionAssociations related to the threat. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
items
$refAssociation
typearray
attackDetails
$refAttackDetails
descriptionMITRE ATT&CK details. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
campaigns
descriptionCampaigns using this IOC threat. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
items
typestring
typearray
category
descriptionThe security category. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
items
enum
  • UNKNOWN_CATEGORY
  • SOFTWARE_MALICIOUS
  • SOFTWARE_SUSPICIOUS
  • SOFTWARE_PUA
  • NETWORK_MALICIOUS
  • NETWORK_SUSPICIOUS
  • NETWORK_CATEGORIZED_CONTENT
  • NETWORK_DENIAL_OF_SERVICE
  • NETWORK_RECON
  • NETWORK_COMMAND_AND_CONTROL
  • ACL_VIOLATION
  • AUTH_VIOLATION
  • EXPLOIT
  • DATA_EXFILTRATION
  • DATA_AT_REST
  • DATA_DESTRUCTION
  • TOR_EXIT_NODE
  • MAIL_SPAM
  • MAIL_PHISHING
  • MAIL_SPOOFING
  • POLICY_VIOLATION
  • SOCIAL_ENGINEERING
  • PHISHING
enumDescriptions
  • The default category.
  • Malware, spyware, rootkit.
  • Below the conviction threshold; probably bad.
  • Potentially Unwanted App (such as adware).
  • Includes C&C or network exploit.
  • Suspicious activity, such as potential reverse tunnel.
  • Non-security related: URL has category like gambling or porn.
  • DoS, DDoS.
  • Port scan detected by an IDS, probing of web app.
  • If we know this is a C&C channel.
  • Unauthorized access attempted, including attempted access to files, web services, processes, web objects, etc.
  • Authentication failed (e.g. bad password or bad 2-factor authentication).
  • Exploit: For all manner of exploits including attempted overflows, bad protocol encodings, ROP, SQL injection, etc. For both network and host- based exploits.
  • DLP: Sensitive data transmission, copy to thumb drive.
  • DLP: Sensitive data found at rest in a scan.
  • Attempt to destroy/delete data.
  • TOR Exit Nodes.
  • Spam email, message, etc.
  • Phishing email, chat messages, etc.
  • Spoofed source email address, etc.
  • Security-related policy violation (e.g. firewall/proxy/HIPS rule violated, NAC block action).
  • Threats which manipulate to break normal security procedures.
  • Phishing pages, pops, https phishing etc.
typestring
typearray
categoryDetails
descriptionFor vendor-specific categories. For web categorization, put type in here such as "gambling" or "porn". This field is not populated when the SecurityResult appears in a finding (a detection or alert).
items
typestring
typearray
confidence
descriptionThe confidence level of the result as estimated by the product. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
enum
  • UNKNOWN_CONFIDENCE
  • LOW_CONFIDENCE
  • MEDIUM_CONFIDENCE
  • HIGH_CONFIDENCE
enumDescriptions
  • The default confidence level.
  • Low confidence.
  • Medium confidence.
  • High confidence.
typestring
confidenceDetails
descriptionAdditional detail with regards to the confidence of a security event as estimated by the product vendor. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
typestring
confidenceScore
descriptionThe confidence score of the security result. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
formatfloat
typenumber
description
descriptionA human-readable description (e.g. "user password was wrong"). This can be more detailed than the summary.
typestring
detectionDepth
descriptionThe depth of the detection chain. Applies only to composite detections.
formatint64
typestring
detectionFields
descriptionAn ordered list of values, that represent fields in detections for a security finding. This list represents mapping of names of requested entities to their values (the security result matched variables). This is only populated when the SecurityResult appears in a finding (a detection or alert).
items
$refLabel
typearray
firstDiscoveredTime
descriptionFirst time the IoC threat was discovered in the provider. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
formatgoogle-datetime
typestring
lastDiscoveredTime
descriptionLast time the IoC was seen in the provider data. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
formatgoogle-datetime
typestring
lastUpdatedTime
descriptionLast time the IoC threat was updated in the provider. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
formatgoogle-datetime
typestring
outcomes
descriptionA list of outcomes that represent the results of this security finding. This list represents a mapping of names of the requested outcomes, to a stringified version of their values. This is only populated when the SecurityResult appears in a finding (a detection or alert).
items
$refLabel
typearray
priority
descriptionThe priority of the result. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
enum
  • UNKNOWN_PRIORITY
  • LOW_PRIORITY
  • MEDIUM_PRIORITY
  • HIGH_PRIORITY
enumDescriptions
  • Default priority level.
  • Low priority.
  • Medium priority.
  • High priority.
typestring
priorityDetails
descriptionVendor-specific information about the security result priority. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
typestring
reports
descriptionReports that reference this IOC threat. These are the report IDs. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
items
typestring
typearray
riskScore
descriptionThe risk score of the security result.
formatfloat
typenumber
ruleAuthor
descriptionAuthor of the security rule. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
typestring
ruleId
descriptionA vendor-specific ID for a rule, varying by observer type (e.g. "08123", "5d2b44d0-5ef6-40f5-a704-47d61d3babbe").
typestring
ruleLabels
descriptionA list of rule labels that can't be captured by the other fields in security result (e.g. "reference : AnotherRule", "contributor : John"). This is primarily set in rule-generated detections and alerts.
items
$refLabel
typearray
ruleName
descriptionName of the security rule (e.g. "BlockInboundToOracle").
typestring
ruleSet
descriptionThe curated detection's rule set identifier. (for example, "windows-threats") This is primarily set in rule-generated detections and alerts.
typestring
ruleSetDisplayName
descriptionThe curated detections rule set display name. This is primarily set in rule-generated detections and alerts.
typestring
ruleType
descriptionThe type of security rule.
typestring
ruleVersion
descriptionVersion of the security rule. (e.g. "v1.1", "00001", "1604709794", "2020-11-16T23:04:19+00:00"). Note that rule versions are source-dependant and lexical ordering should not be assumed.
typestring
rulesetCategoryDisplayName
descriptionThe curated detection rule set category display name. (for example, if rule_set_display_name is "CDIR SCC Enhanced Exfiltration", the rule_set_category is "Cloud Threats"). This is primarily set in rule-generated detections and alerts.
typestring
severity
descriptionThe severity of the result.
enum
  • UNKNOWN_SEVERITY
  • INFORMATIONAL
  • ERROR
  • NONE
  • LOW
  • MEDIUM
  • HIGH
  • CRITICAL
enumDescriptions
  • The default severity level.
  • Info severity.
  • An error.
  • No malicious result.
  • Low-severity malicious result.
  • Medium-severity malicious result.
  • High-severity malicious result.
  • Critical-severity malicious result.
typestring
severityDetails
descriptionVendor-specific severity. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
typestring
summary
descriptionA short human-readable summary (e.g. "failed login occurred")
typestring
threatFeedName
descriptionVendor feed name for a threat indicator feed. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
typestring
threatId
descriptionVendor-specific ID for a threat. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
typestring
threatIdNamespace
descriptionThe attribute threat_id_namespace qualifies threat_id with an id namespace to get an unique id. The attribute threat_id by itself is not unique across Chronicle as it is a vendor specific id. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
enum
  • NORMALIZED_TELEMETRY
  • RAW_TELEMETRY
  • RULE_DETECTIONS
  • UPPERCASE
  • MACHINE_INTELLIGENCE
  • SECURITY_COMMAND_CENTER
  • UNSPECIFIED
  • SOAR_ALERT
  • VIRUS_TOTAL
enumDescriptions
  • Ingested and Normalized telemetry events
  • Ingested Raw telemetry
  • Chronicle Rules engine
  • Uppercase
  • DSML - Machine Intelligence
  • A normalized telemetry event from Google Security Command Center.
  • Unspecified Namespace
  • An alert coming from other SIEMs via Chronicle SOAR.
  • VirusTotal.
typestring
threatName
descriptionA vendor-assigned classification common across multiple customers (for example, "W32/File-A", "Slammer"). This field is not populated when the SecurityResult appears in a finding (a detection or alert).
typestring
threatStatus
descriptionCurrent status of the threat This field is not populated when the SecurityResult appears in a finding (a detection or alert).
enum
  • THREAT_STATUS_UNSPECIFIED
  • ACTIVE
  • CLEARED
  • FALSE_POSITIVE
enumDescriptions
  • Default threat status
  • Active threat.
  • Cleared threat.
  • False positive.
typestring
threatVerdict
descriptionGCTI threat verdict on the security result entity. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
enum
  • THREAT_VERDICT_UNSPECIFIED
  • UNDETECTED
  • SUSPICIOUS
  • MALICIOUS
enumDescriptions
  • Unspecified threat verdict level.
  • Undetected threat verdict level.
  • Suspicious threat verdict level.
  • Malicious threat verdict level.
typestring
urlBackToProduct
descriptionURL that takes the user to the source product console for this event. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
typestring
variables
additionalProperties
$refFindingVariable
descriptionA list of outcomes and match variables that represent the results of this security finding. This list represents a mapping of names of the requested outcomes or match variables, to their values. This is only populated when the SecurityResult appears in a finding (a detection or alert).
typeobject
verdict
$refVerdict
deprecatedTrue
descriptionVerdict about the IoC from the provider. This field is now deprecated. Use VerdictInfo instead.
verdictInfo
descriptionVerdict information about the IoC from the provider. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
items
$refVerdictInfo
typearray
typeobject
Server
descriptionTransport Layer Security (TLS) information associated with the server (for example, Certificate or JA3 hash).
idServer
properties
certificate
$refCertificate
descriptionServer certificate.
ja3s
descriptionJA3 hash from the TLS ServerHello, as a hex-encoded string.
typestring
typeobject
Severity
descriptionSeverity represents the severity level of the rule.
idSeverity
properties
displayName
descriptionThe display name of the severity level. Extracted from the meta section of the rule text.
typestring
typeobject
SignatureInfo
descriptionFile signature information extracted from different tools.
idSignatureInfo
properties
codesign
$refFileMetadataCodesign
descriptionSignature information extracted from the codesign utility.
sigcheck
$refFileMetadataSignatureInfo
descriptionSignature information extracted from the sigcheck tool.
typeobject
SignerInfo
descriptionFile metadata related to the signer information.
idSignerInfo
properties
certIssuer
descriptionCompany that issued the certificate.
typestring
name
descriptionCommon name of the signers/certificate. The order of the signers matters. Each element is a higher level authority, the last being the root authority.
typestring
status
descriptionIt can say "Valid" or state the problem with the certificate if any (e.g. "This certificate or one of the certificates in the certificate chain is not time valid.").
typestring
validUsage
descriptionIndicates which situations the certificate is valid for (e.g. "Code Signing").
typestring
typeobject
Smtp
descriptionSMTP info. See RFC 2821.
idSmtp
properties
helo
descriptionThe client's 'HELO'/'EHLO' string.
typestring
isTls
descriptionIf the connection switched to TLS.
typeboolean
isWebmail
descriptionIf the message was sent via a webmail client.
typeboolean
mailFrom
descriptionThe client's 'MAIL FROM' string.
typestring
messagePath
descriptionThe message's path (extracted from the headers).
typestring
rcptTo
descriptionThe client's 'RCPT TO' string(s).
items
typestring
typearray
serverResponse
descriptionThe server's response(s) to the client.
items
typestring
typearray
typeobject
SoarAlertMetadata
descriptionMetadata fields of alerts coming from other SIEM systems.
idSoarAlertMetadata
properties
alertId
descriptionAlert ID in the source SIEM system.
typestring
product
descriptionName of the product the alert is coming from.
typestring
sourceRule
descriptionName of the rule triggering the alert in the source SIEM.
typestring
sourceSystem
descriptionName of the Source SIEM system.
typestring
sourceSystemTicketId
descriptionTicket id for the alert in the source system.
typestring
sourceSystemUri
descriptionUrl to the source SIEM system.
typestring
vendor
descriptionName of the vendor.
typestring
typeobject
Software
descriptionInformation about a software package or application.
idSoftware
properties
description
descriptionThe description of the software.
typestring
name
descriptionThe name of the software.
typestring
permissions
descriptionSystem permissions granted to the software. For example, "android.permission.WRITE_EXTERNAL_STORAGE"
items
$refPermission
typearray
vendorName
descriptionThe name of the software vendor.
typestring
version
descriptionThe version of the software.
typestring
typeobject
Source
descriptionDeprecated. Information about the threat intelligence source. These fields are used to model Mandiant sources.
idSource
properties
benignCount
descriptionCount of responses where this IoC was marked benign.
formatint32
typeinteger
maliciousCount
descriptionCount of responses where this IoC was marked malicious.
formatint32
typeinteger
name
descriptionName of the IoC source.
typestring
quality
descriptionQuality of the IoC mapping extracted from the source.
enum
  • UNKNOWN_CONFIDENCE
  • LOW_CONFIDENCE
  • MEDIUM_CONFIDENCE
  • HIGH_CONFIDENCE
enumDescriptions
  • The default confidence level.
  • Low confidence.
  • Medium confidence.
  • High confidence.
typestring
responseCount
descriptionTotal response count from this source.
formatint32
typeinteger
sourceCount
descriptionNumber of sources from which intelligence was extracted.
formatint32
typeinteger
threatIntelligenceSources
descriptionDifferent threat intelligence sources from which IoC info was extracted.
items
$refSource
typearray
typeobject
Status
descriptionThe `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors).
idStatus
properties
code
descriptionThe status code, which should be an enum value of google.rpc.Code.
formatint32
typeinteger
details
descriptionA list of messages that carry the error details. There is a common set of message types for APIs to use.
items
additionalProperties
descriptionProperties of the object. Contains field @type with type URL.
typeany
typeobject
typearray
message
descriptionA developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
typestring
typeobject
StringSequence
descriptionStringSequence represents a sequence of string.
idStringSequence
properties
stringVals
descriptionstring sequence.
items
typestring
typearray
typeobject
StringToInt64MapEntry
idStringToInt64MapEntry
properties
key
descriptionKey field.
typestring
value
descriptionValue field.
formatint64
typestring
typeobject
StringValue
idStringValue
properties
displayValue
typestring
rawValue
typestring
typeobject
StringValues
idStringValues
properties
values
items
$refStringValue
typearray
typeobject
Subject
descriptionSubject data.
idSubject
properties
commonName
descriptionCN: CommonName.
typestring
countryName
descriptionC: Country name.
typestring
locality
descriptionL: Locality.
typestring
organization
descriptionO: Organization.
typestring
organizationalUnit
descriptionOU: OrganizationalUnit.
typestring
stateOrProvinceName
descriptionST: StateOrProvinceName.
typestring
typeobject
Tactic
descriptionTactic information related to an attack or threat.
idTactic
properties
id
descriptionTactic ID (e.g. "TA0043").
typestring
name
descriptionTactic Name (e.g. "Reconnaissance")
typestring
typeobject
Tags
descriptionTags are event metadata which is set by examining event contents post-parsing. For example, a UDM event may be assigned a tenant_id based on certain customer-defined parameters.
idTags
properties
dataTapConfigName
descriptionA list of sink name values defined in DataTap configurations.
items
typestring
typearray
tenantId
descriptionA list of subtenant ids that this event belongs to.
items
formatbyte
typestring
typearray
typeobject
Technique
descriptionTechnique information related to an attack or threat.
idTechnique
properties
id
descriptionTechnique ID (e.g. "T1595").
typestring
name
descriptionTechnique Name (e.g. "Active Scanning").
typestring
subtechniqueId
descriptionSubtechnique ID (e.g. "T1595.001").
typestring
subtechniqueName
descriptionSubtechnique Name (e.g. "Scanning IP Blocks").
typestring
typeobject
TimeOff
descriptionSystem record for leave/time-off from a Human Capital Management (HCM) system.
idTimeOff
properties
description
descriptionDescription of the leave if available (e.g. 'Vacation').
typestring
interval
$refInterval
descriptionInterval duration of the leave.
typeobject
Tls
descriptionTransport Layer Security (TLS) information.
idTls
properties
cipher
descriptionCipher used during the connection.
typestring
client
$refClient
descriptionCertificate information for the client certificate.
curve
descriptionElliptical curve used for a given cipher.
typestring
established
descriptionIndicates whether the TLS negotiation was successful.
typeboolean
nextProtocol
descriptionProtocol to be used for tunnel.
typestring
resumed
descriptionIndicates whether the TLS connection was resumed from a previous TLS negotiation.
typeboolean
server
$refServer
descriptionCertificate information for the server certificate.
version
descriptionTLS version.
typestring
versionProtocol
descriptionProtocol.
typestring
typeobject
Tracker
descriptionURL Tracker.
idTracker
properties
id
descriptionTracker ID, if available.
typestring
timestamp
descriptionTracker ingestion date.
formatgoogle-datetime
typestring
tracker
descriptionTracker name.
typestring
url
descriptionTracker script URL.
typestring
typeobject
Tunnels
descriptionVPN tunnels.
idTunnels
properties
provider
descriptionThe provider of the VPN tunnels being used.
typestring
type
descriptionThe type of the VPN tunnels.
typestring
typeobject
UDM
descriptionA Unified Data Model event.
idUDM
properties
about
descriptionRepresents entities referenced by the event that are not otherwise described in principal, src, target, intermediary or observer. For example, it could be used to track email file attachments, domains/URLs/IPs embedded within an email body, and DLLs that are loaded during a PROCESS_LAUNCH event.
items
$refNoun
typearray
additional
additionalProperties
descriptionProperties of the object.
typeany
descriptionAny important vendor-specific event data that cannot be adequately represented within the formal sections of the UDM model.
typeobject
extensions
$refExtensions
descriptionAll other first-class, event-specific metadata goes in this message. Do not place protocol metadata in Extensions; put it in Network.
extracted
additionalProperties
descriptionProperties of the object.
typeany
descriptionFlattened fields extracted from the log.
typeobject
intermediary
descriptionRepresents details on one or more intermediate entities processing activity described in the event. This includes device details about a proxy server or SMTP relay server. If an active event (that has a principal and possibly target) passes through any intermediaries, they're added here. Intermediaries can impact the overall action, for example blocking or modifying an ongoing request. A rule of thumb here is that 'principal', 'target', and description of the initial action should be the same regardless of the intermediary or its action. A successful network connection from A->B should look the same in principal/target/intermediary as one blocked by firewall C: principal: A, target: B (intermediary: C).
items
$refNoun
typearray
metadata
$refMetadata
descriptionEvent metadata such as timestamp, source product, etc.
network
$refNetwork
descriptionAll network details go here, including sub-messages with details on each protocol (for example, DHCP, DNS, or HTTP).
observer
$refNoun
descriptionRepresents an observer entity (for example, a packet sniffer or network-based vulnerability scanner), which is not a direct intermediary, but which observes and reports on the event in question.
principal
$refNoun
descriptionRepresents the acting entity that originates the activity described in the event. The principal must include at least one machine detail (hostname, MACs, IPs, port, product-specific identifiers like an EDR asset ID) or user detail (for example, username), and optionally include process details. It must NOT include any of the following fields: email, files, registry keys or values.
securityResult
descriptionA list of security results.
items
$refSecurityResult
typearray
src
$refNoun
descriptionRepresents a source entity being acted upon by the participant along with the device or process context for the source object (the machine where the source object resides). For example, if user U copies file A on machine X to file B on machine Y, both file A and machine X would be specified in the src portion of the UDM event.
target
$refNoun
descriptionRepresents a target entity being referenced by the event or an object on the target entity. For example, in a firewall connection from device A to device B, A is described as the principal and B is described as the target. For a process injection by process C into target process D, process C is described as the principal and process D is described as the target.
typeobject
UdmColumnList
idUdmColumnList
properties
values
items
$refUdmColumnValue
typearray
typeobject
UdmColumnType
idUdmColumnType
properties
list
$refUdmColumnList
value
$refUdmColumnValue
typeobject
UdmColumnValue
idUdmColumnValue
properties
boolVal
typeboolean
bytesVal
formatbyte
typestring
dateVal
$refDate
doubleVal
formatdouble
typenumber
int64Val
formatint64
typestring
nullVal
typeboolean
protoVal
additionalProperties
descriptionProperties of the object. Contains field @type with type URL.
typeany
typeobject
stringVal
typestring
timestampVal
formatgoogle-datetime
typestring
uint64Val
formatuint64
typestring
typeobject
UdmEventInfo
idUdmEventInfo
properties
alertNumber
formatint32
typeinteger
annotations
items
enum
  • ANNOTATION_UNSPECIFIED
  • ANNOTATION_ALERT
enumDescriptions
typestring
typearray
chip
$refChip
deprecatedTrue
connectedComponentLabel
descriptionOptional.
formatbyte
typestring
datatableRowInfo
items
$refSearchDataTableRowInfo
typearray
detections
items
$refCollection
typearray
displayName
deprecatedTrue
typestring
entity
$refBackstoryEntity
event
$refUDM
eventLogToken
typestring
filterProperties
$refFilterProperties
deprecatedTrue
outcomes
items
$refUdmColumnType
typearray
tenantId
descriptionOptional.
typestring
uid
formatbyte
typestring
typeobject
UdmEventList
idUdmEventList
properties
columnNames
$refColumnNames
complete
typeboolean
datatableInfo
items
$refSearchDataTableInfo
typearray
events
items
$refUdmEventInfo
typearray
progress
formatdouble
typenumber
tooManyEvents
typeboolean
typeobject
UdmFieldAggregation
idUdmFieldAggregation
properties
aggregationType
enum
  • UNSPECIFIED_FIELD_AGGREGATION_TYPE
  • UDM_FIELD_AGGREGATION_TYPE
  • ENTITY_FIELD_AGGREGATION_TYPE
enumDescriptions
typestring
allValues
items
$refUdmValueCount
typearray
baselineEventCount
formatint32
typeinteger
bottomValues
items
$refUdmValueCount
typearray
eventCount
formatint32
typeinteger
fieldName
typestring
tooManyValues
typeboolean
topValues
items
$refUdmValueCount
typearray
valueCount
formatint32
typeinteger
typeobject
UdmFieldAggregations
idUdmFieldAggregations
properties
complete
typeboolean
fields
items
$refUdmFieldAggregation
typearray
groupByFields
items
$refGroupAggregationByField
typearray
typeobject
UdmFieldValue
idUdmFieldValue
properties
boolValue
typeboolean
bytesValue
formatbyte
typestring
doubleValue
formatdouble
typenumber
enumValue
typestring
floatValue
formatfloat
typenumber
int32Value
formatint32
typeinteger
int64Value
formatint64
typestring
isNull
typeboolean
stringValue
typestring
timestampValue
formatgoogle-datetime
typestring
uint32Value
formatuint32
typeinteger
uint64Value
formatuint64
typestring
typeobject
UdmPrevalence
idUdmPrevalence
properties
artifacts
items
$refFieldAndValue
typearray
prevalence
formatint32
typeinteger
typeobject
UdmPrevalenceBucket
idUdmPrevalenceBucket
properties
prevalence
items
$refUdmPrevalence
typearray
typeobject
UdmPrevalenceResponse
idUdmPrevalenceResponse
properties
buckets
items
$refUdmPrevalenceBucket
typearray
partialPrevalence
typeboolean
typeobject
UdmSearchOperationMetadata
descriptionInformation about a UDM Search operation. This message is used to populate the `metadata` field of `Operation` resources created by UDM Search.
idUdmSearchOperationMetadata
properties
baselineEventsCount
descriptionThe number of events matching the baseline query so far.
formatint32
typeinteger
baselineQuery
descriptionQuery used to search for events.
typestring
baselineTimeRange
$refInterval
descriptionThe time range used for the baseline query [inclusive start time, exclusive end time).
caseInsensitive
descriptionIf true, the search was performed in a case-insensitive manner.
typeboolean
endTime
descriptionThe end time of the operation, if done.
formatgoogle-datetime
typestring
expireTime
descriptionThe time when the operation results expire. This time may change while the operation is in progress. If unset, the results never expire.
formatgoogle-datetime
typestring
filteredEventsCount
descriptionThe number of events matching the snapshot query so far. This is <= `baseline_events_count`. If the snapshot query is empty, this will be equal to `baseline_events_count`.
formatint32
typeinteger
progress
descriptionA value from 0 to 1 representing the progress of the operation.
formatdouble
typenumber
snapshotQuery
descriptionQuery used to filter the baseline query's events.
typestring
snapshotTimeRange
$refInterval
descriptionTime range used to filter the baseline query's events [inclusive start time, exclusive end time). This time range is completely within `baseline_time_range`. If not set, it is assumed to match `baseline_time_range`.
startTime
descriptionThe start time of the operation.
formatgoogle-datetime
typestring
statsRowsCount
descriptionThe total number of rows returned for a stats query.
formatint32
typeinteger
typeobject
UdmValueCount
idUdmValueCount
properties
baselineEventCount
formatint32
typeinteger
eventCount
formatint32
typeinteger
value
$refUdmFieldValue
typeobject
Uint64Sequence
descriptionUint64Sequence represents a sequence of uint64s.
idUint64Sequence
properties
uint64Vals
descriptionuint64 sequence.
items
formatuint64
typestring
typearray
typeobject
Url
descriptionUrl.
idUrl
properties
categories
descriptionCategorisation done by VirusTotal partners.
items
typestring
typearray
favicon
$refFavicon
descriptionDifference hash and MD5 hash of the URL's.
htmlMeta
additionalProperties
descriptionProperties of the object.
typeany
descriptionMeta tags (only for URLs downloading HTML).
typeobject
lastFinalUrl
descriptionIf the original URL redirects, where does it end.
typestring
lastHttpResponseCode
descriptionHTTP response code of the last response.
formatint32
typeinteger
lastHttpResponseContentLength
descriptionLength in bytes of the content received.
formatint64
typestring
lastHttpResponseContentSha256
descriptionURL response body's SHA256 hash.
typestring
lastHttpResponseCookies
additionalProperties
descriptionProperties of the object.
typeany
descriptionWebsite's cookies.
typeobject
lastHttpResponseHeaders
additionalProperties
descriptionProperties of the object.
typeany
descriptionHeaders and values of the last HTTP response.
typeobject
tags
descriptionTags.
items
typestring
typearray
title
descriptionWebpage title.
typestring
trackers
descriptionTrackers found in the URL in a historical manner.
items
$refTracker
typearray
url
descriptionURL.
typestring
typeobject
User
descriptionInformation about a user.
idUser
properties
accountExpirationTime
descriptionUser account expiration timestamp.
formatgoogle-datetime
typestring
accountLockoutTime
descriptionUser account lockout timestamp.
formatgoogle-datetime
typestring
accountType
descriptionType of user account (for example, service, domain, or cloud). This is somewhat aligned to: https://attack.mitre.org/techniques/T1078/
enum
  • ACCOUNT_TYPE_UNSPECIFIED
  • DOMAIN_ACCOUNT_TYPE
  • LOCAL_ACCOUNT_TYPE
  • CLOUD_ACCOUNT_TYPE
  • SERVICE_ACCOUNT_TYPE
  • DEFAULT_ACCOUNT_TYPE
enumDescriptions
  • Default user account type.
  • A human account part of some domain in directory services.
  • A local machine account.
  • A SaaS service account type (such as Slack or GitHub).
  • A non-human account for data access.
  • A system built in default account.
typestring
attribute
$refAttribute
descriptionGeneric entity metadata attributes of the user.
companyName
descriptionUser job company name.
typestring
department
descriptionUser job department
items
typestring
typearray
emailAddresses
descriptionEmail addresses of the user. This field can be used as an entity indicator for user entities.
items
typestring
typearray
employeeId
descriptionHuman capital management identifier. This field can be used as an entity indicator for user entities.
typestring
firstName
descriptionFirst name of the user (e.g. "John").
typestring
firstSeenTime
descriptionThe first observed time for a user. The value is calculated on the basis of the first time the identifier was observed.
formatgoogle-datetime
typestring
groupIdentifiers
descriptionProduct object identifiers of the group(s) the user belongs to A vendor-specific identifier to uniquely identify the group(s) the user belongs to (a GUID, LDAP OID, or similar).
items
typestring
typearray
groupid
deprecatedTrue
descriptionThe ID of the group that the user belongs to. Deprecated in favor of the repeated group_identifiers field.
typestring
hireDate
descriptionUser job employment hire date.
formatgoogle-datetime
typestring
lastBadPasswordAttemptTime
descriptionUser last bad password attempt timestamp.
formatgoogle-datetime
typestring
lastLoginTime
descriptionUser last login timestamp.
formatgoogle-datetime
typestring
lastName
descriptionLast name of the user (e.g. "Locke").
typestring
lastPasswordChangeTime
descriptionUser last password change timestamp.
formatgoogle-datetime
typestring
managers
descriptionUser job manager(s).
items
$refUser
typearray
middleName
descriptionMiddle name of the user.
typestring
officeAddress
$refLocation
descriptionUser job office location.
passwordExpirationTime
descriptionUser password expiration timestamp.
formatgoogle-datetime
typestring
personalAddress
$refLocation
descriptionPersonal address of the user.
phoneNumbers
descriptionPhone numbers for the user.
items
typestring
typearray
productObjectId
descriptionA vendor-specific identifier to uniquely identify the entity (e.g. a GUID, LDAP, OID, or similar). This field can be used as an entity indicator for user entities.
typestring
roleDescription
deprecatedTrue
descriptionSystem role description for user. Deprecated: use attribute.roles.
typestring
roleName
deprecatedTrue
descriptionSystem role name for user. Deprecated: use attribute.roles.
typestring
terminationDate
descriptionUser job employment termination date.
formatgoogle-datetime
typestring
timeOff
descriptionUser time off leaves from active work.
items
$refTimeOff
typearray
title
descriptionUser job title.
typestring
userAuthenticationStatus
descriptionSystem authentication status for user.
enum
  • UNKNOWN_AUTHENTICATION_STATUS
  • ACTIVE
  • SUSPENDED
  • NO_ACTIVE_CREDENTIALS
  • DELETED
enumDescriptions
  • The default authentication status.
  • The authentication method is in active state.
  • The authentication method is in suspended/disabled state.
  • The authentication method has no active credentials.
  • The authentication method has been deleted.
typestring
userDisplayName
descriptionThe display name of the user (e.g. "John Locke").
typestring
userRole
deprecatedTrue
descriptionSystem role for user. Deprecated: use attribute.roles.
enum
  • UNKNOWN_ROLE
  • ADMINISTRATOR
  • SERVICE_ACCOUNT
enumDeprecated
  • False
  • False
  • True
enumDescriptions
  • Default user role.
  • Product administrator with elevated privileges.
  • System service account for automated privilege access. Deprecated: not a role, instead set User.account_type.
typestring
userid
descriptionThe ID of the user. This field can be used as an entity indicator for user entities.
typestring
windowsSid
descriptionThe Microsoft Windows SID of the user. This field can be used as an entity indicator for user entities.
typestring
typeobject
UserAgentProto
idUserAgentProto
properties
annotation
items
$refAnnotation
typearray
browser
descriptionProduct brand within the family: Firefox, Netscape, Camino etc.. Or Earth, Windows-Media-Player etc.. for non-browser user agents.
typestring
browserEngineVersion
descriptionVersion of the rendering engine e.g. "8.01" for "Opera/8.01"
typestring
browserVersion
descriptionMinor and lower versions unavailable with reduced User-Agent and no client hints (go/ua-reduction-ua-string-reference).
typestring
carrier
descriptionMobile specific: name of mobile carrier
typestring
device
description(Usually) Mobile specific: name of hardware device, may or may not contain the full model name. e.g. iPhone, Palm750, SPH-M800. Reduced to "K" for Android devices with reduced User-Agent and no client hints (go/ua-reduction-ua-string-reference).
typestring
deviceVersion
description(Usually) Mobile specific: version of hardware device Unavailable with reduced User-Agent and no client hints (go/ua-reduction-ua-string-reference).
typestring
family
descriptionUser agent family captures the type of browser/app at a high-level e.g. MSIE, Gecko, Safari etc..
enum
  • USER_DEFINED
  • MSIE
  • GECKO
  • APPLEWEBKIT
  • OPERA
  • KHTML
  • OTHER
  • APPLE
  • BLACKBERRY
  • DOCOMO
  • GOOGLE
  • OPENWAVE
  • POLARIS
  • OBIGO
  • TELECA
  • MICROSOFT
  • NOKIA
  • NETFRONT
  • SEMC
  • SMIT
  • KOREAN
  • CLIENT_HINTS
enumDescriptions
  • Used to represent new families supported by user-defined parsers
  • Desktop user agent families
  • WebKit based browsers e.g. Safari
  • e.g. Konqueror
  • Mobile and non-browser user agent families UA's w/o enough data to fit into a family
  • Apple apps e.g. YouTube on iPhone
  • Google Earth, Sketchup, UpdateChecker etc...
  • UP.Browser
  • Windows Media Player, RSS platform etc...
  • Sony Ericsson Mobile Communications
  • SKT, LGT
  • Constructed from UA-CH instead of UserAgent string.
typestring
googleToolbarVersion
descriptionVersion number of GoogleToolbar, if installed. Applies only to MSIE and Firefox at this time.
typestring
javaConfiguration
descriptionMobile specific: e.g. Configuration/CLDC-1.1
typestring
javaConfigurationVersion
typestring
javaProfile
descriptionMobile specific: e.g. Profile/MIDP-2.0
typestring
javaProfileVersion
typestring
locale
descriptionLocale in which the browser is running as country code and optionally language pair. Unavailable with reduced User-Agent and no client hints (go/ua-reduction-ua-string-reference).
typestring
messaging
descriptionMobile specific: e.g. MMP/2.0
typestring
messagingVersion
typestring
os
descriptionFull name of the operating system e.g. "Darwin/9.7.0", "Android 1.5", "Windows 98" Version is reduced, and other data might also be missing, for reduced User-Agent and no client hints (go/ua-reduction-ua-string-reference).
typestring
osVariant
descriptionExtra qualifier for the OS e.g. "(i386)", "Build/CUPCAKE", "PalmSource/Palm-D061" Unavailable with reduced User-Agent and no client hints (go/ua-reduction-ua-string-reference).
typestring
platform
descriptionThe platform describes the environment in which the browser or app runs. For desktop user agents, Platform is a string describing the OS family e.g. Windows, Macintosh, Linux. For mobile user agents, Platform either describes the OS family (if available) or the hardware maker. e.g. Linux, or HTC, LG, Palm.
typestring
security
descriptionSecurity level reported by user agent, either U, I or N. Unavailable with reduced User-Agent and no client hints (go/ua-reduction-ua-string-reference).
typestring
subFamily
descriptionSub-family identifies individual regexps when a family has more than 1. This is used to generate the right UA string from a protobuf. Examples in the AppleWebKit family: Chrome and Safari. Can also be an arbitrary identifier.
typestring
typeobject
UserError
descriptionThis message exists solely to get the `UserErrorReason` enum to appear in the service discovery document.
idUserError
properties
reason
descriptionThe reason for a specific error that should be shown to the app user.
enum
  • USER_ERROR_REASON_UNSPECIFIED
  • RULE_REFERENCES_OUT_OF_SCOPE
  • RULE_ARCHIVED
  • RULE_STALE_VERSION
  • RULE_ACTIVE
  • RULE_RETROHUNT_RUNNING
  • RULE_LIVE
  • RULE_ALREADY_DISABLED
  • EXPENSIVE_RULE_LARGE_WINDOW
  • RULE_LIMITED_PAUSED
  • REFERENCE_LIST_NOT_FOUND
  • UEBA_RULES_NO_SCOPE
  • RULE_TESTING_INTERVAL_TOO_SHORT
  • SEARCH_CSV_FIELDS_NOT_SUPPORTED
  • INVALID_ARGUMENT_FOR_DASHBOARD_FILTER
  • INVALID_CONFIG_FOR_DASHBOARD_IMPORT
  • RETROHUNT_LIMIT_REACHED
enumDescriptions
  • Do not use this default value.
  • The rule text references resources, such as reference lists, that are out of scope for the rule. Example of an ErrorInfo for this reason: { "reason": "RULE_REFERENCES_OUT_OF_SCOPE", "domain": "chronicle.googleapis.com", "metadata": { "reference_lists": "list_name1,list_name2,list_name3,", } }
  • The rule being operated on (saving or setting run frequency) is archived, and so the operation can't be done.
  • The rule version being operated on is not the latest, and so the operation can't be done.
  • The rule can't be archived because it is live (detecting) and a retrohunt is running.
  • The rule can't be archived because a retrohunt is running against it.
  • The rule can't be archived because it is live (detecting).
  • The rule can't be disabled because is is already disabled.
  • The rule's match time window is too large for its current run frequency.
  • The rule can't be enabled because it has been limited or paused because of high resource use.
  • The list being referred to doesn't exist.
  • UEBA rules may not be assigned a data access scope.
  • The rule's match window is longer than the time range it's being tested over. Returns the match window duration and testing interval duration as metadata labeled `match_window_duration` and `testing_interval_duration`, formatted as Go durations. Example ErrorInfo: { "reason": "RULE_TESTING_INTERVAL_TOO_SHORT", "domain": "chronicle.googleapis.com", "metadata": { "match_window_duration": "24h", "testing_interval_duration": "12h", } }
  • The CSV fields are not supported for download. Returns the unsupported fields as metadata labeled `unsupported_fields`. Example ErrorInfo: { "reason": "SEARCH_CSV_FIELDS_NOT_SUPPORTED", "domain": "chronicle.googleapis.com", "metadata": { "unsupported_fields": "udm.about.security_result.variables,udm.network.http.parsed_user_agent.family", } }
  • Invalid argument for dashboard chart filters. Returns the filter name, filter value, operator, and expected type as metadata labeled `filter_name`, `filter_value`, `operator`, and `expected_type`, respectively. Example ErrorInfo: { "reason": "INVALID_ARGUMENT_FOR_DASHBOARD_FILTER", "domain": "chronicle.googleapis.com", "metadata": { "filter_name": "filter_name", "filter_value": "filter_value", "operater": "operator", "expected_type": "expected_type", } }
  • Invalid config for dashboard import. Example ErrorInfo: { "reason": "INVALID_CONFIG_FOR_DASHBOARD_IMPORT", "domain": "chronicle.googleapis.com", }
  • The user has reached the limit of retrohunts that can be run. Returns the retrohunt limit as metadata labeled `retrohunt_limit`. Example ErrorInfo: { "reason": "RETROHUNT_LIMIT_REACHED", "domain": "chronicle.googleapis.com", "metadata": { "retrohunt_limit": "10", } }
typestring
typeobject
Validity
descriptionDefines certificate's validity period.
idValidity
properties
expiryTime
descriptionExpiry date.
formatgoogle-datetime
typestring
issueTime
descriptionIssue date.
formatgoogle-datetime
typestring
typeobject
Verdict
descriptionDeprecated. Encapsulates the threat verdict provided by human analysts and ML models. These fields are used to model Mandiant sources.
idVerdict
properties
analystVerdict
$refAnalystVerdict
descriptionHuman analyst verdict provided by sources like Mandiant.
neighbourInfluence
descriptionDescribes the neighbour influence of the verdict.
typestring
responseCount
descriptionTotal response count across all sources.
formatint32
typeinteger
sourceCount
descriptionNumber of sources from which intelligence was extracted.
formatint32
typeinteger
verdict
$refProviderMLVerdict
descriptionML Verdict provided by sources like Mandiant.
typeobject
VerdictInfo
descriptionDescribes the threat verdict provided by human analysts and machine learning models. These fields are used to model Mandiant sources.
idVerdictInfo
properties
benignCount
descriptionCount of responses where this IoC was marked as benign.
formatint32
typeinteger
categoryDetails
descriptionTags related to the verdict.
typestring
confidenceScore
descriptionConfidence score of the verdict.
formatint32
typeinteger
globalCustomerCount
descriptionGlobal customer count over the last 30 days
formatint32
typeinteger
globalHitsCount
descriptionGlobal hit count over the last 30 days.
formatint32
typeinteger
iocStats
descriptionList of IoCStats from which the verdict was generated.
items
$refIoCStats
typearray
maliciousCount
descriptionCount of responses where this IoC was marked as malicious.
formatint32
typeinteger
neighbourInfluence
descriptionDescribes the near neighbor influence of the verdict.
typestring
pwn
descriptionWhether one or more Mandiant incident response customers had this indicator in their environment.
typeboolean
pwnFirstTaggedTime
descriptionThe timestamp of the first time a pwn was associated to this entity.
formatgoogle-datetime
typestring
responseCount
descriptionTotal response count across all sources.
formatint32
typeinteger
sourceCount
descriptionNumber of sources from which intelligence was extracted.
formatint32
typeinteger
sourceProvider
descriptionSource provider giving the machine learning verdict.
typestring
verdictResponse
descriptionDetails about the verdict.
enum
  • VERDICT_RESPONSE_UNSPECIFIED
  • MALICIOUS
  • BENIGN
enumDescriptions
  • The default verdict response type.
  • VerdictResponse resulted a threat as malicious.
  • VerdictResponse resulted a threat as benign.
typestring
verdictTime
descriptionTimestamp when the verdict was generated.
formatgoogle-datetime
typestring
verdictType
descriptionType of verdict.
enum
  • VERDICT_TYPE_UNSPECIFIED
  • PROVIDER_ML_VERDICT
  • ANALYST_VERDICT
enumDescriptions
  • Verdict category not specified.
  • MLVerdict result provided from threat providers, like Mandiant. These fields are used to model Mandiant sources.
  • Verdict provided by the human analyst. These fields are used to model Mandiant sources.
typestring
typeobject
Vulnerabilities
descriptionThe Vulnerabilities extension captures details on observed/detected vulnerabilities.
idVulnerabilities
properties
vulnerabilities
descriptionA list of vulnerabilities.
items
$refVulnerability
typearray
typeobject
Vulnerability
descriptionA vulnerability.
idVulnerability
properties
about
$refNoun
descriptionIf the vulnerability is about a specific noun (e.g. executable), then add it here.
cveDescription
descriptionCommon Vulnerabilities and Exposures Description. https://cve.mitre.org/about/faqs.html#what_is_cve_record
typestring
cveId
descriptionCommon Vulnerabilities and Exposures Id. https://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures https://cve.mitre.org/about/faqs.html#what_is_cve_id
typestring
cvssBaseScore
descriptionCVSS Base Score in the range of 0.0 to 10.0. Useful for sorting.
formatfloat
typenumber
cvssVector
descriptionVector of CVSS properties (e.g. "AV:L/AC:H/Au:N/C:N/I:P/A:C") Can be linked to via: https://nvd.nist.gov/vuln-metrics/cvss/v2-calculator
typestring
cvssVersion
descriptionVersion of CVSS Vector/Score.
typestring
description
descriptionDescription of the vulnerability.
typestring
firstFound
descriptionProducts that maintain a history of vuln scans should populate first_found with the time that a scan first detected the vulnerability on this asset.
formatgoogle-datetime
typestring
lastFound
descriptionProducts that maintain a history of vuln scans should populate last_found with the time that a scan last detected the vulnerability on this asset.
formatgoogle-datetime
typestring
name
descriptionName of the vulnerability (e.g. "Unsupported OS Version detected").
typestring
scanEndTime
descriptionIf the vulnerability was discovered during an asset scan, then this field should be populated with the time the scan ended. This field can be left unset if the end time is not available or not applicable.
formatgoogle-datetime
typestring
scanStartTime
descriptionIf the vulnerability was discovered during an asset scan, then this field should be populated with the time the scan started. This field can be left unset if the start time is not available or not applicable.
formatgoogle-datetime
typestring
severity
descriptionThe severity of the vulnerability.
enum
  • UNKNOWN_SEVERITY
  • LOW
  • MEDIUM
  • HIGH
  • CRITICAL
enumDescriptions
  • The default severity level.
  • Low severity.
  • Medium severity.
  • High severity.
  • Critical severity.
typestring
severityDetails
descriptionVendor-specific severity
typestring
vendor
descriptionVendor of scan that discovered vulnerability.
typestring
vendorKnowledgeBaseArticleId
descriptionVendor specific knowledge base article (e.g. "KBXXXXXX" from Microsoft). https://en.wikipedia.org/wiki/Microsoft_Knowledge_Base https://access.redhat.com/knowledgebase
typestring
vendorVulnerabilityId
descriptionVendor specific vulnerability id (e.g. Microsoft security bulletin id).
typestring
typeobject
Watchlist
descriptionA watchlist is a list of entities that allows for bulk operations over the included entities.
idWatchlist
properties
createTime
descriptionOutput only. Time the watchlist was created.
formatgoogle-datetime
readOnlyTrue
typestring
description
descriptionOptional. Description of the watchlist.
typestring
displayName
descriptionRequired. Display name of the watchlist. Note that it must be at least one character and less than 63 characters (https://google.aip.dev/148).
typestring
entityCount
$refEntityCount
descriptionOutput only. Entity count in the watchlist.
readOnlyTrue
entityPopulationMechanism
$refEntityPopulationMechanism
descriptionRequired. Mechanism to populate entities in the watchlist.
multiplyingFactor
descriptionOptional. Weight applied to the risk score for entities in this watchlist. The default is 1.0 if it is not specified.
formatfloat
typenumber
name
descriptionIdentifier. Resource name of the watchlist. Format: projects/{project}/locations/{location}/instances/{instance}/watchlists/{watchlist}
typestring
updateTime
descriptionOutput only. Time the watchlist was last updated.
formatgoogle-datetime
readOnlyTrue
typestring
watchlistUserPreferences
$refWatchlistUserPreferences
descriptionOptional. User preferences for watchlist configuration.
typeobject
WatchlistUserPreferences
descriptionA collection of user preferences for watchlist UI configuration.
idWatchlistUserPreferences
properties
pinned
descriptionOptional. Whether the watchlist is pinned on the dashboard.
typeboolean
typeobject
X509
descriptionFile certificate.
idX509
properties
algorithm
descriptionCertificate algorithm.
typestring
certIssuer
descriptionIssuer of the certificate.
typestring
name
descriptionCertificate name.
typestring
serialNumber
descriptionCertificate serial number.
typestring
thumbprint
descriptionCertificate thumbprint.
typestring
typeobject
old_value
CancelOperationRequest
descriptionThe request message for Operations.CancelOperation.
idCancelOperationRequest
properties
typeobject
CompilationDiagnostic
descriptionCompilationDiagnostic represents a compilation diagnostic generated during a rule's compilation, such as a compilation error or a compilation warning.
idCompilationDiagnostic
properties
message
descriptionOutput only. The diagnostic message.
readOnlyTrue
typestring
position
$refCompilationPosition
descriptionOutput only. The approximate position in the rule text associated with the compilation diagnostic. Compilation Position may be empty.
readOnlyTrue
severity
descriptionOutput only. The severity of a rule's compilation diagnostic.
enum
  • SEVERITY_UNSPECIFIED
  • WARNING
  • ERROR
enumDescriptions
  • An unspecified severity level.
  • A compilation warning.
  • A compilation error.
readOnlyTrue
typestring
uri
descriptionOutput only. Link to documentation that describes a diagnostic in more detail.
readOnlyTrue
typestring
typeobject
CompilationPosition
descriptionCompilationPosition represents the location of a compilation diagnostic in rule text.
idCompilationPosition
properties
endColumn
descriptionOutput only. End column number, beginning at 1.
formatint32
readOnlyTrue
typeinteger
endLine
descriptionOutput only. End line number, beginning at 1.
formatint32
readOnlyTrue
typeinteger
startColumn
descriptionOutput only. Start column number, beginning at 1.
formatint32
readOnlyTrue
typeinteger
startLine
descriptionOutput only. Start line number, beginning at 1.
formatint32
readOnlyTrue
typeinteger
typeobject
CreateParserExtensionMetadata
descriptionOperation metadata for creating a parser extension.
idCreateParserExtensionMetadata
properties
state
descriptionThe state of the parser extension creation process.
enum
  • STATE_UNSPECIFIED
  • NEW
  • VALIDATING
  • LIVE
  • REJECTED
  • INTERNAL_ERROR
  • VALIDATED
  • ARCHIVED
enumDescriptions
  • The state for this parser extension was not specified.
  • The parser extension has been newly submitted and is waiting to be validated.
  • The parser extension is currently going through the validation pipeline.
  • The parser extension is live in production. Only configs that have successfully passed the validation stage will be set to LIVE.
  • Validation completed, but the parser extension was rejected with errors.
  • An error occurred when processing this parser extension.
  • Extension is validated.
  • Extension is archived and is no more being used.
typestring
stateLastChangedTime
descriptionThe time the config state was last changed.
formatgoogle-datetime
typestring
validationErrors
descriptionAny validation error while validating the extension, this have cap of size 10
items
typestring
typearray
validationReport
descriptionThe validation report generated during validation of the parser extension.
typestring
typeobject
CreateParserMetadata
descriptionOperation metadata for creating a parser.
idCreateParserMetadata
properties
stage
descriptionThe validation stage of the parser creation process.
enum
  • VALIDATION_STAGE_UNSPECIFIED
  • NEW
  • VALIDATING
  • PASSED
  • FAILED
  • DELETE_CANDIDATE
enumDescriptions
  • The validation stage is not specified.
  • The custom parser is submitted for validation.
  • The custom parser is currently going through the validation pipeline
  • The custom parser has successfully passed the validation.
  • The custom parser has failed validation.
  • The parser is no good, It is available for auto deletion.
typestring
validationReport
descriptionThe validation report generated during validation of the parser.
typestring
typeobject
DataAccessLabel
descriptionA DataAccessLabel is a label on events to define user access to data.
idDataAccessLabel
properties
author
descriptionOutput only. The user who created the data access label.
readOnlyTrue
typestring
createTime
descriptionOutput only. The time at which the data access label was created.
formatgoogle-datetime
readOnlyTrue
typestring
description
descriptionOptional. A description of the data access label for a human reader.
typestring
displayName
descriptionOutput only. The short name displayed for the label as it appears on event data.
readOnlyTrue
typestring
lastEditor
descriptionOutput only. The user who last updated the data access label.
readOnlyTrue
typestring
name
descriptionRequired. The unique resource name of the data access label.
typestring
udmQuery
descriptionA UDM query over event data.
typestring
updateTime
descriptionOutput only. The time at which the data access label was last updated.
formatgoogle-datetime
readOnlyTrue
typestring
typeobject
DataAccessLabelReference
descriptionReference object to a data access label.
idDataAccessLabelReference
properties
assetNamespace
descriptionThe asset namespace configured in the forwarder of the customer's events.
typestring
dataAccessLabel
descriptionThe name of the data access label.
typestring
displayName
descriptionOutput only. The display name of the label. Data access label and log types's name will match the display name of the resource. The asset namespace will match the namespace itself. The ingestion key value pair will match the key of the tuple.
readOnlyTrue
typestring
ingestionLabel
$refIngestionLabel
descriptionThe ingestion label configured in the forwarder of the customer's events.
logType
descriptionThe name of the log type.
typestring
typeobject
DataAccessScope
descriptionA DataAccessScope is a boolean expression of data access labels used to restrict access to data for users.
idDataAccessScope
properties
allowAll
descriptionOptional. Whether or not the scope allows all labels, allow_all and allowed_data_access_labels are mutually exclusive and one of them must be present. denied_data_access_labels can still be used along with allow_all. When combined with denied_data_access_labels, access will be granted to all data that doesn't have labels mentioned in denied_data_access_labels. E.g.: A customer with scope with denied labels A and B and allow_all will be able to see all data except data labeled with A and data labeled with B and data with labels A and B.
typeboolean
allowedDataAccessLabels
descriptionOptional. The allowed labels for the scope. Either allow_all or allowed_data_access_labels needs to be provided. When provided, there has to be at least one label allowed for the scope to be valid. The logical operator for evaluation of the allowed labels is OR. E.g.: A customer with scope with allowed labels A and B will be able to see data with labeled with A or B or (A and B).
items
$refDataAccessLabelReference
typearray
author
descriptionOutput only. The user who created the data access scope.
readOnlyTrue
typestring
createTime
descriptionOutput only. The time at which the data access scope was created.
formatgoogle-datetime
readOnlyTrue
typestring
deniedDataAccessLabels
descriptionOptional. The denied labels for the scope. The logical operator for evaluation of the denied labels is AND. E.g.: A customer with scope with denied labels A and B won't be able to see data labeled with A and data labeled with B and data with labels A and B.
items
$refDataAccessLabelReference
typearray
description
descriptionOptional. A description of the data access scope for a human reader.
typestring
displayName
descriptionOutput only. The name to be used for display to customers of the data access scope.
readOnlyTrue
typestring
lastEditor
descriptionOutput only. The user who last updated the data access scope.
readOnlyTrue
typestring
name
descriptionRequired. The unique full name of the data access scope. The name should comply with https://google.aip.dev/122 standards.
typestring
updateTime
descriptionOutput only. The time at which the data access scope was last updated.
formatgoogle-datetime
readOnlyTrue
typestring
typeobject
Empty
descriptionA generic empty message that you can re-use to avoid defining duplicated empty messages in your APIs. A typical example is to use it as the request or the response type of an API method. For instance: service Foo { rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty); }
idEmpty
properties
typeobject
EntityCount
descriptionCount of different types of entities in the watchlist.
idEntityCount
properties
asset
descriptionOutput only. Count of asset type entities in the watchlist.
formatint32
readOnlyTrue
typeinteger
user
descriptionOutput only. Count of user type entities in the watchlist.
formatint32
readOnlyTrue
typeinteger
typeobject
EntityPopulationMechanism
descriptionMechanism to populate entities in the watchlist.
idEntityPopulationMechanism
properties
manual
$refManual
descriptionOptional. Entities are added manually.
typeobject
IngestionLabel
descriptionRepresentation of an ingestion label type.
idIngestionLabel
properties
ingestionLabelKey
descriptionRequired. The key of the ingestion label. Always required.
typestring
ingestionLabelValue
descriptionOptional. The value of the ingestion label. Optional. An object with no provided value and some key provided would match against the given key and ANY value.
typestring
typeobject
InputsUsed
descriptionInputsUsed is a convenience field that tells us which sources of events (if any) were used in the rule. NEXT TAG: 4
idInputsUsed
properties
usesDetection
descriptionOptional. Whether the rule queries detections.
typeboolean
usesEntity
descriptionOptional. Whether the rule queries entity events.
typeboolean
usesUdm
descriptionOptional. Whether the rule queries UDM events.
typeboolean
typeobject
Instance
descriptionA Instance represents an instantiation of the Instance product.
idInstance
properties
name
descriptionOutput only. The resource name of this instance. Format: projects/{project}/locations/{region}/instances/{instance}
readOnlyTrue
typestring
typeobject
Interval
descriptionRepresents a time interval, encoded as a Timestamp start (inclusive) and a Timestamp end (exclusive). The start must be less than or equal to the end. When the start equals the end, the interval is empty (matches no time). When both start and end are unspecified, the interval matches any time.
idInterval
properties
endTime
descriptionOptional. Exclusive end of the interval. If specified, a Timestamp matching this interval will have to be before the end.
formatgoogle-datetime
typestring
startTime
descriptionOptional. Inclusive start of the interval. If specified, a Timestamp matching this interval will have to be the same or after the start.
formatgoogle-datetime
typestring
typeobject
ListDataAccessLabelsResponse
descriptionResponse message for ListDataAccessLabels.
idListDataAccessLabelsResponse
properties
dataAccessLabels
descriptionList of data access labels.
items
$refDataAccessLabel
typearray
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
typeobject
ListDataAccessScopesResponse
descriptionResponse message for ListDataAccessScopes.
idListDataAccessScopesResponse
properties
dataAccessScopes
descriptionList of data access scopes.
items
$refDataAccessScope
typearray
globalDataAccessScopeGranted
descriptionWhether or not global scope is granted to the user.
typeboolean
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
typeobject
ListOperationsResponse
descriptionThe response message for Operations.ListOperations.
idListOperationsResponse
properties
nextPageToken
descriptionThe standard List next-page token.
typestring
operations
descriptionA list of operations that matches the specified filter in the request.
items
$refOperation
typearray
typeobject
ListReferenceListsResponse
descriptionA response to a request for a list of reference lists.
idListReferenceListsResponse
properties
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
referenceLists
descriptionThe reference lists. Ordered in ascending alphabetical order by name.
items
$refReferenceList
typearray
typeobject
ListRetrohuntsResponse
descriptionResponse message for ListRetrohunts method.
idListRetrohuntsResponse
properties
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
retrohunts
descriptionThe retrohunts from the specified rule.
items
$refRetrohunt
typearray
typeobject
ListRuleDeploymentsResponse
descriptionResponse message for ListRuleDeployments.
idListRuleDeploymentsResponse
properties
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
ruleDeployments
descriptionThe rule deployments from all rules.
items
$refRuleDeployment
typearray
typeobject
ListRuleRevisionsResponse
descriptionResponse message for ListRuleRevisions method.
idListRuleRevisionsResponse
properties
nextPageToken
descriptionA token that can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
rules
descriptionThe revisions of the rule.
items
$refRule
typearray
typeobject
ListRulesResponse
descriptionResponse message for ListRules method.
idListRulesResponse
properties
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
rules
descriptionThe rules from the specified instance.
items
$refRule
typearray
typeobject
ListWatchlistsResponse
descriptionResponse message for listing watchlists.
idListWatchlistsResponse
properties
nextPageToken
descriptionOptional. A token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
watchlists
descriptionOptional. The watchlists from the specified instance.
items
$refWatchlist
typearray
typeobject
Manual
descriptionEntities are added manually.
idManual
properties
typeobject
Operation
descriptionThis resource represents a long-running operation that is the result of a network API call.
idOperation
properties
done
descriptionIf the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available.
typeboolean
error
$refStatus
descriptionThe error result of the operation in case of failure or cancellation.
metadata
additionalProperties
descriptionProperties of the object. Contains field @type with type URL.
typeany
descriptionService-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any.
typeobject
name
descriptionThe server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`.
typestring
response
additionalProperties
descriptionProperties of the object. Contains field @type with type URL.
typeany
descriptionThe normal, successful response of the operation. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`.
typeobject
typeobject
ReferenceList
descriptionA reference list. Reference lists are user-defined lists of values which users can use in multiple Rules.
idReferenceList
properties
description
descriptionRequired. A user-provided description of the reference list.
typestring
displayName
descriptionOutput only. The unique display name of the reference list.
readOnlyTrue
typestring
entries
descriptionRequired. The entries of the reference list. When listed, they are returned in the order that was specified at creation or update. The combined size of the values of the reference list may not exceed 6MB. This is returned only when the view is REFERENCE_LIST_VIEW_FULL.
items
$refReferenceListEntry
typearray
name
descriptionOutput only. The resource name of the reference list. Format: projects/{project}/locations/{location}/instances/{instance}/referenceLists/{reference_list}
readOnlyTrue
typestring
revisionCreateTime
descriptionOutput only. The timestamp when the reference list was last updated.
formatgoogle-datetime
readOnlyTrue
typestring
ruleAssociationsCount
descriptionOutput only. The count of self-authored rules using the reference list.
formatint32
readOnlyTrue
typeinteger
rules
descriptionOutput only. The resource names for the associated self-authored Rules that use this reference list. This is returned only when the view is REFERENCE_LIST_VIEW_FULL.
items
typestring
readOnlyTrue
typearray
scopeInfo
$refScopeInfo
descriptionOutput only. The scope info of the reference list. During reference list creation, if this field is not set, the reference list without scopes (an unscoped list) will be created for an unscoped user. For a scoped user, this field must be set. During reference list update, if scope_info is requested to be updated, this field must be set.
readOnlyTrue
syntaxType
descriptionRequired. The syntax type indicating how list entries should be validated.
enum
  • REFERENCE_LIST_SYNTAX_TYPE_UNSPECIFIED
  • REFERENCE_LIST_SYNTAX_TYPE_PLAIN_TEXT_STRING
  • REFERENCE_LIST_SYNTAX_TYPE_REGEX
  • REFERENCE_LIST_SYNTAX_TYPE_CIDR
enumDescriptions
  • Defaults to REFERENCE_LIST_SYNTAX_TYPE_PLAIN_TEXT_STRING.
  • List contains plain text patterns.
  • List contains only Regular Expression patterns.
  • List contains only CIDR patterns.
typestring
typeobject
ReferenceListEntry
descriptionAn entry in a reference list.
idReferenceListEntry
properties
value
descriptionRequired. The value of the entry. Maximum length is 512 characters.
typestring
typeobject
ReferenceListScope
descriptionReferenceListScope specifies the list of scope names of the reference list.
idReferenceListScope
properties
scopeNames
descriptionOptional. The list of scope names of the reference list. The scope names should be full resource names and should be of the format: "projects/{project}/locations/{location}/instances/{instance}/dataAccessScopes/{scope_name}".
items
typestring
typearray
typeobject
Retrohunt
descriptionRetrohunt is an execution of a Rule over a time range in the past.
idRetrohunt
properties
executionInterval
$refInterval
descriptionOutput only. The start and end time of the retrohunt execution. If the retrohunt is not yet finished, the end time of the interval will not be populated.
readOnlyTrue
name
descriptionThe resource name of the retrohunt. Retrohunt is the child of a rule revision. {rule} in the format below is structured as {rule_id@revision_id}. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}/retrohunts/{retrohunt}
typestring
processInterval
$refInterval
descriptionRequired. The start and end time of the event time range this retrohunt processes.
progressPercentage
descriptionOutput only. Percent progress of the retrohunt towards completion, from 0.00 to 100.00.
formatfloat
readOnlyTrue
typenumber
state
descriptionOutput only. The state of the retrohunt.
enum
  • STATE_UNSPECIFIED
  • RUNNING
  • DONE
  • CANCELLED
  • FAILED
enumDescriptions
  • Unspecified or unknown retrohunt state.
  • Running state.
  • Done state.
  • Cancelled state.
  • Failed state.
readOnlyTrue
typestring
typeobject
RetrohuntMetadata
descriptionOperation Metadata for Retrohunts.
idRetrohuntMetadata
properties
executionInterval
$refInterval
descriptionThe start and end time of the retrohunt execution. If the retrohunt is not yet finished, the end time of the interval will not be filled.
progressPercentage
descriptionPercent progress of the retrohunt towards completion, from 0.00 to 100.00.
formatfloat
typenumber
retrohunt
descriptionThe name of the retrohunt. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}/retrohunts/{retrohunt}
typestring
typeobject
Rule
descriptionThe Rule resource represents a user-created rule. NEXT TAG: 21
idRule
properties
allowedRunFrequencies
descriptionOutput only. The run frequencies that are allowed for the rule. Populated in BASIC view and FULL view.
items
enum
  • RUN_FREQUENCY_UNSPECIFIED
  • LIVE
  • HOURLY
  • DAILY
enumDescriptions
  • The run frequency is unspecified/unknown.
  • Executes in real time.
  • Executes once per hour.
  • Executes once per day.
typestring
readOnlyTrue
typearray
author
descriptionOutput only. The author of the rule. Extracted from the meta section of text. Populated in BASIC view and FULL view.
readOnlyTrue
typestring
compilationDiagnostics
descriptionOutput only. A list of a rule's corresponding compilation diagnostic messages such as compilation errors and compilation warnings. Populated in FULL view.
items
$refCompilationDiagnostic
readOnlyTrue
typearray
compilationState
descriptionOutput only. The current compilation state of the rule. Populated in FULL view.
enum
  • COMPILATION_STATE_UNSPECIFIED
  • SUCCEEDED
  • FAILED
enumDescriptions
  • The compilation state is unspecified/unknown.
  • The Rule can successfully compile.
  • The Rule cannot successfully compile. This is possible if a backwards-incompatible change was made to the compiler.
readOnlyTrue
typestring
createTime
descriptionOutput only. The timestamp of when the rule was created. Populated in FULL view.
formatgoogle-datetime
readOnlyTrue
typestring
dataTables
descriptionOutput only. Resource names of the data tables used in this rule.
items
typestring
readOnlyTrue
typearray
displayName
descriptionOutput only. Display name of the rule. Populated in BASIC view and FULL view.
readOnlyTrue
typestring
etag
descriptionThe etag for this rule. If this is provided on update, the request will succeed if and only if it matches the server-computed value, and will fail with an ABORTED error otherwise. Populated in BASIC view and FULL view.
typestring
inputsUsed
$refInputsUsed
descriptionOutput only. The set of inputs used in the rule. For example, if the rule uses $e.principal.hostname, then the uses_udm field will be true.
readOnlyTrue
metadata
additionalProperties
typestring
descriptionOutput only. Additional metadata specified in the meta section of text. Populated in FULL view.
readOnlyTrue
typeobject
name
descriptionFull resource name for the rule. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}
typestring
nearRealTimeLiveRuleEligible
descriptionOutput only. Indicate the rule can run in near real time live rule. If this is true, the rule uses the near real time live rule when the run frequency is set to LIVE.
readOnlyTrue
typeboolean
referenceLists
descriptionOutput only. Resource names of the reference lists used in this rule. Populated in FULL view.
items
typestring
readOnlyTrue
typearray
revisionCreateTime
descriptionOutput only. The timestamp of when the rule revision was created. Populated in FULL, REVISION_METADATA_ONLY views.
formatgoogle-datetime
readOnlyTrue
typestring
revisionId
descriptionOutput only. The revision ID of the rule. A new revision is created whenever the rule text is changed in any way. Format: v_{10 digits}_{9 digits} Populated in REVISION_METADATA_ONLY view and FULL view.
readOnlyTrue
typestring
scope
descriptionResource name of the DataAccessScope bound to this rule. Populated in BASIC view and FULL view. If reference lists are used in the rule, validations will be performed against this scope to ensure that the reference lists are compatible with both the user's and the rule's scopes. The scope should be in the format: "projects/{project}/locations/{location}/instances/{instance}/dataAccessScopes/{scope}".
typestring
severity
$refSeverity
descriptionOutput only. The severity of the rule as specified in the meta section of text. Populated in BASIC view and FULL view.
readOnlyTrue
text
descriptionThe YARA-L content of the rule. Populated in FULL view.
typestring
type
descriptionOutput only. User-facing type of the rule. Extracted from the events section of rule text. Populated in BASIC view and FULL view.
enum
  • RULE_TYPE_UNSPECIFIED
  • SINGLE_EVENT
  • MULTI_EVENT
enumDescriptions
  • The rule type is unspecified/unknown.
  • Rule checks for the existence of a single event.
  • Rule checks for correlation between multiple events
readOnlyTrue
typestring
typeobject
RuleDeployment
descriptionThe RuleDeployment resource represents the deployment state of a Rule.
idRuleDeployment
properties
alerting
descriptionWhether detections resulting from this deployment should be considered alerts.
typeboolean
archiveTime
descriptionOutput only. The timestamp when the rule deployment archive state was last set to true. If the rule deployment's current archive state is not set to true, the field will be empty.
formatgoogle-datetime
readOnlyTrue
typestring
archived
descriptionThe archive state of the rule deployment. Cannot be set to true unless enabled is set to false. If set to true, alerting will automatically be set to false. If currently set to true, enabled, alerting, and run_frequency cannot be updated.
typeboolean
consumerRules
descriptionOutput only. The names of the associated/chained consumer rules. Rules are considered consumers of this rule if their rule text explicitly filters on this rule's ruleid. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}
items
typestring
readOnlyTrue
typearray
enabled
descriptionWhether the rule is currently deployed continuously against incoming data.
typeboolean
executionState
descriptionOutput only. The execution state of the rule deployment.
enum
  • EXECUTION_STATE_UNSPECIFIED
  • DEFAULT
  • LIMITED
  • PAUSED
enumDescriptions
  • Unspecified or unknown execution state.
  • Default execution state.
  • Rules in limited state may not have their executions guaranteed.
  • Paused rules are not executed at all.
readOnlyTrue
typestring
lastAlertStatusChangeTime
descriptionOutput only. The timestamp when the rule deployment alert state was lastly changed. This is filled regardless of the current alert state. E.g. if the current alert status is false, this timestamp will be the timestamp when the alert status was changed to false.
formatgoogle-datetime
readOnlyTrue
typestring
name
descriptionRequired. The resource name of the rule deployment. Note that RuleDeployment is a child of the overall Rule, not any individual revision, so the resource ID segment for the Rule resource must not reference a specific revision. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}/deployment
typestring
producerRules
descriptionOutput only. The names of the associated/chained producer rules. Rules are considered producers for this rule if this rule explicitly filters on their ruleid. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}
items
typestring
readOnlyTrue
typearray
runFrequency
descriptionThe run frequency of the rule deployment.
enum
  • RUN_FREQUENCY_UNSPECIFIED
  • LIVE
  • HOURLY
  • DAILY
enumDescriptions
  • The run frequency is unspecified/unknown.
  • Executes in real time.
  • Executes once per hour.
  • Executes once per day.
typestring
typeobject
ScopeInfo
descriptionScopeInfo specifies the scope info of the reference list.
idScopeInfo
properties
referenceListScope
$refReferenceListScope
descriptionRequired. The list of scope names of the reference list, if the list is empty the reference list is treated as unscoped.
typeobject
Severity
descriptionSeverity represents the severity level of the rule.
idSeverity
properties
displayName
descriptionThe display name of the severity level. Extracted from the meta section of the rule text.
typestring
typeobject
Status
descriptionThe `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors).
idStatus
properties
code
descriptionThe status code, which should be an enum value of google.rpc.Code.
formatint32
typeinteger
details
descriptionA list of messages that carry the error details. There is a common set of message types for APIs to use.
items
additionalProperties
descriptionProperties of the object. Contains field @type with type URL.
typeany
typeobject
typearray
message
descriptionA developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
typestring
typeobject
UdmSearchOperationMetadata
descriptionInformation about a UDM Search operation. This message is used to populate the `metadata` field of `Operation` resources created by UDM Search.
idUdmSearchOperationMetadata
properties
baselineEventsCount
descriptionThe number of events matching the baseline query so far.
formatint32
typeinteger
baselineQuery
descriptionQuery used to search for events.
typestring
baselineTimeRange
$refInterval
descriptionThe time range used for the baseline query [inclusive start time, exclusive end time).
caseInsensitive
descriptionIf true, the search was performed in a case-insensitive manner.
typeboolean
endTime
descriptionThe end time of the operation, if done.
formatgoogle-datetime
typestring
expireTime
descriptionThe time when the operation results expire. This time may change while the operation is in progress. If unset, the results never expire.
formatgoogle-datetime
typestring
filteredEventsCount
descriptionThe number of events matching the snapshot query so far. This is <= `baseline_events_count`. If the snapshot query is empty, this will be equal to `baseline_events_count`.
formatint32
typeinteger
progress
descriptionA value from 0 to 1 representing the progress of the operation.
formatdouble
typenumber
snapshotQuery
descriptionQuery used to filter the baseline query's events.
typestring
snapshotTimeRange
$refInterval
descriptionTime range used to filter the baseline query's events [inclusive start time, exclusive end time). This time range is completely within `baseline_time_range`. If not set, it is assumed to match `baseline_time_range`.
startTime
descriptionThe start time of the operation.
formatgoogle-datetime
typestring
statsRowsCount
descriptionThe total number of rows returned for a stats query.
formatint32
typeinteger
typeobject
UserError
descriptionThis message exists solely to get the `UserErrorReason` enum to appear in the service discovery document.
idUserError
properties
reason
descriptionThe reason for a specific error that should be shown to the app user.
enum
  • USER_ERROR_REASON_UNSPECIFIED
  • RULE_REFERENCES_OUT_OF_SCOPE
  • RULE_ARCHIVED
  • RULE_STALE_VERSION
  • RULE_ACTIVE
  • RULE_RETROHUNT_RUNNING
  • RULE_LIVE
  • RULE_ALREADY_DISABLED
  • EXPENSIVE_RULE_LARGE_WINDOW
  • RULE_LIMITED_PAUSED
  • REFERENCE_LIST_NOT_FOUND
  • UEBA_RULES_NO_SCOPE
  • RULE_TESTING_INTERVAL_TOO_SHORT
  • SEARCH_CSV_FIELDS_NOT_SUPPORTED
  • INVALID_ARGUMENT_FOR_DASHBOARD_FILTER
  • INVALID_CONFIG_FOR_DASHBOARD_IMPORT
  • RETROHUNT_LIMIT_REACHED
enumDescriptions
  • Do not use this default value.
  • The rule text references resources, such as reference lists, that are out of scope for the rule. Example of an ErrorInfo for this reason: { "reason": "RULE_REFERENCES_OUT_OF_SCOPE", "domain": "chronicle.googleapis.com", "metadata": { "reference_lists": "list_name1,list_name2,list_name3,", } }
  • The rule being operated on (saving or setting run frequency) is archived, and so the operation can't be done.
  • The rule version being operated on is not the latest, and so the operation can't be done.
  • The rule can't be archived because it is live (detecting) and a retrohunt is running.
  • The rule can't be archived because a retrohunt is running against it.
  • The rule can't be archived because it is live (detecting).
  • The rule can't be disabled because is is already disabled.
  • The rule's match time window is too large for its current run frequency.
  • The rule can't be enabled because it has been limited or paused because of high resource use.
  • The list being referred to doesn't exist.
  • UEBA rules may not be assigned a data access scope.
  • The rule's match window is longer than the time range it's being tested over. Returns the match window duration and testing interval duration as metadata labeled `match_window_duration` and `testing_interval_duration`, formatted as Go durations. Example ErrorInfo: { "reason": "RULE_TESTING_INTERVAL_TOO_SHORT", "domain": "chronicle.googleapis.com", "metadata": { "match_window_duration": "24h", "testing_interval_duration": "12h", } }
  • The CSV fields are not supported for download. Returns the unsupported fields as metadata labeled `unsupported_fields`. Example ErrorInfo: { "reason": "SEARCH_CSV_FIELDS_NOT_SUPPORTED", "domain": "chronicle.googleapis.com", "metadata": { "unsupported_fields": "udm.about.security_result.variables,udm.network.http.parsed_user_agent.family", } }
  • Invalid argument for dashboard chart filters. Returns the filter name, filter value, operator, and expected type as metadata labeled `filter_name`, `filter_value`, `operator`, and `expected_type`, respectively. Example ErrorInfo: { "reason": "INVALID_ARGUMENT_FOR_DASHBOARD_FILTER", "domain": "chronicle.googleapis.com", "metadata": { "filter_name": "filter_name", "filter_value": "filter_value", "operater": "operator", "expected_type": "expected_type", } }
  • Invalid config for dashboard import. Example ErrorInfo: { "reason": "INVALID_CONFIG_FOR_DASHBOARD_IMPORT", "domain": "chronicle.googleapis.com", }
  • The user has reached the limit of retrohunts that can be run. Returns the retrohunt limit as metadata labeled `retrohunt_limit`. Example ErrorInfo: { "reason": "RETROHUNT_LIMIT_REACHED", "domain": "chronicle.googleapis.com", "metadata": { "retrohunt_limit": "10", } }
typestring
typeobject
Watchlist
descriptionA watchlist is a list of entities that allows for bulk operations over the included entities.
idWatchlist
properties
createTime
descriptionOutput only. Time the watchlist was created.
formatgoogle-datetime
readOnlyTrue
typestring
description
descriptionOptional. Description of the watchlist.
typestring
displayName
descriptionRequired. Display name of the watchlist. Note that it must be at least one character and less than 63 characters (https://google.aip.dev/148).
typestring
entityCount
$refEntityCount
descriptionOutput only. Entity count in the watchlist.
readOnlyTrue
entityPopulationMechanism
$refEntityPopulationMechanism
descriptionRequired. Mechanism to populate entities in the watchlist.
multiplyingFactor
descriptionOptional. Weight applied to the risk score for entities in this watchlist. The default is 1.0 if it is not specified.
formatfloat
typenumber
name
descriptionIdentifier. Resource name of the watchlist. Format: projects/{project}/locations/{location}/instances/{instance}/watchlists/{watchlist}
typestring
updateTime
descriptionOutput only. Time the watchlist was last updated.
formatgoogle-datetime
readOnlyTrue
typestring
watchlistUserPreferences
$refWatchlistUserPreferences
descriptionOptional. User preferences for watchlist configuration.
typeobject
WatchlistUserPreferences
descriptionA collection of user preferences for watchlist UI configuration.
idWatchlistUserPreferences
properties
pinned
descriptionOptional. Whether the watchlist is pinned on the dashboard.
typeboolean
typeobject
prod/europe-west2-chronicle-v1alpha
dictionary_item_added
  • root['resources']['projects']['resources']['locations']['resources']['instances']['methods']['delete']
  • root['resources']['projects']['resources']['locations']['resources']['instances']['methods']['undelete']
  • root['resources']['projects']['resources']['locations']['resources']['instances']['resources']['legacy']['methods']['legacyCreateOrUpdateCase']
  • root['resources']['projects']['resources']['locations']['resources']['instances']['resources']['legacy']['methods']['legacyCreateSoarAlert']
  • root['schemas']['GoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStats']
  • root['schemas']['GoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnData']
  • root['schemas']['GoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnSort']
  • root['schemas']['GoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnType']
  • root['schemas']['GoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnTypeList']
  • root['schemas']['GoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnValue']
  • root['schemas']['GoogleCloudStorageEventDrivenSettings']
  • root['schemas']['InstanceUdmSearchResponse']
  • root['schemas']['LegacyCreateOrUpdateCaseRequest']
  • root['schemas']['LegacyCreateSoarAlertRequest']
  • root['schemas']['LegacyFederatedUdmSearchViewResponse']
  • root['schemas']['LegacySoarAlert']
  • root['schemas']['SQSV2AccessKeySecretAuth']
  • root['schemas']['SoarEvent']
  • root['schemas']['UndeleteInstanceRequest']
  • root['schemas']['BackstoryFile']['properties']['symhash']
  • root['schemas']['ColumnMetadata']['properties']['latitude']
  • root['schemas']['ColumnMetadata']['properties']['longitude']
  • root['schemas']['EntityRisk']['properties']['riskWindowHasNewDetections']
  • root['schemas']['Extensions']['properties']['entityRisk']
  • root['schemas']['FeedDetails']['properties']['googleCloudStorageEventDrivenSettings']
  • root['schemas']['Instance']['properties']['customerCode']
  • root['schemas']['Instance']['properties']['deleteTime']
  • root['schemas']['Instance']['properties']['purgeTime']
  • root['schemas']['Instance']['properties']['wipeoutStatus']
  • root['schemas']['SQSAuthV2']['properties']['sqsV2AccessKeySecretAuth']
dictionary_item_removed
  • root['resources']['projects']['resources']['locations']['resources']['instances']['resources']['findings']
  • root['schemas']['FetchSimilarFindingsResponse']
  • root['schemas']['OmniflowAmazonS3Settings']
  • root['schemas']['OmniflowAmazonSQSSettings']
  • root['schemas']['OmniflowGoogleCloudStorageSettings']
  • root['schemas']['OmniflowS3Auth']
  • root['schemas']['FeedDetails']['properties']['omniflowAmazonS3Settings']
  • root['schemas']['FeedDetails']['properties']['omniflowAmazonSqsSettings']
  • root['schemas']['FeedDetails']['properties']['omniflowGcsSettings']
  • root['schemas']['FeedDetails']['properties']['feedSourceType']['enumDeprecated']
  • root['schemas']['FeedSourceTypeSchema']['properties']['feedSourceType']['enumDeprecated']
  • root['schemas']['PackLogType']['properties']['recommendedSourceType']['enumDeprecated']
values_changed
root['resources']['projects']['resources']['locations']['resources']['instances']['methods']['generateCollectionAgentAuth']['parameters']['name']['description']
new_valueRequired. The name of the chronicle instance to generate a collection agent auth json file for. Format: projects/{project_id}/locations/{location}/instances/{instance}
old_valueRequired. The name of the chronicle instance to generate a collection agent auth json file for. Format: projects/{project_id}/locations/{region}/instances/{instance}
root['resources']['projects']['resources']['locations']['resources']['instances']['methods']['generateSoarAuthJwt']['parameters']['name']['description']
new_valueRequired. The name of the chronicle instance to retrieve a report for. Format: projects/{project_id}/locations/{location}/instances/{instance}
old_valueRequired. The name of the chronicle instance to retrieve a report for. Format: projects/{project_id}/locations/{region}/instances/{instance}
root['resources']['projects']['resources']['locations']['resources']['instances']['methods']['generateWorkspaceConnectionToken']['parameters']['name']['description']
new_valueRequired. The name of the chronicle instance to create workspace token for. Format: projects/{project_id}/locations/{location}/instances/{instance}
old_valueRequired. The name of the chronicle instance to create workspace token for. Format: projects/{project_id}/locations/{region}/instances/{instance}
root['resources']['projects']['resources']['locations']['resources']['instances']['methods']['get']['parameters']['name']['description']
new_valueRequired. The name of the instance to retrieve. Format: projects/{project_id}/locations/{location}/instances/{instance}
old_valueRequired. The name of the instance to retrieve. Format: projects/{project_id}/locations/{region}/instances/{instance}
root['resources']['projects']['resources']['locations']['resources']['instances']['methods']['report']['parameters']['name']['description']
new_valueRequired. The name of the chronicle instance to retrieve a report for. Format: projects/{project_id}/locations/{location}/instances/{instance}
old_valueRequired. The name of the chronicle instance to retrieve a report for. Format: projects/{project_id}/locations/{region}/instances/{instance}
root['resources']['projects']['resources']['locations']['resources']['instances']['resources']['legacy']['methods']['legacyBatchGetCases']['parameters']['instance']['description']
new_valueRequired. Chronicle instance this request is sent to. Format: projects/{project}/locations/{location}/instances/{instance}/legacy
old_valueChronicle instance this request is sent to. Format: projects/{project}/locations/{location}/instances/{instance}/legacy
root['revision']
new_value20250310
old_value20250227
root['schemas']['EntityRisk']['description']
new_valueStores information related to the risk score of an entity. Next ID: 15
old_valueStores information related to the risk score of an entity. Next ID: 14
root['schemas']['EntityRisk']['properties']['riskWindowSize']['description']
new_valueRisk window duration for the entity.
old_valueRisk window duration for the Entity.
root['schemas']['Instance']['properties']['name']['description']
new_valueOutput only. The resource name of this instance. Format: projects/{project}/locations/{location}/instances/{instance}
old_valueOutput only. The resource name of this instance. Format: projects/{project}/locations/{region}/instances/{instance}
root['schemas']['SQSAuthV2']['properties']['additionalS3AccessKeySecretAuth']['description']
new_valueRequired. Deprecated. If the S3 objects referred to by the SQS queue require different auth info other than the SQS auth, that can be specified here. Additional S3AccessKeySecret. Required.
old_valueRequired. If the S3 objects referred to by the SQS queue require different auth info other than the SQS auth, that can be specified here. Additional S3AccessKeySecret. Required.
root['schemas']['StatusProto']['properties']['canonicalCode']['description']
new_valuecopybara:strip_begin(b/383363683) copybara:strip_end_and_replace optional int32 canonical_code = 6;
old_valueThe canonical error code (see codes.proto) that most closely corresponds to this status. This may be missing, and in the common case of the generic space, it definitely will be. copybara:strip_begin(b/383363683) copybara:strip_end_and_replace optional int32 canonical_code = 6;
root['schemas']['StatusProto']['properties']['space']['description']
new_valuecopybara:strip_begin(b/383363683) Space to which this status belongs copybara:strip_end_and_replace optional string space = 2; // Space to which this status belongs
old_valueThe following are usually only present when code != 0 Space to which this status belongs copybara:strip_begin(b/383363683) copybara:strip_end_and_replace optional string space = 2;
iterable_item_added
root['schemas']['AnalyticValue']['properties']['eventType']['enum'][103]ENTITY_RISK_CHANGE
root['schemas']['AnalyticValue']['properties']['eventType']['enumDescriptions'][103]An update to an entity risk score. This event type is restricted to events published by Google Securit Operations Risk Analytics.
root['schemas']['EnrichmentDisablementTarget']['properties']['eventType']['enum'][103]ENTITY_RISK_CHANGE
root['schemas']['EnrichmentDisablementTarget']['properties']['eventType']['enumDescriptions'][103]An update to an entity risk score. This event type is restricted to events published by Google Securit Operations Risk Analytics.
root['schemas']['EventTypesSuggestion']['properties']['eventType']['enum'][103]ENTITY_RISK_CHANGE
root['schemas']['EventTypesSuggestion']['properties']['eventType']['enumDescriptions'][103]An update to an entity risk score. This event type is restricted to events published by Google Securit Operations Risk Analytics.
root['schemas']['FeedDetails']['properties']['feedSourceType']['enum'][19]GOOGLE_CLOUD_STORAGE_EVENT_DRIVEN
root['schemas']['FeedDetails']['properties']['feedSourceType']['enumDescriptions'][19]Google Cloud Storage Feed backed by Omniflow STS driven by pubsub events.
root['schemas']['FeedSourceTypeSchema']['properties']['feedSourceType']['enum'][19]GOOGLE_CLOUD_STORAGE_EVENT_DRIVEN
root['schemas']['FeedSourceTypeSchema']['properties']['feedSourceType']['enumDescriptions'][19]Google Cloud Storage Feed backed by Omniflow STS driven by pubsub events.
root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][1412]BLOCKDAEMON_METOMIC
root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][2124]JIT
root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][2125]PROCORE
root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][2126]HP_INC_MFP
root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][2127]MERU_CONTENTKEEPER_PROXY
root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][2128]KPMG_JAPAN_HR
root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][2129]FORD_ADFS_IDP
root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][2130]FORD_BLUE_DNS
root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][2131]TSA_VMS
root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][2132]ALLIANZ_CPAM
root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][2133]HKBK_ASE1_DIGITALGUARDIAN_NDLP
root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][2134]PANORAYS
root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][2135]BBVA_BAEMPRE
root['schemas']['Metadata']['properties']['eventType']['enum'][103]ENTITY_RISK_CHANGE
root['schemas']['Metadata']['properties']['eventType']['enumDescriptions'][103]An update to an entity risk score. This event type is restricted to events published by Google Securit Operations Risk Analytics.
root['schemas']['PackLogType']['properties']['recommendedSourceType']['enum'][19]GOOGLE_CLOUD_STORAGE_EVENT_DRIVEN
root['schemas']['PackLogType']['properties']['recommendedSourceType']['enumDescriptions'][19]Google Cloud Storage Feed backed by Omniflow STS driven by pubsub events.
root['schemas']['RawLog']['properties']['type']['enum'][1412]BLOCKDAEMON_METOMIC
root['schemas']['RawLog']['properties']['type']['enum'][2124]JIT
root['schemas']['RawLog']['properties']['type']['enum'][2125]PROCORE
root['schemas']['RawLog']['properties']['type']['enum'][2126]HP_INC_MFP
root['schemas']['RawLog']['properties']['type']['enum'][2127]MERU_CONTENTKEEPER_PROXY
root['schemas']['RawLog']['properties']['type']['enum'][2128]KPMG_JAPAN_HR
root['schemas']['RawLog']['properties']['type']['enum'][2129]FORD_ADFS_IDP
root['schemas']['RawLog']['properties']['type']['enum'][2130]FORD_BLUE_DNS
root['schemas']['RawLog']['properties']['type']['enum'][2131]TSA_VMS
root['schemas']['RawLog']['properties']['type']['enum'][2132]ALLIANZ_CPAM
root['schemas']['RawLog']['properties']['type']['enum'][2133]HKBK_ASE1_DIGITALGUARDIAN_NDLP
root['schemas']['RawLog']['properties']['type']['enum'][2134]PANORAYS
root['schemas']['RawLog']['properties']['type']['enum'][2135]BBVA_BAEMPRE
root['schemas']['RawLogEventInformation']['properties']['eventType']['enum'][103]ENTITY_RISK_CHANGE
root['schemas']['RawLogEventInformation']['properties']['eventType']['enumDescriptions'][103]An update to an entity risk score. This event type is restricted to events published by Google Securit Operations Risk Analytics.
root['schemas']['SIEventData']['properties']['rawLogType']['enum'][1412]BLOCKDAEMON_METOMIC
root['schemas']['SIEventData']['properties']['rawLogType']['enum'][2124]JIT
root['schemas']['SIEventData']['properties']['rawLogType']['enum'][2125]PROCORE
root['schemas']['SIEventData']['properties']['rawLogType']['enum'][2126]HP_INC_MFP
root['schemas']['SIEventData']['properties']['rawLogType']['enum'][2127]MERU_CONTENTKEEPER_PROXY
root['schemas']['SIEventData']['properties']['rawLogType']['enum'][2128]KPMG_JAPAN_HR
root['schemas']['SIEventData']['properties']['rawLogType']['enum'][2129]FORD_ADFS_IDP
root['schemas']['SIEventData']['properties']['rawLogType']['enum'][2130]FORD_BLUE_DNS
root['schemas']['SIEventData']['properties']['rawLogType']['enum'][2131]TSA_VMS
root['schemas']['SIEventData']['properties']['rawLogType']['enum'][2132]ALLIANZ_CPAM
root['schemas']['SIEventData']['properties']['rawLogType']['enum'][2133]HKBK_ASE1_DIGITALGUARDIAN_NDLP
root['schemas']['SIEventData']['properties']['rawLogType']['enum'][2134]PANORAYS
root['schemas']['SIEventData']['properties']['rawLogType']['enum'][2135]BBVA_BAEMPRE
iterable_item_removed
root['schemas']['FeedDetails']['properties']['feedSourceType']['enum'][14]OMNIFLOW_GOOGLE_CLOUD_STORAGE
root['schemas']['FeedDetails']['properties']['feedSourceType']['enum'][15]OMNIFLOW_AMAZON_S3
root['schemas']['FeedDetails']['properties']['feedSourceType']['enum'][16]OMNIFLOW_AMAZON_SQS
root['schemas']['FeedDetails']['properties']['feedSourceType']['enumDescriptions'][14]
root['schemas']['FeedSourceTypeSchema']['properties']['feedSourceType']['enum'][14]OMNIFLOW_GOOGLE_CLOUD_STORAGE
root['schemas']['FeedSourceTypeSchema']['properties']['feedSourceType']['enum'][15]OMNIFLOW_AMAZON_S3
root['schemas']['FeedSourceTypeSchema']['properties']['feedSourceType']['enum'][16]OMNIFLOW_AMAZON_SQS
root['schemas']['FeedSourceTypeSchema']['properties']['feedSourceType']['enumDescriptions'][14]
root['schemas']['PackLogType']['properties']['recommendedSourceType']['enum'][14]OMNIFLOW_GOOGLE_CLOUD_STORAGE
root['schemas']['PackLogType']['properties']['recommendedSourceType']['enum'][15]OMNIFLOW_AMAZON_S3
root['schemas']['PackLogType']['properties']['recommendedSourceType']['enum'][16]OMNIFLOW_AMAZON_SQS
root['schemas']['PackLogType']['properties']['recommendedSourceType']['enumDescriptions'][14]
prod/europe-west2-chronicle-v1beta
values_changed
root['resources']['projects']['resources']['locations']['resources']['instances']['methods']['get']['parameters']['name']['description']
new_valueRequired. The name of the instance to retrieve. Format: projects/{project_id}/locations/{location}/instances/{instance}
old_valueRequired. The name of the instance to retrieve. Format: projects/{project_id}/locations/{region}/instances/{instance}
root['revision']
new_value20250310
old_value20250227
root['schemas']
new_value
AIOverview
descriptionAI generated overview for the search results.
idAIOverview
properties
aiSummary
descriptionAI summary for the search results. Markdown formatted.
typestring
complete
descriptionWhether AI overview generation is complete.
typeboolean
suggestions
descriptionSuggested actions to continue the investigation in chat.
items
$refAction
typearray
typeobject
Action
descriptionAction represents an action that can be performed in the host UI.
idAction
properties
actionType
descriptionOutput only. Type of action.
enum
  • ACTION_TYPE_UNSPECIFIED
  • FOLLOW_UP
  • NAVIGATION
  • EXECUTION
enumDescriptions
  • The action type is unspecified.
  • The action is a follow up action.
  • The action is a navigation action.
  • The action is an execution action.
readOnlyTrue
typestring
displayText
descriptionOutput only. The text that'll be displayed to the user if this is rendered in the UI as a suggested action.
readOnlyTrue
typestring
execution
$refExecution
descriptionMetadata for execution action.
followUp
$refFollowUp
descriptionMetadata for follow up action.
navigation
$refNavigation
descriptionMetadata for navigation action.
useCaseId
descriptionOutput only. The use case ID of the action. It's used internally to identify in which context the action is used.
readOnlyTrue
typestring
typeobject
AlertFieldAggregation
idAlertFieldAggregation
properties
alertCount
formatint32
typeinteger
allValues
items
$refAlertFieldValueCount
typearray
baselineAlertCount
formatint32
typeinteger
bottomValues
items
$refAlertFieldValueCount
typearray
fieldName
typestring
tooManyValues
typeboolean
topValues
items
$refAlertFieldValueCount
typearray
valueCount
formatint32
typeinteger
typeobject
AlertFieldAggregations
idAlertFieldAggregations
properties
fields
items
$refAlertFieldAggregation
typearray
typeobject
AlertFieldValue
idAlertFieldValue
properties
boolValue
typeboolean
bytesValue
formatbyte
typestring
doubleValue
formatdouble
typenumber
enumValue
typestring
floatValue
formatfloat
typenumber
int32Value
formatint32
typeinteger
int64Value
formatint64
typestring
stringValue
typestring
uint32Value
formatuint32
typeinteger
uint64Value
formatuint64
typestring
typeobject
AlertFieldValueCount
idAlertFieldValueCount
properties
alertCount
formatint32
typeinteger
baselineAlertCount
formatint32
typeinteger
value
$refAlertFieldValue
typeobject
AnalystVerdict
descriptionVerdict provided by the human analyst. These fields are used to model Mandiant sources.
idAnalystVerdict
properties
confidenceScore
descriptionConfidence score of the verdict.
formatint32
typeinteger
verdictResponse
descriptionDetails of the verdict.
enum
  • VERDICT_RESPONSE_UNSPECIFIED
  • MALICIOUS
  • BENIGN
enumDescriptions
  • The default verdict response type.
  • VerdictResponse resulted a threat as malicious.
  • VerdictResponse resulted a threat as benign.
typestring
verdictTime
descriptionTimestamp at which the verdict was generated.
formatgoogle-datetime
typestring
typeobject
AnalyticsMetadata
descriptionStores information about an analytics metric used in a rule.
idAnalyticsMetadata
properties
analytic
descriptionName of the analytic.
typestring
typeobject
Annotation
descriptionExtra parameters that don't fit anywhere else, captured as key/value. For example "VendorID/42" in BlackBerry user agents. The following keys are modified with reduced User-Agent and no client hints (go/ua-reduction-ua-string-reference): * "Chrome" (see `browser_version`) * "ChromiumBrowser" (unavailable) * "ChromeWebview" (unavailable) * "OS_VERSION" (see `os`) * "Rest" (unavailable) * "misc" (see `device`)
idAnnotation
properties
key
typestring
value
typestring
typeobject
Artifact
descriptionInformation about an artifact. The artifact can only be an IP.
idArtifact
properties
anonymous
descriptionWhether the VPN tunnels are configured for anonymous browsing or not.
typeboolean
artifactClient
$refArtifactClient
descriptionEntity or software accessing or utilizing network resources.
asOwner
descriptionOwner of the Autonomous System to which the IP address belongs.
typestring
asn
descriptionAutonomous System Number to which the IP address belongs.
formatint64
typestring
firstSeenTime
descriptionFirst seen timestamp of the IP in the customer's environment.
formatgoogle-datetime
typestring
ip
descriptionIP address of the artifact. This field can be used as an entity indicator for an external destination IP entity.
typestring
jarm
descriptionThe JARM hash for the IP address. (https://engineering.salesforce.com/easily-identify-malicious-servers-on-the-internet-with-jarm-e095edac525a).
typestring
lastHttpsCertificate
$refSSLCertificate
descriptionSSL certificate information about the IP address.
lastHttpsCertificateDate
descriptionMost recent date for the certificate in VirusTotal.
formatgoogle-datetime
typestring
lastSeenTime
descriptionLast seen timestamp of the IP address in the customer's environment.
formatgoogle-datetime
typestring
location
$refLocation
descriptionLocation of the Artifact's IP address.
network
$refNetwork
descriptionNetwork information related to the Artifact's IP address.
prevalence
$refPrevalence
descriptionThe prevalence of the artifact within the customer's environment.
regionalInternetRegistry
descriptionRIR (one of the current RIRs: AFRINIC, ARIN, APNIC, LACNIC or RIPE NCC).
typestring
risks
descriptionThis field lists potential risks associated with the network activity.
items
typestring
typearray
tags
descriptionIdentification attributes
items
typestring
typearray
tunnels
descriptionVPN tunnels.
items
$refTunnels
typearray
whois
descriptionWHOIS information as returned from the pertinent WHOIS server.
typestring
whoisDate
descriptionDate of the last update of the WHOIS record in VirusTotal.
formatgoogle-datetime
typestring
typeobject
ArtifactClient
descriptionEntity or software accessing or utilizing network resources.
idArtifactClient
properties
behaviors
descriptionThe behaviors of the client accessing the network.
items
typestring
typearray
proxies
descriptionThe type of proxies used by the client.
items
typestring
typearray
typeobject
Asset
descriptionInformation about a compute asset such as a workstation, laptop, phone, virtual desktop, or VM.
idAsset
properties
assetId
descriptionThe asset ID. Value must contain the ':' character. For example, cs:abcdd23434. This field can be used as an entity indicator for asset entities.
typestring
attribute
$refAttribute
descriptionGeneric entity metadata attributes of the asset.
category
descriptionThe category of the asset (e.g. "End User Asset", "Workstation", "Server").
typestring
creationTime
deprecatedTrue
descriptionTime the asset was created or provisioned. Deprecate: creation_time should be populated in Attribute as generic metadata.
formatgoogle-datetime
typestring
deploymentStatus
descriptionThe deployment status of the asset for device lifecycle purposes.
enum
  • DEPLOYMENT_STATUS_UNSPECIFIED
  • ACTIVE
  • PENDING_DECOMISSION
  • DECOMISSIONED
enumDescriptions
  • Unspecified deployment status.
  • Asset is active, functional and deployed.
  • Asset is pending decommission and no longer deployed.
  • Asset is decommissioned.
typestring
firstDiscoverTime
descriptionTime the asset was first discovered (by asset management/discoverability software).
formatgoogle-datetime
typestring
firstSeenTime
descriptionThe first observed time for an asset. The value is calculated on the basis of the first time the identifier was observed.
formatgoogle-datetime
typestring
hardware
descriptionThe asset hardware specifications.
items
$refHardware
typearray
hostname
descriptionAsset hostname or domain name field. This field can be used as an entity indicator for asset entities.
typestring
ip
descriptionA list of IP addresses associated with an asset. This field can be used as an entity indicator for asset entities.
items
typestring
typearray
labels
deprecatedTrue
descriptionMetadata labels for the asset. Deprecated: labels should be populated in Attribute as generic metadata.
items
$refLabel
typearray
lastBootTime
descriptionTime the asset was last boot started.
formatgoogle-datetime
typestring
lastDiscoverTime
descriptionTime the asset was last discovered (by asset management/discoverability software).
formatgoogle-datetime
typestring
location
$refLocation
descriptionLocation of the asset.
mac
descriptionList of MAC addresses associated with an asset. This field can be used as an entity indicator for asset entities.
items
typestring
typearray
natIp
descriptionList of NAT IP addresses associated with an asset.
items
typestring
typearray
networkDomain
descriptionThe network domain of the asset (e.g. "corp.acme.com")
typestring
platformSoftware
$refPlatformSoftware
descriptionThe asset operating system platform software.
productObjectId
descriptionA vendor-specific identifier to uniquely identify the entity (a GUID or similar). This field can be used as an entity indicator for asset entities.
typestring
software
descriptionThe asset software details.
items
$refSoftware
typearray
systemLastUpdateTime
descriptionTime the asset system or OS was last updated. For all other operations that are not system updates (such as resizing a VM), use Attribute.last_update_time.
formatgoogle-datetime
typestring
type
descriptionThe type of the asset (e.g. workstation or laptop or server).
enum
  • ROLE_UNSPECIFIED
  • WORKSTATION
  • LAPTOP
  • IOT
  • NETWORK_ATTACHED_STORAGE
  • PRINTER
  • SCANNER
  • SERVER
  • TAPE_LIBRARY
  • MOBILE
enumDescriptions
  • Unspecified asset role.
  • A workstation or desktop.
  • A laptop computer.
  • An IOT asset.
  • A network attached storage device.
  • A printer.
  • A scanner.
  • A server.
  • A tape library device.
  • A mobile device such as a mobile phone or PDA.
typestring
vulnerabilities
descriptionVulnerabilities discovered on asset.
items
$refVulnerability
typearray
typeobject
Association
descriptionAssociations represents different metadata about malware and threat actors involved with an IoC.
idAssociation
properties
alias
descriptionDifferent aliases of the threat actor given by different sources.
items
$refAssociationAlias
typearray
associatedActors
descriptionList of associated threat actors for a malware. Not applicable for threat actors.
items
$refAssociation
typearray
countryCode
descriptionCountry from which the threat actor/ malware is originated.
items
typestring
typearray
description
descriptionHuman readable description about the association.
typestring
firstReferenceTime
descriptionFirst time the threat actor was referenced or seen.
formatgoogle-datetime
typestring
id
descriptionUnique association id generated by mandiant.
typestring
industriesAffected
descriptionList of industries the threat actor affects.
items
typestring
typearray
lastReferenceTime
descriptionLast time the threat actor was referenced or seen.
formatgoogle-datetime
typestring
name
descriptionName of the threat actor/malware.
typestring
regionCode
$refLocation
descriptionName of the country, the threat is originating from.
role
descriptionRole of the malware. Not applicable for threat actor.
typestring
sourceCountry
deprecatedTrue
descriptionName of the country the threat originated from.
typestring
sponsorRegion
$refLocation
descriptionSponsor region of the threat actor.
tags
descriptionTags.
items
typestring
typearray
targetedRegions
descriptionTargeted regions.
items
$refLocation
typearray
type
descriptionSignifies the type of association.
enum
  • ASSOCIATION_TYPE_UNSPECIFIED
  • THREAT_ACTOR
  • MALWARE
enumDescriptions
  • The default Association Type.
  • Association type Threat actor.
  • Association type Malware.
typestring
typeobject
AssociationAlias
descriptionAssociation Alias used to represent Mandiant Threat Intelligence.
idAssociationAlias
properties
company
descriptionName of the provider who gave the association's name.
typestring
name
descriptionName of the alias.
typestring
typeobject
AttackDetails
descriptionMITRE ATT&CK details.
idAttackDetails
properties
tactics
descriptionTactics employed.
items
$refTactic
typearray
techniques
descriptionTechniques employed.
items
$refTechnique
typearray
version
descriptionATT&CK version (e.g. 12.1).
typestring
typeobject
Attribute
descriptionAttribute is a container for generic entity attributes including common attributes across core entities (such as, user or asset). For example, Cloud is a generic entity attribute since it can apply to an asset (for example, a VM) or a user (for example, an identity service account).
idAttribute
properties
cloud
$refCloud
descriptionCloud metadata attributes such as project ID, account ID, or organizational hierarchy.
creationTime
descriptionTime the resource or entity was created or provisioned.
formatgoogle-datetime
typestring
labels
descriptionSet of labels for the entity. Should only be used for product labels (for example, Google Cloud resource labels or Azure AD sensitivity labels. Should not be used for arbitrary key-value mappings.
items
$refLabel
typearray
lastUpdateTime
descriptionTime the resource or entity was last updated.
formatgoogle-datetime
typestring
permissions
descriptionSystem permissions for IAM entity (human principal, service account, group).
items
$refPermission
typearray
roles
descriptionSystem IAM roles to be assumed by resources to use the role's permissions for access control.
items
$refRole
typearray
typeobject
Authentication
descriptionThe Authentication extension captures details specific to authentication events. General guidelines for authentication events: * Details about the source of the authentication event (for example, client IP or hostname), should be captured in principal. The principal may be empty if we have no details about the source of the login. * Details about the target of the authentication event (for example, details about the machine that is being logged into or logged out of) should be captured in target. * Some authentication events may involve a third-party. For example, a user logs into a cloud service (for example, Chronicle) via their company's SSO (the event is logged by their SSO solution). In this case, the principal captures information about the user's device, the target captures details about the cloud service they logged into, and the intermediary captures details about the SSO solution.
idAuthentication
properties
authDetails
descriptionThe vendor defined details of the authentication.
typestring
mechanism
descriptionThe authentication mechanism.
items
enum
  • MECHANISM_UNSPECIFIED
  • USERNAME_PASSWORD
  • OTP
  • HARDWARE_KEY
  • LOCAL
  • REMOTE
  • REMOTE_INTERACTIVE
  • MECHANISM_OTHER
  • BADGE_READER
  • NETWORK
  • BATCH
  • SERVICE
  • UNLOCK
  • NETWORK_CLEAR_TEXT
  • NEW_CREDENTIALS
  • INTERACTIVE
  • CACHED_INTERACTIVE
  • CACHED_REMOTE_INTERACTIVE
  • CACHED_UNLOCK
  • BIOMETRIC
  • WEARABLE
enumDescriptions
  • The default mechanism.
  • Username + password authentication.
  • OTP authentication.
  • Hardware key authentication.
  • Local authentication.
  • Remote authentication.
  • RDP, Terminal Services, or VNC.
  • Some other mechanism that is not defined here.
  • Badge reader authentication
  • Network authentication.
  • Batch authentication.
  • Service authentication
  • Direct human-interactive unlock authentication.
  • Network clear text authentication.
  • Authentication with new credentials.
  • Interactive authentication.
  • Interactive authentication using cached credentials.
  • Cached Remote Interactive authentication using cached credentials.
  • Cached Remote Interactive authentication using cached credentials.
  • Biometric device such as a fingerprint reader.
  • Wearable such as an Apple Watch.
typestring
typearray
type
descriptionThe type of authentication.
enum
  • AUTHTYPE_UNSPECIFIED
  • MACHINE
  • SSO
  • VPN
  • PHYSICAL
  • TACACS
enumDescriptions
  • The default type.
  • A machine authentication.
  • An SSO authentication.
  • A VPN authentication.
  • A Physical authentication (e.g. "Badge reader").
  • A TACACS family protocol for networked systems authentication (e.g. TACACS, TACACS+).
typestring
typeobject
AuthorityKeyId
descriptionIdentifies the public key to be used to verify the signature on this certificate or CRL.
idAuthorityKeyId
properties
keyid
descriptionKey hexdump.
typestring
serialNumber
descriptionSerial number hexdump.
typestring
typeobject
BackstoryEntity
descriptionAn Entity provides additional context about an item in a UDM event. For example, a PROCESS_LAUNCH event describes that user 'abc@example.corp' launched process 'shady.exe'. The event does not include information that user 'abc@example.com' is a recently terminated employee who administers a server storing finance data. Information stored in one or more Entities can add this additional context.
idBackstoryEntity
properties
additional
additionalProperties
descriptionProperties of the object.
typeany
descriptionImportant entity data that cannot be adequately represented within the formal sections of the Entity.
typeobject
entity
$refNoun
descriptionNoun in the UDM event that this entity represents.
metadata
$refEntityMetadata
descriptionEntity metadata such as timestamp, product, etc.
metric
$refMetric
descriptionStores statistical metrics about the entity. Used if metadata.entity_type is METRIC.
relations
descriptionOne or more relationships between the entity (a) and other entities, including the relationship type and related entity.
items
$refRelation
typearray
riskScore
$refEntityRisk
descriptionStores information related to the entity's risk score.
typeobject
BackstoryFile
descriptionInformation about a file.
idBackstoryFile
properties
ahash
deprecatedTrue
descriptionDeprecated. Use authentihash instead.
typestring
authentihash
descriptionAuthentihash of the file.
typestring
capabilitiesTags
descriptionCapabilities tags.
items
typestring
typearray
createTime
descriptionTimestamp when the file was created.
formatgoogle-datetime
typestring
embeddedDomains
descriptionEmbedded domains found in the file.
items
typestring
typearray
embeddedIps
descriptionEmbedded IP addresses found in the file.
items
typestring
typearray
embeddedUrls
descriptionEmbedded urls found in the file.
items
typestring
typearray
exifInfo
$refExifInfo
descriptionExif metadata from different file formats extracted by exiftool.
fileMetadata
$refFileMetadata
deprecatedTrue
descriptionMetadata associated with the file. Deprecate FileMetadata in favor of using fields in File.
fileType
descriptionFileType field.
enum
  • FILE_TYPE_UNSPECIFIED
  • FILE_TYPE_PE_EXE
  • FILE_TYPE_PE_DLL
  • FILE_TYPE_MSI
  • FILE_TYPE_NE_EXE
  • FILE_TYPE_NE_DLL
  • FILE_TYPE_DOS_EXE
  • FILE_TYPE_DOS_COM
  • FILE_TYPE_COFF
  • FILE_TYPE_ELF
  • FILE_TYPE_LINUX_KERNEL
  • FILE_TYPE_RPM
  • FILE_TYPE_LINUX
  • FILE_TYPE_MACH_O
  • FILE_TYPE_JAVA_BYTECODE
  • FILE_TYPE_DMG
  • FILE_TYPE_DEB
  • FILE_TYPE_PKG
  • FILE_TYPE_PYC
  • FILE_TYPE_LNK
  • FILE_TYPE_DESKTOP_ENTRY
  • FILE_TYPE_JPEG
  • FILE_TYPE_TIFF
  • FILE_TYPE_GIF
  • FILE_TYPE_PNG
  • FILE_TYPE_BMP
  • FILE_TYPE_GIMP
  • FILE_TYPE_IN_DESIGN
  • FILE_TYPE_PSD
  • FILE_TYPE_TARGA
  • FILE_TYPE_XWD
  • FILE_TYPE_DIB
  • FILE_TYPE_JNG
  • FILE_TYPE_ICO
  • FILE_TYPE_FPX
  • FILE_TYPE_EPS
  • FILE_TYPE_SVG
  • FILE_TYPE_EMF
  • FILE_TYPE_WEBP
  • FILE_TYPE_DWG
  • FILE_TYPE_DXF
  • FILE_TYPE_THREEDS
  • FILE_TYPE_OGG
  • FILE_TYPE_FLC
  • FILE_TYPE_FLI
  • FILE_TYPE_MP3
  • FILE_TYPE_FLAC
  • FILE_TYPE_WAV
  • FILE_TYPE_MIDI
  • FILE_TYPE_AVI
  • FILE_TYPE_MPEG
  • FILE_TYPE_QUICKTIME
  • FILE_TYPE_ASF
  • FILE_TYPE_DIVX
  • FILE_TYPE_FLV
  • FILE_TYPE_WMA
  • FILE_TYPE_WMV
  • FILE_TYPE_RM
  • FILE_TYPE_MOV
  • FILE_TYPE_MP4
  • FILE_TYPE_T3GP
  • FILE_TYPE_WEBM
  • FILE_TYPE_MKV
  • FILE_TYPE_PDF
  • FILE_TYPE_PS
  • FILE_TYPE_DOC
  • FILE_TYPE_DOCX
  • FILE_TYPE_PPT
  • FILE_TYPE_PPTX
  • FILE_TYPE_XLS
  • FILE_TYPE_XLSX
  • FILE_TYPE_RTF
  • FILE_TYPE_PPSX
  • FILE_TYPE_ODP
  • FILE_TYPE_ODS
  • FILE_TYPE_ODT
  • FILE_TYPE_HWP
  • FILE_TYPE_GUL
  • FILE_TYPE_ODF
  • FILE_TYPE_ODG
  • FILE_TYPE_ONE_NOTE
  • FILE_TYPE_OOXML
  • FILE_TYPE_SLK
  • FILE_TYPE_EBOOK
  • FILE_TYPE_LATEX
  • FILE_TYPE_TTF
  • FILE_TYPE_EOT
  • FILE_TYPE_WOFF
  • FILE_TYPE_CHM
  • FILE_TYPE_ZIP
  • FILE_TYPE_GZIP
  • FILE_TYPE_BZIP
  • FILE_TYPE_RZIP
  • FILE_TYPE_DZIP
  • FILE_TYPE_SEVENZIP
  • FILE_TYPE_CAB
  • FILE_TYPE_JAR
  • FILE_TYPE_RAR
  • FILE_TYPE_MSCOMPRESS
  • FILE_TYPE_ACE
  • FILE_TYPE_ARC
  • FILE_TYPE_ARJ
  • FILE_TYPE_ASD
  • FILE_TYPE_BLACKHOLE
  • FILE_TYPE_KGB
  • FILE_TYPE_ZLIB
  • FILE_TYPE_TAR
  • FILE_TYPE_ZST
  • FILE_TYPE_LZFSE
  • FILE_TYPE_PYTHON_WHL
  • FILE_TYPE_PYTHON_PKG
  • FILE_TYPE_MSIX
  • FILE_TYPE_TEXT
  • FILE_TYPE_SCRIPT
  • FILE_TYPE_PHP
  • FILE_TYPE_PYTHON
  • FILE_TYPE_PERL
  • FILE_TYPE_RUBY
  • FILE_TYPE_C
  • FILE_TYPE_CPP
  • FILE_TYPE_JAVA
  • FILE_TYPE_SHELLSCRIPT
  • FILE_TYPE_PASCAL
  • FILE_TYPE_AWK
  • FILE_TYPE_DYALOG
  • FILE_TYPE_FORTRAN
  • FILE_TYPE_JAVASCRIPT
  • FILE_TYPE_POWERSHELL
  • FILE_TYPE_VBA
  • FILE_TYPE_M4
  • FILE_TYPE_OBJETIVEC
  • FILE_TYPE_JMOD
  • FILE_TYPE_MAKEFILE
  • FILE_TYPE_INI
  • FILE_TYPE_CLJ
  • FILE_TYPE_PDB
  • FILE_TYPE_SQL
  • FILE_TYPE_NEKO
  • FILE_TYPE_WER
  • FILE_TYPE_GOLANG
  • FILE_TYPE_M3U
  • FILE_TYPE_BAT
  • FILE_TYPE_MSC
  • FILE_TYPE_RDP
  • FILE_TYPE_SYMBIAN
  • FILE_TYPE_PALMOS
  • FILE_TYPE_WINCE
  • FILE_TYPE_ANDROID
  • FILE_TYPE_IPHONE
  • FILE_TYPE_HTML
  • FILE_TYPE_XML
  • FILE_TYPE_SWF
  • FILE_TYPE_FLA
  • FILE_TYPE_COOKIE
  • FILE_TYPE_TORRENT
  • FILE_TYPE_EMAIL_TYPE
  • FILE_TYPE_OUTLOOK
  • FILE_TYPE_SGML
  • FILE_TYPE_JSON
  • FILE_TYPE_CSV
  • FILE_TYPE_HTA
  • FILE_TYPE_INTERNET_SHORTCUT
  • FILE_TYPE_CAP
  • FILE_TYPE_ISOIMAGE
  • FILE_TYPE_SQUASHFS
  • FILE_TYPE_VHD
  • FILE_TYPE_APPLE
  • FILE_TYPE_MACINTOSH
  • FILE_TYPE_APPLESINGLE
  • FILE_TYPE_APPLEDOUBLE
  • FILE_TYPE_MACINTOSH_HFS
  • FILE_TYPE_APPLE_PLIST
  • FILE_TYPE_MACINTOSH_LIB
  • FILE_TYPE_APPLESCRIPT
  • FILE_TYPE_APPLESCRIPT_COMPILED
  • FILE_TYPE_CRX
  • FILE_TYPE_XPI
  • FILE_TYPE_ROM
  • FILE_TYPE_IPS
  • FILE_TYPE_PEM
  • FILE_TYPE_PGP
  • FILE_TYPE_CRT
enumDescriptions
  • File type is UNSPECIFIED.
  • File type is PE_EXE.
  • Although DLLs are actually portable executables, this value enables the file type to be identified separately. File type is PE_DLL.
  • File type is MSI.
  • File type is NE_EXE.
  • File type is NE_DLL.
  • File type is DOS_EXE.
  • File type is DOS_COM.
  • File type is COFF.
  • File type is ELF.
  • File type is LINUX_KERNEL.
  • File type is RPM.
  • File type is LINUX.
  • File type is MACH_O.
  • File type is JAVA_BYTECODE.
  • File type is DMG.
  • File type is DEB.
  • File type is PKG.
  • File type is PYC.
  • File type is LNK.
  • File type is DESKTOP_ENTRY.
  • File type is JPEG.
  • File type is TIFF.
  • File type is GIF.
  • File type is PNG.
  • File type is BMP.
  • File type is GIMP.
  • File type is Adobe InDesign.
  • File type is PSD. Adobe Photoshop.
  • File type is TARGA.
  • File type is XWD.
  • File type is DIB.
  • File type is JNG.
  • File type is ICO.
  • File type is FPX.
  • File type is EPS.
  • File type is SVG.
  • File type is EMF.
  • File type is WEBP.
  • File type is DWG.
  • File type is DXF.
  • File type is 3DS.
  • File type is OGG.
  • File type is FLC.
  • File type is FLI.
  • File type is MP3.
  • File type is FLAC.
  • File type is WAV.
  • File type is MIDI.
  • File type is AVI.
  • File type is MPEG.
  • File type is QUICKTIME.
  • File type is ASF.
  • File type is DIVX.
  • File type is FLV.
  • File type is WMA.
  • File type is WMV.
  • File type is RM. RealMedia type.
  • File type is MOV.
  • File type is MP4.
  • File type is T3GP.
  • File type is WEBM.
  • File type is MKV.
  • File type is PDF.
  • File type is PS.
  • File type is DOC.
  • File type is DOCX.
  • File type is PPT.
  • File type is PPTX.
  • File type is XLS.
  • File type is XLSX.
  • File type is RTF.
  • File type is PPSX.
  • File type is ODP.
  • File type is ODS.
  • File type is ODT.
  • File type is HWP.
  • File type is GUL.
  • File type is ODF.
  • File type is ODG.
  • File type is ONE_NOTE.
  • File type is OOXML.
  • File type is SLK.
  • File type is EBOOK.
  • File type is LATEX.
  • File type is TTF.
  • File type is EOT.
  • File type is WOFF.
  • File type is CHM.
  • File type is ZIP.
  • File type is GZIP.
  • File type is BZIP.
  • File type is RZIP.
  • File type is DZIP.
  • File type is SEVENZIP.
  • File type is CAB.
  • File type is JAR.
  • File type is RAR.
  • File type is MSCOMPRESS.
  • File type is ACE.
  • File type is ARC.
  • File type is ARJ.
  • File type is ASD.
  • File type is BLACKHOLE.
  • File type is KGB.
  • File type is ZLIB.
  • File type is TAR.
  • File type is ZST.
  • File type is LZFSE.
  • File type is PYTHON_WHL.
  • File type is PYTHON_PKG.
  • File type is MSIX, new Windows app package format.
  • File type is TEXT.
  • File type is SCRIPT.
  • File type is PHP.
  • File type is PYTHON.
  • File type is PERL.
  • File type is RUBY.
  • File type is C.
  • File type is CPP.
  • File type is JAVA.
  • File type is SHELLSCRIPT.
  • File type is PASCAL.
  • File type is AWK.
  • File type is DYALOG.
  • File type is FORTRAN.
  • File type is JAVASCRIPT.
  • File type is POWERSHELL.
  • File type is VBA.
  • File type is M4.
  • File type is OBJETIVEC.
  • File type is JMOD.
  • File type is MAKEFILE.
  • File type is INI.
  • File type is CLJ.
  • File type is PDB.
  • File type is SQL.
  • File type is NEKO.
  • File type is WER.
  • File type is GOLANG.
  • File type is M3U.
  • File type is BAT, Windows .bat/.cmd (old files are tagged as SHELLSCRIPT).
  • File type is MSC, Microsoft Management Console (MMC).
  • File type is RDP, Microsoft Remote Desktop Protocol (RDP) file.
  • File type is SYMBIAN.
  • File type is PALMOS.
  • File type is WINCE.
  • File type is ANDROID.
  • File type is IPHONE.
  • File type is HTML.
  • File type is XML.
  • File type is SWF.
  • File type is FLA.
  • File type is COOKIE.
  • File type is TORRENT.
  • File type is EMAIL_TYPE.
  • File type is OUTLOOK.
  • File type is SGML.
  • File type is JSON.
  • File type is CSV.
  • File type is HTA (HTML Application).
  • File type is MSHTML .url.
  • File type is CAP.
  • File type is ISOIMAGE.
  • File type is SQUASHFS.
  • File type is VHD.
  • File type is APPLE.
  • File type is MACINTOSH.
  • File type is APPLESINGLE.
  • File type is APPLEDOUBLE.
  • File type is MACINTOSH_HFS.
  • File type is APPLE_PLIST.
  • File type is MACINTOSH_LIB.
  • File type is APPLESCRIPT.
  • File type is APPLESCRIPT_COMPILED .
  • File type is CRX.
  • File type is XPI.
  • File type is ROM.
  • File type is IPS.
  • File type is PEM.
  • File type is PGP.
  • File type is CRT.
typestring
firstSeenTime
descriptionTimestamp the file was first seen in the customer's environment.
formatgoogle-datetime
typestring
firstSubmissionTime
descriptionFirst submission time of the file.
formatgoogle-datetime
typestring
fullPath
descriptionThe full path identifying the location of the file on the system. This field can be used as an entity indicator for file entities.
typestring
lastAccessTime
descriptionTimestamp when the file was accessed.
formatgoogle-datetime
typestring
lastAnalysisTime
descriptionTimestamp the file was last analysed.
formatgoogle-datetime
typestring
lastModificationTime
descriptionTimestamp when the file was last updated.
formatgoogle-datetime
typestring
lastSeenTime
descriptionTimestamp the file was last seen in the customer's environment.
formatgoogle-datetime
typestring
lastSubmissionTime
descriptionLast submission time of the file.
formatgoogle-datetime
typestring
mainIcon
$refFavicon
descriptionIcon's relevant hashes.
md5
descriptionThe MD5 hash of the file, as a hex-encoded string. This field can be used as an entity indicator for file entities.
typestring
mimeType
descriptionThe MIME (Multipurpose Internet Mail Extensions) type of the file, for example "PE", "PDF", or "powershell script".
typestring
names
descriptionNames fields.
items
typestring
typearray
ntfs
$refNtfsFileMetadata
descriptionNTFS metadata.
pdfInfo
$refPDFInfo
descriptionInformation about the PDF file structure.
peFile
$refFileMetadataPE
descriptionMetadata about the Portable Executable (PE) file.
prevalence
$refPrevalence
descriptionPrevalence of the file hash in the customer's environment.
securityResult
$refSecurityResult
descriptionGoogle Cloud Threat Intelligence (GCTI) security result for the file including threat context and detection metadata.
sha1
descriptionThe SHA1 hash of the file, as a hex-encoded string. This field can be used as an entity indicator for file entities.
typestring
sha256
descriptionThe SHA256 hash of the file, as a hex-encoded string. This field can be used as an entity indicator for file entities.
typestring
signatureInfo
$refSignatureInfo
descriptionFile signature information extracted from different tools.
size
descriptionThe size of the file in bytes.
formatuint64
typestring
ssdeep
descriptionSsdeep of the file
typestring
statDev
descriptionThe file system identifier to which the object belongs.
formatuint64
typestring
statFlags
descriptionUser defined flags for file.
formatuint32
typeinteger
statInode
descriptionThe file identifier. Unique identifier of object within a file system.
formatuint64
typestring
statMode
descriptionThe mode of the file. A bit string indicating the permissions and privileges of the file.
formatuint64
typestring
statNlink
descriptionNumber of links to file.
formatuint64
typestring
symhash
descriptionSymHash of the file. Used for Mach-O (e.g. MacOS) binaries, to identify similar files based on their symbol table.
typestring
tags
descriptionTags for the file.
items
typestring
typearray
vhash
descriptionVhash of the file.
typestring
typeobject
BoolSequence
descriptionBoolSequence represents a sequence of bools.
idBoolSequence
properties
boolVals
descriptionbool sequence.
items
typeboolean
typearray
typeobject
BytesSequence
descriptionBytesSequence represents a sequence of bytes.
idBytesSequence
properties
bytesVals
descriptionbytes sequence.
items
formatbyte
typestring
typearray
typeobject
CancelOperationRequest
descriptionThe request message for Operations.CancelOperation.
idCancelOperationRequest
properties
typeobject
CertSignature
descriptionCertificate's signature and algorithm.
idCertSignature
properties
signature
descriptionSignature.
typestring
signatureAlgorithm
descriptionAlgorithm.
typestring
typeobject
Certificate
descriptionCertificate information
idCertificate
properties
issuer
descriptionIssuer of the certificate.
typestring
md5
descriptionThe MD5 hash of the certificate, as a hex-encoded string.
typestring
notAfter
descriptionIndicates when the certificate is no longer valid.
formatgoogle-datetime
typestring
notBefore
descriptionIndicates when the certificate is first valid.
formatgoogle-datetime
typestring
serial
descriptionCertificate serial number.
typestring
sha1
descriptionThe SHA1 hash of the certificate, as a hex-encoded string.
typestring
sha256
descriptionThe SHA256 hash of the certificate, as a hex-encoded string.
typestring
subject
descriptionSubject of the certificate.
typestring
version
descriptionCertificate version.
typestring
typeobject
Chip
idChip
properties
text
typestring
type
enum
  • UNSPECIFIED
  • ALERT
  • NETWORK_CONNECTION
  • EDR
  • UNPARSED_RAW_LOG
  • LOGIN_EVENT
  • EMAIL_EVENT
  • GENERIC
  • TELEMETRY
enumDescriptions
typestring
typeobject
Client
descriptionTransport Layer Security (TLS) information associated with the client (for example, Certificate or JA3 hash).
idClient
properties
certificate
$refCertificate
descriptionClient certificate.
ja3
descriptionJA3 hash from the TLS ClientHello, as a hex-encoded string.
typestring
serverName
descriptionHost name of the server, that the client is connecting to.
typestring
supportedCiphers
descriptionCiphers supported by the client during client hello.
items
typestring
typearray
typeobject
Cloud
descriptionMetadata related to the cloud environment.
idCloud
properties
availabilityZone
descriptionThe cloud environment availability zone (different from region which is location.name).
typestring
environment
descriptionThe Cloud environment.
enum
  • UNSPECIFIED_CLOUD_ENVIRONMENT
  • GOOGLE_CLOUD_PLATFORM
  • AMAZON_WEB_SERVICES
  • MICROSOFT_AZURE
enumDescriptions
  • Default.
  • Google Cloud Platform.
  • Amazon Web Services.
  • Microsoft Azure.
typestring
project
$refResource
deprecatedTrue
descriptionThe cloud environment project information. Deprecated: Use Resource.resource_ancestors
vpc
$refResource
deprecatedTrue
descriptionThe cloud environment VPC. Deprecated.
typeobject
Collection
descriptionCollection represents a container of objects (such as events, entity context metadata, detection finding metadata) and state (such as investigation details). BEGIN GOOGLE-INTERNAL See go/udm:collections for additional details. END GOOGLE-INTERNAL An example use case for Collection is to model a detection and investigation from detection finding metadata to investigative state collected in the course of the investigation. For more complex investigation and response workflows a Collection could represent an incident consisting of multiple child findings or incidents. This can be expanded on to model remediation elements of a full detection and response workflow. NEXT TAG: 20
idCollection
properties
caseName
descriptionThe resource name of the Case that this collection belongs to. Example: projects/{project id}/locations/{region}/chronicle/cases/{internal_case_id}
typestring
collectionElements
descriptionConstituent elements of the collection. Each element shares an association that groups it together and is a component of the overall collection. For example, a detection collection may have several constituent elements that each share a correlation association that together represent a particular pattern or behavior.
items
$refElement
typearray
createdTime
descriptionTime the collection was created.
formatgoogle-datetime
typestring
dataAccessScope
descriptionThe resource name of the DataAccessScope of this collection. BEGIN GOOGLE-INTERNAL We may change this name based on the final resource design of the scope. END GOOGLE-INTERNAL
typestring
detection
descriptionDetection metadata for findings that represent detections, can include rule details, machine learning model metadata, and indicators implicated in the detection (using the .about field).
items
$refSecurityResult
typearray
detectionTime
descriptionTimestamp within the time_window related to the time of the collection_elements. For Rule Detections, this timestamp is the end of the the time_window for multi-event rules or the time of the event for single event rules. For late-arriving events that trigger new alerts, the detection_time will be the event time of the event.
formatgoogle-datetime
typestring
feedbackHistory
descriptionThe history of feedback submitted by analysts for this finding, in descending order by timestamp. This field is limited to the most recent 1000 feedback events. The primary feedback will also be included in this list.
items
$refFeedback
typearray
feedbackSummary
$refFeedback
descriptionThe current primary analyst feedback. This does not include the history of feedback given, which may be supplied in `feedback`.
id
descriptionUnique ID for the collection. The ID is specific to the type of collection. For example, with rule detections this is the detection ID.
typestring
idNamespace
descriptionThe ID namespace used for the Collection.
enum
  • NORMALIZED_TELEMETRY
  • RAW_TELEMETRY
  • RULE_DETECTIONS
  • UPPERCASE
  • MACHINE_INTELLIGENCE
  • SECURITY_COMMAND_CENTER
  • UNSPECIFIED
  • SOAR_ALERT
  • VIRUS_TOTAL
enumDescriptions
  • Ingested and Normalized telemetry events
  • Ingested Raw telemetry
  • Chronicle Rules engine
  • Uppercase
  • DSML - Machine Intelligence
  • A normalized telemetry event from Google Security Command Center.
  • Unspecified Namespace
  • An alert coming from other SIEMs via Chronicle SOAR.
  • VirusTotal.
typestring
investigation
$refInvestigation
descriptionConsolidated investigation details (categorization, status, etc) typically for collections that begin as detection findings and then evolve with analyst action and feedback into investigations around the detection output.
lastUpdatedTime
descriptionTime the collection was last updated.
formatgoogle-datetime
typestring
responsePlatformInfo
$refResponsePlatformInfo
descriptionAlert related info of this same alert in customer's SOAR platform.
soarAlert
descriptionA boolean field indicating that the alert is present in SOAR.
typeboolean
soarAlertMetadata
$refSoarAlertMetadata
descriptionMetadata fields of alerts coming from other SIEM systems via SOAR.
tags
descriptionTags set by UC/DSML/RE for the Finding during creation.
items
typestring
typearray
timeWindow
$refInterval
descriptionTime interval that the collection represents.
type
descriptionWhat the collection represents.
enum
  • COLLECTION_TYPE_UNSPECIFIED
  • TELEMETRY_ALERT
  • GCTI_FINDING
  • UPPERCASE_ALERT
  • RULE_DETECTION
  • MACHINE_INTELLIGENCE_ALERT
  • SOAR_ALERT
enumDescriptions
  • An unspecified collection type.
  • An alert reported in customer telemetry.
  • A finding from the Uppercase team.
  • A detection found by applying a rule.
  • An alert generated by Chronicle machine learning models.
  • An alert coming from other SIEMs via Chronicle SOAR.
typestring
typeobject
ColumnNames
idColumnNames
properties
names
items
typestring
typearray
typeobject
CompilationDiagnostic
descriptionCompilationDiagnostic represents a compilation diagnostic generated during a rule's compilation, such as a compilation error or a compilation warning.
idCompilationDiagnostic
properties
message
descriptionOutput only. The diagnostic message.
readOnlyTrue
typestring
position
$refCompilationPosition
descriptionOutput only. The approximate position in the rule text associated with the compilation diagnostic. Compilation Position may be empty.
readOnlyTrue
severity
descriptionOutput only. The severity of a rule's compilation diagnostic.
enum
  • SEVERITY_UNSPECIFIED
  • WARNING
  • ERROR
enumDescriptions
  • An unspecified severity level.
  • A compilation warning.
  • A compilation error.
readOnlyTrue
typestring
uri
descriptionOutput only. Link to documentation that describes a diagnostic in more detail.
readOnlyTrue
typestring
typeobject
CompilationPosition
descriptionCompilationPosition represents the location of a compilation diagnostic in rule text.
idCompilationPosition
properties
endColumn
descriptionOutput only. End column number, beginning at 1.
formatint32
readOnlyTrue
typeinteger
endLine
descriptionOutput only. End line number, beginning at 1.
formatint32
readOnlyTrue
typeinteger
startColumn
descriptionOutput only. Start column number, beginning at 1.
formatint32
readOnlyTrue
typeinteger
startLine
descriptionOutput only. Start line number, beginning at 1.
formatint32
readOnlyTrue
typeinteger
typeobject
CreateParserExtensionMetadata
descriptionOperation metadata for creating a parser extension.
idCreateParserExtensionMetadata
properties
state
descriptionThe state of the parser extension creation process.
enum
  • STATE_UNSPECIFIED
  • NEW
  • VALIDATING
  • LIVE
  • REJECTED
  • INTERNAL_ERROR
  • VALIDATED
  • ARCHIVED
enumDescriptions
  • The state for this parser extension was not specified.
  • The parser extension has been newly submitted and is waiting to be validated.
  • The parser extension is currently going through the validation pipeline.
  • The parser extension is live in production. Only configs that have successfully passed the validation stage will be set to LIVE.
  • Validation completed, but the parser extension was rejected with errors.
  • An error occurred when processing this parser extension.
  • Extension is validated.
  • Extension is archived and is no more being used.
typestring
stateLastChangedTime
descriptionThe time the config state was last changed.
formatgoogle-datetime
typestring
validationErrors
descriptionAny validation error while validating the extension, this have cap of size 10
items
typestring
typearray
validationReport
descriptionThe validation report generated during validation of the parser extension.
typestring
typeobject
CreateParserMetadata
descriptionOperation metadata for creating a parser.
idCreateParserMetadata
properties
stage
descriptionThe validation stage of the parser creation process.
enum
  • VALIDATION_STAGE_UNSPECIFIED
  • NEW
  • VALIDATING
  • PASSED
  • FAILED
  • DELETE_CANDIDATE
enumDescriptions
  • The validation stage is not specified.
  • The custom parser is submitted for validation.
  • The custom parser is currently going through the validation pipeline
  • The custom parser has successfully passed the validation.
  • The custom parser has failed validation.
  • The parser is no good, It is available for auto deletion.
typestring
validationReport
descriptionThe validation report generated during validation of the parser.
typestring
typeobject
DNSRecord
descriptionDNS record.
idDNSRecord
properties
expire
descriptionExpire.
formatgoogle-duration
typestring
minimum
descriptionMinimum.
formatgoogle-duration
typestring
priority
descriptionPriority.
formatint64
typestring
refresh
descriptionRefresh.
formatgoogle-duration
typestring
retry
descriptionRetry.
formatint64
typestring
rname
descriptionRname.
typestring
serial
descriptionSerial.
formatint64
typestring
ttl
descriptionTime to live.
formatgoogle-duration
typestring
type
descriptionType.
typestring
value
descriptionValue.
typestring
typeobject
DataAccessIngestionLabel
idDataAccessIngestionLabel
properties
key
descriptionThe key.
typestring
value
descriptionThe value.
typestring
typeobject
DataAccessLabel
descriptionA DataAccessLabel is a label on events to define user access to data.
idDataAccessLabel
properties
author
descriptionOutput only. The user who created the data access label.
readOnlyTrue
typestring
createTime
descriptionOutput only. The time at which the data access label was created.
formatgoogle-datetime
readOnlyTrue
typestring
description
descriptionOptional. A description of the data access label for a human reader.
typestring
displayName
descriptionOutput only. The short name displayed for the label as it appears on event data.
readOnlyTrue
typestring
lastEditor
descriptionOutput only. The user who last updated the data access label.
readOnlyTrue
typestring
name
descriptionRequired. The unique resource name of the data access label.
typestring
udmQuery
descriptionA UDM query over event data.
typestring
updateTime
descriptionOutput only. The time at which the data access label was last updated.
formatgoogle-datetime
readOnlyTrue
typestring
typeobject
DataAccessLabelReference
descriptionReference object to a data access label.
idDataAccessLabelReference
properties
assetNamespace
descriptionThe asset namespace configured in the forwarder of the customer's events.
typestring
dataAccessLabel
descriptionThe name of the data access label.
typestring
displayName
descriptionOutput only. The display name of the label. Data access label and log types's name will match the display name of the resource. The asset namespace will match the namespace itself. The ingestion key value pair will match the key of the tuple.
readOnlyTrue
typestring
ingestionLabel
$refIngestionLabel
descriptionThe ingestion label configured in the forwarder of the customer's events.
logType
descriptionThe name of the log type.
typestring
typeobject
DataAccessLabels
idDataAccessLabels
properties
allowScopedAccess
descriptionAre the labels ready for scoped access
typeboolean
customLabels
descriptionAll the complex labels (UDM search syntax based).
items
typestring
typearray
ingestionKvLabels
descriptionAll the ingestion labels (key/value pairs).
items
$refDataAccessIngestionLabel
typearray
ingestionLabels
deprecatedTrue
descriptionAll the ingestion labels.
items
typestring
typearray
logTypes
descriptionAll the LogType labels.
items
typestring
typearray
namespaces
descriptionAll the namespaces.
items
typestring
typearray
typeobject
DataAccessScope
descriptionA DataAccessScope is a boolean expression of data access labels used to restrict access to data for users.
idDataAccessScope
properties
allowAll
descriptionOptional. Whether or not the scope allows all labels, allow_all and allowed_data_access_labels are mutually exclusive and one of them must be present. denied_data_access_labels can still be used along with allow_all. When combined with denied_data_access_labels, access will be granted to all data that doesn't have labels mentioned in denied_data_access_labels. E.g.: A customer with scope with denied labels A and B and allow_all will be able to see all data except data labeled with A and data labeled with B and data with labels A and B.
typeboolean
allowedDataAccessLabels
descriptionOptional. The allowed labels for the scope. Either allow_all or allowed_data_access_labels needs to be provided. When provided, there has to be at least one label allowed for the scope to be valid. The logical operator for evaluation of the allowed labels is OR. E.g.: A customer with scope with allowed labels A and B will be able to see data with labeled with A or B or (A and B).
items
$refDataAccessLabelReference
typearray
author
descriptionOutput only. The user who created the data access scope.
readOnlyTrue
typestring
createTime
descriptionOutput only. The time at which the data access scope was created.
formatgoogle-datetime
readOnlyTrue
typestring
deniedDataAccessLabels
descriptionOptional. The denied labels for the scope. The logical operator for evaluation of the denied labels is AND. E.g.: A customer with scope with denied labels A and B won't be able to see data labeled with A and data labeled with B and data with labels A and B.
items
$refDataAccessLabelReference
typearray
description
descriptionOptional. A description of the data access scope for a human reader.
typestring
displayName
descriptionOutput only. The name to be used for display to customers of the data access scope.
readOnlyTrue
typestring
lastEditor
descriptionOutput only. The user who last updated the data access scope.
readOnlyTrue
typestring
name
descriptionRequired. The unique full name of the data access scope. The name should comply with https://google.aip.dev/122 standards.
typestring
updateTime
descriptionOutput only. The time at which the data access scope was last updated.
formatgoogle-datetime
readOnlyTrue
typestring
typeobject
Date
descriptionRepresents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values. * A month and day, with a zero year (for example, an anniversary). * A year on its own, with a zero month and a zero day. * A year and month, with a zero day (for example, a credit card expiration date). Related types: * google.type.TimeOfDay * google.type.DateTime * google.protobuf.Timestamp
idDate
properties
day
descriptionDay of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.
formatint32
typeinteger
month
descriptionMonth of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.
formatint32
typeinteger
year
descriptionYear of the date. Must be from 1 to 9999, or 0 to specify a date without a year.
formatint32
typeinteger
typeobject
Detections
idDetections
properties
baselineAlertsCount
formatint32
typeinteger
complete
typeboolean
detectionFieldAggregations
$refAlertFieldAggregations
detections
items
$refCollection
typearray
filteredAlertsCount
formatint32
typeinteger
tooManyDetections
typeboolean
validSnapshotQuery
typeboolean
typeobject
Dhcp
descriptionDHCP information.
idDhcp
properties
chaddr
descriptionClient hardware address (chaddr).
typestring
ciaddr
descriptionClient IP address (ciaddr).
typestring
clientHostname
descriptionClient hostname. See RFC2132, section 3.14.
typestring
clientIdentifier
descriptionClient identifier. See RFC2132, section 9.14. Note: Make sure to update the client_identifier_string field as well if you update this field.
formatbyte
typestring
clientIdentifierString
descriptionClient identifier as string. See RFC2132, section 9.14. This field holds the string value of the client_identifier.
typestring
file
descriptionBoot image filename.
typestring
flags
descriptionFlags.
formatuint32
typeinteger
giaddr
descriptionRelay agent IP address (giaddr).
typestring
hlen
descriptionHardware address length.
formatuint32
typeinteger
hops
descriptionHardware ops.
formatuint32
typeinteger
htype
descriptionHardware address type.
formatuint32
typeinteger
leaseTimeSeconds
descriptionLease time in seconds. See RFC2132, section 9.2.
formatuint32
typeinteger
opcode
descriptionThe BOOTP op code.
enum
  • UNKNOWN_OPCODE
  • BOOTREQUEST
  • BOOTREPLY
enumDescriptions
  • Default opcode.
  • Request.
  • Reply.
typestring
options
descriptionList of DHCP options.
items
$refOption
typearray
requestedAddress
descriptionRequested IP address. See RFC2132, section 9.1.
typestring
seconds
descriptionSeconds elapsed since client began address acquisition/renewal process.
formatuint32
typeinteger
siaddr
descriptionIP address of the next bootstrap server.
typestring
sname
descriptionServer name that the client wishes to boot from.
typestring
transactionId
descriptionTransaction ID.
formatuint32
typeinteger
type
descriptionDHCP message type.
enum
  • UNKNOWN_MESSAGE_TYPE
  • DISCOVER
  • OFFER
  • REQUEST
  • DECLINE
  • ACK
  • NAK
  • RELEASE
  • INFORM
  • WIN_DELETED
  • WIN_EXPIRED
enumDescriptions
  • Default message type.
  • DHCPDISCOVER.
  • DHCPOFFER.
  • DHCPREQUEST.
  • DHCPDECLINE.
  • DHCPACK.
  • DHCPNAK.
  • DHCPRELEASE.
  • DHCPINFORM.
  • Microsoft Windows DHCP "lease deleted".
  • Microsoft Windows DHCP "lease expired".
typestring
yiaddr
descriptionYour IP address (yiaddr).
typestring
typeobject
Dns
descriptionDNS information.
idDns
properties
additional
descriptionA list of additional domain name servers that can be used to verify the answer to the domain.
items
$refResourceRecord
typearray
answers
descriptionA list of answers to the domain name query.
items
$refResourceRecord
typearray
authoritative
descriptionOther DNS header flags. See RFC1035, section 4.1.1.
typeboolean
authority
descriptionA list of domain name servers which verified the answers to the domain name queries.
items
$refResourceRecord
typearray
id
descriptionDNS query id.
formatuint32
typeinteger
opcode
descriptionThe DNS OpCode used to specify the type of DNS query (for example, QUERY, IQUERY, or STATUS).
formatuint32
typeinteger
questions
descriptionA list of domain protocol message questions.
items
$refQuestion
typearray
recursionAvailable
descriptionWhether a recursive DNS lookup is available.
typeboolean
recursionDesired
descriptionWhether a recursive DNS lookup is desired.
typeboolean
response
descriptionSet to true if the event is a DNS response. See QR field from RFC1035.
typeboolean
responseCode
descriptionResponse code. See RCODE from RFC1035.
formatuint32
typeinteger
truncated
descriptionWhether the DNS response was truncated.
typeboolean
typeobject
Domain
descriptionInformation about a domain.
idDomain
properties
admin
$refUser
descriptionParsed contact information for the administrative contact for the domain.
auditUpdateTime
descriptionAudit updated time.
formatgoogle-datetime
typestring
billing
$refUser
descriptionParsed contact information for the billing contact of the domain.
categories
descriptionCategories assign to the domain as retrieved from VirusTotal.
items
typestring
typearray
contactEmail
descriptionContact email address.
typestring
creationTime
descriptionDomain creation time.
formatgoogle-datetime
typestring
expirationTime
descriptionExpiration time.
formatgoogle-datetime
typestring
favicon
$refFavicon
descriptionIncludes difference hash and MD5 hash of the domain's favicon.
firstSeenTime
descriptionFirst seen timestamp of the domain in the customer's environment.
formatgoogle-datetime
typestring
ianaRegistrarId
descriptionIANA Registrar ID. See https://www.iana.org/assignments/registrar-ids/registrar-ids.xhtml
formatint32
typeinteger
jarm
descriptionDomain's JARM hash.
typestring
lastDnsRecords
descriptionDomain's DNS records from the last scan.
items
$refDNSRecord
typearray
lastDnsRecordsTime
descriptionDate when the DNS records list was retrieved by VirusTotal.
formatgoogle-datetime
typestring
lastHttpsCertificate
$refSSLCertificate
descriptionSSL certificate object retrieved last time the domain was analyzed.
lastHttpsCertificateTime
descriptionWhen the certificate was retrieved by VirusTotal.
formatgoogle-datetime
typestring
lastSeenTime
descriptionLast seen timestamp of the domain in the customer's environment.
formatgoogle-datetime
typestring
name
descriptionThe domain name. This field can be used as an entity indicator for Domain entities.
typestring
nameServer
descriptionRepeated list of name servers.
items
typestring
typearray
popularityRanks
descriptionDomain's position in popularity ranks such as Alexa, Quantcast, Statvoo, etc
items
$refPopularityRank
typearray
prevalence
$refPrevalence
descriptionThe prevalence of the domain within the customer's environment.
privateRegistration
descriptionIndicates whether the domain appears to be using a private registration service to mask the owner's contact information.
typeboolean
registrant
$refUser
descriptionParsed contact information for the registrant of the domain.
registrar
descriptionRegistrar name . FOr example, "Wild West Domains, Inc. (R120-LROR)", "GoDaddy.com, LLC", or "PDR LTD. D/B/A PUBLICDOMAINREGISTRY.COM".
typestring
registryDataRawText
descriptionRegistry Data raw text.
formatbyte
typestring
status
descriptionDomain status. See https://www.icann.org/resources/pages/epp-status-codes-2014-06-16-en for meanings of possible values
typestring
tags
descriptionList of representative attributes.
items
typestring
typearray
tech
$refUser
descriptionParsed contact information for the technical contact for the domain
updateTime
descriptionLast updated time.
formatgoogle-datetime
typestring
whoisRecordRawText
descriptionWHOIS raw text.
formatbyte
typestring
whoisServer
descriptionWhois server name.
typestring
whoisTime
descriptionDate of the last update of the WHOIS record.
formatgoogle-datetime
typestring
zone
$refUser
descriptionParsed contact information for the zone.
typeobject
DoubleSequence
descriptionDoubleSequence represents a sequence of doubles.
idDoubleSequence
properties
doubleVals
descriptiondouble sequence.
items
formatdouble
typenumber
typearray
typeobject
EC
descriptionEC public key information.
idEC
properties
oid
descriptionCurve name.
typestring
pub
descriptionPublic key hexdump.
typestring
typeobject
Element
descriptionNEXT TAG: 5
idElement
properties
association
$refSecurityResult
descriptionMetadata that provides the relevant association for the references in the element. For a detection, this can be the correlated aspect of the references that contributed to the overall detection. For example, may include sub-rule condition, machine learning model metadata, and/or indicators implicated in this component of the detection (using the .about field).
label
descriptionA name that labels the entire references group.
typestring
references
descriptionReferences to model primatives including events and entities that share a common association. Even though a reference can have both UDM and entity, a collection of references (of a single element) will only have one type of message in it (either UDM / Entity).
items
$refReference
typearray
referencesSampled
descriptionCopied from the detection event_sample.too_many_event_samples field. If true, the number of references will be capped at the sample limit (set at rule service). This is applicable to both UDM references and Entity references.
typeboolean
typeobject
Email
descriptionEmail info.
idEmail
properties
bcc
descriptionA list of 'bcc' addresses.
items
typestring
typearray
bounceAddress
descriptionThe envelope from address. https://en.wikipedia.org/wiki/Bounce_address
typestring
cc
descriptionA list of 'cc' addresses.
items
typestring
typearray
from
descriptionThe 'from' address.
typestring
mailId
descriptionThe mail (or message) ID.
typestring
replyTo
descriptionThe 'reply to' address.
typestring
subject
descriptionThe subject line(s) of the email.
items
typestring
typearray
to
descriptionA list of 'to' addresses.
items
typestring
typearray
typeobject
Empty
descriptionA generic empty message that you can re-use to avoid defining duplicated empty messages in your APIs. A typical example is to use it as the request or the response type of an API method. For instance: service Foo { rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty); }
idEmpty
properties
typeobject
EntityChangedCountTimelineBucket
idEntityChangedCountTimelineBucket
properties
entityChangedInfo
items
$refEntityChangedInfo
typearray
totalChangedEntitiesCount
formatint32
typeinteger
typeobject
EntityChangedInfo
idEntityChangedInfo
properties
artifacts
$refFieldAndValue
entityCount
formatint32
typeinteger
typeobject
EntityCount
descriptionCount of different types of entities in the watchlist.
idEntityCount
properties
asset
descriptionOutput only. Count of asset type entities in the watchlist.
formatint32
readOnlyTrue
typeinteger
user
descriptionOutput only. Count of user type entities in the watchlist.
formatint32
readOnlyTrue
typeinteger
typeobject
EntityMetadata
descriptionInformation about the Entity and the product where the entity was created. Next Tag: 17
idEntityMetadata
properties
collectedTimestamp
descriptionGMT timestamp when the entity information was collected by the vendor's local collection infrastructure.
formatgoogle-datetime
typestring
creationTimestamp
descriptionGMT timestamp when the entity described by the product_entity_id was created on the system where data was collected.
formatgoogle-datetime
typestring
description
descriptionHuman-readable description of the entity.
typestring
entityType
descriptionEntity type. If an entity has multiple possible types, this specifies the most specific type.
enum
  • UNKNOWN_ENTITYTYPE
  • ASSET
  • USER
  • GROUP
  • RESOURCE
  • IP_ADDRESS
  • FILE
  • DOMAIN_NAME
  • URL
  • MUTEX
  • METRIC
enumDescriptions
  • @hide_from_doc
  • An asset, such as workstation, laptop, phone, virtual machine, etc.
  • User.
  • Group.
  • Resource.
  • An external IP address.
  • A file.
  • A domain.
  • A url.
  • A mutex.
  • A metric.
typestring
eventMetadata
$refMetadata
descriptionMetadata field from the event.
extracted
additionalProperties
descriptionProperties of the object.
typeany
descriptionFlattened fields extracted from the log.
typeobject
feed
descriptionVendor feed name for a threat indicator feed.
typestring
interval
$refInterval
descriptionValid existence time range for the version of the entity represented by this entity data.
productEntityId
descriptionA vendor-specific identifier that uniquely identifies the entity (e.g. a GUID, LDAP, OID, or similar).
typestring
productName
descriptionProduct name that produced the entity information.
typestring
productVersion
descriptionVersion of the product that produced the entity information.
typestring
sourceLabels
descriptionEntity source metadata labels.
items
$refLabel
typearray
sourceType
descriptionThe source of the entity.
enum
  • SOURCE_TYPE_UNSPECIFIED
  • ENTITY_CONTEXT
  • DERIVED_CONTEXT
  • GLOBAL_CONTEXT
enumDescriptions
  • Default source type
  • Entities ingested from customers (e.g. AD_CONTEXT, DLP_CONTEXT)
  • Entities derived from customer data such as prevalence, artifact first/last seen, or asset/user first seen stats.
  • Global contextual entities such as WHOIS or Safe Browsing.
typestring
structuredFields
additionalProperties
descriptionProperties of the object.
typeany
deprecatedTrue
descriptionStructured fields extracted from the log.
typeobject
threat
descriptionMetadata provided by a threat intelligence feed that identified the entity as malicious.
items
$refSecurityResult
typearray
vendorName
descriptionVendor name of the product that produced the entity information.
typestring
typeobject
EntityPopulationMechanism
descriptionMechanism to populate entities in the watchlist.
idEntityPopulationMechanism
properties
manual
$refManual
descriptionOptional. Entities are added manually.
typeobject
EntityRisk
descriptionStores information related to the risk score of an entity. Next ID: 15
idEntityRisk
properties
DEPRECATEDRiskScore
deprecatedTrue
descriptionDeprecated risk score.
formatint32
typeinteger
detailUri
descriptionLink to the Google Security Operations UI with information about the entity risk score. If the SecOps instance has multiple frontend paths configured, this will be a relative path that can be used to construct the full URL.
typestring
detectionsCount
descriptionNumber of detections that make up the risk score within the time window.
formatint32
typeinteger
firstDetectionTime
descriptionTimestamp of the first detection within the specified time window. This field is empty when there are no detections.
formatgoogle-datetime
typestring
lastDetectionTime
descriptionTimestamp of the last detection within the specified time window. This field is empty when there are no detections.
formatgoogle-datetime
typestring
lastResetTime
descriptionTimestamp for UEBA risk score reset based deduplication. Used specifically for risk based meta rules.
formatgoogle-datetime
typestring
normalizedRiskScore
descriptionNormalized risk score for the entity. This value is between 0-1000.
formatint32
typeinteger
rawRiskDelta
$refRiskDelta
descriptionRepresents the change in raw risk score for an entity between the end of the previous time window and the end of the current time window.
riskDelta
$refRiskDelta
descriptionRepresents the change in risk score for an entity between the end of the previous time window and the end of the current time window.
riskScore
descriptionRaw risk score for the entity.
formatfloat
typenumber
riskVersion
descriptionVersion of the risk score calculation algorithm.
typestring
riskWindow
$refInterval
descriptionTime window used when computing the risk score for an entity, for example 24 hours or 7 days.
riskWindowHasNewDetections
descriptionWhether there are new detections for the risk window.
typeboolean
riskWindowSize
descriptionRisk window duration for the entity.
formatgoogle-duration
typestring
typeobject
ErrorMessage
idErrorMessage
properties
errorText
typestring
type
enum
  • UNDEFINED_ERROR_TYPE
  • INVALID_QUERY_TYPE
  • INVALID_FIELD_PATH_TYPE
  • UNCLOSED_BRACKET_TYPE
  • BACKEND_ERROR_TYPE
  • UNCLOSED_QUOTES_TYPE
  • QUERY_TOO_LARGE_TYPE
enumDescriptions
typestring
typeobject
EventCountTimeline
idEventCountTimeline
properties
buckets
items
$refEventCountTimelineBucket
typearray
sizeOfBucketMs
formatint64
typestring
typeobject
EventCountTimelineBucket
idEventCountTimelineBucket
properties
alertCount
formatint32
typeinteger
baselineAlertCount
formatint32
typeinteger
baselineEventCount
formatint32
typeinteger
baselineTimedEntityCount
formatint32
typeinteger
entityChangedCount
$refEntityChangedCountTimelineBucket
eventCount
formatint32
typeinteger
filteredTimedEntityCount
formatint32
typeinteger
typeobject
Execution
descriptionExecution can be used to store metadata required for what action the UI should execute.
idExecution
properties
metadata
additionalProperties
typestring
descriptionOutput only. The payload to use when executing the action.
readOnlyTrue
typeobject
typeobject
ExifInfo
descriptionExif information.
idExifInfo
properties
company
descriptioncompany name.
typestring
compilationTime
descriptionCompilation time.
formatgoogle-datetime
typestring
entryPoint
descriptionentry point.
formatint64
typestring
fileDescription
descriptiondescription of a file.
typestring
originalFile
descriptionoriginal file name.
typestring
product
descriptionproduct name.
typestring
typeobject
Extension
descriptionCertificate's extensions.
idExtension
properties
authorityKeyId
$refAuthorityKeyId
descriptionIdentifies the public key to be used to verify the signature on this certificate or CRL.
ca
descriptionWhether the subject acts as a certificate authority (CA) or not.
typeboolean
caInfoAccess
descriptionAuthority information access locations are URLs that are added to a certificate in its authority information access extension.
typestring
certTemplateNameDc
descriptionBMP data value "DomainController". See MS Q291010.
typestring
certificatePolicies
descriptionDifferent certificate policies will relate to different applications which may use the certified key.
typestring
crlDistributionPoints
descriptionCRL distribution points to which a certificate user should refer to ascertain if the certificate has been revoked.
typestring
extendedKeyUsage
descriptionOne or more purposes for which the certified public key may be used, in addition to or in place of the basic purposes indicated in the key usage extension field.
typestring
keyUsage
descriptionThe purpose for which the certified public key is used.
typestring
netscapeCertComment
descriptionUsed to include free-form text comments inside certificates.
typestring
netscapeCertificate
descriptionIdentify whether the certificate subject is an SSL client, an SSL server, or a CA.
typeboolean
oldAuthorityKeyId
descriptionWhether the certificate has an old authority key identifier extension.
typeboolean
peLogotype
descriptionWhether the certificate includes a logotype.
typeboolean
subjectAlternativeName
descriptionContains one or more alternative names, using any of a variety of name forms, for the entity that is bound by the CA to the certified public key.
typestring
subjectKeyId
descriptionIdentifies the public key being certified.
typestring
typeobject
Extensions
descriptionExtensions to a UDM event.
idExtensions
properties
auth
$refAuthentication
descriptionAn authentication extension.
entityRisk
$refEntityRisk
descriptionAn entity risk change extension.
vulns
$refVulnerabilities
descriptionA vulnerability extension.
typeobject
Favicon
descriptionDifference hash and MD5 hash of the domain's favicon.
idFavicon
properties
dhash
descriptionDifference hash.
typestring
rawMd5
descriptionFavicon's MD5 hash.
typestring
typeobject
Feedback
idFeedback
properties
comment
descriptionOptional.
typestring
confidenceScore
formatint32
typeinteger
createdTime
formatgoogle-datetime
typestring
disregarded
typeboolean
idpUserId
typestring
priority
descriptionOptional.
enum
  • PRIORITY_UNSPECIFIED
  • PRIORITY_INFO
  • PRIORITY_LOW
  • PRIORITY_MEDIUM
  • PRIORITY_HIGH
  • PRIORITY_CRITICAL
enumDescriptions
  • Default priority level.
  • Informational priority.
  • Low priority.
  • Medium priority.
  • High priority.
  • Critical priority.
typestring
priorityDisplay
descriptionOptional.
typestring
reason
descriptionOptional.
enum
  • REASON_UNSPECIFIED
  • REASON_NOT_MALICIOUS
  • REASON_MALICIOUS
  • REASON_MAINTENANCE
enumDescriptions
  • Default reason.
  • Case or Alert not malicious.
  • Case or Alert is malicious.
  • Case or Alert is under maintenance.
typestring
reputation
enum
  • REPUTATION_UNSPECIFIED
  • USEFUL
  • NOT_USEFUL
enumDescriptions
  • An unspecified reputation.
  • A categorization of the finding as useful.
  • A categorization of the finding as not useful.
typestring
riskScore
formatint32
typeinteger
rootCause
descriptionOptional.
typestring
severity
formatint32
typeinteger
severityDisplay
descriptionOptional.
typestring
status
descriptionOptional.
enum
  • STATUS_UNSPECIFIED
  • NEW
  • REVIEWED
  • CLOSED
  • OPEN
enumDescriptions
  • Unspecified finding status.
  • New finding.
  • When a finding has feedback.
  • When an analyst closes an finding.
  • Open. Used to indicate that a Case / Alert is open.
typestring
verdict
enum
  • VERDICT_UNSPECIFIED
  • TRUE_POSITIVE
  • FALSE_POSITIVE
enumDescriptions
  • An unspecified verdict.
  • A categorization of the finding as a "true positive".
  • A categorization of the finding as a "false positive".
typestring
typeobject
FieldAndValue
idFieldAndValue
properties
entityNamespace
typestring
fieldPath
typestring
kvalueType
enum
  • UNKNOWN
  • COLLECTOR_ID
  • EVENT_SHARD
  • ASSET_IP_ADDRESS
  • MAC
  • HOSTNAME
  • PRODUCT_SPECIFIC_ID
  • NAMESPACE
  • DOMAIN_NAME
  • RESOLVED_IP_ADDRESS
  • STEMMED_DOMAIN_NAME
  • PROCESS_ID
  • FULL_COMMAND_LINE
  • FILE_NAME
  • FILE_PATH
  • HASH_MD5
  • HASH_SHA256
  • HASH_SHA1
  • RAW_PID
  • PARENT_PROCESS_ID
  • EMAIL
  • USERNAME
  • WINDOWS_SID
  • EMPLOYEE_ID
  • PRODUCT_OBJECT_ID
  • USER_DISPLAY_NAME
  • CLOUD_RESOURCE_NAME
  • REGISTRY_KEY
  • REGISTRY_VALUE_DATA
  • REGISTRY_VALUE_NAME
enumDescriptions
typestring
value
typestring
typeobject
FileMetadata
descriptionMetadata about a file. Place metadata about different file types here, for example data from the Microsoft Windows VersionInfo block or digital signer details. Use a different sub-message per file type.
idFileMetadata
properties
pe
$refPeFileMetadata
deprecatedTrue
descriptionMetadata for Microsoft Windows PE files. Deprecate PeFileMetadata in favor of single File proto.
typeobject
FileMetadataCodesign
descriptionFile metadata from the codesign utility.
idFileMetadataCodesign
properties
compilationTime
descriptionCode sign timestamp
formatgoogle-datetime
typestring
format
descriptionCode sign format.
typestring
id
descriptionCode sign identifier.
typestring
teamId
descriptionThe assigned team identifier of the developer who signed the application.
typestring
typeobject
FileMetadataImports
descriptionFile metadata imports.
idFileMetadataImports
properties
functions
descriptionFunction field.
items
typestring
typearray
library
descriptionLibrary field.
typestring
typeobject
FileMetadataPE
descriptionMetadata about the Portable Executable (PE) file.
idFileMetadataPE
properties
compilationExiftoolTime
descriptioninfo.exiftool.TimeStamp.
formatgoogle-datetime
typestring
compilationTime
descriptioninfo.pe-timestamp.
formatgoogle-datetime
typestring
entryPoint
descriptioninfo.pe-entry-point.
formatint64
typestring
entryPointExiftool
descriptioninfo.exiftool.EntryPoint.
formatint64
typestring
imphash
descriptionImphash of the file.
typestring
imports
descriptionFilemetadataImports fields.
items
$refFileMetadataImports
typearray
resource
descriptionFilemetadataPeResourceInfo fields.
items
$refFileMetadataPeResourceInfo
typearray
resourcesLanguageCount
deprecatedTrue
descriptionDeprecated: use resources_language_count_str.
items
$refStringToInt64MapEntry
typearray
resourcesLanguageCountStr
descriptionNumber of resources by language. Example: NEUTRAL: 20, ENGLISH US: 10
items
$refLabel
typearray
resourcesTypeCount
deprecatedTrue
descriptionDeprecated: use resources_type_count_str.
items
$refStringToInt64MapEntry
typearray
resourcesTypeCountStr
descriptionNumber of resources by resource type. Example: RT_ICON: 10, RT_DIALOG: 5
items
$refLabel
typearray
section
descriptionFilemetadataSection fields.
items
$refFileMetadataSection
typearray
signatureInfo
$refFileMetadataSignatureInfo
deprecatedTrue
descriptionFilemetadataSignatureInfo field. deprecated, user File.signature_info instead.
typeobject
FileMetadataPeResourceInfo
descriptionFile metadata for PE resource.
idFileMetadataPeResourceInfo
properties
entropy
descriptionEntropy of the resource.
formatdouble
typenumber
fileType
descriptionFile type. Note that this value may not match any of the well-known type identifiers defined in the ResourceType enum.
typestring
filetypeMagic
descriptionType of resource content, as identified by the magic Python module.
typestring
languageCode
descriptionHuman-readable version of the language and sublanguage identifiers, as defined in the Microsoft Windows PE specification. Examples: | Language | Sublanguage | Field value | | LANG_NEUTRAL | SUBLANG_NEUTRAL | NEUTRAL | | LANG_FRENCH | - | FRENCH | | LANG_ENGLISH | SUBLANG_ENGLISH US | ENGLISH US |
typestring
sha256Hex
descriptionSHA256_hex field..
typestring
typeobject
FileMetadataSection
descriptionFile metadata section.
idFileMetadataSection
properties
entropy
descriptionEntropy of the section.
formatdouble
typenumber
md5Hex
descriptionMD5 hex of the file.
typestring
name
descriptionName of the section.
typestring
rawSizeBytes
descriptionRaw file size in bytes.
formatint64
typestring
virtualSizeBytes
descriptionVirtual file size in bytes.
formatint64
typestring
typeobject
FileMetadataSignatureInfo
descriptionSignature information.
idFileMetadataSignatureInfo
properties
signer
deprecatedTrue
descriptionDeprecated: use signers field.
items
typestring
typearray
signers
descriptionFile metadata signer information. The order of the signers matters. Each element is a higher level authority, being the last the root authority.
items
$refSignerInfo
typearray
verificationMessage
descriptionStatus of the certificate. Valid values are "Signed", "Unsigned" or a description of the certificate anomaly, if found.
typestring
verified
descriptionTrue if verification_message == "Signed"
typeboolean
x509
descriptionList of certificates.
items
$refX509
typearray
typeobject
FilterProperties
idFilterProperties
properties
hidden
typeboolean
stringProperties
additionalProperties
$refStringValues
typeobject
typeobject
FindingVariable
descriptionA structure that holds the value and associated metadata for values extracted while producing a Finding.
idFindingVariable
properties
boolSeq
$refBoolSequence
descriptionThe value in boolsequence format.
boolVal
descriptionThe value in boolean format.
typeboolean
bytesSeq
$refBytesSequence
descriptionThe value in bytessequence format.
bytesVal
descriptionThe value in bytes format.
formatbyte
typestring
doubleSeq
$refDoubleSequence
descriptionThe value in doublesequence format.
doubleVal
descriptionThe value in double format.
formatdouble
typenumber
int64Seq
$refInt64Sequence
descriptionThe value in int64sequence format.
int64Val
descriptionThe value in int64 format.
formatint64
typestring
nullVal
descriptionWhether the value is null.
typeboolean
sourcePath
descriptionThe UDM field path for the field which this value was derived from. Example: `principal.user.username`
typestring
stringSeq
$refStringSequence
descriptionThe value in stringsequence format.
stringVal
descriptionThe value in string format. Enum values are returned as strings.
typestring
type
descriptionThe type of the variable.
enum
  • TYPE_UNSPECIFIED
  • MATCH
  • OUTCOME
enumDescriptions
  • An unspecified variable type.
  • A variable coming from the match conditions.
  • A variable representing significant data that was found in the detection logic.
typestring
uint64Seq
$refUint64Sequence
descriptionThe value in uint64sequence format.
uint64Val
descriptionThe value in uint64 format.
formatuint64
typestring
value
descriptionThe value in string form.
typestring
typeobject
FollowUp
descriptionFollowUp can be used to store metadata required to send a follow up message by the UI.
idFollowUp
properties
followUp
descriptionOutput only. The text to use as input when generating the follow up message.
readOnlyTrue
typestring
typeobject
Ftp
descriptionFTP info.
idFtp
properties
command
descriptionThe FTP command.
typestring
typeobject
FunctionResponse
idFunctionResponse
properties
rows
items
$refFunctionResponseRow
typearray
tooManyRows
typeboolean
typeobject
FunctionResponseRow
idFunctionResponseRow
properties
values
items
$refUdmFieldValue
typearray
typeobject
GoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStats
descriptionLINT.IfChange(stats_data) Stats results when the query is for statistics NEXT TAG = 6;
idGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStats
properties
dataQueryExpression
descriptionExpression that represent the subset of the requested query used to filter data. The expression will be used to enable features such as drill-down from stats results to UDM events. In that case, the new query will be composed by this expression and the expression related to a stats result.
typestring
results
descriptionResult rows that are queried.
items
$refGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnData
typearray
sortOrder
descriptionIndicates the columns used for sorting and the order in which they are sorted. If no ORDER section is specified in the query, this will be empty.
items
$refGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnSort
typearray
tooManyResults
descriptionIf true, there are too many results to return and some have been omitted.
typeboolean
totalResults
descriptionThe total number of results returned.
formatint32
typeinteger
typeobject
GoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnData
descriptionRepresents a single column in the set of columns returned as the stats query result.
idGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnData
properties
column
descriptionUsed to store column names.
typestring
filterExpression
descriptionExpression used to compose a query for filtering/drill-downs related to the data in this column.
typestring
filterable
descriptionTo identify if the column can be used for filtering/drill-downs.
typeboolean
values
descriptionTo store store column data.
items
$refGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnType
typearray
typeobject
GoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnSort
descriptionContains the column name and which direction the column is sorted (ascending or descenging).
idGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnSort
properties
descending
descriptionWhether the column is sorted in descending order (ascending by default);
typeboolean
name
descriptionName of the column.
typestring
typeobject
GoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnType
descriptionSingular vs list of values in a column.
idGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnType
properties
list
$refGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnTypeList
descriptionList of values in a column e.g. IPs
value
$refGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnValue
descriptionSingle value in a column.
typeobject
GoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnTypeList
descriptionStore list of values in a column.
idGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnTypeList
properties
values
descriptionList of values in one cell of the column.
items
$refGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnValue
typearray
typeobject
GoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnValue
descriptionValue of the column based on data type
idGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnValue
properties
boolVal
descriptionBoolean value.
typeboolean
bytesVal
descriptionBytes value.
formatbyte
typestring
dateVal
$refDate
descriptionDate values.
doubleVal
descriptionDouble value.
formatdouble
typenumber
int64Val
descriptionInteger value (signed).
formatint64
typestring
nullVal
descriptionTrue if the value is NULL.
typeboolean
protoVal
additionalProperties
descriptionProperties of the object. Contains field @type with type URL.
typeany
descriptionFor any proto values that are not any of the above.
typeobject
stringVal
descriptionString value. Enum values are returned as strings.
typestring
timestampVal
descriptionTimestamp values.
formatgoogle-datetime
typestring
uint64Val
descriptionUn-signed integer value.
formatuint64
typestring
typeobject
Group
descriptionInformation about an organizational group.
idGroup
properties
attribute
$refAttribute
descriptionGeneric entity metadata attributes of the group.
creationTime
deprecatedTrue
descriptionGroup creation time. Deprecated: creation_time should be populated in Attribute as generic metadata.
formatgoogle-datetime
typestring
emailAddresses
descriptionEmail addresses of the group.
items
typestring
typearray
groupDisplayName
descriptionGroup display name. e.g. "Finance".
typestring
productObjectId
descriptionProduct globally unique user object identifier, such as an LDAP Object Identifier.
typestring
windowsSid
descriptionMicrosoft Windows SID of the group.
typestring
typeobject
GroupAggregationByField
idGroupAggregationByField
properties
baselineEventCount
formatint32
typeinteger
eventCount
formatint32
typeinteger
fieldName
typestring
fieldValue
$refUdmFieldValue
fields
items
$refUdmFieldAggregation
typearray
valueCount
formatint32
typeinteger
typeobject
Hardware
descriptionHardware specification details for a resource, including both physical and virtual hardware.
idHardware
properties
cpuClockSpeed
descriptionClock speed of the hardware CPU in MHz.
formatuint64
typestring
cpuMaxClockSpeed
descriptionMaximum possible clock speed of the hardware CPU in MHz.
formatuint64
typestring
cpuModel
descriptionModel description of the hardware CPU (e.g. "2.8 GHz Quad-Core Intel Core i5").
typestring
cpuNumberCores
descriptionNumber of CPU cores.
formatuint64
typestring
cpuPlatform
descriptionPlatform of the hardware CPU (e.g. "Intel Broadwell").
typestring
manufacturer
descriptionHardware manufacturer.
typestring
model
descriptionHardware model.
typestring
ram
descriptionAmount of the hardware ramdom access memory (RAM) in Mb.
formatuint64
typestring
serialNumber
descriptionHardware serial number.
typestring
typeobject
Http
descriptionSpecify the full URL of the HTTP request within "target". Also specify any uploaded or downloaded file information within "source" or "target".
idHttp
properties
method
descriptionThe HTTP request method (e.g. "GET", "POST", "PATCH", "DELETE").
typestring
parsedUserAgent
$refUserAgentProto
descriptionThe parsed user_agent string.
referralUrl
descriptionThe URL for the HTTP referer.
typestring
responseCode
descriptionThe response status code, for example 200, 302, 404, or 500.
formatint32
typeinteger
userAgent
descriptionThe User-Agent request header which includes the application type, operating system, software vendor or software version of the requesting software user agent.
typestring
typeobject
Id
descriptionIdentifier to identify a UDM object like a UDM event, Entity, Collection. The full identifier for persistence is created by setting the 32 most significant bits as the Id.Namespace enum and the rest according to go/udm:ids. This is a convenience wrapper to define the id space enum values and provide an easy interface for RPCs, most persistence use cases should use a denormalized form. See go/udm:ids for background and details.
idId
properties
id
descriptionFull raw ID.
formatbyte
typestring
namespace
descriptionNamespace the id belongs to.
enum
  • NORMALIZED_TELEMETRY
  • RAW_TELEMETRY
  • RULE_DETECTIONS
  • UPPERCASE
  • MACHINE_INTELLIGENCE
  • SECURITY_COMMAND_CENTER
  • UNSPECIFIED
  • SOAR_ALERT
  • VIRUS_TOTAL
enumDescriptions
  • Ingested and Normalized telemetry events
  • Ingested Raw telemetry
  • Chronicle Rules engine
  • Uppercase
  • DSML - Machine Intelligence
  • A normalized telemetry event from Google Security Command Center.
  • Unspecified Namespace
  • An alert coming from other SIEMs via Chronicle SOAR.
  • VirusTotal.
typestring
stringId
descriptionSome ids are stored as strings that are not able to be translated to bytes, so store these separately. Ex. detection id of the form de_aaaaaaaa-aaaa...
typestring
typeobject
IngestionLabel
descriptionRepresentation of an ingestion label type.
idIngestionLabel
properties
ingestionLabelKey
descriptionRequired. The key of the ingestion label. Always required.
typestring
ingestionLabelValue
descriptionOptional. The value of the ingestion label. Optional. An object with no provided value and some key provided would match against the given key and ANY value.
typestring
typeobject
InputsUsed
descriptionInputsUsed is a convenience field that tells us which sources of events (if any) were used in the rule. NEXT TAG: 4
idInputsUsed
properties
usesDetection
descriptionOptional. Whether the rule queries detections.
typeboolean
usesEntity
descriptionOptional. Whether the rule queries entity events.
typeboolean
usesUdm
descriptionOptional. Whether the rule queries UDM events.
typeboolean
typeobject
Instance
descriptionA Instance represents an instantiation of the Instance product.
idInstance
properties
name
descriptionOutput only. The resource name of this instance. Format: projects/{project}/locations/{location}/instances/{instance}
readOnlyTrue
typestring
typeobject
InstanceUdmSearchResponse
idInstanceUdmSearchResponse
properties
baselineEventsCount
formatint32
typeinteger
complete
typeboolean
detections
$refDetections
filteredEventsCount
formatint32
typeinteger
instanceId
typestring
prevalence
$refUdmPrevalenceResponse
progress
formatdouble
typenumber
runtimeErrors
$refRuntimeError
timeline
$refEventCountTimeline
tooManyEvents
typeboolean
typeobject
Int64Sequence
descriptionInt64Sequence represents a sequence of int64s.
idInt64Sequence
properties
int64Vals
descriptionint64 sequence.
items
formatint64
typestring
typearray
typeobject
Interval
descriptionRepresents a time interval, encoded as a Timestamp start (inclusive) and a Timestamp end (exclusive). The start must be less than or equal to the end. When the start equals the end, the interval is empty (matches no time). When both start and end are unspecified, the interval matches any time.
idInterval
properties
endTime
descriptionOptional. Exclusive end of the interval. If specified, a Timestamp matching this interval will have to be before the end.
formatgoogle-datetime
typestring
startTime
descriptionOptional. Inclusive start of the interval. If specified, a Timestamp matching this interval will have to be the same or after the start.
formatgoogle-datetime
typestring
typeobject
Investigation
descriptionRepresents the aggregated state of an investigation such as categorization, severity, and status. Can be expanded to include analyst assignment details and more.
idInvestigation
properties
comments
descriptionComment added by the Analyst.
items
typestring
typearray
priority
descriptionPriority of the Alert or Finding set by analyst.
enum
  • PRIORITY_UNSPECIFIED
  • PRIORITY_INFO
  • PRIORITY_LOW
  • PRIORITY_MEDIUM
  • PRIORITY_HIGH
  • PRIORITY_CRITICAL
enumDescriptions
  • Default priority level.
  • Informational priority.
  • Low priority.
  • Medium priority.
  • High priority.
  • Critical priority.
typestring
reason
descriptionReason for closing the Case or Alert.
enum
  • REASON_UNSPECIFIED
  • REASON_NOT_MALICIOUS
  • REASON_MALICIOUS
  • REASON_MAINTENANCE
enumDescriptions
  • Default reason.
  • Case or Alert not malicious.
  • Case or Alert is malicious.
  • Case or Alert is under maintenance.
typestring
reputation
descriptionDescribes whether a finding was useful or not-useful.
enum
  • REPUTATION_UNSPECIFIED
  • USEFUL
  • NOT_USEFUL
enumDescriptions
  • An unspecified reputation.
  • A categorization of the finding as useful.
  • A categorization of the finding as not useful.
typestring
riskScore
descriptionRisk score for a finding set by an analyst.
formatuint32
typeinteger
rootCause
descriptionRoot cause of the Alert or Finding set by analyst.
typestring
severityScore
descriptionSeverity score for a finding set by an analyst.
formatuint32
typeinteger
status
descriptionDescribes the workflow status of a finding.
enum
  • STATUS_UNSPECIFIED
  • NEW
  • REVIEWED
  • CLOSED
  • OPEN
enumDescriptions
  • Unspecified finding status.
  • New finding.
  • When a finding has feedback.
  • When an analyst closes an finding.
  • Open. Used to indicate that a Case / Alert is open.
typestring
verdict
descriptionDescribes reason a finding investigation was resolved.
enum
  • VERDICT_UNSPECIFIED
  • TRUE_POSITIVE
  • FALSE_POSITIVE
enumDescriptions
  • An unspecified verdict.
  • A categorization of the finding as a "true positive".
  • A categorization of the finding as a "false positive".
typestring
typeobject
IoCStats
descriptionInformation about the threat intelligence source. These fields are used to model Mandiant sources.
idIoCStats
properties
benignCount
descriptionCount of responses where the IoC was identified as benign.
formatint32
typeinteger
firstLevelSource
descriptionName of first level IoC source, for example Mandiant or a third-party.
typestring
iocStatsType
descriptionDescribes the source of the IoCStat.
enum
  • UNSPECIFIED_IOC_STATS_TYPE
  • MANDIANT_SOURCES
  • THIRD_PARTY_SOURCES
  • THREAT_INTELLIGENCE_IOC_STATS
enumDescriptions
  • IoCStat source is unidentified.
  • IoCStat is from a Mandiant Source.
  • IoCStat is from a third-party source.
  • IoCStat is from a threat intelligence feed.
typestring
maliciousCount
descriptionCount of responses where the IoC was identified as malicious.
formatint32
typeinteger
quality
descriptionLevel of confidence in the IoC mapping extracted from the source.
enum
  • UNKNOWN_CONFIDENCE
  • LOW_CONFIDENCE
  • MEDIUM_CONFIDENCE
  • HIGH_CONFIDENCE
enumDescriptions
  • The default confidence level.
  • Low confidence.
  • Medium confidence.
  • High confidence.
typestring
responseCount
descriptionTotal number of response from the source.
formatint32
typeinteger
secondLevelSource
descriptionName of the second-level IoC source, for example Crowdsourced Threat Analysis or Knowledge Graph.
typestring
sourceCount
descriptionNumber of sources from which information was extracted.
formatint32
typeinteger
typeobject
Label
descriptionKey value labels.
idLabel
properties
key
descriptionThe key.
typestring
rbacEnabled
descriptionIndicates whether this label can be used for Data RBAC
typeboolean
source
descriptionWhere the label is derived from.
typestring
value
descriptionThe value.
typestring
typeobject
LatLng
descriptionAn object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges.
idLatLng
properties
latitude
descriptionThe latitude in degrees. It must be in the range [-90.0, +90.0].
formatdouble
typenumber
longitude
descriptionThe longitude in degrees. It must be in the range [-180.0, +180.0].
formatdouble
typenumber
typeobject
LegacyFederatedUdmSearchViewResponse
descriptionResponse to a Federated UDM Search query. This will be used by StreamSearchOperation RPC to return the results of a federated search operation.
idLegacyFederatedUdmSearchViewResponse
properties
activityTimeline
$refEventCountTimeline
descriptionTimeline of event counts broken into hourly/daily buckets to identify activity.
aiOverview
$refAIOverview
descriptionLINT.ThenChange( //depot/google3/google/cloud/chronicle/v1main/dashboard_query.proto:data_sources, //depot/google3/googlex/security/malachite/proto/udm_search.proto:data_sources ) AI generated overview for the search results. Only populated if the AI features are enabled for the customer and generate_ai_overview is set to true in the request.
baselineEventsCount
descriptionThe number of events in the baseline query.
formatint32
typeinteger
complete
descriptionStreaming for this response is done. There will be no additional updates.
typeboolean
dataSources
descriptionDatasource of the query and results in case of a statistics query
items
enum
  • SEARCH_DATA_SOURCE_UNSPECIFIED
  • SEARCH_UDM
  • SEARCH_ENTITY
  • SEARCH_RULE_DETECTIONS
  • SEARCH_RULESETS
enumDescriptions
  • Unspecified data source.
  • Events
  • Entities
  • To be used for detections data source.
  • To be used for ruleset with detections datasource.
typestring
typearray
detectionFieldAggregations
$refAlertFieldAggregations
descriptionList of detection fields with aggregated values. This enabled filtering in the Alerts panel for federated search.
events
$refUdmEventList
descriptionList of UDM events. NOTE: After complete is set to true, the `UdmEventList` message will be omitted from the response. The latest message should be used as reference. If the `UdmEventList` message is returned again, then it should replace the previous value.
fieldAggregations
$refUdmFieldAggregations
descriptionList of UDM fields with aggregated values.
filteredEventsCount
descriptionThe number of events in the snapshot that match the snapshot_query. This is <= `baseline_events_count`. If the snapshot query is empty this will be equivalent to `baseline_events_count`.
formatint32
typeinteger
groupedFieldAggregations
$refUdmFieldAggregations
descriptionList of grouped fields with aggregated values.
instanceAggregations
$refUdmFieldAggregations
descriptionInstance aggregations for the search results. Provides information on the number of events per instance for the aggregations panel in the UI. This allows users to easily drill-down into the individual instances.
instanceUdmSearchResponses
descriptionAll the instance specific UDM search responses.
items
$refInstanceUdmSearchResponse
typearray
operation
descriptionThe name of the operation resource representing the UDM Search operation. This can be passed to `StreamSearchOperation` to fetch stored results or stream the results of an in-progress operation. The metadata type of the operation is `UdmSearchMetadata`. The response type is `LegacyFetchUdmSearchViewResponse`. Format: projects/{project}/locations/{location}/instances/{instance}/operations/{operation}
typestring
progress
descriptionProgress of the query represented as a double between 0 and 1.
formatdouble
typenumber
queryValidationErrors
descriptionParse error for the baseline_query and/or the snapshot_query.
items
$refErrorMessage
typearray
runtimeErrors
descriptionRuntime errors.
items
$refRuntimeError
typearray
stats
$refGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStats
descriptionStats results when the query is for statistics
statsFunctionParameterValidationErrorMessage
descriptionIf the request's stats_function_parameter` is invalid, this field will contain the detailed error message.
typestring
statsFunctionResponse
$refFunctionResponse
descriptionResult for statistical function.
timeline
$refEventCountTimeline
descriptionTimeline of event counts broken into buckets. This populates the trend-over-time chart in the UI.
tooLargeResponse
descriptionIf true, the response to be returned to the UI is too large and some events have been omitted.
typeboolean
tooManyEvents
descriptionIf true, there are too many events to return and some have been omitted.
typeboolean
validBaselineQuery
descriptionIndicates whether the request baseline_query is a valid structured query or not. If not, `query_validation_errors` will include the parse error.
typeboolean
validSnapshotQuery
descriptionIndicates whether the request baseline and snapshot queries are valid. If not, `query_validation_errors` will include the parse error.
typeboolean
typeobject
ListDataAccessLabelsResponse
descriptionResponse message for ListDataAccessLabels.
idListDataAccessLabelsResponse
properties
dataAccessLabels
descriptionList of data access labels.
items
$refDataAccessLabel
typearray
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
typeobject
ListDataAccessScopesResponse
descriptionResponse message for ListDataAccessScopes.
idListDataAccessScopesResponse
properties
dataAccessScopes
descriptionList of data access scopes.
items
$refDataAccessScope
typearray
globalDataAccessScopeGranted
descriptionWhether or not global scope is granted to the user.
typeboolean
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
typeobject
ListOperationsResponse
descriptionThe response message for Operations.ListOperations.
idListOperationsResponse
properties
nextPageToken
descriptionThe standard List next-page token.
typestring
operations
descriptionA list of operations that matches the specified filter in the request.
items
$refOperation
typearray
typeobject
ListReferenceListsResponse
descriptionA response to a request for a list of reference lists.
idListReferenceListsResponse
properties
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
referenceLists
descriptionThe reference lists. Ordered in ascending alphabetical order by name.
items
$refReferenceList
typearray
typeobject
ListRetrohuntsResponse
descriptionResponse message for ListRetrohunts method.
idListRetrohuntsResponse
properties
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
retrohunts
descriptionThe retrohunts from the specified rule.
items
$refRetrohunt
typearray
typeobject
ListRuleDeploymentsResponse
descriptionResponse message for ListRuleDeployments.
idListRuleDeploymentsResponse
properties
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
ruleDeployments
descriptionThe rule deployments from all rules.
items
$refRuleDeployment
typearray
typeobject
ListRuleRevisionsResponse
descriptionResponse message for ListRuleRevisions method.
idListRuleRevisionsResponse
properties
nextPageToken
descriptionA token that can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
rules
descriptionThe revisions of the rule.
items
$refRule
typearray
typeobject
ListRulesResponse
descriptionResponse message for ListRules method.
idListRulesResponse
properties
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
rules
descriptionThe rules from the specified instance.
items
$refRule
typearray
typeobject
ListWatchlistsResponse
descriptionResponse message for listing watchlists.
idListWatchlistsResponse
properties
nextPageToken
descriptionOptional. A token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
watchlists
descriptionOptional. The watchlists from the specified instance.
items
$refWatchlist
typearray
typeobject
Location
descriptionInformation about a location.
idLocation
properties
city
descriptionThe city.
typestring
countryOrRegion
descriptionThe country or region.
typestring
deskName
descriptionDesk name or individual location, typically for an employee in an office. (e.g. "IN-BLR-BCPC-11-1121D").
typestring
floorName
descriptionFloor name, number or a combination of the two for a building. (e.g. "1-A").
typestring
name
descriptionCustom location name (e.g. building or site name like "London Office"). For cloud environments, this is the region (e.g. "us-west2").
typestring
regionCoordinates
$refLatLng
descriptionCoordinates for the associated region. See https://cloud.google.com/vision/docs/reference/rest/v1/LatLng for a description of the fields.
regionLatitude
deprecatedTrue
descriptionDeprecated: use region_coordinates.
formatfloat
typenumber
regionLongitude
deprecatedTrue
descriptionDeprecated: use region_coordinates.
formatfloat
typenumber
state
descriptionThe state.
typestring
typeobject
Manual
descriptionEntities are added manually.
idManual
properties
typeobject
Measure
descriptionDescribes the precomputed measure.
idMeasure
properties
aggregateFunction
descriptionFunction used to calculate the aggregated measure.
enum
  • AGGREGATE_FUNCTION_UNSPECIFIED
  • MIN
  • MAX
  • COUNT
  • SUM
  • AVG
  • STDDEV
enumDescriptions
  • Default value.
  • Minimum.
  • Maximum.
  • Count.
  • Sum.
  • Average.
  • Standard Deviation.
typestring
value
descriptionValue of the aggregated measure.
formatdouble
typenumber
typeobject
Metadata
descriptionGeneral information associated with a UDM event.
idMetadata
properties
baseLabels
$refDataAccessLabels
descriptionData access labels on the base event.
collectedTimestamp
descriptionThe GMT timestamp when the event was collected by the vendor's local collection infrastructure.
formatgoogle-datetime
typestring
description
descriptionA human-readable unparsable description of the event.
typestring
enrichmentLabels
$refDataAccessLabels
descriptionData access labels from all the contextual events used to enrich the base event.
enrichmentState
descriptionThe enrichment state.
enum
  • ENRICHMENT_STATE_UNSPECIFIED
  • ENRICHED
  • UNENRICHED
enumDescriptions
  • Unspecified.
  • The event has been enriched by Chronicle.
  • The event has not been enriched by Chronicle.
typestring
eventTimestamp
descriptionThe GMT timestamp when the event was generated.
formatgoogle-datetime
typestring
eventType
descriptionThe event type. If an event has multiple possible types, this specifies the most specific type.
enum
  • EVENTTYPE_UNSPECIFIED
  • PROCESS_UNCATEGORIZED
  • PROCESS_LAUNCH
  • PROCESS_INJECTION
  • PROCESS_PRIVILEGE_ESCALATION
  • PROCESS_TERMINATION
  • PROCESS_OPEN
  • PROCESS_MODULE_LOAD
  • REGISTRY_UNCATEGORIZED
  • REGISTRY_CREATION
  • REGISTRY_MODIFICATION
  • REGISTRY_DELETION
  • SETTING_UNCATEGORIZED
  • SETTING_CREATION
  • SETTING_MODIFICATION
  • SETTING_DELETION
  • MUTEX_UNCATEGORIZED
  • MUTEX_CREATION
  • FILE_UNCATEGORIZED
  • FILE_CREATION
  • FILE_DELETION
  • FILE_MODIFICATION
  • FILE_READ
  • FILE_COPY
  • FILE_OPEN
  • FILE_MOVE
  • FILE_SYNC
  • USER_UNCATEGORIZED
  • USER_LOGIN
  • USER_LOGOUT
  • USER_CREATION
  • USER_CHANGE_PASSWORD
  • USER_CHANGE_PERMISSIONS
  • USER_STATS
  • USER_BADGE_IN
  • USER_DELETION
  • USER_RESOURCE_CREATION
  • USER_RESOURCE_UPDATE_CONTENT
  • USER_RESOURCE_UPDATE_PERMISSIONS
  • USER_COMMUNICATION
  • USER_RESOURCE_ACCESS
  • USER_RESOURCE_DELETION
  • GROUP_UNCATEGORIZED
  • GROUP_CREATION
  • GROUP_DELETION
  • GROUP_MODIFICATION
  • EMAIL_UNCATEGORIZED
  • EMAIL_TRANSACTION
  • EMAIL_URL_CLICK
  • NETWORK_UNCATEGORIZED
  • NETWORK_FLOW
  • NETWORK_CONNECTION
  • NETWORK_FTP
  • NETWORK_DHCP
  • NETWORK_DNS
  • NETWORK_HTTP
  • NETWORK_SMTP
  • STATUS_UNCATEGORIZED
  • STATUS_HEARTBEAT
  • STATUS_STARTUP
  • STATUS_SHUTDOWN
  • STATUS_UPDATE
  • SCAN_UNCATEGORIZED
  • SCAN_FILE
  • SCAN_PROCESS_BEHAVIORS
  • SCAN_PROCESS
  • SCAN_HOST
  • SCAN_VULN_HOST
  • SCAN_VULN_NETWORK
  • SCAN_NETWORK
  • SCHEDULED_TASK_UNCATEGORIZED
  • SCHEDULED_TASK_CREATION
  • SCHEDULED_TASK_DELETION
  • SCHEDULED_TASK_ENABLE
  • SCHEDULED_TASK_DISABLE
  • SCHEDULED_TASK_MODIFICATION
  • SYSTEM_AUDIT_LOG_UNCATEGORIZED
  • SYSTEM_AUDIT_LOG_WIPE
  • SERVICE_UNSPECIFIED
  • SERVICE_CREATION
  • SERVICE_DELETION
  • SERVICE_START
  • SERVICE_STOP
  • SERVICE_MODIFICATION
  • GENERIC_EVENT
  • RESOURCE_CREATION
  • RESOURCE_DELETION
  • RESOURCE_PERMISSIONS_CHANGE
  • RESOURCE_READ
  • RESOURCE_WRITTEN
  • DEVICE_FIRMWARE_UPDATE
  • DEVICE_CONFIG_UPDATE
  • DEVICE_PROGRAM_UPLOAD
  • DEVICE_PROGRAM_DOWNLOAD
  • ANALYST_UPDATE_VERDICT
  • ANALYST_UPDATE_REPUTATION
  • ANALYST_UPDATE_SEVERITY_SCORE
  • ANALYST_UPDATE_STATUS
  • ANALYST_ADD_COMMENT
  • ANALYST_UPDATE_PRIORITY
  • ANALYST_UPDATE_ROOT_CAUSE
  • ANALYST_UPDATE_REASON
  • ANALYST_UPDATE_RISK_SCORE
  • ENTITY_RISK_CHANGE
enumDeprecated
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • True
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • True
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • True
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
enumDescriptions
  • Default event type
  • Activity related to a process which does not match any other event types.
  • Process launch.
  • Process injecting into another process.
  • Process privilege escalation.
  • Process termination.
  • Process being opened.
  • Process loading a module.
  • Registry event which does not match any of the other event types.
  • Registry creation.
  • Registry modification.
  • Registry deletion.
  • Settings-related event which does not match any of the other event types.
  • Setting creation.
  • Setting modification.
  • Setting deletion.
  • Any mutex event other than creation.
  • Mutex creation.
  • File event which does not match any of the other event types.
  • File created.
  • File deleted.
  • File modified.
  • File read.
  • File copied. Used for file copies, for example, to a thumb drive.
  • File opened.
  • File moved or renamed.
  • File synced (for example, Google Drive, Dropbox, backup).
  • User activity which does not match any of the other event types.
  • User login.
  • User logout.
  • User creation.
  • User password change event.
  • Change in user permissions.
  • Deprecated. Used to update user info for an LDAP dump.
  • User physically badging into a location.
  • User deletion.
  • User creating a virtual resource. This is equivalent to RESOURCE_CREATION.
  • User updating content of a virtual resource. This is equivalent to RESOURCE_WRITTEN.
  • User updating permissions of a virtual resource. This is equivalent to RESOURCE_PERMISSIONS_CHANGE.
  • User initiating communication through a medium (for example, video).
  • User accessing a virtual resource. This is equivalent to RESOURCE_READ.
  • User deleting a virtual resource. This is equivalent to RESOURCE_DELETION.
  • A group activity that does not fall into one of the other event types.
  • A group creation.
  • A group deletion.
  • A group modification.
  • Email messages
  • An email transaction.
  • Deprecated: use NETWORK_HTTP instead. An email URL click event.
  • A network event that does not fit into one of the other event types.
  • Aggregated flow stats like netflow.
  • Network connection details like from a FW.
  • FTP telemetry.
  • DHCP payload.
  • DNS payload.
  • HTTP telemetry.
  • SMTP telemetry.
  • A status message that does not fit into one of the other event types.
  • Heartbeat indicating product is alive.
  • An agent startup.
  • An agent shutdown.
  • A software or fingerprint update.
  • Scan item that does not fit into one of the other event types.
  • A file scan.
  • Scan process behaviors. Please use SCAN_PROCESS instead.
  • Scan process.
  • Scan results from scanning an entire host device for threats/sensitive documents.
  • Vulnerability scan logs about host vulnerabilities (e.g., out of date software) and network vulnerabilities (e.g., unprotected service detected via a network scan).
  • Vulnerability scan logs about network vulnerabilities.
  • Scan network for suspicious activity
  • Scheduled task event that does not fall into one of the other event types.
  • Scheduled task creation.
  • Scheduled task deletion.
  • Scheduled task being enabled.
  • Scheduled task being disabled.
  • Scheduled task being modified.
  • A system audit log event that is not a wipe.
  • A system audit log wipe.
  • Service event that does not fit into one of the other event types.
  • A service creation.
  • A service deletion.
  • A service start.
  • A service stop.
  • A service modification.
  • Operating system events that are not described by any of the other event types. Might include uncategorized Microsoft Windows event logs.
  • The resource was created/provisioned. This is equivalent to USER_RESOURCE_CREATION.
  • The resource was deleted/deprovisioned. This is equivalent to USER_RESOURCE_DELETION.
  • The resource had it's permissions or ACLs updated. This is equivalent to USER_RESOURCE_UPDATE_PERMISSIONS.
  • The resource was read. This is equivalent to USER_RESOURCE_ACCESS.
  • The resource was written to. This is equivalent to USER_RESOURCE_UPDATE_CONTENT.
  • Firmware update.
  • Configuration update.
  • A program or application uploaded to a device.
  • A program or application downloaded to a device.
  • Analyst update about the Verdict (such as true positive, false positive, or disregard) of a finding.
  • Analyst update about the Reputation (such as useful or not useful) of a finding.
  • Analyst update about the Severity score (0-100) of a finding.
  • Analyst update about the finding status.
  • Analyst addition of a comment for a finding.
  • Analyst update about the priority (such as low, medium, or high) for a finding.
  • Analyst update about the root cause for a finding.
  • Analyst update about the reason (such as malicious or not malicious) for a finding.
  • Analyst update about the risk score (0-100) of a finding.
  • An update to an entity risk score. This event type is restricted to events published by Google Securit Operations Risk Analytics.
typestring
id
descriptionID of the UDM event. Can be used for raw and normalized event retrieval.
formatbyte
typestring
ingestedTimestamp
descriptionThe GMT timestamp when the event was ingested (received) by Chronicle.
formatgoogle-datetime
typestring
ingestionLabels
descriptionUser-configured ingestion metadata labels.
items
$refLabel
typearray
logType
descriptionThe string value of log type.
typestring
productDeploymentId
descriptionThe deployment identifier assigned by the vendor for a product deployment.
typestring
productEventType
descriptionA short, descriptive, human-readable, product-specific event name or type (e.g. "Scanned X", "User account created", "process_start").
typestring
productLogId
descriptionA vendor-specific event identifier to uniquely identify the event (e.g. a GUID).
typestring
productName
descriptionThe name of the product.
typestring
productVersion
descriptionThe version of the product.
typestring
structuredFields
additionalProperties
descriptionProperties of the object.
typeany
deprecatedTrue
descriptionFlattened fields extracted from the log.
typeobject
tags
$refTags
descriptionTags added by Chronicle after an event is parsed. It is an error to populate this field from within a parser.
urlBackToProduct
descriptionA URL that takes the user to the source product console for this event.
typestring
vendorName
descriptionThe name of the product vendor.
typestring
typeobject
Metric
descriptionStores precomputed aggregated analytic data for an entity.
idMetric
properties
dimensions
descriptionAll group by clauses used to calculate the metric.
items
enum
  • DIMENSION_UNSPECIFIED
  • PRINCIPAL_DEVICE
  • TARGET_USER
  • TARGET_DEVICE
  • PRINCIPAL_USER
  • TARGET_IP
  • PRINCIPAL_FILE_HASH
  • PRINCIPAL_COUNTRY
  • SECURITY_CATEGORY
  • NETWORK_ASN
  • CLIENT_CERTIFICATE_HASH
  • DNS_QUERY_TYPE
  • DNS_DOMAIN
  • HTTP_USER_AGENT
  • EVENT_TYPE
  • PRODUCT_NAME
  • PRODUCT_EVENT_TYPE
  • PARENT_FOLDER_PATH
  • TARGET_RESOURCE_NAME
  • PRINCIPAL_APPLICATION
  • TARGET_APPLICATION
  • EMAIL_TO_ADDRESS
  • EMAIL_FROM_ADDRESS
  • MAIL_ID
  • PRINCIPAL_IP
  • SECURITY_ACTION
  • SECURITY_RULE_ID
  • TARGET_NETWORK_ORGANIZATION_NAME
  • PRINCIPAL_NETWORK_ORGANIZATION_NAME
  • PRINCIPAL_PROCESS_FILE_PATH
  • PRINCIPAL_PROCESS_FILE_HASH
  • SECURITY_RESULT_RULE_NAME
  • TARGET_RESOURCE_LABEL_KEY
  • VENDOR_NAME
  • TARGET_RESOURCE_TYPE
  • TARGET_LOCATION_NAME
enumDescriptions
  • Default
  • Principal Device
  • Target User
  • Target Device
  • Principal User
  • Target IP
  • Principal File Hash
  • Principal Country
  • Security Category
  • Network ASN
  • Client Certificate Hash
  • DNS Query Type
  • DNS Domain
  • HTTP User Agent
  • Event Type
  • Product Name
  • Product Event Type
  • Parent Folder Path
  • Target resource Name
  • Principal Application.
  • Target Application.
  • Email To Address.
  • Email From Address.
  • Mail Id.
  • Principal IP.
  • Security Action.
  • Security Rule Id.
  • Target Network Organization name.
  • Principal Network Organization name.
  • Principal Process File Path.
  • Principal Process File SHA256 Hash.
  • Security Result rule name.
  • Target Resource label key.
  • Vendor name.
  • Target Resource type.
  • Target Location name.
typestring
typearray
exportWindow
descriptionExport window for which the metric was exported.
formatint64
typestring
firstSeen
descriptionTimestamp of the first time the entity was seen in the environment.
formatgoogle-datetime
typestring
lastSeen
descriptionTime stamp of the last time last time the entity was seen in the environment.
formatgoogle-datetime
typestring
metricName
descriptionName of the analytic.
enum
  • METRIC_NAME_UNSPECIFIED
  • NETWORK_BYTES_INBOUND
  • NETWORK_BYTES_OUTBOUND
  • NETWORK_BYTES_TOTAL
  • AUTH_ATTEMPTS_SUCCESS
  • AUTH_ATTEMPTS_FAIL
  • AUTH_ATTEMPTS_TOTAL
  • DNS_BYTES_OUTBOUND
  • NETWORK_FLOWS_INBOUND
  • NETWORK_FLOWS_OUTBOUND
  • NETWORK_FLOWS_TOTAL
  • DNS_QUERIES_SUCCESS
  • DNS_QUERIES_FAIL
  • DNS_QUERIES_TOTAL
  • FILE_EXECUTIONS_SUCCESS
  • FILE_EXECUTIONS_FAIL
  • FILE_EXECUTIONS_TOTAL
  • HTTP_QUERIES_SUCCESS
  • HTTP_QUERIES_FAIL
  • HTTP_QUERIES_TOTAL
  • WORKSPACE_EMAILS_SENT_TOTAL
  • WORKSPACE_TOTAL_DOWNLOAD_ACTIONS
  • WORKSPACE_TOTAL_CHANGE_ACTIONS
  • WORKSPACE_AUTH_ATTEMPTS_TOTAL
  • WORKSPACE_NETWORK_BYTES_OUTBOUND
  • WORKSPACE_NETWORK_BYTES_TOTAL
  • ALERT_EVENT_NAME_COUNT
  • RESOURCE_CREATION_TOTAL
  • RESOURCE_CREATION_SUCCESS
  • RESOURCE_READ_SUCCESS
  • RESOURCE_READ_FAIL
  • RESOURCE_DELETION_SUCCESS
enumDescriptions
  • Default
  • Total received network bytes.
  • Total network sent bytes.
  • Total network sent bytes and received bytes.
  • Successful authentication attempts.
  • Failed authentication attempts.
  • Total authentication attempts.
  • Total number of sent bytes for DNS events.
  • Total number of events having non-null received bytes.
  • Total number of events having non-null sent bytes.
  • Total events having non-null sent or received bytes.
  • DNS query success count - Number of events with response_code = 0.
  • Number of events with response_code != 0.
  • Total number of DNS queries made.
  • Number of successfule file executions.
  • Number of failed file executions.
  • Total number file executions.
  • Number of successful HTTP queries.
  • Number of failed HTTP queries.
  • Total number of HTTP queries.
  • Total number of emails sent in Google Workspace.
  • Total number of download actions in Google Workspace.
  • Total number of change actions in Google Workspace.
  • Total number of authentication attempts in Google Workspace.
  • Number of outbound network bytes (total sent) in Google Workspace.
  • Total number of network bytes (both sent and received) in Google Workspace.
  • Track number of alerts fired by EDR/SENTINEL/MICROSOFT_GRAPH.
  • First-time analytic tracking successful resource creations.
  • Volume-based analytic tracking successful resource creations.
  • Volume-based analytic tracking successful resource reads.
  • Volume-based analytic tracking failed resource reads.
  • Volume-based analytic tracking successful resource deletions.
typestring
sumMeasure
$refMeasure
descriptionSum of all precomputed measures for the given metric.
totalEvents
descriptionTotal number of events used to calculate the given precomputed metric.
formatint64
typestring
typeobject
Navigation
descriptionNavigation can be used to store the metadata required to navigate the user to a new URL.
idNavigation
properties
targetUri
descriptionOutput only. The URI to redirect the user to.
readOnlyTrue
typestring
typeobject
Network
descriptionA network event.
idNetwork
properties
applicationProtocol
descriptionThe application protocol.
enum
  • UNKNOWN_APPLICATION_PROTOCOL
  • AFP
  • APPC
  • AMQP
  • ATOM
  • BEEP
  • BITCOIN
  • BIT_TORRENT
  • CFDP
  • CIP
  • COAP
  • COTP
  • DCERPC
  • DDS
  • DEVICE_NET
  • DHCP
  • DICOM
  • DNP3
  • DNS
  • E_DONKEY
  • ENRP
  • FAST_TRACK
  • FINGER
  • FREENET
  • FTAM
  • GOOSE
  • GOPHER
  • GRPC
  • HL7
  • H323
  • HTTP
  • HTTPS
  • IEC104
  • IRCP
  • KADEMLIA
  • KRB5
  • LDAP
  • LPD
  • MIME
  • MMS
  • MODBUS
  • MQTT
  • NETCONF
  • NFS
  • NIS
  • NNTP
  • NTCIP
  • NTP
  • OSCAR
  • PNRP
  • PTP
  • QUIC
  • RDP
  • RELP
  • RIP
  • RLOGIN
  • RPC
  • RTMP
  • RTP
  • RTPS
  • RTSP
  • SAP
  • SDP
  • SIP
  • SLP
  • SMB
  • SMTP
  • SNMP
  • SNTP
  • SSH
  • SSMS
  • STYX
  • SV
  • TCAP
  • TDS
  • TOR
  • TSP
  • VTP
  • WHOIS
  • WEB_DAV
  • X400
  • X500
  • XMPP
enumDescriptions
  • The default application protocol.
  • Apple Filing Protocol.
  • Advanced Program-to-Program Communication.
  • Advanced Message Queuing Protocol.
  • Publishing Protocol.
  • Block Extensible Exchange Protocol.
  • Crypto currency protocol.
  • Peer-to-peer file sharing.
  • Coherent File Distribution Protocol.
  • Common Industrial Protocol.
  • Constrained Application Protocol.
  • Connection Oriented Transport Protocol.
  • DCE/RPC.
  • Data Distribution Service.
  • Automation industry protocol.
  • DHCP.
  • Digital Imaging and Communications in Medicine Protocol.
  • Distributed Network Protocol 3 (DNP3)
  • DNS.
  • Classic file sharing protocol.
  • Endpoint Handlespace Redundancy Protocol.
  • Filesharing peer-to-peer protocol.
  • User Information Protocol.
  • Censorship resistant peer-to-peer network.
  • File Transfer Access and Management.
  • GOOSE Protocol.
  • Gopher protocol.
  • gRPC Remote Procedure Call.
  • Health Level Seven.
  • Packet-based multimedia communications system.
  • HTTP.
  • HTTPS.
  • IEC 60870-5-104 (IEC 104) Protocol.
  • Internet Relay Chat Protocol.
  • Peer-to-peer hashtables.
  • Kerberos 5.
  • Lightweight Directory Access Protocol.
  • Line Printer Daemon Protocol.
  • Multipurpose Internet Mail Extensions and Secure MIME.
  • Multimedia Messaging Service.
  • Serial communications protocol.
  • Message Queuing Telemetry Transport.
  • Network Configuration.
  • Network File System.
  • Network Information Service.
  • Network News Transfer Protocol.
  • National Transportation Communications for Intelligent Transportation System.
  • Network Time Protocol.
  • AOL Instant Messenger Protocol.
  • Peer Name Resolution Protocol.
  • Precision Time Protocol.
  • QUIC.
  • Remote Desktop Protocol.
  • Reliable Event Logging Protocol.
  • Routing Information Protocol.
  • Remote Login in UNIX Systems.
  • Remote Procedure Call.
  • Real Time Messaging Protocol.
  • Real-time Transport Protocol.
  • Real Time Publish Subscribe.
  • Real Time Streaming Protocol.
  • Session Announcement Protocol.
  • Session Description Protocol.
  • Session Initiation Protocol.
  • Service Location Protocol.
  • Server Message Block.
  • Simple Mail Transfer Protocol.
  • Simple Network Management Protocol.
  • Simple Network Time Protocol.
  • Secure Shell.
  • Secure SMS Messaging Protocol.
  • Styx/9P - Plan 9 from Bell Labs distributed file system protocol.
  • Sampled Values Protocol.
  • Transaction Capabilities Application Part.
  • Tabular Data Stream.
  • Anonymity network.
  • Time Stamp Protocol.
  • Virtual Terminal Protocol.
  • Remote Directory Access Protocol.
  • Web Distributed Authoring and Versioning.
  • Message Handling Service Protocol.
  • Directory Access Protocol (DAP).
  • Extensible Messaging and Presence Protocol.
typestring
applicationProtocolVersion
descriptionThe version of the application protocol. e.g. "1.1, 2.0"
typestring
asn
descriptionAutonomous system number.
typestring
carrierName
descriptionCarrier identification.
typestring
communityId
descriptionCommunity ID network flow value.
typestring
dhcp
$refDhcp
descriptionDHCP info.
direction
descriptionThe direction of network traffic.
enum
  • UNKNOWN_DIRECTION
  • INBOUND
  • OUTBOUND
  • BROADCAST
enumDescriptions
  • The default direction.
  • An inbound request.
  • An outbound request.
  • A broadcast.
typestring
dns
$refDns
descriptionDNS info.
dnsDomain
descriptionDNS domain name.
typestring
email
$refEmail
descriptionEmail info for the sender/recipient.
ftp
$refFtp
descriptionFTP info.
http
$refHttp
descriptionHTTP info.
ipProtocol
descriptionThe IP protocol.
enum
  • UNKNOWN_IP_PROTOCOL
  • ICMP
  • IGMP
  • TCP
  • UDP
  • IP6IN4
  • GRE
  • ESP
  • ICMP6
  • EIGRP
  • ETHERIP
  • PIM
  • VRRP
  • SCTP
enumDescriptions
  • The default protocol.
  • ICMP.
  • IGMP
  • TCP.
  • UDP.
  • IPv6 Encapsulation
  • Generic Routing Encapsulation
  • Encapsulating Security Payload
  • ICMPv6
  • Enhanced Interior Gateway Routing
  • Ethernet-within-IP Encapsulation
  • Protocol Independent Multicast
  • Virtual Router Redundancy Protocol
  • Stream Control Transmission Protocol
typestring
ipSubnetRange
descriptionAssociated human-readable IP subnet range (e.g. 10.1.2.0/24).
typestring
organizationName
descriptionOrganization name (e.g Google).
typestring
parentSessionId
descriptionThe ID of the parent network session.
typestring
receivedBytes
descriptionThe number of bytes received.
formatuint64
typestring
receivedPackets
descriptionThe number of packets received.
formatint64
typestring
sentBytes
descriptionThe number of bytes sent.
formatuint64
typestring
sentPackets
descriptionThe number of packets sent.
formatint64
typestring
sessionDuration
descriptionThe duration of the session as the number of seconds and nanoseconds. For seconds, network.session_duration.seconds, the type is a 64-bit integer. For nanoseconds, network.session_duration.nanos, the type is a 32-bit integer.
formatgoogle-duration
typestring
sessionId
descriptionThe ID of the network session.
typestring
smtp
$refSmtp
descriptionSMTP info. Store fields specific to SMTP not covered by Email.
tls
$refTls
descriptionTLS info.
typeobject
Noun
descriptionThe Noun type is used to represent the different entities in an event: principal, src, target, observer, intermediary, and about. It stores attributes known about the entity. For example, if the entity is a device with multiple IP or MAC addresses, it stores the IP and MAC addresses that are relevant to the event.
idNoun
properties
administrativeDomain
descriptionDomain which the device belongs to (for example, the Microsoft Windows domain).
typestring
application
descriptionThe name of an application or service. Some SSO solutions only capture the name of a target application such as "Atlassian" or "Chronicle".
typestring
artifact
$refArtifact
descriptionInformation about an artifact.
asset
$refAsset
descriptionInformation about the asset.
assetId
descriptionThe asset ID. This field can be used as an entity indicator for asset entities.
typestring
cloud
$refCloud
deprecatedTrue
descriptionCloud metadata. Deprecated: cloud should be populated in entity Attribute as generic metadata (e.g. asset.attribute.cloud).
domain
$refDomain
descriptionInformation about the domain.
email
descriptionEmail address. Only filled in for security_result.about
typestring
file
$refBackstoryFile
descriptionInformation about the file.
group
$refGroup
descriptionInformation about the group.
hostname
descriptionClient hostname or domain name field. Hostname also doubles as the domain for remote entities. This field can be used as an entity indicator for asset entities.
typestring
investigation
$refInvestigation
descriptionAnalyst feedback/investigation for alerts.
ip
descriptionA list of IP addresses associated with a network connection. This field can be used as an entity indicator for asset entities.
items
typestring
typearray
ipGeoArtifact
descriptionEnriched geographic information corresponding to an IP address. Specifically, location and network data.
items
$refArtifact
typearray
ipLocation
deprecatedTrue
descriptionDeprecated: use ip_geo_artifact.location instead.
items
$refLocation
typearray
labels
deprecatedTrue
descriptionLabels are key-value pairs. For example: key = "env", value = "prod". Deprecated: labels should be populated in entity Attribute as generic metadata (e.g. user.attribute.labels).
items
$refLabel
typearray
location
$refLocation
descriptionPhysical location. For cloud environments, set the region in location.name.
mac
descriptionList of MAC addresses associated with a device. This field can be used as an entity indicator for asset entities.
items
typestring
typearray
namespace
descriptionNamespace which the device belongs to, such as "AD forest". Uses for this field include Microsoft Windows AD forest, the name of subsidiary, or the name of acquisition. This field can be used along with an asset indicator to identify an asset.
typestring
natIp
descriptionA list of NAT translated IP addresses associated with a network connection.
items
typestring
typearray
natPort
descriptionNAT external network port number when a specific network connection is described within an event.
formatint32
typeinteger
network
$refNetwork
descriptionNetwork details, including sub-messages with details on each protocol (for example, DHCP, DNS, or HTTP).
objectReference
$refId
descriptionFinding to which the Analyst updated the feedback.
platform
descriptionPlatform.
enum
  • UNKNOWN_PLATFORM
  • WINDOWS
  • MAC
  • LINUX
  • GCP
  • AWS
  • AZURE
  • IOS
  • ANDROID
  • CHROME_OS
enumDeprecated
  • False
  • False
  • False
  • False
  • True
  • True
  • True
  • False
  • False
  • False
enumDescriptions
  • Default value.
  • Microsoft Windows.
  • macOS.
  • Linux.
  • Deprecated: see cloud.environment.
  • Deprecated: see cloud.environment.
  • Deprecated: see cloud.environment.
  • IOS
  • Android
  • Chrome OS
typestring
platformPatchLevel
descriptionPlatform patch level. For example, "Build 17134.48"
typestring
platformVersion
descriptionPlatform version. For example, "Microsoft Windows 1803".
typestring
port
descriptionSource or destination network port number when a specific network connection is described within an event.
formatint32
typeinteger
process
$refProcess
descriptionInformation about the process.
processAncestors
descriptionInformation about the process's ancestors ordered from immediate ancestor (parent process) to root. Note: process_ancestors is only populated when data is exported to BigQuery since recursive fields (e.g. process.parent_process) are not supported by BigQuery.
items
$refProcess
typearray
registry
$refRegistry
descriptionRegistry information.
resource
$refResource
descriptionInformation about the resource (e.g. scheduled task, calendar entry). This field should not be used for files, registry, or processes because these objects are already part of Noun.
resourceAncestors
descriptionInformation about the resource's ancestors ordered from immediate ancestor (starting with parent resource).
items
$refResource
typearray
securityResult
descriptionA list of security results.
items
$refSecurityResult
typearray
url
descriptionThe URL.
typestring
urlMetadata
$refUrl
descriptionInformation about the URL.
user
$refUser
descriptionInformation about the user.
userManagementChain
descriptionInformation about the user's management chain (reporting hierarchy). Note: user_management_chain is only populated when data is exported to BigQuery since recursive fields (e.g. user.managers) are not supported by BigQuery.
items
$refUser
typearray
typeobject
NtfsFileMetadata
descriptionNTFS-specific file metadata.
idNtfsFileMetadata
properties
changeTime
descriptionNTFS MFT entry changed timestamp.
formatgoogle-datetime
typestring
filenameAccessTime
descriptionNTFS $FILE_NAME attribute accessed timestamp.
formatgoogle-datetime
typestring
filenameChangeTime
descriptionNTFS $FILE_NAME attribute changed timestamp.
formatgoogle-datetime
typestring
filenameCreateTime
descriptionNTFS $FILE_NAME attribute created timestamp.
formatgoogle-datetime
typestring
filenameModifyTime
descriptionNTFS $FILE_NAME attribute modified timestamp.
formatgoogle-datetime
typestring
typeobject
Operation
descriptionThis resource represents a long-running operation that is the result of a network API call.
idOperation
properties
done
descriptionIf the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available.
typeboolean
error
$refStatus
descriptionThe error result of the operation in case of failure or cancellation.
metadata
additionalProperties
descriptionProperties of the object. Contains field @type with type URL.
typeany
descriptionService-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any.
typeobject
name
descriptionThe server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`.
typestring
response
additionalProperties
descriptionProperties of the object. Contains field @type with type URL.
typeany
descriptionThe normal, successful response of the operation. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`.
typeobject
typeobject
Option
descriptionDHCP options.
idOption
properties
code
descriptionCode. See RFC1533.
formatuint32
typeinteger
data
descriptionData.
formatbyte
typestring
typeobject
PDFInfo
descriptionInformation about the PDF file structure. See https://developers.virustotal.com/reference/pdf_info
idPDFInfo
properties
acroform
descriptionNumber of /AcroForm tags found in the PDF.
formatint64
typestring
autoaction
descriptionNumber of /AA tags found in the PDF.
formatint64
typestring
embeddedFile
descriptionNumber of /EmbeddedFile tags found in the PDF.
formatint64
typestring
encrypted
descriptionWhether the document is encrypted or not. This is defined by the /Encrypt tag.
formatint64
typestring
endobjCount
descriptionNumber of object definitions (endobj keyword).
formatint64
typestring
endstreamCount
descriptionNumber of defined stream objects (stream keyword).
formatint64
typestring
flash
descriptionNumber of /RichMedia tags found in the PDF.
formatint64
typestring
header
descriptionPDF version.
typestring
javascript
descriptionNumber of /JavaScript tags found in the PDF file. Should be the same as the js field in normal scenarios.
formatint64
typestring
jbig2Compression
descriptionNumber of /JBIG2Decode tags found in the PDF.
formatint64
typestring
js
descriptionNumber of /JS tags found in the PDF file. Should be the same as javascript field in normal scenarios.
formatint64
typestring
launchActionCount
descriptionNumber of /Launch tags found in the PDF file.
formatint64
typestring
objCount
descriptionNumber of objects definitions (obj keyword).
formatint64
typestring
objectStreamCount
descriptionNumber of object streams.
formatint64
typestring
openaction
descriptionNumber of /OpenAction tags found in the PDF.
formatint64
typestring
pageCount
descriptionNumber of pages in the PDF.
formatint64
typestring
startxref
descriptionNumber of startxref keywords in the PDF.
formatint64
typestring
streamCount
descriptionNumber of defined stream objects (stream keyword).
formatint64
typestring
suspiciousColors
descriptionNumber of colors expressed with more than 3 bytes (CVE-2009-3459).
formatint64
typestring
trailer
descriptionNumber of trailer keywords in the PDF.
formatint64
typestring
xfa
descriptionNumber of \XFA tags found in the PDF.
formatint64
typestring
xref
descriptionNumber of xref keywords in the PDF.
formatint64
typestring
typeobject
PeFileMetadata
descriptionMetadata about a Microsoft Windows Portable Executable.
idPeFileMetadata
properties
importHash
descriptionHash of PE imports.
typestring
typeobject
Permission
descriptionSystem permission for resource access and modification.
idPermission
properties
description
descriptionDescription of the permission (e.g. 'Ability to update detect rules').
typestring
name
descriptionName of the permission (e.g. chronicle.analyst.updateRule).
typestring
type
descriptionType of the permission.
enum
  • UNKNOWN_PERMISSION_TYPE
  • ADMIN_WRITE
  • ADMIN_READ
  • DATA_WRITE
  • DATA_READ
enumDescriptions
  • Default permission type.
  • Administrator write permission.
  • Administrator read permission.
  • Data resource access write permission.
  • Data resource access read permission.
typestring
typeobject
PlatformSoftware
descriptionPlatform software information about an operating system.
idPlatformSoftware
properties
platform
descriptionThe platform operating system.
enum
  • UNKNOWN_PLATFORM
  • WINDOWS
  • MAC
  • LINUX
  • GCP
  • AWS
  • AZURE
  • IOS
  • ANDROID
  • CHROME_OS
enumDeprecated
  • False
  • False
  • False
  • False
  • True
  • True
  • True
  • False
  • False
  • False
enumDescriptions
  • Default value.
  • Microsoft Windows.
  • macOS.
  • Linux.
  • Deprecated: see cloud.environment.
  • Deprecated: see cloud.environment.
  • Deprecated: see cloud.environment.
  • IOS
  • Android
  • Chrome OS
typestring
platformPatchLevel
descriptionThe platform software patch level ( e.g. "Build 17134.48", "SP1").
typestring
platformVersion
descriptionThe platform software version ( e.g. "Microsoft Windows 1803").
typestring
typeobject
PopularityRank
descriptionDomain's position in popularity ranks for sources such as Alexa, Quantcast, or Statvoo.
idPopularityRank
properties
giver
descriptionName of the rank serial number hexdump.
typestring
ingestionTime
descriptionTimestamp when the rank was ingested.
formatgoogle-datetime
typestring
rank
descriptionRank position.
formatint64
typestring
typeobject
Prevalence
descriptionThe prevalence of a resource within the customer's environment. This measures how common it is for assets to access the resource.
idPrevalence
properties
dayCount
descriptionThe number of days over which rolling_max is calculated.
formatint32
typeinteger
dayMax
descriptionThe max prevalence score in a day interval window.
formatint32
typeinteger
dayMaxSubDomains
descriptionThe max prevalence score in a day interval window across sub-domains. This field is only valid for domains.
formatint32
typeinteger
rollingMax
descriptionThe maximum number of assets per day accessing the resource over the trailing day_count days.
formatint32
typeinteger
rollingMaxSubDomains
descriptionThe maximum number of assets per day accessing the domain along with sub-domains over the trailing day_count days. This field is only valid for domains.
formatint32
typeinteger
typeobject
Process
descriptionInformation about a process.
idProcess
properties
accessMask
descriptionA bit mask representing the level of access.
formatuint64
typestring
commandLine
descriptionThe command line command that created the process. This field can be used as an entity indicator for process entities.
typestring
commandLineHistory
descriptionThe command line history of the process.
items
typestring
typearray
egid
descriptionThe effective group ID of the process.
typestring
euid
descriptionThe effective user ID of the process.
typestring
file
$refBackstoryFile
descriptionInformation about the file in use by the process.
integrityLevelRid
descriptionThe Microsoft Windows integrity level relative ID (RID) of the process.
formatuint64
typestring
parentPid
deprecatedTrue
descriptionThe ID of the parent process. Deprecated: use parent_process.pid instead.
typestring
parentProcess
$refProcess
descriptionInformation about the parent process.
pgid
descriptionThe identifier that points to the process group ID leader.
typestring
pid
descriptionThe process ID. This field can be used as an entity indicator for process entities.
typestring
productSpecificParentProcessId
deprecatedTrue
descriptionA product specific id for the parent process. Please use parent_process.product_specific_process_id instead.
typestring
productSpecificProcessId
descriptionA product specific process id.
typestring
rgid
descriptionThe real group ID of the process.
typestring
ruid
descriptionThe real user ID of the process.
typestring
sessionLeaderPid
descriptionThe process ID of the session leader process.
typestring
tokenElevationType
descriptionThe elevation type of the process on Microsoft Windows. This determines if any privileges are removed when UAC is enabled.
enum
  • UNKNOWN
  • TYPE_1
  • TYPE_2
  • TYPE_3
enumDescriptions
  • An undetermined token type.
  • A full token with no privileges removed or groups disabled.
  • An elevated token with no privileges removed or groups disabled. Used when running as administrator.
  • A limited token with administrative privileges removed and administrative groups disabled.
typestring
tty
descriptionThe teletype terminal which the command was executed within.
typestring
typeobject
ProviderMLVerdict
descriptionDeprecated. MLVerdict result provided from threat providers, like Mandiant. These fields are used to model Mandiant sources.
idProviderMLVerdict
properties
benignCount
descriptionCount of responses where this IoC was marked benign.
formatint32
typeinteger
confidenceScore
descriptionConfidence score of the verdict.
formatint32
typeinteger
maliciousCount
descriptionCount of responses where this IoC was marked malicious.
formatint32
typeinteger
mandiantSources
descriptionList of mandiant sources from which the verdict was generated.
items
$refSource
typearray
sourceProvider
descriptionSource provider giving the ML verdict.
typestring
thirdPartySources
descriptionList of third-party sources from which the verdict was generated.
items
$refSource
typearray
typeobject
PublicKey
descriptionSubject public key info.
idPublicKey
properties
algorithm
descriptionAny of "RSA", "DSA" or "EC". Indicates the algorithm used to generate the certificate.
typestring
rsa
$refRSA
descriptionRSA public key information.
typeobject
Question
descriptionDNS Questions. See RFC1035, section 4.1.2.
idQuestion
properties
class
descriptionThe code specifying the class of the query.
formatuint32
typeinteger
name
descriptionThe domain name.
typestring
prevalence
$refPrevalence
descriptionThe prevalence of the domain within the customer's environment.
type
descriptionThe code specifying the type of the query.
formatuint32
typeinteger
typeobject
RSA
descriptionRSA public key information.
idRSA
properties
exponent
descriptionKey exponent hexdump.
typestring
keySize
descriptionKey size.
formatint64
typestring
modulus
descriptionKey modulus hexdump.
typestring
typeobject
Reference
descriptionReference to model primatives including event and entity. As support is added for fast retrieval of objects by identifiers, this will be expanded to include ID references rather than full object copies. BEGIN GOOGLE-INTERNAL See go/udm:ids for additional details. END GOOGLE-INTERNAL
idReference
properties
entity
$refBackstoryEntity
descriptionEntity being referenced. End one-of
event
$refUDM
descriptionOnly one of event or entity will be populated for a single reference. Start one-of Event being referenced.
id
$refId
descriptionId being referenced. This field will also be populated for both event and entity with the event id. For detections, only this field will be populated.
typeobject
ReferenceList
descriptionA reference list. Reference lists are user-defined lists of values which users can use in multiple Rules.
idReferenceList
properties
description
descriptionRequired. A user-provided description of the reference list.
typestring
displayName
descriptionOutput only. The unique display name of the reference list.
readOnlyTrue
typestring
entries
descriptionRequired. The entries of the reference list. When listed, they are returned in the order that was specified at creation or update. The combined size of the values of the reference list may not exceed 6MB. This is returned only when the view is REFERENCE_LIST_VIEW_FULL.
items
$refReferenceListEntry
typearray
name
descriptionOutput only. The resource name of the reference list. Format: projects/{project}/locations/{location}/instances/{instance}/referenceLists/{reference_list}
readOnlyTrue
typestring
revisionCreateTime
descriptionOutput only. The timestamp when the reference list was last updated.
formatgoogle-datetime
readOnlyTrue
typestring
ruleAssociationsCount
descriptionOutput only. The count of self-authored rules using the reference list.
formatint32
readOnlyTrue
typeinteger
rules
descriptionOutput only. The resource names for the associated self-authored Rules that use this reference list. This is returned only when the view is REFERENCE_LIST_VIEW_FULL.
items
typestring
readOnlyTrue
typearray
scopeInfo
$refScopeInfo
descriptionOutput only. The scope info of the reference list. During reference list creation, if this field is not set, the reference list without scopes (an unscoped list) will be created for an unscoped user. For a scoped user, this field must be set. During reference list update, if scope_info is requested to be updated, this field must be set.
readOnlyTrue
syntaxType
descriptionRequired. The syntax type indicating how list entries should be validated.
enum
  • REFERENCE_LIST_SYNTAX_TYPE_UNSPECIFIED
  • REFERENCE_LIST_SYNTAX_TYPE_PLAIN_TEXT_STRING
  • REFERENCE_LIST_SYNTAX_TYPE_REGEX
  • REFERENCE_LIST_SYNTAX_TYPE_CIDR
enumDescriptions
  • Defaults to REFERENCE_LIST_SYNTAX_TYPE_PLAIN_TEXT_STRING.
  • List contains plain text patterns.
  • List contains only Regular Expression patterns.
  • List contains only CIDR patterns.
typestring
typeobject
ReferenceListEntry
descriptionAn entry in a reference list.
idReferenceListEntry
properties
value
descriptionRequired. The value of the entry. Maximum length is 512 characters.
typestring
typeobject
ReferenceListScope
descriptionReferenceListScope specifies the list of scope names of the reference list.
idReferenceListScope
properties
scopeNames
descriptionOptional. The list of scope names of the reference list. The scope names should be full resource names and should be of the format: "projects/{project}/locations/{location}/instances/{instance}/dataAccessScopes/{scope_name}".
items
typestring
typearray
typeobject
Registry
descriptionInformation about a registry key or value.
idRegistry
properties
registryKey
descriptionRegistry key associated with an application or system component (e.g., HKEY_, HKCU\Environment...).
typestring
registryValueData
descriptionData associated with a registry value (e.g. %USERPROFILE%\Local Settings\Temp).
typestring
registryValueName
descriptionName of the registry value associated with an application or system component (e.g. TEMP).
typestring
registryValueType
descriptionType of the registry value.
enum
  • TYPE_UNSPECIFIED
  • NONE
  • SZ
  • EXPAND_SZ
  • BINARY
  • DWORD
  • DWORD_LITTLE_ENDIAN
  • DWORD_BIG_ENDIAN
  • LINK
  • MULTI_SZ
  • RESOURCE_LIST
  • QWORD
  • QWORD_LITTLE_ENDIAN
enumDescriptions
  • Default registry value type used when the type is unknown.
  • The registry value is not set and only the key exists.
  • A null-terminated string.
  • A null-terminated string that contains unexpanded references to environment variables
  • Binary data in any form.
  • A 32-bit number.
  • A 32-bit number in little-endian format.
  • A 32-bit number in big-endian format.
  • A null-terminated Unicode string that contains the target path of a symbolic link.
  • A sequence of null-terminated strings, terminated by an empty string
  • A device driver resource list.
  • A 64-bit number.
  • A 64-bit number in little-endian format.
typestring
typeobject
Relation
descriptionDefines the relationship between the entity (a) and another entity (b).
idRelation
properties
direction
descriptionDirectionality of relationship between primary entity (a) and the related entity (b).
enum
  • DIRECTIONALITY_UNSPECIFIED
  • BIDIRECTIONAL
  • UNIDIRECTIONAL
enumDescriptions
  • Default value.
  • Modeled in both directions. Primary entity (a) to related entity (b) and related entity (b) to primary entity (a).
  • Modeled in a single direction. Primary entity (a) to related entity (b).
typestring
entity
$refNoun
descriptionEntity (b) that the primary entity (a) is related to.
entityLabel
descriptionLabel to identify the Noun of the relation.
enum
  • ENTITY_LABEL_UNSPECIFIED
  • PRINCIPAL
  • TARGET
  • OBSERVER
  • SRC
  • NETWORK
  • SECURITY_RESULT
  • INTERMEDIARY
enumDescriptions
  • Default value.
  • The Noun represents a principal type object.
  • The Noun represents a target type object.
  • The Noun represents an observer type object.
  • The Noun represents src type object.
  • The Noun represents a network type object.
  • The Noun represents a SecurityResult object.
  • The Noun represents an intermediary type object.
typestring
entityType
descriptionType of the related entity (b) in this relationship.
enum
  • UNKNOWN_ENTITYTYPE
  • ASSET
  • USER
  • GROUP
  • RESOURCE
  • IP_ADDRESS
  • FILE
  • DOMAIN_NAME
  • URL
  • MUTEX
  • METRIC
enumDescriptions
  • @hide_from_doc
  • An asset, such as workstation, laptop, phone, virtual machine, etc.
  • User.
  • Group.
  • Resource.
  • An external IP address.
  • A file.
  • A domain.
  • A url.
  • A mutex.
  • A metric.
typestring
relationship
descriptionType of relationship.
enum
  • RELATIONSHIP_UNSPECIFIED
  • OWNS
  • ADMINISTERS
  • MEMBER
  • EXECUTES
  • DOWNLOADED_FROM
  • CONTACTS
enumDescriptions
  • Default value
  • Related entity is owned by the primary entity (e.g. user owns device asset).
  • Related entity is administered by the primary entity (e.g. user administers a group).
  • Primary entity is a member of the related entity (e.g. user is a member of a group).
  • Primary entity may have executed the related entity.
  • Primary entity may have been downloaded from the related entity.
  • Primary entity contacts the related entity.
typestring
uid
descriptionUID of the relationship.
formatbyte
typestring
typeobject
Resource
descriptionInformation about a resource such as a task, Cloud Storage bucket, database, disk, logical policy, or something similar.
idResource
properties
attribute
$refAttribute
descriptionGeneric entity metadata attributes of the resource.
id
deprecatedTrue
descriptionDeprecated: Use resource.name or resource.product_object_id.
typestring
name
descriptionThe full name of the resource. For example, Google Cloud: //cloudresourcemanager.googleapis.com/projects/wombat-123, and AWS: arn:aws:iam::123456789012:user/johndoe.
typestring
parent
deprecatedTrue
descriptionThe parent of the resource. For a database table, the parent is the database. For a storage object, the bucket name. Deprecated: use resource_ancestors.name.
typestring
productObjectId
descriptionA vendor-specific identifier to uniquely identify the entity (a GUID, OID, or similar) This field can be used as an entity indicator for a Resource entity.
typestring
resourceSubtype
descriptionResource sub-type (e.g. "BigQuery", "Bigtable").
typestring
resourceType
descriptionResource type.
enum
  • UNSPECIFIED
  • MUTEX
  • TASK
  • PIPE
  • DEVICE
  • FIREWALL_RULE
  • MAILBOX_FOLDER
  • VPC_NETWORK
  • VIRTUAL_MACHINE
  • STORAGE_BUCKET
  • STORAGE_OBJECT
  • DATABASE
  • TABLE
  • CLOUD_PROJECT
  • CLOUD_ORGANIZATION
  • SERVICE_ACCOUNT
  • ACCESS_POLICY
  • CLUSTER
  • SETTING
  • DATASET
  • BACKEND_SERVICE
  • POD
  • CONTAINER
  • FUNCTION
  • RUNTIME
  • IP_ADDRESS
  • DISK
  • VOLUME
  • IMAGE
  • SNAPSHOT
  • REPOSITORY
  • CREDENTIAL
  • LOAD_BALANCER
  • GATEWAY
  • SUBNET
  • USER
enumDescriptions
  • Default type.
  • Mutex.
  • Task.
  • Named pipe.
  • Device.
  • Firewall rule.
  • Mailbox folder.
  • VPC Network.
  • Virtual machine.
  • Storage bucket.
  • Storage object.
  • Database.
  • Data table.
  • Cloud project.
  • Cloud organization.
  • Service account.
  • Access policy.
  • Cluster.
  • Settings.
  • Dataset.
  • Endpoint that receive traffic from a load balancer or proxy.
  • Pod, which is a collection of containers. Often used in Kubernetes.
  • Container.
  • Cloud function.
  • Runtime.
  • IP address.
  • Disk.
  • Volume.
  • Machine image.
  • Snapshot.
  • Repository.
  • Credential, e.g. access keys, ssh keys, tokens, certificates.
  • Load balancer.
  • Gateway.
  • Subnet.
  • User.
typestring
type
deprecatedTrue
descriptionDeprecated: use resource_type instead.
typestring
typeobject
ResourceRecord
descriptionDNS Resource Records. See RFC1035, section 4.1.3.
idResourceRecord
properties
binaryData
descriptionThe raw bytes of any non-UTF8 strings that might be included as part of a DNS response.
formatbyte
typestring
class
descriptionThe code specifying the class of the resource record.
formatuint32
typeinteger
data
descriptionThe payload or response to the DNS question for all responses encoded in UTF-8 format
typestring
name
descriptionThe name of the owner of the resource record.
typestring
ttl
descriptionThe time interval for which the resource record can be cached before the source of the information should again be queried.
formatuint32
typeinteger
type
descriptionThe code specifying the type of the resource record.
formatuint32
typeinteger
typeobject
ResponsePlatformInfo
descriptionRelated info of an Alert in customer's SOAR platform.
idResponsePlatformInfo
properties
alertId
descriptionId of the alert in SOAR product.
typestring
responsePlatformType
descriptionType of SOAR product.
enum
  • RESPONSE_PLATFORM_TYPE_UNSPECIFIED
  • RESPONSE_PLATFORM_TYPE_SIEMPLIFY
enumDescriptions
  • Response platform not specified.
  • Siemplify
typestring
typeobject
Retrohunt
descriptionRetrohunt is an execution of a Rule over a time range in the past.
idRetrohunt
properties
executionInterval
$refInterval
descriptionOutput only. The start and end time of the retrohunt execution. If the retrohunt is not yet finished, the end time of the interval will not be populated.
readOnlyTrue
name
descriptionThe resource name of the retrohunt. Retrohunt is the child of a rule revision. {rule} in the format below is structured as {rule_id@revision_id}. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}/retrohunts/{retrohunt}
typestring
processInterval
$refInterval
descriptionRequired. The start and end time of the event time range this retrohunt processes.
progressPercentage
descriptionOutput only. Percent progress of the retrohunt towards completion, from 0.00 to 100.00.
formatfloat
readOnlyTrue
typenumber
state
descriptionOutput only. The state of the retrohunt.
enum
  • STATE_UNSPECIFIED
  • RUNNING
  • DONE
  • CANCELLED
  • FAILED
enumDescriptions
  • Unspecified or unknown retrohunt state.
  • Running state.
  • Done state.
  • Cancelled state.
  • Failed state.
readOnlyTrue
typestring
typeobject
RetrohuntMetadata
descriptionOperation Metadata for Retrohunts.
idRetrohuntMetadata
properties
executionInterval
$refInterval
descriptionThe start and end time of the retrohunt execution. If the retrohunt is not yet finished, the end time of the interval will not be filled.
progressPercentage
descriptionPercent progress of the retrohunt towards completion, from 0.00 to 100.00.
formatfloat
typenumber
retrohunt
descriptionThe name of the retrohunt. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}/retrohunts/{retrohunt}
typestring
typeobject
RiskDelta
descriptionDescribes the difference in risk score between two points in time.
idRiskDelta
properties
previousRangeEndTime
descriptionEnd time of the previous time window.
formatgoogle-datetime
typestring
previousRiskScore
descriptionRisk score from previous risk window
formatint32
typeinteger
riskScoreDelta
descriptionDifference in the normalized risk score from the previous recorded value.
formatint32
typeinteger
riskScoreNumericDelta
descriptionNumeric change between current and previous risk score
formatint32
typeinteger
typeobject
Role
descriptionSystem role for resource access and modification.
idRole
properties
description
descriptionSystem role description for user.
typestring
name
descriptionSystem role name for user.
typestring
type
descriptionSystem role type for well known roles.
enum
  • TYPE_UNSPECIFIED
  • ADMINISTRATOR
  • SERVICE_ACCOUNT
enumDescriptions
  • Default user role.
  • Product administrator with elevated privileges.
  • System service account for automated privilege access.
typestring
typeobject
Rule
descriptionThe Rule resource represents a user-created rule. NEXT TAG: 21
idRule
properties
allowedRunFrequencies
descriptionOutput only. The run frequencies that are allowed for the rule. Populated in BASIC view and FULL view.
items
enum
  • RUN_FREQUENCY_UNSPECIFIED
  • LIVE
  • HOURLY
  • DAILY
enumDescriptions
  • The run frequency is unspecified/unknown.
  • Executes in real time.
  • Executes once per hour.
  • Executes once per day.
typestring
readOnlyTrue
typearray
author
descriptionOutput only. The author of the rule. Extracted from the meta section of text. Populated in BASIC view and FULL view.
readOnlyTrue
typestring
compilationDiagnostics
descriptionOutput only. A list of a rule's corresponding compilation diagnostic messages such as compilation errors and compilation warnings. Populated in FULL view.
items
$refCompilationDiagnostic
readOnlyTrue
typearray
compilationState
descriptionOutput only. The current compilation state of the rule. Populated in FULL view.
enum
  • COMPILATION_STATE_UNSPECIFIED
  • SUCCEEDED
  • FAILED
enumDescriptions
  • The compilation state is unspecified/unknown.
  • The Rule can successfully compile.
  • The Rule cannot successfully compile. This is possible if a backwards-incompatible change was made to the compiler.
readOnlyTrue
typestring
createTime
descriptionOutput only. The timestamp of when the rule was created. Populated in FULL view.
formatgoogle-datetime
readOnlyTrue
typestring
dataTables
descriptionOutput only. Resource names of the data tables used in this rule.
items
typestring
readOnlyTrue
typearray
displayName
descriptionOutput only. Display name of the rule. Populated in BASIC view and FULL view.
readOnlyTrue
typestring
etag
descriptionThe etag for this rule. If this is provided on update, the request will succeed if and only if it matches the server-computed value, and will fail with an ABORTED error otherwise. Populated in BASIC view and FULL view.
typestring
inputsUsed
$refInputsUsed
descriptionOutput only. The set of inputs used in the rule. For example, if the rule uses $e.principal.hostname, then the uses_udm field will be true.
readOnlyTrue
metadata
additionalProperties
typestring
descriptionOutput only. Additional metadata specified in the meta section of text. Populated in FULL view.
readOnlyTrue
typeobject
name
descriptionFull resource name for the rule. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}
typestring
nearRealTimeLiveRuleEligible
descriptionOutput only. Indicate the rule can run in near real time live rule. If this is true, the rule uses the near real time live rule when the run frequency is set to LIVE.
readOnlyTrue
typeboolean
referenceLists
descriptionOutput only. Resource names of the reference lists used in this rule. Populated in FULL view.
items
typestring
readOnlyTrue
typearray
revisionCreateTime
descriptionOutput only. The timestamp of when the rule revision was created. Populated in FULL, REVISION_METADATA_ONLY views.
formatgoogle-datetime
readOnlyTrue
typestring
revisionId
descriptionOutput only. The revision ID of the rule. A new revision is created whenever the rule text is changed in any way. Format: v_{10 digits}_{9 digits} Populated in REVISION_METADATA_ONLY view and FULL view.
readOnlyTrue
typestring
scope
descriptionResource name of the DataAccessScope bound to this rule. Populated in BASIC view and FULL view. If reference lists are used in the rule, validations will be performed against this scope to ensure that the reference lists are compatible with both the user's and the rule's scopes. The scope should be in the format: "projects/{project}/locations/{location}/instances/{instance}/dataAccessScopes/{scope}".
typestring
severity
$refSeverity
descriptionOutput only. The severity of the rule as specified in the meta section of text. Populated in BASIC view and FULL view.
readOnlyTrue
text
descriptionThe YARA-L content of the rule. Populated in FULL view.
typestring
type
descriptionOutput only. User-facing type of the rule. Extracted from the events section of rule text. Populated in BASIC view and FULL view.
enum
  • RULE_TYPE_UNSPECIFIED
  • SINGLE_EVENT
  • MULTI_EVENT
enumDescriptions
  • The rule type is unspecified/unknown.
  • Rule checks for the existence of a single event.
  • Rule checks for correlation between multiple events
readOnlyTrue
typestring
typeobject
RuleDeployment
descriptionThe RuleDeployment resource represents the deployment state of a Rule.
idRuleDeployment
properties
alerting
descriptionWhether detections resulting from this deployment should be considered alerts.
typeboolean
archiveTime
descriptionOutput only. The timestamp when the rule deployment archive state was last set to true. If the rule deployment's current archive state is not set to true, the field will be empty.
formatgoogle-datetime
readOnlyTrue
typestring
archived
descriptionThe archive state of the rule deployment. Cannot be set to true unless enabled is set to false. If set to true, alerting will automatically be set to false. If currently set to true, enabled, alerting, and run_frequency cannot be updated.
typeboolean
consumerRules
descriptionOutput only. The names of the associated/chained consumer rules. Rules are considered consumers of this rule if their rule text explicitly filters on this rule's ruleid. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}
items
typestring
readOnlyTrue
typearray
enabled
descriptionWhether the rule is currently deployed continuously against incoming data.
typeboolean
executionState
descriptionOutput only. The execution state of the rule deployment.
enum
  • EXECUTION_STATE_UNSPECIFIED
  • DEFAULT
  • LIMITED
  • PAUSED
enumDescriptions
  • Unspecified or unknown execution state.
  • Default execution state.
  • Rules in limited state may not have their executions guaranteed.
  • Paused rules are not executed at all.
readOnlyTrue
typestring
lastAlertStatusChangeTime
descriptionOutput only. The timestamp when the rule deployment alert state was lastly changed. This is filled regardless of the current alert state. E.g. if the current alert status is false, this timestamp will be the timestamp when the alert status was changed to false.
formatgoogle-datetime
readOnlyTrue
typestring
name
descriptionRequired. The resource name of the rule deployment. Note that RuleDeployment is a child of the overall Rule, not any individual revision, so the resource ID segment for the Rule resource must not reference a specific revision. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}/deployment
typestring
producerRules
descriptionOutput only. The names of the associated/chained producer rules. Rules are considered producers for this rule if this rule explicitly filters on their ruleid. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}
items
typestring
readOnlyTrue
typearray
runFrequency
descriptionThe run frequency of the rule deployment.
enum
  • RUN_FREQUENCY_UNSPECIFIED
  • LIVE
  • HOURLY
  • DAILY
enumDescriptions
  • The run frequency is unspecified/unknown.
  • Executes in real time.
  • Executes once per hour.
  • Executes once per day.
typestring
typeobject
RuntimeError
idRuntimeError
properties
errorText
typestring
timeRange
$refInterval
typeobject
SSLCertificate
descriptionSSL certificate.
idSSLCertificate
properties
certExtensions
additionalProperties
descriptionProperties of the object.
typeany
descriptionCertificate's extensions.
typeobject
certSignature
$refCertSignature
descriptionCertificate's signature and algorithm.
ec
$refEC
descriptionEC public key information.
extension
$refExtension
deprecatedTrue
description(DEPRECATED) certificate's extension.
firstSeenTime
descriptionDate the certificate was first retrieved by VirusTotal.
formatgoogle-datetime
typestring
issuer
$refSubject
descriptionCertificate's issuer data.
publicKey
$refPublicKey
descriptionPublic key information.
serialNumber
descriptionCertificate's serial number hexdump.
typestring
signatureAlgorithm
descriptionAlgorithm used for the signature (for example, "sha1RSA").
typestring
size
descriptionCertificate content length.
formatint64
typestring
subject
$refSubject
descriptionCertificate's subject data.
thumbprint
descriptionCertificate's content SHA1 hash.
typestring
thumbprintSha256
descriptionCertificate's content SHA256 hash.
typestring
validity
$refValidity
descriptionCertificate's validity period.
version
descriptionCertificate version (typically "V1", "V2" or "V3").
typestring
typeobject
ScopeInfo
descriptionScopeInfo specifies the scope info of the reference list.
idScopeInfo
properties
referenceListScope
$refReferenceListScope
descriptionRequired. The list of scope names of the reference list, if the list is empty the reference list is treated as unscoped.
typeobject
SearchDataTableColumnInfo
idSearchDataTableColumnInfo
properties
isDefault
typeboolean
originalColumn
typestring
typeobject
SearchDataTableInfo
idSearchDataTableInfo
properties
columnInfo
items
$refSearchDataTableColumnInfo
typearray
dataTable
typestring
typeobject
SearchDataTableRow
idSearchDataTableRow
properties
column
typestring
value
typestring
typeobject
SearchDataTableRowInfo
idSearchDataTableRowInfo
properties
dataTable
typestring
rows
items
$refSearchDataTableRow
typearray
typeobject
SecurityResult
descriptionSecurity related metadata for the event. A security result might be something like "virus detected and quarantined," "malicious connection blocked," or "sensitive data included in document foo.doc." Each security result, of which there may be more than one, may either pertain to the whole event, or to a specific object or device referenced in the event (e.g. a malicious file that was detected, or a sensitive document sent as an email attachment). For security results that apply to a particular object referenced in the event, the security_results message MUST contain details about the implicated object (such as process, user, IP, domain, URL, IP, or email address) in the about field. For security results that apply to the entire event (e.g. SPAM found in this email), the about field must remain empty.
idSecurityResult
properties
about
$refNoun
descriptionIf the security result is about a specific entity (Noun), add it here. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
action
descriptionActions taken for this event. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
items
enum
  • UNKNOWN_ACTION
  • ALLOW
  • BLOCK
  • ALLOW_WITH_MODIFICATION
  • QUARANTINE
  • FAIL
  • CHALLENGE
enumDescriptions
  • The default action.
  • Allowed.
  • Blocked.
  • Strip, modify something (e.g. File or email was disinfected or rewritten and still forwarded).
  • Put somewhere for later analysis (does NOT imply block).
  • Failed (e.g. the event was allowed but failed).
  • Challenged (e.g. the user was challenged by a Captcha, 2FA).
typestring
typearray
actionDetails
descriptionThe detail of the action taken as provided by the vendor. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
typestring
alertState
descriptionThe alerting types of this security result. This is primarily set for rule-generated detections and alerts.
enum
  • UNSPECIFIED
  • NOT_ALERTING
  • ALERTING
enumDescriptions
  • The security result type is not known.
  • The security result is not an alert.
  • The security result is an alert.
typestring
analyticsMetadata
descriptionStores metadata about each risk analytic metric the rule uses. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
items
$refAnalyticsMetadata
typearray
associations
descriptionAssociations related to the threat. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
items
$refAssociation
typearray
attackDetails
$refAttackDetails
descriptionMITRE ATT&CK details. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
campaigns
descriptionCampaigns using this IOC threat. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
items
typestring
typearray
category
descriptionThe security category. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
items
enum
  • UNKNOWN_CATEGORY
  • SOFTWARE_MALICIOUS
  • SOFTWARE_SUSPICIOUS
  • SOFTWARE_PUA
  • NETWORK_MALICIOUS
  • NETWORK_SUSPICIOUS
  • NETWORK_CATEGORIZED_CONTENT
  • NETWORK_DENIAL_OF_SERVICE
  • NETWORK_RECON
  • NETWORK_COMMAND_AND_CONTROL
  • ACL_VIOLATION
  • AUTH_VIOLATION
  • EXPLOIT
  • DATA_EXFILTRATION
  • DATA_AT_REST
  • DATA_DESTRUCTION
  • TOR_EXIT_NODE
  • MAIL_SPAM
  • MAIL_PHISHING
  • MAIL_SPOOFING
  • POLICY_VIOLATION
  • SOCIAL_ENGINEERING
  • PHISHING
enumDescriptions
  • The default category.
  • Malware, spyware, rootkit.
  • Below the conviction threshold; probably bad.
  • Potentially Unwanted App (such as adware).
  • Includes C&C or network exploit.
  • Suspicious activity, such as potential reverse tunnel.
  • Non-security related: URL has category like gambling or porn.
  • DoS, DDoS.
  • Port scan detected by an IDS, probing of web app.
  • If we know this is a C&C channel.
  • Unauthorized access attempted, including attempted access to files, web services, processes, web objects, etc.
  • Authentication failed (e.g. bad password or bad 2-factor authentication).
  • Exploit: For all manner of exploits including attempted overflows, bad protocol encodings, ROP, SQL injection, etc. For both network and host- based exploits.
  • DLP: Sensitive data transmission, copy to thumb drive.
  • DLP: Sensitive data found at rest in a scan.
  • Attempt to destroy/delete data.
  • TOR Exit Nodes.
  • Spam email, message, etc.
  • Phishing email, chat messages, etc.
  • Spoofed source email address, etc.
  • Security-related policy violation (e.g. firewall/proxy/HIPS rule violated, NAC block action).
  • Threats which manipulate to break normal security procedures.
  • Phishing pages, pops, https phishing etc.
typestring
typearray
categoryDetails
descriptionFor vendor-specific categories. For web categorization, put type in here such as "gambling" or "porn". This field is not populated when the SecurityResult appears in a finding (a detection or alert).
items
typestring
typearray
confidence
descriptionThe confidence level of the result as estimated by the product. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
enum
  • UNKNOWN_CONFIDENCE
  • LOW_CONFIDENCE
  • MEDIUM_CONFIDENCE
  • HIGH_CONFIDENCE
enumDescriptions
  • The default confidence level.
  • Low confidence.
  • Medium confidence.
  • High confidence.
typestring
confidenceDetails
descriptionAdditional detail with regards to the confidence of a security event as estimated by the product vendor. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
typestring
confidenceScore
descriptionThe confidence score of the security result. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
formatfloat
typenumber
description
descriptionA human-readable description (e.g. "user password was wrong"). This can be more detailed than the summary.
typestring
detectionDepth
descriptionThe depth of the detection chain. Applies only to composite detections.
formatint64
typestring
detectionFields
descriptionAn ordered list of values, that represent fields in detections for a security finding. This list represents mapping of names of requested entities to their values (the security result matched variables). This is only populated when the SecurityResult appears in a finding (a detection or alert).
items
$refLabel
typearray
firstDiscoveredTime
descriptionFirst time the IoC threat was discovered in the provider. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
formatgoogle-datetime
typestring
lastDiscoveredTime
descriptionLast time the IoC was seen in the provider data. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
formatgoogle-datetime
typestring
lastUpdatedTime
descriptionLast time the IoC threat was updated in the provider. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
formatgoogle-datetime
typestring
outcomes
descriptionA list of outcomes that represent the results of this security finding. This list represents a mapping of names of the requested outcomes, to a stringified version of their values. This is only populated when the SecurityResult appears in a finding (a detection or alert).
items
$refLabel
typearray
priority
descriptionThe priority of the result. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
enum
  • UNKNOWN_PRIORITY
  • LOW_PRIORITY
  • MEDIUM_PRIORITY
  • HIGH_PRIORITY
enumDescriptions
  • Default priority level.
  • Low priority.
  • Medium priority.
  • High priority.
typestring
priorityDetails
descriptionVendor-specific information about the security result priority. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
typestring
reports
descriptionReports that reference this IOC threat. These are the report IDs. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
items
typestring
typearray
riskScore
descriptionThe risk score of the security result.
formatfloat
typenumber
ruleAuthor
descriptionAuthor of the security rule. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
typestring
ruleId
descriptionA vendor-specific ID for a rule, varying by observer type (e.g. "08123", "5d2b44d0-5ef6-40f5-a704-47d61d3babbe").
typestring
ruleLabels
descriptionA list of rule labels that can't be captured by the other fields in security result (e.g. "reference : AnotherRule", "contributor : John"). This is primarily set in rule-generated detections and alerts.
items
$refLabel
typearray
ruleName
descriptionName of the security rule (e.g. "BlockInboundToOracle").
typestring
ruleSet
descriptionThe curated detection's rule set identifier. (for example, "windows-threats") This is primarily set in rule-generated detections and alerts.
typestring
ruleSetDisplayName
descriptionThe curated detections rule set display name. This is primarily set in rule-generated detections and alerts.
typestring
ruleType
descriptionThe type of security rule.
typestring
ruleVersion
descriptionVersion of the security rule. (e.g. "v1.1", "00001", "1604709794", "2020-11-16T23:04:19+00:00"). Note that rule versions are source-dependant and lexical ordering should not be assumed.
typestring
rulesetCategoryDisplayName
descriptionThe curated detection rule set category display name. (for example, if rule_set_display_name is "CDIR SCC Enhanced Exfiltration", the rule_set_category is "Cloud Threats"). This is primarily set in rule-generated detections and alerts.
typestring
severity
descriptionThe severity of the result.
enum
  • UNKNOWN_SEVERITY
  • INFORMATIONAL
  • ERROR
  • NONE
  • LOW
  • MEDIUM
  • HIGH
  • CRITICAL
enumDescriptions
  • The default severity level.
  • Info severity.
  • An error.
  • No malicious result.
  • Low-severity malicious result.
  • Medium-severity malicious result.
  • High-severity malicious result.
  • Critical-severity malicious result.
typestring
severityDetails
descriptionVendor-specific severity. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
typestring
summary
descriptionA short human-readable summary (e.g. "failed login occurred")
typestring
threatFeedName
descriptionVendor feed name for a threat indicator feed. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
typestring
threatId
descriptionVendor-specific ID for a threat. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
typestring
threatIdNamespace
descriptionThe attribute threat_id_namespace qualifies threat_id with an id namespace to get an unique id. The attribute threat_id by itself is not unique across Chronicle as it is a vendor specific id. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
enum
  • NORMALIZED_TELEMETRY
  • RAW_TELEMETRY
  • RULE_DETECTIONS
  • UPPERCASE
  • MACHINE_INTELLIGENCE
  • SECURITY_COMMAND_CENTER
  • UNSPECIFIED
  • SOAR_ALERT
  • VIRUS_TOTAL
enumDescriptions
  • Ingested and Normalized telemetry events
  • Ingested Raw telemetry
  • Chronicle Rules engine
  • Uppercase
  • DSML - Machine Intelligence
  • A normalized telemetry event from Google Security Command Center.
  • Unspecified Namespace
  • An alert coming from other SIEMs via Chronicle SOAR.
  • VirusTotal.
typestring
threatName
descriptionA vendor-assigned classification common across multiple customers (for example, "W32/File-A", "Slammer"). This field is not populated when the SecurityResult appears in a finding (a detection or alert).
typestring
threatStatus
descriptionCurrent status of the threat This field is not populated when the SecurityResult appears in a finding (a detection or alert).
enum
  • THREAT_STATUS_UNSPECIFIED
  • ACTIVE
  • CLEARED
  • FALSE_POSITIVE
enumDescriptions
  • Default threat status
  • Active threat.
  • Cleared threat.
  • False positive.
typestring
threatVerdict
descriptionGCTI threat verdict on the security result entity. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
enum
  • THREAT_VERDICT_UNSPECIFIED
  • UNDETECTED
  • SUSPICIOUS
  • MALICIOUS
enumDescriptions
  • Unspecified threat verdict level.
  • Undetected threat verdict level.
  • Suspicious threat verdict level.
  • Malicious threat verdict level.
typestring
urlBackToProduct
descriptionURL that takes the user to the source product console for this event. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
typestring
variables
additionalProperties
$refFindingVariable
descriptionA list of outcomes and match variables that represent the results of this security finding. This list represents a mapping of names of the requested outcomes or match variables, to their values. This is only populated when the SecurityResult appears in a finding (a detection or alert).
typeobject
verdict
$refVerdict
deprecatedTrue
descriptionVerdict about the IoC from the provider. This field is now deprecated. Use VerdictInfo instead.
verdictInfo
descriptionVerdict information about the IoC from the provider. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
items
$refVerdictInfo
typearray
typeobject
Server
descriptionTransport Layer Security (TLS) information associated with the server (for example, Certificate or JA3 hash).
idServer
properties
certificate
$refCertificate
descriptionServer certificate.
ja3s
descriptionJA3 hash from the TLS ServerHello, as a hex-encoded string.
typestring
typeobject
Severity
descriptionSeverity represents the severity level of the rule.
idSeverity
properties
displayName
descriptionThe display name of the severity level. Extracted from the meta section of the rule text.
typestring
typeobject
SignatureInfo
descriptionFile signature information extracted from different tools.
idSignatureInfo
properties
codesign
$refFileMetadataCodesign
descriptionSignature information extracted from the codesign utility.
sigcheck
$refFileMetadataSignatureInfo
descriptionSignature information extracted from the sigcheck tool.
typeobject
SignerInfo
descriptionFile metadata related to the signer information.
idSignerInfo
properties
certIssuer
descriptionCompany that issued the certificate.
typestring
name
descriptionCommon name of the signers/certificate. The order of the signers matters. Each element is a higher level authority, the last being the root authority.
typestring
status
descriptionIt can say "Valid" or state the problem with the certificate if any (e.g. "This certificate or one of the certificates in the certificate chain is not time valid.").
typestring
validUsage
descriptionIndicates which situations the certificate is valid for (e.g. "Code Signing").
typestring
typeobject
Smtp
descriptionSMTP info. See RFC 2821.
idSmtp
properties
helo
descriptionThe client's 'HELO'/'EHLO' string.
typestring
isTls
descriptionIf the connection switched to TLS.
typeboolean
isWebmail
descriptionIf the message was sent via a webmail client.
typeboolean
mailFrom
descriptionThe client's 'MAIL FROM' string.
typestring
messagePath
descriptionThe message's path (extracted from the headers).
typestring
rcptTo
descriptionThe client's 'RCPT TO' string(s).
items
typestring
typearray
serverResponse
descriptionThe server's response(s) to the client.
items
typestring
typearray
typeobject
SoarAlertMetadata
descriptionMetadata fields of alerts coming from other SIEM systems.
idSoarAlertMetadata
properties
alertId
descriptionAlert ID in the source SIEM system.
typestring
product
descriptionName of the product the alert is coming from.
typestring
sourceRule
descriptionName of the rule triggering the alert in the source SIEM.
typestring
sourceSystem
descriptionName of the Source SIEM system.
typestring
sourceSystemTicketId
descriptionTicket id for the alert in the source system.
typestring
sourceSystemUri
descriptionUrl to the source SIEM system.
typestring
vendor
descriptionName of the vendor.
typestring
typeobject
Software
descriptionInformation about a software package or application.
idSoftware
properties
description
descriptionThe description of the software.
typestring
name
descriptionThe name of the software.
typestring
permissions
descriptionSystem permissions granted to the software. For example, "android.permission.WRITE_EXTERNAL_STORAGE"
items
$refPermission
typearray
vendorName
descriptionThe name of the software vendor.
typestring
version
descriptionThe version of the software.
typestring
typeobject
Source
descriptionDeprecated. Information about the threat intelligence source. These fields are used to model Mandiant sources.
idSource
properties
benignCount
descriptionCount of responses where this IoC was marked benign.
formatint32
typeinteger
maliciousCount
descriptionCount of responses where this IoC was marked malicious.
formatint32
typeinteger
name
descriptionName of the IoC source.
typestring
quality
descriptionQuality of the IoC mapping extracted from the source.
enum
  • UNKNOWN_CONFIDENCE
  • LOW_CONFIDENCE
  • MEDIUM_CONFIDENCE
  • HIGH_CONFIDENCE
enumDescriptions
  • The default confidence level.
  • Low confidence.
  • Medium confidence.
  • High confidence.
typestring
responseCount
descriptionTotal response count from this source.
formatint32
typeinteger
sourceCount
descriptionNumber of sources from which intelligence was extracted.
formatint32
typeinteger
threatIntelligenceSources
descriptionDifferent threat intelligence sources from which IoC info was extracted.
items
$refSource
typearray
typeobject
Status
descriptionThe `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors).
idStatus
properties
code
descriptionThe status code, which should be an enum value of google.rpc.Code.
formatint32
typeinteger
details
descriptionA list of messages that carry the error details. There is a common set of message types for APIs to use.
items
additionalProperties
descriptionProperties of the object. Contains field @type with type URL.
typeany
typeobject
typearray
message
descriptionA developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
typestring
typeobject
StringSequence
descriptionStringSequence represents a sequence of string.
idStringSequence
properties
stringVals
descriptionstring sequence.
items
typestring
typearray
typeobject
StringToInt64MapEntry
idStringToInt64MapEntry
properties
key
descriptionKey field.
typestring
value
descriptionValue field.
formatint64
typestring
typeobject
StringValue
idStringValue
properties
displayValue
typestring
rawValue
typestring
typeobject
StringValues
idStringValues
properties
values
items
$refStringValue
typearray
typeobject
Subject
descriptionSubject data.
idSubject
properties
commonName
descriptionCN: CommonName.
typestring
countryName
descriptionC: Country name.
typestring
locality
descriptionL: Locality.
typestring
organization
descriptionO: Organization.
typestring
organizationalUnit
descriptionOU: OrganizationalUnit.
typestring
stateOrProvinceName
descriptionST: StateOrProvinceName.
typestring
typeobject
Tactic
descriptionTactic information related to an attack or threat.
idTactic
properties
id
descriptionTactic ID (e.g. "TA0043").
typestring
name
descriptionTactic Name (e.g. "Reconnaissance")
typestring
typeobject
Tags
descriptionTags are event metadata which is set by examining event contents post-parsing. For example, a UDM event may be assigned a tenant_id based on certain customer-defined parameters.
idTags
properties
dataTapConfigName
descriptionA list of sink name values defined in DataTap configurations.
items
typestring
typearray
tenantId
descriptionA list of subtenant ids that this event belongs to.
items
formatbyte
typestring
typearray
typeobject
Technique
descriptionTechnique information related to an attack or threat.
idTechnique
properties
id
descriptionTechnique ID (e.g. "T1595").
typestring
name
descriptionTechnique Name (e.g. "Active Scanning").
typestring
subtechniqueId
descriptionSubtechnique ID (e.g. "T1595.001").
typestring
subtechniqueName
descriptionSubtechnique Name (e.g. "Scanning IP Blocks").
typestring
typeobject
TimeOff
descriptionSystem record for leave/time-off from a Human Capital Management (HCM) system.
idTimeOff
properties
description
descriptionDescription of the leave if available (e.g. 'Vacation').
typestring
interval
$refInterval
descriptionInterval duration of the leave.
typeobject
Tls
descriptionTransport Layer Security (TLS) information.
idTls
properties
cipher
descriptionCipher used during the connection.
typestring
client
$refClient
descriptionCertificate information for the client certificate.
curve
descriptionElliptical curve used for a given cipher.
typestring
established
descriptionIndicates whether the TLS negotiation was successful.
typeboolean
nextProtocol
descriptionProtocol to be used for tunnel.
typestring
resumed
descriptionIndicates whether the TLS connection was resumed from a previous TLS negotiation.
typeboolean
server
$refServer
descriptionCertificate information for the server certificate.
version
descriptionTLS version.
typestring
versionProtocol
descriptionProtocol.
typestring
typeobject
Tracker
descriptionURL Tracker.
idTracker
properties
id
descriptionTracker ID, if available.
typestring
timestamp
descriptionTracker ingestion date.
formatgoogle-datetime
typestring
tracker
descriptionTracker name.
typestring
url
descriptionTracker script URL.
typestring
typeobject
Tunnels
descriptionVPN tunnels.
idTunnels
properties
provider
descriptionThe provider of the VPN tunnels being used.
typestring
type
descriptionThe type of the VPN tunnels.
typestring
typeobject
UDM
descriptionA Unified Data Model event.
idUDM
properties
about
descriptionRepresents entities referenced by the event that are not otherwise described in principal, src, target, intermediary or observer. For example, it could be used to track email file attachments, domains/URLs/IPs embedded within an email body, and DLLs that are loaded during a PROCESS_LAUNCH event.
items
$refNoun
typearray
additional
additionalProperties
descriptionProperties of the object.
typeany
descriptionAny important vendor-specific event data that cannot be adequately represented within the formal sections of the UDM model.
typeobject
extensions
$refExtensions
descriptionAll other first-class, event-specific metadata goes in this message. Do not place protocol metadata in Extensions; put it in Network.
extracted
additionalProperties
descriptionProperties of the object.
typeany
descriptionFlattened fields extracted from the log.
typeobject
intermediary
descriptionRepresents details on one or more intermediate entities processing activity described in the event. This includes device details about a proxy server or SMTP relay server. If an active event (that has a principal and possibly target) passes through any intermediaries, they're added here. Intermediaries can impact the overall action, for example blocking or modifying an ongoing request. A rule of thumb here is that 'principal', 'target', and description of the initial action should be the same regardless of the intermediary or its action. A successful network connection from A->B should look the same in principal/target/intermediary as one blocked by firewall C: principal: A, target: B (intermediary: C).
items
$refNoun
typearray
metadata
$refMetadata
descriptionEvent metadata such as timestamp, source product, etc.
network
$refNetwork
descriptionAll network details go here, including sub-messages with details on each protocol (for example, DHCP, DNS, or HTTP).
observer
$refNoun
descriptionRepresents an observer entity (for example, a packet sniffer or network-based vulnerability scanner), which is not a direct intermediary, but which observes and reports on the event in question.
principal
$refNoun
descriptionRepresents the acting entity that originates the activity described in the event. The principal must include at least one machine detail (hostname, MACs, IPs, port, product-specific identifiers like an EDR asset ID) or user detail (for example, username), and optionally include process details. It must NOT include any of the following fields: email, files, registry keys or values.
securityResult
descriptionA list of security results.
items
$refSecurityResult
typearray
src
$refNoun
descriptionRepresents a source entity being acted upon by the participant along with the device or process context for the source object (the machine where the source object resides). For example, if user U copies file A on machine X to file B on machine Y, both file A and machine X would be specified in the src portion of the UDM event.
target
$refNoun
descriptionRepresents a target entity being referenced by the event or an object on the target entity. For example, in a firewall connection from device A to device B, A is described as the principal and B is described as the target. For a process injection by process C into target process D, process C is described as the principal and process D is described as the target.
typeobject
UdmColumnList
idUdmColumnList
properties
values
items
$refUdmColumnValue
typearray
typeobject
UdmColumnType
idUdmColumnType
properties
list
$refUdmColumnList
value
$refUdmColumnValue
typeobject
UdmColumnValue
idUdmColumnValue
properties
boolVal
typeboolean
bytesVal
formatbyte
typestring
dateVal
$refDate
doubleVal
formatdouble
typenumber
int64Val
formatint64
typestring
nullVal
typeboolean
protoVal
additionalProperties
descriptionProperties of the object. Contains field @type with type URL.
typeany
typeobject
stringVal
typestring
timestampVal
formatgoogle-datetime
typestring
uint64Val
formatuint64
typestring
typeobject
UdmEventInfo
idUdmEventInfo
properties
alertNumber
formatint32
typeinteger
annotations
items
enum
  • ANNOTATION_UNSPECIFIED
  • ANNOTATION_ALERT
enumDescriptions
typestring
typearray
chip
$refChip
deprecatedTrue
connectedComponentLabel
descriptionOptional.
formatbyte
typestring
datatableRowInfo
items
$refSearchDataTableRowInfo
typearray
detections
items
$refCollection
typearray
displayName
deprecatedTrue
typestring
entity
$refBackstoryEntity
event
$refUDM
eventLogToken
typestring
filterProperties
$refFilterProperties
deprecatedTrue
outcomes
items
$refUdmColumnType
typearray
tenantId
descriptionOptional.
typestring
uid
formatbyte
typestring
typeobject
UdmEventList
idUdmEventList
properties
columnNames
$refColumnNames
complete
typeboolean
datatableInfo
items
$refSearchDataTableInfo
typearray
events
items
$refUdmEventInfo
typearray
progress
formatdouble
typenumber
tooManyEvents
typeboolean
typeobject
UdmFieldAggregation
idUdmFieldAggregation
properties
aggregationType
enum
  • UNSPECIFIED_FIELD_AGGREGATION_TYPE
  • UDM_FIELD_AGGREGATION_TYPE
  • ENTITY_FIELD_AGGREGATION_TYPE
enumDescriptions
typestring
allValues
items
$refUdmValueCount
typearray
baselineEventCount
formatint32
typeinteger
bottomValues
items
$refUdmValueCount
typearray
eventCount
formatint32
typeinteger
fieldName
typestring
tooManyValues
typeboolean
topValues
items
$refUdmValueCount
typearray
valueCount
formatint32
typeinteger
typeobject
UdmFieldAggregations
idUdmFieldAggregations
properties
complete
typeboolean
fields
items
$refUdmFieldAggregation
typearray
groupByFields
items
$refGroupAggregationByField
typearray
typeobject
UdmFieldValue
idUdmFieldValue
properties
boolValue
typeboolean
bytesValue
formatbyte
typestring
doubleValue
formatdouble
typenumber
enumValue
typestring
floatValue
formatfloat
typenumber
int32Value
formatint32
typeinteger
int64Value
formatint64
typestring
isNull
typeboolean
stringValue
typestring
timestampValue
formatgoogle-datetime
typestring
uint32Value
formatuint32
typeinteger
uint64Value
formatuint64
typestring
typeobject
UdmPrevalence
idUdmPrevalence
properties
artifacts
items
$refFieldAndValue
typearray
prevalence
formatint32
typeinteger
typeobject
UdmPrevalenceBucket
idUdmPrevalenceBucket
properties
prevalence
items
$refUdmPrevalence
typearray
typeobject
UdmPrevalenceResponse
idUdmPrevalenceResponse
properties
buckets
items
$refUdmPrevalenceBucket
typearray
partialPrevalence
typeboolean
typeobject
UdmSearchOperationMetadata
descriptionInformation about a UDM Search operation. This message is used to populate the `metadata` field of `Operation` resources created by UDM Search.
idUdmSearchOperationMetadata
properties
baselineEventsCount
descriptionThe number of events matching the baseline query so far.
formatint32
typeinteger
baselineQuery
descriptionQuery used to search for events.
typestring
baselineTimeRange
$refInterval
descriptionThe time range used for the baseline query [inclusive start time, exclusive end time).
caseInsensitive
descriptionIf true, the search was performed in a case-insensitive manner.
typeboolean
endTime
descriptionThe end time of the operation, if done.
formatgoogle-datetime
typestring
expireTime
descriptionThe time when the operation results expire. This time may change while the operation is in progress. If unset, the results never expire.
formatgoogle-datetime
typestring
filteredEventsCount
descriptionThe number of events matching the snapshot query so far. This is <= `baseline_events_count`. If the snapshot query is empty, this will be equal to `baseline_events_count`.
formatint32
typeinteger
progress
descriptionA value from 0 to 1 representing the progress of the operation.
formatdouble
typenumber
snapshotQuery
descriptionQuery used to filter the baseline query's events.
typestring
snapshotTimeRange
$refInterval
descriptionTime range used to filter the baseline query's events [inclusive start time, exclusive end time). This time range is completely within `baseline_time_range`. If not set, it is assumed to match `baseline_time_range`.
startTime
descriptionThe start time of the operation.
formatgoogle-datetime
typestring
statsRowsCount
descriptionThe total number of rows returned for a stats query.
formatint32
typeinteger
typeobject
UdmValueCount
idUdmValueCount
properties
baselineEventCount
formatint32
typeinteger
eventCount
formatint32
typeinteger
value
$refUdmFieldValue
typeobject
Uint64Sequence
descriptionUint64Sequence represents a sequence of uint64s.
idUint64Sequence
properties
uint64Vals
descriptionuint64 sequence.
items
formatuint64
typestring
typearray
typeobject
Url
descriptionUrl.
idUrl
properties
categories
descriptionCategorisation done by VirusTotal partners.
items
typestring
typearray
favicon
$refFavicon
descriptionDifference hash and MD5 hash of the URL's.
htmlMeta
additionalProperties
descriptionProperties of the object.
typeany
descriptionMeta tags (only for URLs downloading HTML).
typeobject
lastFinalUrl
descriptionIf the original URL redirects, where does it end.
typestring
lastHttpResponseCode
descriptionHTTP response code of the last response.
formatint32
typeinteger
lastHttpResponseContentLength
descriptionLength in bytes of the content received.
formatint64
typestring
lastHttpResponseContentSha256
descriptionURL response body's SHA256 hash.
typestring
lastHttpResponseCookies
additionalProperties
descriptionProperties of the object.
typeany
descriptionWebsite's cookies.
typeobject
lastHttpResponseHeaders
additionalProperties
descriptionProperties of the object.
typeany
descriptionHeaders and values of the last HTTP response.
typeobject
tags
descriptionTags.
items
typestring
typearray
title
descriptionWebpage title.
typestring
trackers
descriptionTrackers found in the URL in a historical manner.
items
$refTracker
typearray
url
descriptionURL.
typestring
typeobject
User
descriptionInformation about a user.
idUser
properties
accountExpirationTime
descriptionUser account expiration timestamp.
formatgoogle-datetime
typestring
accountLockoutTime
descriptionUser account lockout timestamp.
formatgoogle-datetime
typestring
accountType
descriptionType of user account (for example, service, domain, or cloud). This is somewhat aligned to: https://attack.mitre.org/techniques/T1078/
enum
  • ACCOUNT_TYPE_UNSPECIFIED
  • DOMAIN_ACCOUNT_TYPE
  • LOCAL_ACCOUNT_TYPE
  • CLOUD_ACCOUNT_TYPE
  • SERVICE_ACCOUNT_TYPE
  • DEFAULT_ACCOUNT_TYPE
enumDescriptions
  • Default user account type.
  • A human account part of some domain in directory services.
  • A local machine account.
  • A SaaS service account type (such as Slack or GitHub).
  • A non-human account for data access.
  • A system built in default account.
typestring
attribute
$refAttribute
descriptionGeneric entity metadata attributes of the user.
companyName
descriptionUser job company name.
typestring
department
descriptionUser job department
items
typestring
typearray
emailAddresses
descriptionEmail addresses of the user. This field can be used as an entity indicator for user entities.
items
typestring
typearray
employeeId
descriptionHuman capital management identifier. This field can be used as an entity indicator for user entities.
typestring
firstName
descriptionFirst name of the user (e.g. "John").
typestring
firstSeenTime
descriptionThe first observed time for a user. The value is calculated on the basis of the first time the identifier was observed.
formatgoogle-datetime
typestring
groupIdentifiers
descriptionProduct object identifiers of the group(s) the user belongs to A vendor-specific identifier to uniquely identify the group(s) the user belongs to (a GUID, LDAP OID, or similar).
items
typestring
typearray
groupid
deprecatedTrue
descriptionThe ID of the group that the user belongs to. Deprecated in favor of the repeated group_identifiers field.
typestring
hireDate
descriptionUser job employment hire date.
formatgoogle-datetime
typestring
lastBadPasswordAttemptTime
descriptionUser last bad password attempt timestamp.
formatgoogle-datetime
typestring
lastLoginTime
descriptionUser last login timestamp.
formatgoogle-datetime
typestring
lastName
descriptionLast name of the user (e.g. "Locke").
typestring
lastPasswordChangeTime
descriptionUser last password change timestamp.
formatgoogle-datetime
typestring
managers
descriptionUser job manager(s).
items
$refUser
typearray
middleName
descriptionMiddle name of the user.
typestring
officeAddress
$refLocation
descriptionUser job office location.
passwordExpirationTime
descriptionUser password expiration timestamp.
formatgoogle-datetime
typestring
personalAddress
$refLocation
descriptionPersonal address of the user.
phoneNumbers
descriptionPhone numbers for the user.
items
typestring
typearray
productObjectId
descriptionA vendor-specific identifier to uniquely identify the entity (e.g. a GUID, LDAP, OID, or similar). This field can be used as an entity indicator for user entities.
typestring
roleDescription
deprecatedTrue
descriptionSystem role description for user. Deprecated: use attribute.roles.
typestring
roleName
deprecatedTrue
descriptionSystem role name for user. Deprecated: use attribute.roles.
typestring
terminationDate
descriptionUser job employment termination date.
formatgoogle-datetime
typestring
timeOff
descriptionUser time off leaves from active work.
items
$refTimeOff
typearray
title
descriptionUser job title.
typestring
userAuthenticationStatus
descriptionSystem authentication status for user.
enum
  • UNKNOWN_AUTHENTICATION_STATUS
  • ACTIVE
  • SUSPENDED
  • NO_ACTIVE_CREDENTIALS
  • DELETED
enumDescriptions
  • The default authentication status.
  • The authentication method is in active state.
  • The authentication method is in suspended/disabled state.
  • The authentication method has no active credentials.
  • The authentication method has been deleted.
typestring
userDisplayName
descriptionThe display name of the user (e.g. "John Locke").
typestring
userRole
deprecatedTrue
descriptionSystem role for user. Deprecated: use attribute.roles.
enum
  • UNKNOWN_ROLE
  • ADMINISTRATOR
  • SERVICE_ACCOUNT
enumDeprecated
  • False
  • False
  • True
enumDescriptions
  • Default user role.
  • Product administrator with elevated privileges.
  • System service account for automated privilege access. Deprecated: not a role, instead set User.account_type.
typestring
userid
descriptionThe ID of the user. This field can be used as an entity indicator for user entities.
typestring
windowsSid
descriptionThe Microsoft Windows SID of the user. This field can be used as an entity indicator for user entities.
typestring
typeobject
UserAgentProto
idUserAgentProto
properties
annotation
items
$refAnnotation
typearray
browser
descriptionProduct brand within the family: Firefox, Netscape, Camino etc.. Or Earth, Windows-Media-Player etc.. for non-browser user agents.
typestring
browserEngineVersion
descriptionVersion of the rendering engine e.g. "8.01" for "Opera/8.01"
typestring
browserVersion
descriptionMinor and lower versions unavailable with reduced User-Agent and no client hints (go/ua-reduction-ua-string-reference).
typestring
carrier
descriptionMobile specific: name of mobile carrier
typestring
device
description(Usually) Mobile specific: name of hardware device, may or may not contain the full model name. e.g. iPhone, Palm750, SPH-M800. Reduced to "K" for Android devices with reduced User-Agent and no client hints (go/ua-reduction-ua-string-reference).
typestring
deviceVersion
description(Usually) Mobile specific: version of hardware device Unavailable with reduced User-Agent and no client hints (go/ua-reduction-ua-string-reference).
typestring
family
descriptionUser agent family captures the type of browser/app at a high-level e.g. MSIE, Gecko, Safari etc..
enum
  • USER_DEFINED
  • MSIE
  • GECKO
  • APPLEWEBKIT
  • OPERA
  • KHTML
  • OTHER
  • APPLE
  • BLACKBERRY
  • DOCOMO
  • GOOGLE
  • OPENWAVE
  • POLARIS
  • OBIGO
  • TELECA
  • MICROSOFT
  • NOKIA
  • NETFRONT
  • SEMC
  • SMIT
  • KOREAN
  • CLIENT_HINTS
enumDescriptions
  • Used to represent new families supported by user-defined parsers
  • Desktop user agent families
  • WebKit based browsers e.g. Safari
  • e.g. Konqueror
  • Mobile and non-browser user agent families UA's w/o enough data to fit into a family
  • Apple apps e.g. YouTube on iPhone
  • Google Earth, Sketchup, UpdateChecker etc...
  • UP.Browser
  • Windows Media Player, RSS platform etc...
  • Sony Ericsson Mobile Communications
  • SKT, LGT
  • Constructed from UA-CH instead of UserAgent string.
typestring
googleToolbarVersion
descriptionVersion number of GoogleToolbar, if installed. Applies only to MSIE and Firefox at this time.
typestring
javaConfiguration
descriptionMobile specific: e.g. Configuration/CLDC-1.1
typestring
javaConfigurationVersion
typestring
javaProfile
descriptionMobile specific: e.g. Profile/MIDP-2.0
typestring
javaProfileVersion
typestring
locale
descriptionLocale in which the browser is running as country code and optionally language pair. Unavailable with reduced User-Agent and no client hints (go/ua-reduction-ua-string-reference).
typestring
messaging
descriptionMobile specific: e.g. MMP/2.0
typestring
messagingVersion
typestring
os
descriptionFull name of the operating system e.g. "Darwin/9.7.0", "Android 1.5", "Windows 98" Version is reduced, and other data might also be missing, for reduced User-Agent and no client hints (go/ua-reduction-ua-string-reference).
typestring
osVariant
descriptionExtra qualifier for the OS e.g. "(i386)", "Build/CUPCAKE", "PalmSource/Palm-D061" Unavailable with reduced User-Agent and no client hints (go/ua-reduction-ua-string-reference).
typestring
platform
descriptionThe platform describes the environment in which the browser or app runs. For desktop user agents, Platform is a string describing the OS family e.g. Windows, Macintosh, Linux. For mobile user agents, Platform either describes the OS family (if available) or the hardware maker. e.g. Linux, or HTC, LG, Palm.
typestring
security
descriptionSecurity level reported by user agent, either U, I or N. Unavailable with reduced User-Agent and no client hints (go/ua-reduction-ua-string-reference).
typestring
subFamily
descriptionSub-family identifies individual regexps when a family has more than 1. This is used to generate the right UA string from a protobuf. Examples in the AppleWebKit family: Chrome and Safari. Can also be an arbitrary identifier.
typestring
typeobject
UserError
descriptionThis message exists solely to get the `UserErrorReason` enum to appear in the service discovery document.
idUserError
properties
reason
descriptionThe reason for a specific error that should be shown to the app user.
enum
  • USER_ERROR_REASON_UNSPECIFIED
  • RULE_REFERENCES_OUT_OF_SCOPE
  • RULE_ARCHIVED
  • RULE_STALE_VERSION
  • RULE_ACTIVE
  • RULE_RETROHUNT_RUNNING
  • RULE_LIVE
  • RULE_ALREADY_DISABLED
  • EXPENSIVE_RULE_LARGE_WINDOW
  • RULE_LIMITED_PAUSED
  • REFERENCE_LIST_NOT_FOUND
  • UEBA_RULES_NO_SCOPE
  • RULE_TESTING_INTERVAL_TOO_SHORT
  • SEARCH_CSV_FIELDS_NOT_SUPPORTED
  • INVALID_ARGUMENT_FOR_DASHBOARD_FILTER
  • INVALID_CONFIG_FOR_DASHBOARD_IMPORT
  • RETROHUNT_LIMIT_REACHED
enumDescriptions
  • Do not use this default value.
  • The rule text references resources, such as reference lists, that are out of scope for the rule. Example of an ErrorInfo for this reason: { "reason": "RULE_REFERENCES_OUT_OF_SCOPE", "domain": "chronicle.googleapis.com", "metadata": { "reference_lists": "list_name1,list_name2,list_name3,", } }
  • The rule being operated on (saving or setting run frequency) is archived, and so the operation can't be done.
  • The rule version being operated on is not the latest, and so the operation can't be done.
  • The rule can't be archived because it is live (detecting) and a retrohunt is running.
  • The rule can't be archived because a retrohunt is running against it.
  • The rule can't be archived because it is live (detecting).
  • The rule can't be disabled because is is already disabled.
  • The rule's match time window is too large for its current run frequency.
  • The rule can't be enabled because it has been limited or paused because of high resource use.
  • The list being referred to doesn't exist.
  • UEBA rules may not be assigned a data access scope.
  • The rule's match window is longer than the time range it's being tested over. Returns the match window duration and testing interval duration as metadata labeled `match_window_duration` and `testing_interval_duration`, formatted as Go durations. Example ErrorInfo: { "reason": "RULE_TESTING_INTERVAL_TOO_SHORT", "domain": "chronicle.googleapis.com", "metadata": { "match_window_duration": "24h", "testing_interval_duration": "12h", } }
  • The CSV fields are not supported for download. Returns the unsupported fields as metadata labeled `unsupported_fields`. Example ErrorInfo: { "reason": "SEARCH_CSV_FIELDS_NOT_SUPPORTED", "domain": "chronicle.googleapis.com", "metadata": { "unsupported_fields": "udm.about.security_result.variables,udm.network.http.parsed_user_agent.family", } }
  • Invalid argument for dashboard chart filters. Returns the filter name, filter value, operator, and expected type as metadata labeled `filter_name`, `filter_value`, `operator`, and `expected_type`, respectively. Example ErrorInfo: { "reason": "INVALID_ARGUMENT_FOR_DASHBOARD_FILTER", "domain": "chronicle.googleapis.com", "metadata": { "filter_name": "filter_name", "filter_value": "filter_value", "operater": "operator", "expected_type": "expected_type", } }
  • Invalid config for dashboard import. Example ErrorInfo: { "reason": "INVALID_CONFIG_FOR_DASHBOARD_IMPORT", "domain": "chronicle.googleapis.com", }
  • The user has reached the limit of retrohunts that can be run. Returns the retrohunt limit as metadata labeled `retrohunt_limit`. Example ErrorInfo: { "reason": "RETROHUNT_LIMIT_REACHED", "domain": "chronicle.googleapis.com", "metadata": { "retrohunt_limit": "10", } }
typestring
typeobject
Validity
descriptionDefines certificate's validity period.
idValidity
properties
expiryTime
descriptionExpiry date.
formatgoogle-datetime
typestring
issueTime
descriptionIssue date.
formatgoogle-datetime
typestring
typeobject
Verdict
descriptionDeprecated. Encapsulates the threat verdict provided by human analysts and ML models. These fields are used to model Mandiant sources.
idVerdict
properties
analystVerdict
$refAnalystVerdict
descriptionHuman analyst verdict provided by sources like Mandiant.
neighbourInfluence
descriptionDescribes the neighbour influence of the verdict.
typestring
responseCount
descriptionTotal response count across all sources.
formatint32
typeinteger
sourceCount
descriptionNumber of sources from which intelligence was extracted.
formatint32
typeinteger
verdict
$refProviderMLVerdict
descriptionML Verdict provided by sources like Mandiant.
typeobject
VerdictInfo
descriptionDescribes the threat verdict provided by human analysts and machine learning models. These fields are used to model Mandiant sources.
idVerdictInfo
properties
benignCount
descriptionCount of responses where this IoC was marked as benign.
formatint32
typeinteger
categoryDetails
descriptionTags related to the verdict.
typestring
confidenceScore
descriptionConfidence score of the verdict.
formatint32
typeinteger
globalCustomerCount
descriptionGlobal customer count over the last 30 days
formatint32
typeinteger
globalHitsCount
descriptionGlobal hit count over the last 30 days.
formatint32
typeinteger
iocStats
descriptionList of IoCStats from which the verdict was generated.
items
$refIoCStats
typearray
maliciousCount
descriptionCount of responses where this IoC was marked as malicious.
formatint32
typeinteger
neighbourInfluence
descriptionDescribes the near neighbor influence of the verdict.
typestring
pwn
descriptionWhether one or more Mandiant incident response customers had this indicator in their environment.
typeboolean
pwnFirstTaggedTime
descriptionThe timestamp of the first time a pwn was associated to this entity.
formatgoogle-datetime
typestring
responseCount
descriptionTotal response count across all sources.
formatint32
typeinteger
sourceCount
descriptionNumber of sources from which intelligence was extracted.
formatint32
typeinteger
sourceProvider
descriptionSource provider giving the machine learning verdict.
typestring
verdictResponse
descriptionDetails about the verdict.
enum
  • VERDICT_RESPONSE_UNSPECIFIED
  • MALICIOUS
  • BENIGN
enumDescriptions
  • The default verdict response type.
  • VerdictResponse resulted a threat as malicious.
  • VerdictResponse resulted a threat as benign.
typestring
verdictTime
descriptionTimestamp when the verdict was generated.
formatgoogle-datetime
typestring
verdictType
descriptionType of verdict.
enum
  • VERDICT_TYPE_UNSPECIFIED
  • PROVIDER_ML_VERDICT
  • ANALYST_VERDICT
enumDescriptions
  • Verdict category not specified.
  • MLVerdict result provided from threat providers, like Mandiant. These fields are used to model Mandiant sources.
  • Verdict provided by the human analyst. These fields are used to model Mandiant sources.
typestring
typeobject
Vulnerabilities
descriptionThe Vulnerabilities extension captures details on observed/detected vulnerabilities.
idVulnerabilities
properties
vulnerabilities
descriptionA list of vulnerabilities.
items
$refVulnerability
typearray
typeobject
Vulnerability
descriptionA vulnerability.
idVulnerability
properties
about
$refNoun
descriptionIf the vulnerability is about a specific noun (e.g. executable), then add it here.
cveDescription
descriptionCommon Vulnerabilities and Exposures Description. https://cve.mitre.org/about/faqs.html#what_is_cve_record
typestring
cveId
descriptionCommon Vulnerabilities and Exposures Id. https://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures https://cve.mitre.org/about/faqs.html#what_is_cve_id
typestring
cvssBaseScore
descriptionCVSS Base Score in the range of 0.0 to 10.0. Useful for sorting.
formatfloat
typenumber
cvssVector
descriptionVector of CVSS properties (e.g. "AV:L/AC:H/Au:N/C:N/I:P/A:C") Can be linked to via: https://nvd.nist.gov/vuln-metrics/cvss/v2-calculator
typestring
cvssVersion
descriptionVersion of CVSS Vector/Score.
typestring
description
descriptionDescription of the vulnerability.
typestring
firstFound
descriptionProducts that maintain a history of vuln scans should populate first_found with the time that a scan first detected the vulnerability on this asset.
formatgoogle-datetime
typestring
lastFound
descriptionProducts that maintain a history of vuln scans should populate last_found with the time that a scan last detected the vulnerability on this asset.
formatgoogle-datetime
typestring
name
descriptionName of the vulnerability (e.g. "Unsupported OS Version detected").
typestring
scanEndTime
descriptionIf the vulnerability was discovered during an asset scan, then this field should be populated with the time the scan ended. This field can be left unset if the end time is not available or not applicable.
formatgoogle-datetime
typestring
scanStartTime
descriptionIf the vulnerability was discovered during an asset scan, then this field should be populated with the time the scan started. This field can be left unset if the start time is not available or not applicable.
formatgoogle-datetime
typestring
severity
descriptionThe severity of the vulnerability.
enum
  • UNKNOWN_SEVERITY
  • LOW
  • MEDIUM
  • HIGH
  • CRITICAL
enumDescriptions
  • The default severity level.
  • Low severity.
  • Medium severity.
  • High severity.
  • Critical severity.
typestring
severityDetails
descriptionVendor-specific severity
typestring
vendor
descriptionVendor of scan that discovered vulnerability.
typestring
vendorKnowledgeBaseArticleId
descriptionVendor specific knowledge base article (e.g. "KBXXXXXX" from Microsoft). https://en.wikipedia.org/wiki/Microsoft_Knowledge_Base https://access.redhat.com/knowledgebase
typestring
vendorVulnerabilityId
descriptionVendor specific vulnerability id (e.g. Microsoft security bulletin id).
typestring
typeobject
Watchlist
descriptionA watchlist is a list of entities that allows for bulk operations over the included entities.
idWatchlist
properties
createTime
descriptionOutput only. Time the watchlist was created.
formatgoogle-datetime
readOnlyTrue
typestring
description
descriptionOptional. Description of the watchlist.
typestring
displayName
descriptionRequired. Display name of the watchlist. Note that it must be at least one character and less than 63 characters (https://google.aip.dev/148).
typestring
entityCount
$refEntityCount
descriptionOutput only. Entity count in the watchlist.
readOnlyTrue
entityPopulationMechanism
$refEntityPopulationMechanism
descriptionRequired. Mechanism to populate entities in the watchlist.
multiplyingFactor
descriptionOptional. Weight applied to the risk score for entities in this watchlist. The default is 1.0 if it is not specified.
formatfloat
typenumber
name
descriptionIdentifier. Resource name of the watchlist. Format: projects/{project}/locations/{location}/instances/{instance}/watchlists/{watchlist}
typestring
updateTime
descriptionOutput only. Time the watchlist was last updated.
formatgoogle-datetime
readOnlyTrue
typestring
watchlistUserPreferences
$refWatchlistUserPreferences
descriptionOptional. User preferences for watchlist configuration.
typeobject
WatchlistUserPreferences
descriptionA collection of user preferences for watchlist UI configuration.
idWatchlistUserPreferences
properties
pinned
descriptionOptional. Whether the watchlist is pinned on the dashboard.
typeboolean
typeobject
X509
descriptionFile certificate.
idX509
properties
algorithm
descriptionCertificate algorithm.
typestring
certIssuer
descriptionIssuer of the certificate.
typestring
name
descriptionCertificate name.
typestring
serialNumber
descriptionCertificate serial number.
typestring
thumbprint
descriptionCertificate thumbprint.
typestring
typeobject
old_value
CancelOperationRequest
descriptionThe request message for Operations.CancelOperation.
idCancelOperationRequest
properties
typeobject
CompilationDiagnostic
descriptionCompilationDiagnostic represents a compilation diagnostic generated during a rule's compilation, such as a compilation error or a compilation warning.
idCompilationDiagnostic
properties
message
descriptionOutput only. The diagnostic message.
readOnlyTrue
typestring
position
$refCompilationPosition
descriptionOutput only. The approximate position in the rule text associated with the compilation diagnostic. Compilation Position may be empty.
readOnlyTrue
severity
descriptionOutput only. The severity of a rule's compilation diagnostic.
enum
  • SEVERITY_UNSPECIFIED
  • WARNING
  • ERROR
enumDescriptions
  • An unspecified severity level.
  • A compilation warning.
  • A compilation error.
readOnlyTrue
typestring
uri
descriptionOutput only. Link to documentation that describes a diagnostic in more detail.
readOnlyTrue
typestring
typeobject
CompilationPosition
descriptionCompilationPosition represents the location of a compilation diagnostic in rule text.
idCompilationPosition
properties
endColumn
descriptionOutput only. End column number, beginning at 1.
formatint32
readOnlyTrue
typeinteger
endLine
descriptionOutput only. End line number, beginning at 1.
formatint32
readOnlyTrue
typeinteger
startColumn
descriptionOutput only. Start column number, beginning at 1.
formatint32
readOnlyTrue
typeinteger
startLine
descriptionOutput only. Start line number, beginning at 1.
formatint32
readOnlyTrue
typeinteger
typeobject
CreateParserExtensionMetadata
descriptionOperation metadata for creating a parser extension.
idCreateParserExtensionMetadata
properties
state
descriptionThe state of the parser extension creation process.
enum
  • STATE_UNSPECIFIED
  • NEW
  • VALIDATING
  • LIVE
  • REJECTED
  • INTERNAL_ERROR
  • VALIDATED
  • ARCHIVED
enumDescriptions
  • The state for this parser extension was not specified.
  • The parser extension has been newly submitted and is waiting to be validated.
  • The parser extension is currently going through the validation pipeline.
  • The parser extension is live in production. Only configs that have successfully passed the validation stage will be set to LIVE.
  • Validation completed, but the parser extension was rejected with errors.
  • An error occurred when processing this parser extension.
  • Extension is validated.
  • Extension is archived and is no more being used.
typestring
stateLastChangedTime
descriptionThe time the config state was last changed.
formatgoogle-datetime
typestring
validationErrors
descriptionAny validation error while validating the extension, this have cap of size 10
items
typestring
typearray
validationReport
descriptionThe validation report generated during validation of the parser extension.
typestring
typeobject
CreateParserMetadata
descriptionOperation metadata for creating a parser.
idCreateParserMetadata
properties
stage
descriptionThe validation stage of the parser creation process.
enum
  • VALIDATION_STAGE_UNSPECIFIED
  • NEW
  • VALIDATING
  • PASSED
  • FAILED
  • DELETE_CANDIDATE
enumDescriptions
  • The validation stage is not specified.
  • The custom parser is submitted for validation.
  • The custom parser is currently going through the validation pipeline
  • The custom parser has successfully passed the validation.
  • The custom parser has failed validation.
  • The parser is no good, It is available for auto deletion.
typestring
validationReport
descriptionThe validation report generated during validation of the parser.
typestring
typeobject
DataAccessLabel
descriptionA DataAccessLabel is a label on events to define user access to data.
idDataAccessLabel
properties
author
descriptionOutput only. The user who created the data access label.
readOnlyTrue
typestring
createTime
descriptionOutput only. The time at which the data access label was created.
formatgoogle-datetime
readOnlyTrue
typestring
description
descriptionOptional. A description of the data access label for a human reader.
typestring
displayName
descriptionOutput only. The short name displayed for the label as it appears on event data.
readOnlyTrue
typestring
lastEditor
descriptionOutput only. The user who last updated the data access label.
readOnlyTrue
typestring
name
descriptionRequired. The unique resource name of the data access label.
typestring
udmQuery
descriptionA UDM query over event data.
typestring
updateTime
descriptionOutput only. The time at which the data access label was last updated.
formatgoogle-datetime
readOnlyTrue
typestring
typeobject
DataAccessLabelReference
descriptionReference object to a data access label.
idDataAccessLabelReference
properties
assetNamespace
descriptionThe asset namespace configured in the forwarder of the customer's events.
typestring
dataAccessLabel
descriptionThe name of the data access label.
typestring
displayName
descriptionOutput only. The display name of the label. Data access label and log types's name will match the display name of the resource. The asset namespace will match the namespace itself. The ingestion key value pair will match the key of the tuple.
readOnlyTrue
typestring
ingestionLabel
$refIngestionLabel
descriptionThe ingestion label configured in the forwarder of the customer's events.
logType
descriptionThe name of the log type.
typestring
typeobject
DataAccessScope
descriptionA DataAccessScope is a boolean expression of data access labels used to restrict access to data for users.
idDataAccessScope
properties
allowAll
descriptionOptional. Whether or not the scope allows all labels, allow_all and allowed_data_access_labels are mutually exclusive and one of them must be present. denied_data_access_labels can still be used along with allow_all. When combined with denied_data_access_labels, access will be granted to all data that doesn't have labels mentioned in denied_data_access_labels. E.g.: A customer with scope with denied labels A and B and allow_all will be able to see all data except data labeled with A and data labeled with B and data with labels A and B.
typeboolean
allowedDataAccessLabels
descriptionOptional. The allowed labels for the scope. Either allow_all or allowed_data_access_labels needs to be provided. When provided, there has to be at least one label allowed for the scope to be valid. The logical operator for evaluation of the allowed labels is OR. E.g.: A customer with scope with allowed labels A and B will be able to see data with labeled with A or B or (A and B).
items
$refDataAccessLabelReference
typearray
author
descriptionOutput only. The user who created the data access scope.
readOnlyTrue
typestring
createTime
descriptionOutput only. The time at which the data access scope was created.
formatgoogle-datetime
readOnlyTrue
typestring
deniedDataAccessLabels
descriptionOptional. The denied labels for the scope. The logical operator for evaluation of the denied labels is AND. E.g.: A customer with scope with denied labels A and B won't be able to see data labeled with A and data labeled with B and data with labels A and B.
items
$refDataAccessLabelReference
typearray
description
descriptionOptional. A description of the data access scope for a human reader.
typestring
displayName
descriptionOutput only. The name to be used for display to customers of the data access scope.
readOnlyTrue
typestring
lastEditor
descriptionOutput only. The user who last updated the data access scope.
readOnlyTrue
typestring
name
descriptionRequired. The unique full name of the data access scope. The name should comply with https://google.aip.dev/122 standards.
typestring
updateTime
descriptionOutput only. The time at which the data access scope was last updated.
formatgoogle-datetime
readOnlyTrue
typestring
typeobject
Empty
descriptionA generic empty message that you can re-use to avoid defining duplicated empty messages in your APIs. A typical example is to use it as the request or the response type of an API method. For instance: service Foo { rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty); }
idEmpty
properties
typeobject
EntityCount
descriptionCount of different types of entities in the watchlist.
idEntityCount
properties
asset
descriptionOutput only. Count of asset type entities in the watchlist.
formatint32
readOnlyTrue
typeinteger
user
descriptionOutput only. Count of user type entities in the watchlist.
formatint32
readOnlyTrue
typeinteger
typeobject
EntityPopulationMechanism
descriptionMechanism to populate entities in the watchlist.
idEntityPopulationMechanism
properties
manual
$refManual
descriptionOptional. Entities are added manually.
typeobject
IngestionLabel
descriptionRepresentation of an ingestion label type.
idIngestionLabel
properties
ingestionLabelKey
descriptionRequired. The key of the ingestion label. Always required.
typestring
ingestionLabelValue
descriptionOptional. The value of the ingestion label. Optional. An object with no provided value and some key provided would match against the given key and ANY value.
typestring
typeobject
InputsUsed
descriptionInputsUsed is a convenience field that tells us which sources of events (if any) were used in the rule. NEXT TAG: 4
idInputsUsed
properties
usesDetection
descriptionOptional. Whether the rule queries detections.
typeboolean
usesEntity
descriptionOptional. Whether the rule queries entity events.
typeboolean
usesUdm
descriptionOptional. Whether the rule queries UDM events.
typeboolean
typeobject
Instance
descriptionA Instance represents an instantiation of the Instance product.
idInstance
properties
name
descriptionOutput only. The resource name of this instance. Format: projects/{project}/locations/{region}/instances/{instance}
readOnlyTrue
typestring
typeobject
Interval
descriptionRepresents a time interval, encoded as a Timestamp start (inclusive) and a Timestamp end (exclusive). The start must be less than or equal to the end. When the start equals the end, the interval is empty (matches no time). When both start and end are unspecified, the interval matches any time.
idInterval
properties
endTime
descriptionOptional. Exclusive end of the interval. If specified, a Timestamp matching this interval will have to be before the end.
formatgoogle-datetime
typestring
startTime
descriptionOptional. Inclusive start of the interval. If specified, a Timestamp matching this interval will have to be the same or after the start.
formatgoogle-datetime
typestring
typeobject
ListDataAccessLabelsResponse
descriptionResponse message for ListDataAccessLabels.
idListDataAccessLabelsResponse
properties
dataAccessLabels
descriptionList of data access labels.
items
$refDataAccessLabel
typearray
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
typeobject
ListDataAccessScopesResponse
descriptionResponse message for ListDataAccessScopes.
idListDataAccessScopesResponse
properties
dataAccessScopes
descriptionList of data access scopes.
items
$refDataAccessScope
typearray
globalDataAccessScopeGranted
descriptionWhether or not global scope is granted to the user.
typeboolean
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
typeobject
ListOperationsResponse
descriptionThe response message for Operations.ListOperations.
idListOperationsResponse
properties
nextPageToken
descriptionThe standard List next-page token.
typestring
operations
descriptionA list of operations that matches the specified filter in the request.
items
$refOperation
typearray
typeobject
ListReferenceListsResponse
descriptionA response to a request for a list of reference lists.
idListReferenceListsResponse
properties
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
referenceLists
descriptionThe reference lists. Ordered in ascending alphabetical order by name.
items
$refReferenceList
typearray
typeobject
ListRetrohuntsResponse
descriptionResponse message for ListRetrohunts method.
idListRetrohuntsResponse
properties
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
retrohunts
descriptionThe retrohunts from the specified rule.
items
$refRetrohunt
typearray
typeobject
ListRuleDeploymentsResponse
descriptionResponse message for ListRuleDeployments.
idListRuleDeploymentsResponse
properties
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
ruleDeployments
descriptionThe rule deployments from all rules.
items
$refRuleDeployment
typearray
typeobject
ListRuleRevisionsResponse
descriptionResponse message for ListRuleRevisions method.
idListRuleRevisionsResponse
properties
nextPageToken
descriptionA token that can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
rules
descriptionThe revisions of the rule.
items
$refRule
typearray
typeobject
ListRulesResponse
descriptionResponse message for ListRules method.
idListRulesResponse
properties
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
rules
descriptionThe rules from the specified instance.
items
$refRule
typearray
typeobject
ListWatchlistsResponse
descriptionResponse message for listing watchlists.
idListWatchlistsResponse
properties
nextPageToken
descriptionOptional. A token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
watchlists
descriptionOptional. The watchlists from the specified instance.
items
$refWatchlist
typearray
typeobject
Manual
descriptionEntities are added manually.
idManual
properties
typeobject
Operation
descriptionThis resource represents a long-running operation that is the result of a network API call.
idOperation
properties
done
descriptionIf the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available.
typeboolean
error
$refStatus
descriptionThe error result of the operation in case of failure or cancellation.
metadata
additionalProperties
descriptionProperties of the object. Contains field @type with type URL.
typeany
descriptionService-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any.
typeobject
name
descriptionThe server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`.
typestring
response
additionalProperties
descriptionProperties of the object. Contains field @type with type URL.
typeany
descriptionThe normal, successful response of the operation. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`.
typeobject
typeobject
ReferenceList
descriptionA reference list. Reference lists are user-defined lists of values which users can use in multiple Rules.
idReferenceList
properties
description
descriptionRequired. A user-provided description of the reference list.
typestring
displayName
descriptionOutput only. The unique display name of the reference list.
readOnlyTrue
typestring
entries
descriptionRequired. The entries of the reference list. When listed, they are returned in the order that was specified at creation or update. The combined size of the values of the reference list may not exceed 6MB. This is returned only when the view is REFERENCE_LIST_VIEW_FULL.
items
$refReferenceListEntry
typearray
name
descriptionOutput only. The resource name of the reference list. Format: projects/{project}/locations/{location}/instances/{instance}/referenceLists/{reference_list}
readOnlyTrue
typestring
revisionCreateTime
descriptionOutput only. The timestamp when the reference list was last updated.
formatgoogle-datetime
readOnlyTrue
typestring
ruleAssociationsCount
descriptionOutput only. The count of self-authored rules using the reference list.
formatint32
readOnlyTrue
typeinteger
rules
descriptionOutput only. The resource names for the associated self-authored Rules that use this reference list. This is returned only when the view is REFERENCE_LIST_VIEW_FULL.
items
typestring
readOnlyTrue
typearray
scopeInfo
$refScopeInfo
descriptionOutput only. The scope info of the reference list. During reference list creation, if this field is not set, the reference list without scopes (an unscoped list) will be created for an unscoped user. For a scoped user, this field must be set. During reference list update, if scope_info is requested to be updated, this field must be set.
readOnlyTrue
syntaxType
descriptionRequired. The syntax type indicating how list entries should be validated.
enum
  • REFERENCE_LIST_SYNTAX_TYPE_UNSPECIFIED
  • REFERENCE_LIST_SYNTAX_TYPE_PLAIN_TEXT_STRING
  • REFERENCE_LIST_SYNTAX_TYPE_REGEX
  • REFERENCE_LIST_SYNTAX_TYPE_CIDR
enumDescriptions
  • Defaults to REFERENCE_LIST_SYNTAX_TYPE_PLAIN_TEXT_STRING.
  • List contains plain text patterns.
  • List contains only Regular Expression patterns.
  • List contains only CIDR patterns.
typestring
typeobject
ReferenceListEntry
descriptionAn entry in a reference list.
idReferenceListEntry
properties
value
descriptionRequired. The value of the entry. Maximum length is 512 characters.
typestring
typeobject
ReferenceListScope
descriptionReferenceListScope specifies the list of scope names of the reference list.
idReferenceListScope
properties
scopeNames
descriptionOptional. The list of scope names of the reference list. The scope names should be full resource names and should be of the format: "projects/{project}/locations/{location}/instances/{instance}/dataAccessScopes/{scope_name}".
items
typestring
typearray
typeobject
Retrohunt
descriptionRetrohunt is an execution of a Rule over a time range in the past.
idRetrohunt
properties
executionInterval
$refInterval
descriptionOutput only. The start and end time of the retrohunt execution. If the retrohunt is not yet finished, the end time of the interval will not be populated.
readOnlyTrue
name
descriptionThe resource name of the retrohunt. Retrohunt is the child of a rule revision. {rule} in the format below is structured as {rule_id@revision_id}. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}/retrohunts/{retrohunt}
typestring
processInterval
$refInterval
descriptionRequired. The start and end time of the event time range this retrohunt processes.
progressPercentage
descriptionOutput only. Percent progress of the retrohunt towards completion, from 0.00 to 100.00.
formatfloat
readOnlyTrue
typenumber
state
descriptionOutput only. The state of the retrohunt.
enum
  • STATE_UNSPECIFIED
  • RUNNING
  • DONE
  • CANCELLED
  • FAILED
enumDescriptions
  • Unspecified or unknown retrohunt state.
  • Running state.
  • Done state.
  • Cancelled state.
  • Failed state.
readOnlyTrue
typestring
typeobject
RetrohuntMetadata
descriptionOperation Metadata for Retrohunts.
idRetrohuntMetadata
properties
executionInterval
$refInterval
descriptionThe start and end time of the retrohunt execution. If the retrohunt is not yet finished, the end time of the interval will not be filled.
progressPercentage
descriptionPercent progress of the retrohunt towards completion, from 0.00 to 100.00.
formatfloat
typenumber
retrohunt
descriptionThe name of the retrohunt. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}/retrohunts/{retrohunt}
typestring
typeobject
Rule
descriptionThe Rule resource represents a user-created rule. NEXT TAG: 21
idRule
properties
allowedRunFrequencies
descriptionOutput only. The run frequencies that are allowed for the rule. Populated in BASIC view and FULL view.
items
enum
  • RUN_FREQUENCY_UNSPECIFIED
  • LIVE
  • HOURLY
  • DAILY
enumDescriptions
  • The run frequency is unspecified/unknown.
  • Executes in real time.
  • Executes once per hour.
  • Executes once per day.
typestring
readOnlyTrue
typearray
author
descriptionOutput only. The author of the rule. Extracted from the meta section of text. Populated in BASIC view and FULL view.
readOnlyTrue
typestring
compilationDiagnostics
descriptionOutput only. A list of a rule's corresponding compilation diagnostic messages such as compilation errors and compilation warnings. Populated in FULL view.
items
$refCompilationDiagnostic
readOnlyTrue
typearray
compilationState
descriptionOutput only. The current compilation state of the rule. Populated in FULL view.
enum
  • COMPILATION_STATE_UNSPECIFIED
  • SUCCEEDED
  • FAILED
enumDescriptions
  • The compilation state is unspecified/unknown.
  • The Rule can successfully compile.
  • The Rule cannot successfully compile. This is possible if a backwards-incompatible change was made to the compiler.
readOnlyTrue
typestring
createTime
descriptionOutput only. The timestamp of when the rule was created. Populated in FULL view.
formatgoogle-datetime
readOnlyTrue
typestring
dataTables
descriptionOutput only. Resource names of the data tables used in this rule.
items
typestring
readOnlyTrue
typearray
displayName
descriptionOutput only. Display name of the rule. Populated in BASIC view and FULL view.
readOnlyTrue
typestring
etag
descriptionThe etag for this rule. If this is provided on update, the request will succeed if and only if it matches the server-computed value, and will fail with an ABORTED error otherwise. Populated in BASIC view and FULL view.
typestring
inputsUsed
$refInputsUsed
descriptionOutput only. The set of inputs used in the rule. For example, if the rule uses $e.principal.hostname, then the uses_udm field will be true.
readOnlyTrue
metadata
additionalProperties
typestring
descriptionOutput only. Additional metadata specified in the meta section of text. Populated in FULL view.
readOnlyTrue
typeobject
name
descriptionFull resource name for the rule. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}
typestring
nearRealTimeLiveRuleEligible
descriptionOutput only. Indicate the rule can run in near real time live rule. If this is true, the rule uses the near real time live rule when the run frequency is set to LIVE.
readOnlyTrue
typeboolean
referenceLists
descriptionOutput only. Resource names of the reference lists used in this rule. Populated in FULL view.
items
typestring
readOnlyTrue
typearray
revisionCreateTime
descriptionOutput only. The timestamp of when the rule revision was created. Populated in FULL, REVISION_METADATA_ONLY views.
formatgoogle-datetime
readOnlyTrue
typestring
revisionId
descriptionOutput only. The revision ID of the rule. A new revision is created whenever the rule text is changed in any way. Format: v_{10 digits}_{9 digits} Populated in REVISION_METADATA_ONLY view and FULL view.
readOnlyTrue
typestring
scope
descriptionResource name of the DataAccessScope bound to this rule. Populated in BASIC view and FULL view. If reference lists are used in the rule, validations will be performed against this scope to ensure that the reference lists are compatible with both the user's and the rule's scopes. The scope should be in the format: "projects/{project}/locations/{location}/instances/{instance}/dataAccessScopes/{scope}".
typestring
severity
$refSeverity
descriptionOutput only. The severity of the rule as specified in the meta section of text. Populated in BASIC view and FULL view.
readOnlyTrue
text
descriptionThe YARA-L content of the rule. Populated in FULL view.
typestring
type
descriptionOutput only. User-facing type of the rule. Extracted from the events section of rule text. Populated in BASIC view and FULL view.
enum
  • RULE_TYPE_UNSPECIFIED
  • SINGLE_EVENT
  • MULTI_EVENT
enumDescriptions
  • The rule type is unspecified/unknown.
  • Rule checks for the existence of a single event.
  • Rule checks for correlation between multiple events
readOnlyTrue
typestring
typeobject
RuleDeployment
descriptionThe RuleDeployment resource represents the deployment state of a Rule.
idRuleDeployment
properties
alerting
descriptionWhether detections resulting from this deployment should be considered alerts.
typeboolean
archiveTime
descriptionOutput only. The timestamp when the rule deployment archive state was last set to true. If the rule deployment's current archive state is not set to true, the field will be empty.
formatgoogle-datetime
readOnlyTrue
typestring
archived
descriptionThe archive state of the rule deployment. Cannot be set to true unless enabled is set to false. If set to true, alerting will automatically be set to false. If currently set to true, enabled, alerting, and run_frequency cannot be updated.
typeboolean
consumerRules
descriptionOutput only. The names of the associated/chained consumer rules. Rules are considered consumers of this rule if their rule text explicitly filters on this rule's ruleid. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}
items
typestring
readOnlyTrue
typearray
enabled
descriptionWhether the rule is currently deployed continuously against incoming data.
typeboolean
executionState
descriptionOutput only. The execution state of the rule deployment.
enum
  • EXECUTION_STATE_UNSPECIFIED
  • DEFAULT
  • LIMITED
  • PAUSED
enumDescriptions
  • Unspecified or unknown execution state.
  • Default execution state.
  • Rules in limited state may not have their executions guaranteed.
  • Paused rules are not executed at all.
readOnlyTrue
typestring
lastAlertStatusChangeTime
descriptionOutput only. The timestamp when the rule deployment alert state was lastly changed. This is filled regardless of the current alert state. E.g. if the current alert status is false, this timestamp will be the timestamp when the alert status was changed to false.
formatgoogle-datetime
readOnlyTrue
typestring
name
descriptionRequired. The resource name of the rule deployment. Note that RuleDeployment is a child of the overall Rule, not any individual revision, so the resource ID segment for the Rule resource must not reference a specific revision. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}/deployment
typestring
producerRules
descriptionOutput only. The names of the associated/chained producer rules. Rules are considered producers for this rule if this rule explicitly filters on their ruleid. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}
items
typestring
readOnlyTrue
typearray
runFrequency
descriptionThe run frequency of the rule deployment.
enum
  • RUN_FREQUENCY_UNSPECIFIED
  • LIVE
  • HOURLY
  • DAILY
enumDescriptions
  • The run frequency is unspecified/unknown.
  • Executes in real time.
  • Executes once per hour.
  • Executes once per day.
typestring
typeobject
ScopeInfo
descriptionScopeInfo specifies the scope info of the reference list.
idScopeInfo
properties
referenceListScope
$refReferenceListScope
descriptionRequired. The list of scope names of the reference list, if the list is empty the reference list is treated as unscoped.
typeobject
Severity
descriptionSeverity represents the severity level of the rule.
idSeverity
properties
displayName
descriptionThe display name of the severity level. Extracted from the meta section of the rule text.
typestring
typeobject
Status
descriptionThe `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors).
idStatus
properties
code
descriptionThe status code, which should be an enum value of google.rpc.Code.
formatint32
typeinteger
details
descriptionA list of messages that carry the error details. There is a common set of message types for APIs to use.
items
additionalProperties
descriptionProperties of the object. Contains field @type with type URL.
typeany
typeobject
typearray
message
descriptionA developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
typestring
typeobject
UdmSearchOperationMetadata
descriptionInformation about a UDM Search operation. This message is used to populate the `metadata` field of `Operation` resources created by UDM Search.
idUdmSearchOperationMetadata
properties
baselineEventsCount
descriptionThe number of events matching the baseline query so far.
formatint32
typeinteger
baselineQuery
descriptionQuery used to search for events.
typestring
baselineTimeRange
$refInterval
descriptionThe time range used for the baseline query [inclusive start time, exclusive end time).
caseInsensitive
descriptionIf true, the search was performed in a case-insensitive manner.
typeboolean
endTime
descriptionThe end time of the operation, if done.
formatgoogle-datetime
typestring
expireTime
descriptionThe time when the operation results expire. This time may change while the operation is in progress. If unset, the results never expire.
formatgoogle-datetime
typestring
filteredEventsCount
descriptionThe number of events matching the snapshot query so far. This is <= `baseline_events_count`. If the snapshot query is empty, this will be equal to `baseline_events_count`.
formatint32
typeinteger
progress
descriptionA value from 0 to 1 representing the progress of the operation.
formatdouble
typenumber
snapshotQuery
descriptionQuery used to filter the baseline query's events.
typestring
snapshotTimeRange
$refInterval
descriptionTime range used to filter the baseline query's events [inclusive start time, exclusive end time). This time range is completely within `baseline_time_range`. If not set, it is assumed to match `baseline_time_range`.
startTime
descriptionThe start time of the operation.
formatgoogle-datetime
typestring
statsRowsCount
descriptionThe total number of rows returned for a stats query.
formatint32
typeinteger
typeobject
UserError
descriptionThis message exists solely to get the `UserErrorReason` enum to appear in the service discovery document.
idUserError
properties
reason
descriptionThe reason for a specific error that should be shown to the app user.
enum
  • USER_ERROR_REASON_UNSPECIFIED
  • RULE_REFERENCES_OUT_OF_SCOPE
  • RULE_ARCHIVED
  • RULE_STALE_VERSION
  • RULE_ACTIVE
  • RULE_RETROHUNT_RUNNING
  • RULE_LIVE
  • RULE_ALREADY_DISABLED
  • EXPENSIVE_RULE_LARGE_WINDOW
  • RULE_LIMITED_PAUSED
  • REFERENCE_LIST_NOT_FOUND
  • UEBA_RULES_NO_SCOPE
  • RULE_TESTING_INTERVAL_TOO_SHORT
  • SEARCH_CSV_FIELDS_NOT_SUPPORTED
  • INVALID_ARGUMENT_FOR_DASHBOARD_FILTER
  • INVALID_CONFIG_FOR_DASHBOARD_IMPORT
  • RETROHUNT_LIMIT_REACHED
enumDescriptions
  • Do not use this default value.
  • The rule text references resources, such as reference lists, that are out of scope for the rule. Example of an ErrorInfo for this reason: { "reason": "RULE_REFERENCES_OUT_OF_SCOPE", "domain": "chronicle.googleapis.com", "metadata": { "reference_lists": "list_name1,list_name2,list_name3,", } }
  • The rule being operated on (saving or setting run frequency) is archived, and so the operation can't be done.
  • The rule version being operated on is not the latest, and so the operation can't be done.
  • The rule can't be archived because it is live (detecting) and a retrohunt is running.
  • The rule can't be archived because a retrohunt is running against it.
  • The rule can't be archived because it is live (detecting).
  • The rule can't be disabled because is is already disabled.
  • The rule's match time window is too large for its current run frequency.
  • The rule can't be enabled because it has been limited or paused because of high resource use.
  • The list being referred to doesn't exist.
  • UEBA rules may not be assigned a data access scope.
  • The rule's match window is longer than the time range it's being tested over. Returns the match window duration and testing interval duration as metadata labeled `match_window_duration` and `testing_interval_duration`, formatted as Go durations. Example ErrorInfo: { "reason": "RULE_TESTING_INTERVAL_TOO_SHORT", "domain": "chronicle.googleapis.com", "metadata": { "match_window_duration": "24h", "testing_interval_duration": "12h", } }
  • The CSV fields are not supported for download. Returns the unsupported fields as metadata labeled `unsupported_fields`. Example ErrorInfo: { "reason": "SEARCH_CSV_FIELDS_NOT_SUPPORTED", "domain": "chronicle.googleapis.com", "metadata": { "unsupported_fields": "udm.about.security_result.variables,udm.network.http.parsed_user_agent.family", } }
  • Invalid argument for dashboard chart filters. Returns the filter name, filter value, operator, and expected type as metadata labeled `filter_name`, `filter_value`, `operator`, and `expected_type`, respectively. Example ErrorInfo: { "reason": "INVALID_ARGUMENT_FOR_DASHBOARD_FILTER", "domain": "chronicle.googleapis.com", "metadata": { "filter_name": "filter_name", "filter_value": "filter_value", "operater": "operator", "expected_type": "expected_type", } }
  • Invalid config for dashboard import. Example ErrorInfo: { "reason": "INVALID_CONFIG_FOR_DASHBOARD_IMPORT", "domain": "chronicle.googleapis.com", }
  • The user has reached the limit of retrohunts that can be run. Returns the retrohunt limit as metadata labeled `retrohunt_limit`. Example ErrorInfo: { "reason": "RETROHUNT_LIMIT_REACHED", "domain": "chronicle.googleapis.com", "metadata": { "retrohunt_limit": "10", } }
typestring
typeobject
Watchlist
descriptionA watchlist is a list of entities that allows for bulk operations over the included entities.
idWatchlist
properties
createTime
descriptionOutput only. Time the watchlist was created.
formatgoogle-datetime
readOnlyTrue
typestring
description
descriptionOptional. Description of the watchlist.
typestring
displayName
descriptionRequired. Display name of the watchlist. Note that it must be at least one character and less than 63 characters (https://google.aip.dev/148).
typestring
entityCount
$refEntityCount
descriptionOutput only. Entity count in the watchlist.
readOnlyTrue
entityPopulationMechanism
$refEntityPopulationMechanism
descriptionRequired. Mechanism to populate entities in the watchlist.
multiplyingFactor
descriptionOptional. Weight applied to the risk score for entities in this watchlist. The default is 1.0 if it is not specified.
formatfloat
typenumber
name
descriptionIdentifier. Resource name of the watchlist. Format: projects/{project}/locations/{location}/instances/{instance}/watchlists/{watchlist}
typestring
updateTime
descriptionOutput only. Time the watchlist was last updated.
formatgoogle-datetime
readOnlyTrue
typestring
watchlistUserPreferences
$refWatchlistUserPreferences
descriptionOptional. User preferences for watchlist configuration.
typeobject
WatchlistUserPreferences
descriptionA collection of user preferences for watchlist UI configuration.
idWatchlistUserPreferences
properties
pinned
descriptionOptional. Whether the watchlist is pinned on the dashboard.
typeboolean
typeobject
prod/europe-west2-containerfilesystem-
values_changed
root['revision']
new_value20250307
old_value20250221
prod/europe-west2-containerfilesystem-v1
values_changed
root['revision']
new_value20250307
old_value20250221
prod/europe-west3-connectgateway-
values_changed
root['revision']
new_value20250310
old_value20250303
prod/europe-west3-connectgateway-v1
values_changed
root['revision']
new_value20250310
old_value20250303
prod/europe-west3-connectgateway-v1beta1
values_changed
root['revision']
new_value20250310
old_value20250303
prod/europe-west3-containerfilesystem-
values_changed
root['revision']
new_value20250307
old_value20250221
prod/europe-west3-containerfilesystem-v1
values_changed
root['revision']
new_value20250307
old_value20250221
prod/familymanagement-pa-
values_changed
root['revision']
new_value20250312
old_value20250309
prod/familymanagement-pa-v1
values_changed
root['revision']
new_value20250312
old_value20250309
prod/fcmregistrations-
values_changed
root['revision']
new_value20250312
old_value20250309
prod/fcmregistrations-v1
values_changed
root['revision']
new_value20250312
old_value20250309
prod/firealerts-pa-
values_changed
root['revision']
new_value20250311
old_value20250304
prod/firealerts-pa-v1
values_changed
root['revision']
new_value20250311
old_value20250304
prod/firebaseabt-pa-
values_changed
root['revision']
new_value20250312
old_value20250309
prod/firebaseabt-pa-v1
values_changed
root['revision']
new_value20250312
old_value20250309
prod/firebaseabt-pa-v2
values_changed
root['revision']
new_value20250312
old_value20250309
prod/firebaseappcheck-pa-
values_changed
root['revision']
new_value20250310
old_value20250303
prod/firebaseappcheck-pa-v1
values_changed
root['revision']
new_value20250310
old_value20250303
prod/firebaseapptesters-
values_changed
root['revision']
new_value20250313
old_value20250310
prod/firebaseapptesters-v1
values_changed
root['revision']
new_value20250313
old_value20250310
prod/firebaseapptesters-v1alpha
values_changed
root['revision']
new_value20250313
old_value20250310
prod/firebasecrashlytics-
values_changed
root['revision']
new_value20250313
old_value20250310
root['schemas']
new_value
Breadcrumb
descriptionAnalytics events recorded during the session.
idBreadcrumb
properties
eventTime
descriptionDevice timestamp for the event.
formatgoogle-datetime
typestring
params
additionalProperties
typestring
descriptionEvent parameters.
typeobject
title
descriptionAnalytic event name.
typestring
typeobject
DeleteUserCrashReportsResponse
descriptionResponse message for the DeleteUserCrashReports method. All crash reports associated with the specified user will be deleted typically within 24 hours of receiving the crash report.
idDeleteUserCrashReportsResponse
properties
targetCompleteTime
descriptionTarget time to complete the delete crash reports operation.
formatgoogle-datetime
typestring
typeobject
Device
descriptionMobile device metadata.
idDevice
properties
architecture
descriptionDevice processor architecture.
typestring
companyName
descriptionAn invariant name of the manufacturer that submitted this product in its most recognizable human-readable form. e.g. "Google"
typestring
displayName
descriptionFull device name, suitable for passing to DeviceFilter. Formatted like "manufacturer (model)".
typestring
formFactor
descriptionSee FormFactor message
enum
  • FORM_FACTOR_UNSPECIFIED
  • PHONE
  • TABLET
  • DESKTOP
  • TV
  • WATCH
enumDescriptions
  • Unknown
  • Includes mobile phones, small foldables and other form factors not fitting the other categories.
  • Includes tablets and larger foldables.
  • Includes desktops, laptops, Chromebooks, etc.
  • Includes televisions and set-tops
  • Includes both watches and other wearables
typestring
manufacturer
descriptionDevice brand name which is consistent with android.os.Build.BRAND
typestring
marketingName
descriptionMarketing name, most recognizable human-readable form. e.g. "Pixel 6"
typestring
model
descriptionThe model name which is consistent with android.os.Build.MODEL e.g. ("SPH-L710", "GT-I9300")
typestring
typeobject
Error
descriptionA non-fatal error and its stacktrace, only from Apple apps.
idError
properties
blamed
descriptionTrue when the Crashlytics analysis has determined that the stacktrace in this error is where the fault occurred.
typeboolean
code
descriptionError code associated with the app's custom logged NSError.
formatint64
typestring
frames
descriptionThe frames in the error's stacktrace.
items
$refFrame
typearray
queue
descriptionThe queue on which the thread was running.
typestring
subtitle
descriptionThe subtitle of the error.
typestring
title
descriptionThe title of the error.
typestring
typeobject
Event
descriptionThe message describing a single Crashlytics event. Should be almost the same as the big query schema for consistency. google3/java/com/google/fabric/crashlytics/proto/bigqueryexport.proto
idEvent
properties
appOrientation
descriptionApp orientation at the time of the crash (portrait or landscape).
typestring
blameFrame
$refFrame
descriptionThe stack trace frame blamed by Crashlytics processing. May not be present in future analyzer.
breadcrumbs
descriptionAnalytics events recorded by the analytics SDK during the session.
items
$refBreadcrumb
typearray
buildStamp
descriptionMetadata provided by the app's build system, including version control repository info.
typestring
bundleOrPackage
descriptionThe bundle name for iOS apps or the package name of Android apps. Format usually like "com.mycompany.myapp".
typestring
crashlyticsSdkVersion
descriptionCrashlytics SDK version.
typestring
customKeys
additionalProperties
typestring
descriptionCustom keys set by the developer during the session.
typeobject
device
$refDevice
descriptionMobile device metadata.
deviceOrientation
descriptionDevice orientation at the time of the crash (portrait or landscape).
typestring
errors
descriptionApple only: A non-fatal error captured by the iOS SDK and its stacktrace.
items
$refError
typearray
eventId
descriptionOutput only. Immutable. The unique event identifier is assigned during processing.
readOnlyTrue
typestring
eventTime
descriptionDevice timestamp at which the event was recorded.
formatgoogle-datetime
typestring
exceptions
descriptionAndroid only: Exceptions that occurred during this event. Nested exceptions are presented in reverse chronological order, so that the last record is the first exception thrown.
items
$refException
typearray
installationUuid
descriptionUnique identifier for the device-app installation. This field is used to compute the unique number of impacted users.
typestring
issue
$refIssue
descriptionDetails for the [Issue] assigned to this [Event].
issueSubtitle
descriptionThe subtitle of the issue in which the event was grouped. This is usually a symbol or an exception message.
typestring
issueTitle
descriptionThe title of the issue in which the event was grouped. This is usually a source file or method name.
typestring
logs
descriptionLog messages recorded by the developer during the session.
items
$refLog
typearray
memory
$refMemory
descriptionMobile device memory usage.
name
descriptionRequired. Output only. Immutable. Identifier. The name of the event resource. Format: `projects/{project}/apps/{app_id}/events/{event}`
readOnlyTrue
typestring
operatingSystem
$refOperatingSystem
descriptionOperating system and version.
platform
descriptionMobile platform (Android or iOS).
typestring
processState
descriptionThe state of the app process at the time of the event.
typestring
receivedTime
descriptionServer timestamp at which the event was received by Crashlytics.
formatgoogle-datetime
typestring
storage
$refStorage
descriptionMobile device disk/flash usage.
threads
descriptionApplication threads present at the time the event was recorded. Each contains a stacktrace. One thread will be blamed for the error.
items
$refThread
typearray
user
$refUser
descriptionEnd user identifiers for the device owner.
version
$refVersion
descriptionMobile application version.
typeobject
Exception
descriptionA Java exception and its stacktrace, only from Android apps.
idException
properties
blamed
descriptionTrue when the Crashlytics analysis has determined that this thread is where the fault occurred.
typeboolean
exceptionMessage
descriptionA message associated with the exception.
typestring
frames
descriptionThe frames in the exception's stacktrace.
items
$refFrame
typearray
nested
descriptionTrue for all but the last-thrown exception (i.e. the first record).
typeboolean
subtitle
descriptionThe subtitle of the exception.
typestring
title
descriptionThe title of the exception.
typestring
type
descriptionThe exception type e.g. java.lang.IllegalStateException.
typestring
typeobject
FirebaseSessionEvent
descriptionSessions recorded by the Firebase App Quality Sessions SDK
idFirebaseSessionEvent
properties
device
$refDevice
descriptionMobile device metadata.
eventTime
descriptionThe start timestamp for the session event.
formatgoogle-datetime
typestring
eventType
descriptionSession event type. The SDK only supports SESSION_START events at this time.
enum
  • SESSION_EVENT_TYPE_UNKNOWN
  • SESSION_START
enumDescriptions
  • Unknown
  • Application session started
typestring
firebaseInstallationId
descriptionUniquely identifies a device with Firebase apps installed.
typestring
firstSessionId
descriptionThe identifier of the first session since the last "cold start." This id and the session_id will be the same for app launches.
typestring
operatingSystem
$refOperatingSystem
descriptionOperating system and version.
sessionId
descriptionUnique identifier for the Firebase session
typestring
sessionIndex
descriptionIndicates the number of sessions since the last cold start.
formatint32
typeinteger
version
$refVersion
descriptionMobile application version numbers.
typeobject
Frame
descriptionA frame in a stacktrace.
idFrame
properties
address
descriptionThe address in the binary image which contains the code. Present for native frames.
formatint64
typestring
blamed
descriptionTrue when the Crashlytics analysis has determined that this frame is likely to be the cause of the error.
typeboolean
file
descriptionThe name of the source file in which the frame is found.
typestring
library
descriptionThe display name of the library that includes the frame.
typestring
line
descriptionThe line number in the file of the frame.
formatint64
typestring
offset
descriptionThe byte offset into the binary image that contains the code. Present for native frames.
formatint64
typestring
owner
descriptionOne of DEVELOPER, VENDOR, RUNTIME, PLATFORM, or SYSTEM.
typestring
symbol
descriptionThe frame symbol after it has been deobfuscated or symbolicated. The raw symbol from the device if it could not be hydrated.
typestring
typeobject
IntervalMetrics
descriptionA set of computed metric values for a time interval
idIntervalMetrics
properties
endTime
descriptionThe end of the interval covered by the computation.
formatgoogle-datetime
typestring
eventsCount
descriptionThe total count of events in the interval.
formatint64
typestring
impactedUsersCount
descriptionThe cardinality of distinct users in the set of events.
formatint64
typestring
startTime
descriptionThe start of the interval covered by the computation.
formatgoogle-datetime
typestring
typeobject
Issue
descriptionAn issue describes a set of similar events that have been analyzed by Crashlytics and grouped together. All events within an issue will be of the same error_type: crash, non-fatal exception or ANR. All events within an issue will contain similar stack traces in their blamed thread.
idIssue
properties
errorType
descriptionOutput only. Immutable. Indicates whether this issue is a crash, non-fatal exception, or ANR.
enum
  • ERROR_TYPE_UNSPECIFIED
  • FATAL
  • NON_FATAL
  • ANR
enumDescriptions
  • Unknown
  • Fatal crash event.
  • Non-fatal event, such as a caught Java exception or NSError on iOS.
  • Application not responding error, Android only.
readOnlyTrue
typestring
firstSeenVersion
descriptionOutput only. Immutable. The first app display_version in which this issue was seen.
readOnlyTrue
typestring
id
descriptionOutput only. Immutable. Unique identifier for the issue.
readOnlyTrue
typestring
lastSeenVersion
descriptionOutput only. The most recent app display_version in which this issue was seen.
readOnlyTrue
typestring
name
descriptionRequired. Output only. Immutable. Identifier. The name of the issue resource. Format: `projects/{project}/apps/{app}/issues/{issue}`
readOnlyTrue
typestring
notesCount
descriptionOutput only. Immutable. The number of notes attached to an issue.
formatint64
readOnlyTrue
typestring
sampleEvent
descriptionOutput only. The resource name for a sample event in this issue.
readOnlyTrue
typestring
signals
descriptionOutput only. Immutable. Distinctive characteristics assigned by the Crashlytics analyzer.
items
$refIssueSignals
readOnlyTrue
typearray
state
descriptionOutput only. Indicates whether this issue is open, closed or muted. For details on how issue states change without user actions, see https://firebase.google.com/docs/crashlytics/troubleshooting?platform=ios#regressed-issues.
enum
  • STATE_UNSPECIFIED
  • OPEN
  • CLOSED
  • MUTED
enumDescriptions
  • Unknown
  • Ongoing issue.
  • Issue resolved.
  • Issue muted. No alerts will be fired for this issue.
readOnlyTrue
typestring
subtitle
descriptionOutput only. Immutable. Caption subtitle. This is usually a symbol or an exception message.
readOnlyTrue
typestring
title
descriptionOutput only. Immutable. Caption title. This is usually a source file or method name.
readOnlyTrue
typestring
uri
descriptionOutput only. Provides a link to the Issue on the Firebase console. When this Issue is obtained as part of a Report, then the link will be configured with the same time interval and filters as the request.
readOnlyTrue
typestring
variants
descriptionOutput only. Immutable. The top 12 variants (subgroups) within the issue. Variants group events within an issue that are very similar. A single result implies that the "variant" is the same as the parent issue. This field will be empty when multiple issues are requested. Request a single issue to list variants.
items
$refIssueVariant
readOnlyTrue
typearray
typeobject
IssueSignals
descriptionDistinctive characteristics assigned by the Crashlytics analyzer.
idIssueSignals
properties
description
descriptionOutput only. Supporting detail information.
readOnlyTrue
typestring
signal
descriptionOutput only. The signal name.
enum
  • SIGNAL_UNSPECIFIED
  • SIGNAL_EARLY
  • SIGNAL_FRESH
  • SIGNAL_REGRESSED
  • SIGNAL_REPETITIVE
enumDescriptions
  • Default
  • Indicates an issue that is impacting end users early in the app session.
  • Indicates newly detected issues.
  • Indicates previously closed issues which have been detected again.
  • Indicates issues impacting some end users multiple times.
readOnlyTrue
typestring
typeobject
IssueVariant
descriptionA variant is a subgroup of an issue where all events have very similar stack traces. Issues may contain one or more variants.
idIssueVariant
properties
id
descriptionOutput only. Immutable. Distinct identifier for the variant.
readOnlyTrue
typestring
sampleEvent
descriptionOutput only. The resource name for a sample event in this variant.
readOnlyTrue
typestring
uri
descriptionOutput only. Provides a link to the Variant on the Firebase console. When this Variant is obtained as part of a Report, then the link will be configured with the same time interval and filters as the request.
readOnlyTrue
typestring
typeobject
Log
descriptionDeveloper-provided log lines recorded during the session.
idLog
properties
logTime
descriptionDevice timestamp when the line was logged.
formatgoogle-datetime
typestring
message
descriptionLog message.
typestring
typeobject
Memory
descriptionMobile device memory usage.
idMemory
properties
free
descriptionBytes free.
formatint64
typestring
used
descriptionBytes in use.
formatint64
typestring
typeobject
OperatingSystem
descriptionMobile device operating system metadata.
idOperatingSystem
properties
deviceType
descriptionThe device category (mobile, tablet, desktop).
typestring
displayName
descriptionFormatted name and version number, suitable for passing to OperatingSystemFilter.
typestring
displayVersion
descriptionOperating system display version number.
typestring
modificationState
descriptionIndicates if the OS has been modified or "jailbroken."
typestring
os
descriptionOperating system name.
typestring
type
descriptionThe OS type on Apple platforms (iOS, iPadOS, etc.).
typestring
typeobject
PlayTrack
descriptionDescribes a release track in the Play Developer Console.
idPlayTrack
properties
title
descriptionUser-generated or auto-generated name of this track. PROD and INTERNAL track types always have auto-generated names, ie. "prod" and "internal" respectively. Tracks of type EARLY_ACCESS always have a user-generated name. Other track types do not have any guarantees, might have user-generated or auto-generated names.
typestring
type
descriptionThe type of track (prod, internal, etc.).
enum
  • TRACK_TYPE_UNSPECIFIED
  • TRACK_TYPE_PROD
  • TRACK_TYPE_INTERNAL
  • TRACK_TYPE_OPEN_TESTING
  • TRACK_TYPE_CLOSED_TESTING
  • TRACK_TYPE_EARLY_ACCESS
enumDescriptions
  • Unknown
  • Production
  • Internal testing
  • Open testing
  • Closed testing
  • Early access
typestring
typeobject
ReportGroup
descriptionA group of results in an EventReport, similar to a SQL "GROUP BY" result. In any report, the group_parent field is strictly the same type for all of the groups in any collection.
idReportGroup
properties
device
$refDevice
descriptionDevice metrics group
issue
$refIssue
descriptionIssue metrics group
metrics
descriptionScalar metrics will contain a single object covering the entire interval, while time-dimensioned graphs will contain one per time grain.
items
$refIntervalMetrics
typearray
operatingSystem
$refOperatingSystem
descriptionOperating system metrics group
subgroups
descriptionAdditional nested groupings when relevant, eg by operating system and operating system version
items
$refReportGroup
typearray
variant
$refIssueVariant
descriptionIssue variant metrics group
version
$refVersion
descriptionVersion metrics group
typeobject
Storage
descriptionMobile device disk/flash usage. Not reported for all devices.
idStorage
properties
free
descriptionBytes free.
formatint64
typestring
used
descriptionBytes used.
formatint64
typestring
typeobject
Thread
descriptionAn application thread.
idThread
properties
blamed
descriptionTrue when the Crashlytics analysis has determined that the stacktrace in this thread is where the fault occurred.
typeboolean
crashAddress
descriptionThe address of the signal that caused the application to crash. Only present on crashed native threads
formatint64
typestring
crashed
descriptionTrue when the thread has crashed.
typeboolean
frames
descriptionThe frames in the thread's stacktrace.
items
$refFrame
typearray
name
descriptionThe name of the thread.
typestring
queue
descriptionThe queue on which the thread was running.
typestring
signal
descriptionThe name of the signal that caused the app to crash. Only present on crashed native threads.
typestring
signalCode
descriptionThe code of the signal that caused the app to crash. Only present on crashed native threads.
typestring
subtitle
descriptionThe subtitle of the thread.
typestring
sysThreadId
descriptionThe system id of the thread, only available for ANR threads.
formatint64
typestring
threadId
descriptionThe id of the thread, only available for ANR threads.
formatint64
typestring
threadState
descriptionOutput only. The state of the thread at the time the ANR occurred.
enum
  • STATE_UNSPECIFIED
  • THREAD_STATE_TERMINATED
  • THREAD_STATE_RUNNABLE
  • THREAD_STATE_TIMED_WAITING
  • THREAD_STATE_BLOCKED
  • THREAD_STATE_WAITING
  • THREAD_STATE_NEW
  • THREAD_STATE_NATIVE_RUNNABLE
  • THREAD_STATE_NATIVE_WAITING
enumDescriptions
  • Thread state unspecified.
  • Thread was terminated.
  • Thread was runnable.
  • Thread was waiting with a timeout.
  • Thread was blocked.
  • Thread was waiting.
  • Thread was started, yet to run anything.
  • The thread was native and we could not heuristically determine that it was was waiting, so assume it's runnable.
  • We heuristically determined that the thread is waiting.
readOnlyTrue
typestring
title
descriptionThe title of the thread.
typestring
typeobject
User
descriptionDeveloper-provided end user identifiers.
idUser
properties
id
descriptionUser id if provided by the app developer.
typestring
typeobject
Version
descriptionApplication software version.
idVersion
properties
buildVersion
descriptionOne display_version can have many build_version. On Android, strictly the same as "version code" On iOS, strictly the same as "build number" or CFBundleVersion
typestring
displayName
descriptionCompound human-readable string containing both display and build versions. Formatted like "display_version (build_version)" eg "1.2.3 (456)" This string can be used for filtering with the VersionFilter.display_name field.
typestring
displayVersion
descriptionHuman-readable version string, eg "1.2.3" On Android, strictly the same as "version name" On iOS, strictly the same as "version number" or CFBundleShortVersionString
typestring
tracks
descriptionIndicates releases which have artifacts that are currently available in the Play Store to the target audience of the track. Versions may be available in multiple tracks.
items
$refPlayTrack
typearray
typeobject
old_value
DeleteUserCrashReportsResponse
descriptionResponse message for the DeleteUserCrashReports method. All crash reports associated with the specified user will be deleted typically within 24 hours of receiving the crash report.
idDeleteUserCrashReportsResponse
properties
targetCompleteTime
descriptionTarget time to complete the delete crash reports operation.
formatgoogle-datetime
typestring
typeobject
prod/firebasecrashlytics-v1alpha
values_changed
root['revision']
new_value20250313
old_value20250311
root['schemas']
new_value
Breadcrumb
descriptionAnalytics events recorded during the session.
idBreadcrumb
properties
eventTime
descriptionDevice timestamp for the event.
formatgoogle-datetime
typestring
params
additionalProperties
typestring
descriptionEvent parameters.
typeobject
title
descriptionAnalytic event name.
typestring
typeobject
DeleteUserCrashReportsResponse
descriptionResponse message for the DeleteUserCrashReports method. All crash reports associated with the specified user will be deleted typically within 24 hours of receiving the crash report.
idDeleteUserCrashReportsResponse
properties
targetCompleteTime
descriptionTarget time to complete the delete crash reports operation.
formatgoogle-datetime
typestring
typeobject
Device
descriptionMobile device metadata.
idDevice
properties
architecture
descriptionDevice processor architecture.
typestring
companyName
descriptionAn invariant name of the manufacturer that submitted this product in its most recognizable human-readable form. e.g. "Google"
typestring
displayName
descriptionFull device name, suitable for passing to DeviceFilter. Formatted like "manufacturer (model)".
typestring
formFactor
descriptionSee FormFactor message
enum
  • FORM_FACTOR_UNSPECIFIED
  • PHONE
  • TABLET
  • DESKTOP
  • TV
  • WATCH
enumDescriptions
  • Unknown
  • Includes mobile phones, small foldables and other form factors not fitting the other categories.
  • Includes tablets and larger foldables.
  • Includes desktops, laptops, Chromebooks, etc.
  • Includes televisions and set-tops
  • Includes both watches and other wearables
typestring
manufacturer
descriptionDevice brand name which is consistent with android.os.Build.BRAND
typestring
marketingName
descriptionMarketing name, most recognizable human-readable form. e.g. "Pixel 6"
typestring
model
descriptionThe model name which is consistent with android.os.Build.MODEL e.g. ("SPH-L710", "GT-I9300")
typestring
typeobject
Error
descriptionA non-fatal error and its stacktrace, only from Apple apps.
idError
properties
blamed
descriptionTrue when the Crashlytics analysis has determined that the stacktrace in this error is where the fault occurred.
typeboolean
code
descriptionError code associated with the app's custom logged NSError.
formatint64
typestring
frames
descriptionThe frames in the error's stacktrace.
items
$refFrame
typearray
queue
descriptionThe queue on which the thread was running.
typestring
subtitle
descriptionThe subtitle of the error.
typestring
title
descriptionThe title of the error.
typestring
typeobject
Event
descriptionThe message describing a single Crashlytics event. Should be almost the same as the big query schema for consistency. google3/java/com/google/fabric/crashlytics/proto/bigqueryexport.proto
idEvent
properties
appOrientation
descriptionApp orientation at the time of the crash (portrait or landscape).
typestring
blameFrame
$refFrame
descriptionThe stack trace frame blamed by Crashlytics processing. May not be present in future analyzer.
breadcrumbs
descriptionAnalytics events recorded by the analytics SDK during the session.
items
$refBreadcrumb
typearray
buildStamp
descriptionMetadata provided by the app's build system, including version control repository info.
typestring
bundleOrPackage
descriptionThe bundle name for iOS apps or the package name of Android apps. Format usually like "com.mycompany.myapp".
typestring
crashlyticsSdkVersion
descriptionCrashlytics SDK version.
typestring
customKeys
additionalProperties
typestring
descriptionCustom keys set by the developer during the session.
typeobject
device
$refDevice
descriptionMobile device metadata.
deviceOrientation
descriptionDevice orientation at the time of the crash (portrait or landscape).
typestring
errors
descriptionApple only: A non-fatal error captured by the iOS SDK and its stacktrace.
items
$refError
typearray
eventId
descriptionOutput only. Immutable. The unique event identifier is assigned during processing.
readOnlyTrue
typestring
eventTime
descriptionDevice timestamp at which the event was recorded.
formatgoogle-datetime
typestring
exceptions
descriptionAndroid only: Exceptions that occurred during this event. Nested exceptions are presented in reverse chronological order, so that the last record is the first exception thrown.
items
$refException
typearray
installationUuid
descriptionUnique identifier for the device-app installation. This field is used to compute the unique number of impacted users.
typestring
issue
$refIssue
descriptionDetails for the [Issue] assigned to this [Event].
issueSubtitle
descriptionThe subtitle of the issue in which the event was grouped. This is usually a symbol or an exception message.
typestring
issueTitle
descriptionThe title of the issue in which the event was grouped. This is usually a source file or method name.
typestring
logs
descriptionLog messages recorded by the developer during the session.
items
$refLog
typearray
memory
$refMemory
descriptionMobile device memory usage.
name
descriptionRequired. Output only. Immutable. Identifier. The name of the event resource. Format: `projects/{project}/apps/{app_id}/events/{event}`
readOnlyTrue
typestring
operatingSystem
$refOperatingSystem
descriptionOperating system and version.
platform
descriptionMobile platform (Android or iOS).
typestring
processState
descriptionThe state of the app process at the time of the event.
typestring
receivedTime
descriptionServer timestamp at which the event was received by Crashlytics.
formatgoogle-datetime
typestring
storage
$refStorage
descriptionMobile device disk/flash usage.
threads
descriptionApplication threads present at the time the event was recorded. Each contains a stacktrace. One thread will be blamed for the error.
items
$refThread
typearray
user
$refUser
descriptionEnd user identifiers for the device owner.
version
$refVersion
descriptionMobile application version.
typeobject
Exception
descriptionA Java exception and its stacktrace, only from Android apps.
idException
properties
blamed
descriptionTrue when the Crashlytics analysis has determined that this thread is where the fault occurred.
typeboolean
exceptionMessage
descriptionA message associated with the exception.
typestring
frames
descriptionThe frames in the exception's stacktrace.
items
$refFrame
typearray
nested
descriptionTrue for all but the last-thrown exception (i.e. the first record).
typeboolean
subtitle
descriptionThe subtitle of the exception.
typestring
title
descriptionThe title of the exception.
typestring
type
descriptionThe exception type e.g. java.lang.IllegalStateException.
typestring
typeobject
FirebaseSessionEvent
descriptionSessions recorded by the Firebase App Quality Sessions SDK
idFirebaseSessionEvent
properties
device
$refDevice
descriptionMobile device metadata.
eventTime
descriptionThe start timestamp for the session event.
formatgoogle-datetime
typestring
eventType
descriptionSession event type. The SDK only supports SESSION_START events at this time.
enum
  • SESSION_EVENT_TYPE_UNKNOWN
  • SESSION_START
enumDescriptions
  • Unknown
  • Application session started
typestring
firebaseInstallationId
descriptionUniquely identifies a device with Firebase apps installed.
typestring
firstSessionId
descriptionThe identifier of the first session since the last "cold start." This id and the session_id will be the same for app launches.
typestring
operatingSystem
$refOperatingSystem
descriptionOperating system and version.
sessionId
descriptionUnique identifier for the Firebase session
typestring
sessionIndex
descriptionIndicates the number of sessions since the last cold start.
formatint32
typeinteger
version
$refVersion
descriptionMobile application version numbers.
typeobject
Frame
descriptionA frame in a stacktrace.
idFrame
properties
address
descriptionThe address in the binary image which contains the code. Present for native frames.
formatint64
typestring
blamed
descriptionTrue when the Crashlytics analysis has determined that this frame is likely to be the cause of the error.
typeboolean
file
descriptionThe name of the source file in which the frame is found.
typestring
library
descriptionThe display name of the library that includes the frame.
typestring
line
descriptionThe line number in the file of the frame.
formatint64
typestring
offset
descriptionThe byte offset into the binary image that contains the code. Present for native frames.
formatint64
typestring
owner
descriptionOne of DEVELOPER, VENDOR, RUNTIME, PLATFORM, or SYSTEM.
typestring
symbol
descriptionThe frame symbol after it has been deobfuscated or symbolicated. The raw symbol from the device if it could not be hydrated.
typestring
typeobject
IntervalMetrics
descriptionA set of computed metric values for a time interval
idIntervalMetrics
properties
endTime
descriptionThe end of the interval covered by the computation.
formatgoogle-datetime
typestring
eventsCount
descriptionThe total count of events in the interval.
formatint64
typestring
impactedUsersCount
descriptionThe cardinality of distinct users in the set of events.
formatint64
typestring
startTime
descriptionThe start of the interval covered by the computation.
formatgoogle-datetime
typestring
typeobject
Issue
descriptionAn issue describes a set of similar events that have been analyzed by Crashlytics and grouped together. All events within an issue will be of the same error_type: crash, non-fatal exception or ANR. All events within an issue will contain similar stack traces in their blamed thread.
idIssue
properties
errorType
descriptionOutput only. Immutable. Indicates whether this issue is a crash, non-fatal exception, or ANR.
enum
  • ERROR_TYPE_UNSPECIFIED
  • FATAL
  • NON_FATAL
  • ANR
enumDescriptions
  • Unknown
  • Fatal crash event.
  • Non-fatal event, such as a caught Java exception or NSError on iOS.
  • Application not responding error, Android only.
readOnlyTrue
typestring
firstSeenVersion
descriptionOutput only. Immutable. The first app display_version in which this issue was seen.
readOnlyTrue
typestring
id
descriptionOutput only. Immutable. Unique identifier for the issue.
readOnlyTrue
typestring
lastSeenVersion
descriptionOutput only. The most recent app display_version in which this issue was seen.
readOnlyTrue
typestring
name
descriptionRequired. Output only. Immutable. Identifier. The name of the issue resource. Format: `projects/{project}/apps/{app}/issues/{issue}`
readOnlyTrue
typestring
notesCount
descriptionOutput only. Immutable. The number of notes attached to an issue.
formatint64
readOnlyTrue
typestring
sampleEvent
descriptionOutput only. The resource name for a sample event in this issue.
readOnlyTrue
typestring
signals
descriptionOutput only. Immutable. Distinctive characteristics assigned by the Crashlytics analyzer.
items
$refIssueSignals
readOnlyTrue
typearray
state
descriptionOutput only. Indicates whether this issue is open, closed or muted. For details on how issue states change without user actions, see https://firebase.google.com/docs/crashlytics/troubleshooting?platform=ios#regressed-issues.
enum
  • STATE_UNSPECIFIED
  • OPEN
  • CLOSED
  • MUTED
enumDescriptions
  • Unknown
  • Ongoing issue.
  • Issue resolved.
  • Issue muted. No alerts will be fired for this issue.
readOnlyTrue
typestring
subtitle
descriptionOutput only. Immutable. Caption subtitle. This is usually a symbol or an exception message.
readOnlyTrue
typestring
title
descriptionOutput only. Immutable. Caption title. This is usually a source file or method name.
readOnlyTrue
typestring
uri
descriptionOutput only. Provides a link to the Issue on the Firebase console. When this Issue is obtained as part of a Report, then the link will be configured with the same time interval and filters as the request.
readOnlyTrue
typestring
variants
descriptionOutput only. Immutable. The top 12 variants (subgroups) within the issue. Variants group events within an issue that are very similar. A single result implies that the "variant" is the same as the parent issue. This field will be empty when multiple issues are requested. Request a single issue to list variants.
items
$refIssueVariant
readOnlyTrue
typearray
typeobject
IssueSignals
descriptionDistinctive characteristics assigned by the Crashlytics analyzer.
idIssueSignals
properties
description
descriptionOutput only. Supporting detail information.
readOnlyTrue
typestring
signal
descriptionOutput only. The signal name.
enum
  • SIGNAL_UNSPECIFIED
  • SIGNAL_EARLY
  • SIGNAL_FRESH
  • SIGNAL_REGRESSED
  • SIGNAL_REPETITIVE
enumDescriptions
  • Default
  • Indicates an issue that is impacting end users early in the app session.
  • Indicates newly detected issues.
  • Indicates previously closed issues which have been detected again.
  • Indicates issues impacting some end users multiple times.
readOnlyTrue
typestring
typeobject
IssueVariant
descriptionA variant is a subgroup of an issue where all events have very similar stack traces. Issues may contain one or more variants.
idIssueVariant
properties
id
descriptionOutput only. Immutable. Distinct identifier for the variant.
readOnlyTrue
typestring
sampleEvent
descriptionOutput only. The resource name for a sample event in this variant.
readOnlyTrue
typestring
uri
descriptionOutput only. Provides a link to the Variant on the Firebase console. When this Variant is obtained as part of a Report, then the link will be configured with the same time interval and filters as the request.
readOnlyTrue
typestring
typeobject
Log
descriptionDeveloper-provided log lines recorded during the session.
idLog
properties
logTime
descriptionDevice timestamp when the line was logged.
formatgoogle-datetime
typestring
message
descriptionLog message.
typestring
typeobject
Memory
descriptionMobile device memory usage.
idMemory
properties
free
descriptionBytes free.
formatint64
typestring
used
descriptionBytes in use.
formatint64
typestring
typeobject
OperatingSystem
descriptionMobile device operating system metadata.
idOperatingSystem
properties
deviceType
descriptionThe device category (mobile, tablet, desktop).
typestring
displayName
descriptionFormatted name and version number, suitable for passing to OperatingSystemFilter.
typestring
displayVersion
descriptionOperating system display version number.
typestring
modificationState
descriptionIndicates if the OS has been modified or "jailbroken."
typestring
os
descriptionOperating system name.
typestring
type
descriptionThe OS type on Apple platforms (iOS, iPadOS, etc.).
typestring
typeobject
PlayTrack
descriptionDescribes a release track in the Play Developer Console.
idPlayTrack
properties
title
descriptionUser-generated or auto-generated name of this track. PROD and INTERNAL track types always have auto-generated names, ie. "prod" and "internal" respectively. Tracks of type EARLY_ACCESS always have a user-generated name. Other track types do not have any guarantees, might have user-generated or auto-generated names.
typestring
type
descriptionThe type of track (prod, internal, etc.).
enum
  • TRACK_TYPE_UNSPECIFIED
  • TRACK_TYPE_PROD
  • TRACK_TYPE_INTERNAL
  • TRACK_TYPE_OPEN_TESTING
  • TRACK_TYPE_CLOSED_TESTING
  • TRACK_TYPE_EARLY_ACCESS
enumDescriptions
  • Unknown
  • Production
  • Internal testing
  • Open testing
  • Closed testing
  • Early access
typestring
typeobject
ReportGroup
descriptionA group of results in an EventReport, similar to a SQL "GROUP BY" result. In any report, the group_parent field is strictly the same type for all of the groups in any collection.
idReportGroup
properties
device
$refDevice
descriptionDevice metrics group
issue
$refIssue
descriptionIssue metrics group
metrics
descriptionScalar metrics will contain a single object covering the entire interval, while time-dimensioned graphs will contain one per time grain.
items
$refIntervalMetrics
typearray
operatingSystem
$refOperatingSystem
descriptionOperating system metrics group
subgroups
descriptionAdditional nested groupings when relevant, eg by operating system and operating system version
items
$refReportGroup
typearray
variant
$refIssueVariant
descriptionIssue variant metrics group
version
$refVersion
descriptionVersion metrics group
typeobject
Storage
descriptionMobile device disk/flash usage. Not reported for all devices.
idStorage
properties
free
descriptionBytes free.
formatint64
typestring
used
descriptionBytes used.
formatint64
typestring
typeobject
Thread
descriptionAn application thread.
idThread
properties
blamed
descriptionTrue when the Crashlytics analysis has determined that the stacktrace in this thread is where the fault occurred.
typeboolean
crashAddress
descriptionThe address of the signal that caused the application to crash. Only present on crashed native threads
formatint64
typestring
crashed
descriptionTrue when the thread has crashed.
typeboolean
frames
descriptionThe frames in the thread's stacktrace.
items
$refFrame
typearray
name
descriptionThe name of the thread.
typestring
queue
descriptionThe queue on which the thread was running.
typestring
signal
descriptionThe name of the signal that caused the app to crash. Only present on crashed native threads.
typestring
signalCode
descriptionThe code of the signal that caused the app to crash. Only present on crashed native threads.
typestring
subtitle
descriptionThe subtitle of the thread.
typestring
sysThreadId
descriptionThe system id of the thread, only available for ANR threads.
formatint64
typestring
threadId
descriptionThe id of the thread, only available for ANR threads.
formatint64
typestring
threadState
descriptionOutput only. The state of the thread at the time the ANR occurred.
enum
  • STATE_UNSPECIFIED
  • THREAD_STATE_TERMINATED
  • THREAD_STATE_RUNNABLE
  • THREAD_STATE_TIMED_WAITING
  • THREAD_STATE_BLOCKED
  • THREAD_STATE_WAITING
  • THREAD_STATE_NEW
  • THREAD_STATE_NATIVE_RUNNABLE
  • THREAD_STATE_NATIVE_WAITING
enumDescriptions
  • Thread state unspecified.
  • Thread was terminated.
  • Thread was runnable.
  • Thread was waiting with a timeout.
  • Thread was blocked.
  • Thread was waiting.
  • Thread was started, yet to run anything.
  • The thread was native and we could not heuristically determine that it was was waiting, so assume it's runnable.
  • We heuristically determined that the thread is waiting.
readOnlyTrue
typestring
title
descriptionThe title of the thread.
typestring
typeobject
User
descriptionDeveloper-provided end user identifiers.
idUser
properties
id
descriptionUser id if provided by the app developer.
typestring
typeobject
Version
descriptionApplication software version.
idVersion
properties
buildVersion
descriptionOne display_version can have many build_version. On Android, strictly the same as "version code" On iOS, strictly the same as "build number" or CFBundleVersion
typestring
displayName
descriptionCompound human-readable string containing both display and build versions. Formatted like "display_version (build_version)" eg "1.2.3 (456)" This string can be used for filtering with the VersionFilter.display_name field.
typestring
displayVersion
descriptionHuman-readable version string, eg "1.2.3" On Android, strictly the same as "version name" On iOS, strictly the same as "version number" or CFBundleShortVersionString
typestring
tracks
descriptionIndicates releases which have artifacts that are currently available in the Play Store to the target audience of the track. Versions may be available in multiple tracks.
items
$refPlayTrack
typearray
typeobject
old_value
DeleteUserCrashReportsResponse
descriptionResponse message for the DeleteUserCrashReports method. All crash reports associated with the specified user will be deleted typically within 24 hours of receiving the crash report.
idDeleteUserCrashReportsResponse
properties
targetCompleteTime
descriptionTarget time to complete the delete crash reports operation.
formatgoogle-datetime
typestring
typeobject
prod/firebasedurablelinks-ipv4-pa-
values_changed
root['revision']
new_value20250310
old_value20250307
prod/firebasedurablelinks-ipv4-pa-v1
values_changed
root['revision']
new_value20250310
old_value20250307
prod/firebasedurablelinks-pa-
values_changed
root['revision']
new_value20250310
old_value20250307
prod/firebasedurablelinks-pa-v1
values_changed
root['revision']
new_value20250310
old_value20250307
prod/firebaseextensions-
values_changed
root['revision']
new_value20250312
old_value20250309
prod/firebaseextensions-v1beta
values_changed
root['revision']
new_value20250312
old_value20250309
prod/firebaseextensionspublisher-
values_changed
root['revision']
new_value20250312
old_value20250309
prod/firebaseextensionspublisher-v1beta
values_changed
root['revision']
new_value20250312
old_value20250309
prod/firebasegenaimonitoring-pa-
values_changed
root['revision']
new_value20250313
old_value20250310
prod/firebasegenaimonitoring-pa-v1
values_changed
root['revision']
new_value20250313
old_value20250310
prod/firebaseinappmessaging-pa-
values_changed
root['revision']
new_value20250310
old_value20250303
prod/firebaseinappmessaging-pa-v1
values_changed
root['revision']
new_value20250310
old_value20250303
prod/firebasemessagingcampaigns-
values_changed
root['revision']
new_value20250310
old_value20250303
prod/firebasemessagingcampaigns-v1beta
values_changed
root['revision']
new_value20250310
old_value20250303
prod/firebasereleasemon-pa-
values_changed
root['revision']
new_value20250313
old_value20250310
prod/firebasereleasemon-pa-v1
values_changed
root['revision']
new_value20250313
old_value20250310
prod/firebaseremoteconfig-pa-
values_changed
root['revision']
new_value20250312
old_value20250310
prod/firebaseremoteconfig-pa-v1
values_changed
root['revision']
new_value20250312
old_value20250310
prod/firebaseremoteconfig-pa-v2
values_changed
root['revision']
new_value20250312
old_value20250310
prod/firebaseremoteconfigrealtime-
values_changed
root['revision']
new_value20250312
old_value20250310
prod/firebaseremoteconfigrealtime-v1
values_changed
root['revision']
new_value20250312
old_value20250310
prod/firebasesagepredictions-pa-
values_changed
root['revision']
new_value20250312
old_value20250309
prod/firebasesagepredictions-pa-v1
values_changed
root['revision']
new_value20250312
old_value20250309
prod/firebasesegmentation-pa-
values_changed
root['revision']
new_value20250311
old_value20250304
prod/firebasesegmentation-pa-v1
values_changed
root['revision']
new_value20250311
old_value20250304
prod/firebasetargeting-pa-
values_changed
root['revision']
new_value20250312
old_value20250310
prod/firebasetargeting-pa-v1
values_changed
root['revision']
new_value20250312
old_value20250310
prod/fireconsole-pa-
values_changed
root['revision']
new_value20250312
old_value20250307
iterable_item_added
root['schemas']['Permission']['properties']['entityAction']['enum'][58]RECEIVE_PERFORMANCE_EMAIL
root['schemas']['Permission']['properties']['entityAction']['enumDescriptions'][58]Allows a user to receive performance emails. See go/gacs-performance-emails for details.
prod/fireconsole-pa-v1
values_changed
root['revision']
new_value20250312
old_value20250307
iterable_item_added
root['schemas']['Permission']['properties']['entityAction']['enum'][58]RECEIVE_PERFORMANCE_EMAIL
root['schemas']['Permission']['properties']['entityAction']['enumDescriptions'][58]Allows a user to receive performance emails. See go/gacs-performance-emails for details.
prod/fit-
values_changed
root['revision']
new_value20250312
old_value20250310
prod/fit-v2beta1
values_changed
root['revision']
new_value20250312
old_value20250310
prod/gcmcontextualcampaign-pa-
values_changed
root['revision']
new_value20250310
old_value20250303
prod/gcmcontextualcampaign-pa-v1
values_changed
root['revision']
new_value20250310
old_value20250303
prod/gcmcontextualcampaign-pa-v2
values_changed
root['revision']
new_value20250310
old_value20250303
prod/gdchardwaremanagement-
dictionary_item_added
  • root['schemas']['Zone']['properties']['useDualPowerSupplyUnits']
values_changed
root['revision']
new_value20250306
old_value20250227
prod/gdchardwaremanagement-v1alpha
dictionary_item_added
  • root['schemas']['Zone']['properties']['useDualPowerSupplyUnits']
values_changed
root['revision']
new_value20250306
old_value20250227
prod/generativelanguage-
values_changed
root['revision']
new_value20250313
old_value20250309
prod/generativelanguage-v1
values_changed
root['revision']
new_value20250313
old_value20250311
prod/generativelanguage-v1alpha
dictionary_item_added
  • root['schemas']['Schema']['properties']['anyOf']
  • root['schemas']['Schema']['properties']['maximum']
  • root['schemas']['Schema']['properties']['minimum']
values_changed
root['revision']
new_value20250313
old_value20250311
prod/generativelanguage-v1beta
dictionary_item_added
  • root['schemas']['Schema']['properties']['anyOf']
  • root['schemas']['Schema']['properties']['maximum']
  • root['schemas']['Schema']['properties']['minimum']
values_changed
root['revision']
new_value20250313
old_value20250309
prod/generativelanguage-v1beta1
values_changed
root['revision']
new_value20250313
old_value20250309
prod/generativelanguage-v1beta2
values_changed
root['revision']
new_value20250313
old_value20250311
prod/generativelanguage-v1beta3
values_changed
root['revision']
new_value20250313
old_value20250309
prod/geoar-
values_changed
root['revision']
new_value20250313
old_value20250309
prod/geoar-v1
values_changed
root['revision']
new_value20250313
old_value20250309
prod/geofeedtaskrouting-
values_changed
root['revision']
new_value20250312
old_value20250309
prod/geofeedtaskrouting-v1alpha
values_changed
root['revision']
new_value20250312
old_value20250309
prod/growth-pa-
values_changed
root['revision']
new_value20250311
old_value20250307
prod/growth-pa-v1
values_changed
root['revision']
new_value20250311
old_value20250307
prod/gsuiteaddons-
values_changed
root['revision']
new_value20250310
old_value20250303
prod/gsuiteaddons-v1
values_changed
root['revision']
new_value20250310
old_value20250303
prod/guidedhelp-pa-
values_changed
root['revision']
new_value20250312
old_value20250309
prod/guidedhelp-pa-v1
values_changed
root['revision']
new_value20250312
old_value20250309
prod/guts-
values_changed
root['revision']
new_value20250313
old_value20250226
prod/guts-v3
values_changed
root['revision']
new_value20250313
old_value20250226
prod/hangouts-
values_changed
root['revision']
new_value20250310
old_value20250304
prod/hangouts-v1
values_changed
root['revision']
new_value20250310
old_value20250304
prod/hourly-dynamicmail-pa.sandbox-
values_changed
root['revision']
new_value20250314
old_value20250311
prod/hourly-dynamicmail-pa.sandbox-v2
values_changed
root['revision']
new_value20250314
old_value20250311
prod/ipprotection-ppissuer-
values_changed
root['revision']
new_value20250313
old_value20250310
prod/ipprotection-ppissuer-v1
values_changed
root['revision']
new_value20250313
old_value20250310
prod/jibemessagestore-
values_changed
root['revision']
new_value20250311
old_value20250304
prod/jibemessagestore-v1
values_changed
root['revision']
new_value20250311
old_value20250304
prod/keep-pa-
dictionary_item_added
  • root['schemas']['GetNoteInfoResponse']['properties']['type']['enumDeprecated']
  • root['schemas']['Note']['properties']['quillNote']['deprecated']
values_changed
root['revision']
new_value20250304
old_value20250207
root['schemas']['Note']['properties']['quillNote']['description']
new_valueA quillNote is a note with an empty message.
old_valueA quillNote is a note with an empty message.
prod/keep-pa-v1
dictionary_item_added
  • root['schemas']['GetNoteInfoResponse']['properties']['type']['enumDeprecated']
  • root['schemas']['Note']['properties']['quillNote']['deprecated']
values_changed
root['revision']
new_value20250304
old_value20250207
root['schemas']['Note']['properties']['quillNote']['description']
new_valueA quillNote is a note with an empty message.
old_valueA quillNote is a note with an empty message.
prod/kidsmanagement-pa-
values_changed
root['revision']
new_value20250311
old_value20250310
prod/kidsmanagement-pa-v1
values_changed
root['revision']
new_value20250311
old_value20250310
prod/kidsnotification-pa-
values_changed
root['revision']
new_value20250312
old_value20250310
prod/kidsnotification-pa-v1
values_changed
root['revision']
new_value20250312
old_value20250310
prod/krmapihosting-
values_changed
root['revision']
new_value20250305
old_value20250219
prod/krmapihosting-v1
values_changed
root['revision']
new_value20250305
old_value20250219
prod/krmapihosting-v1alpha1
values_changed
root['revision']
new_value20250305
old_value20250219
prod/legalproductions-pa-
values_changed
root['revision']
new_value20250312
old_value20250309
prod/legalproductions-pa-v1
values_changed
root['revision']
new_value20250312
old_value20250309
prod/linkauthorization-
values_changed
root['revision']
new_value20250312
old_value20250307
prod/linkauthorization-v1
values_changed
root['revision']
new_value20250312
old_value20250307
prod/localservicespartner-
values_changed
root['revision']
new_value20250312
old_value20250309
prod/localservicespartner-v1beta1
values_changed
root['revision']
new_value20250312
old_value20250309
prod/lookerstudio-pa-
dictionary_item_added
  • root['resources']['c']['resources']['v1']['resources']['firstparty']['methods']['deleteLasikSuite']
  • root['resources']['c']['resources']['v1']['resources']['firstparty']['resources']['createLasikRun']
  • root['resources']['firstparty']['methods']['deleteLasikSuite']
  • root['resources']['firstparty']['resources']['createLasikRun']
  • root['schemas']['CreateLasikRunRequest']
  • root['schemas']['CreateLasikRunResponse']
  • root['schemas']['DeleteLasikSuiteRequest']
  • root['schemas']['DeleteLasikSuiteResponse']
  • root['schemas']['WebHook']
values_changed
root['revision']
new_value20250311
old_value20250302
root['resources']['firstparty']['resources']['assets']['methods']['search']['parameters']['orderBy.fieldName']['enumDescriptions'][8]
new_valueOrder by id of assets.
old_valueOrder by name of assets.
root['resources']['firstparty']['resources']['assets']['methods']['search']['parameters']['orderBy.fieldName']['enum'][8]
new_valueCATEGORY_ID
old_valueCATEGORY_NAME
root['resources']['c']['resources']['v1']['resources']['firstparty']['resources']['assets']['methods']['search']['parameters']['orderBy.fieldName']['enumDescriptions'][8]
new_valueOrder by id of assets.
old_valueOrder by name of assets.
root['resources']['c']['resources']['v1']['resources']['firstparty']['resources']['assets']['methods']['search']['parameters']['orderBy.fieldName']['enum'][8]
new_valueCATEGORY_ID
old_valueCATEGORY_NAME
prod/lookerstudio-pa-v1
dictionary_item_added
  • root['resources']['c']['resources']['v1']['resources']['firstparty']['methods']['deleteLasikSuite']
  • root['resources']['c']['resources']['v1']['resources']['firstparty']['resources']['createLasikRun']
  • root['resources']['firstparty']['methods']['deleteLasikSuite']
  • root['resources']['firstparty']['resources']['createLasikRun']
  • root['schemas']['CreateLasikRunRequest']
  • root['schemas']['CreateLasikRunResponse']
  • root['schemas']['DeleteLasikSuiteRequest']
  • root['schemas']['DeleteLasikSuiteResponse']
  • root['schemas']['WebHook']
values_changed
root['revision']
new_value20250311
old_value20250302
root['resources']['firstparty']['resources']['assets']['methods']['search']['parameters']['orderBy.fieldName']['enumDescriptions'][8]
new_valueOrder by id of assets.
old_valueOrder by name of assets.
root['resources']['firstparty']['resources']['assets']['methods']['search']['parameters']['orderBy.fieldName']['enum'][8]
new_valueCATEGORY_ID
old_valueCATEGORY_NAME
root['resources']['c']['resources']['v1']['resources']['firstparty']['resources']['assets']['methods']['search']['parameters']['orderBy.fieldName']['enumDescriptions'][8]
new_valueOrder by id of assets.
old_valueOrder by name of assets.
root['resources']['c']['resources']['v1']['resources']['firstparty']['resources']['assets']['methods']['search']['parameters']['orderBy.fieldName']['enum'][8]
new_valueCATEGORY_ID
old_valueCATEGORY_NAME
prod/mapsplatformdatasets-
values_changed
root['revision']
new_value20250312
old_value20250309
prod/mapsplatformdatasets-v1
values_changed
root['revision']
new_value20250312
old_value20250309
prod/mapsplatformdatasets-v1alpha
values_changed
root['revision']
new_value20250312
old_value20250309
prod/media3p-
values_changed
root['revision']
new_value20250312
old_value20250309
prod/media3p-v1
values_changed
root['revision']
new_value20250312
old_value20250309
prod/memorystore-
dictionary_item_added
  • root['resources']['projects']['resources']['locations']['resources']['instances']['methods']['rescheduleMaintenance']
  • root['schemas']['CrossInstanceReplicationConfig']
  • root['schemas']['MaintenancePolicy']
  • root['schemas']['MaintenanceSchedule']
  • root['schemas']['Membership']
  • root['schemas']['RemoteInstance']
  • root['schemas']['RescheduleMaintenanceRequest']
  • root['schemas']['TimeOfDay']
  • root['schemas']['WeeklyMaintenanceWindow']
  • root['schemas']['Instance']['properties']['crossInstanceReplicationConfig']
  • root['schemas']['Instance']['properties']['maintenancePolicy']
  • root['schemas']['Instance']['properties']['maintenanceSchedule']
  • root['schemas']['Instance']['properties']['ondemandMaintenance']
dictionary_item_removed
  • root['schemas']['BillingView']
  • root['schemas']['Exemplar']
  • root['schemas']['GoogleApiServicecontrolV1AttributeValue']
  • root['schemas']['GoogleApiServicecontrolV1Attributes']
  • root['schemas']['GoogleApiServicecontrolV1Distribution']
  • root['schemas']['GoogleApiServicecontrolV1ExplicitBuckets']
  • root['schemas']['GoogleApiServicecontrolV1ExponentialBuckets']
  • root['schemas']['GoogleApiServicecontrolV1HttpRequest']
  • root['schemas']['GoogleApiServicecontrolV1LinearBuckets']
  • root['schemas']['GoogleApiServicecontrolV1LogEntry']
  • root['schemas']['GoogleApiServicecontrolV1LogEntryOperation']
  • root['schemas']['GoogleApiServicecontrolV1LogEntrySourceLocation']
  • root['schemas']['GoogleApiServicecontrolV1MetricValue']
  • root['schemas']['GoogleApiServicecontrolV1MetricValueSet']
  • root['schemas']['GoogleApiServicecontrolV1Operation']
  • root['schemas']['GoogleApiServicecontrolV1QuotaProperties']
  • root['schemas']['GoogleApiServicecontrolV1ReportRequest']
  • root['schemas']['GoogleApiServicecontrolV1ResourceInfo']
  • root['schemas']['GoogleApiServicecontrolV1TraceSpan']
  • root['schemas']['GoogleApiServicecontrolV1TruncatableString']
  • root['schemas']['Money']
values_changed
root['revision']
new_value20250307
old_value20250220
root['schemas']['Instance']['properties']['engineVersion']['description']
new_valueOptional. Engine version of the instance.
old_valueOptional. Immutable. Engine version of the instance.
root['schemas']['Instance']['properties']['nodeType']['description']
new_valueOptional. Machine type for individual nodes of the instance.
old_valueOptional. Immutable. Machine type for individual nodes of the instance.
prod/memorystore-v1
dictionary_item_added
  • root['resources']['projects']['resources']['locations']['resources']['instances']['methods']['rescheduleMaintenance']
  • root['schemas']['CrossInstanceReplicationConfig']
  • root['schemas']['MaintenancePolicy']
  • root['schemas']['MaintenanceSchedule']
  • root['schemas']['Membership']
  • root['schemas']['RemoteInstance']
  • root['schemas']['RescheduleMaintenanceRequest']
  • root['schemas']['TimeOfDay']
  • root['schemas']['WeeklyMaintenanceWindow']
  • root['schemas']['Instance']['properties']['crossInstanceReplicationConfig']
  • root['schemas']['Instance']['properties']['maintenancePolicy']
  • root['schemas']['Instance']['properties']['maintenanceSchedule']
  • root['schemas']['Instance']['properties']['ondemandMaintenance']
dictionary_item_removed
  • root['schemas']['BillingView']
  • root['schemas']['Exemplar']
  • root['schemas']['GoogleApiServicecontrolV1AttributeValue']
  • root['schemas']['GoogleApiServicecontrolV1Attributes']
  • root['schemas']['GoogleApiServicecontrolV1Distribution']
  • root['schemas']['GoogleApiServicecontrolV1ExplicitBuckets']
  • root['schemas']['GoogleApiServicecontrolV1ExponentialBuckets']
  • root['schemas']['GoogleApiServicecontrolV1HttpRequest']
  • root['schemas']['GoogleApiServicecontrolV1LinearBuckets']
  • root['schemas']['GoogleApiServicecontrolV1LogEntry']
  • root['schemas']['GoogleApiServicecontrolV1LogEntryOperation']
  • root['schemas']['GoogleApiServicecontrolV1LogEntrySourceLocation']
  • root['schemas']['GoogleApiServicecontrolV1MetricValue']
  • root['schemas']['GoogleApiServicecontrolV1MetricValueSet']
  • root['schemas']['GoogleApiServicecontrolV1Operation']
  • root['schemas']['GoogleApiServicecontrolV1QuotaProperties']
  • root['schemas']['GoogleApiServicecontrolV1ReportRequest']
  • root['schemas']['GoogleApiServicecontrolV1ResourceInfo']
  • root['schemas']['GoogleApiServicecontrolV1TraceSpan']
  • root['schemas']['GoogleApiServicecontrolV1TruncatableString']
  • root['schemas']['Money']
values_changed
root['revision']
new_value20250307
old_value20250220
root['schemas']['Instance']['properties']['engineVersion']['description']
new_valueOptional. Engine version of the instance.
old_valueOptional. Immutable. Engine version of the instance.
root['schemas']['Instance']['properties']['nodeType']['description']
new_valueOptional. Machine type for individual nodes of the instance.
old_valueOptional. Immutable. Machine type for individual nodes of the instance.
prod/memorystore-v1alpha
dictionary_item_added
  • root['resources']['projects']['resources']['locations']['resources']['instances']['methods']['rescheduleMaintenance']
  • root['schemas']['CrossInstanceReplicationConfig']
  • root['schemas']['MaintenancePolicy']
  • root['schemas']['MaintenanceSchedule']
  • root['schemas']['Membership']
  • root['schemas']['RemoteInstance']
  • root['schemas']['RescheduleMaintenanceRequest']
  • root['schemas']['TimeOfDay']
  • root['schemas']['WeeklyMaintenanceWindow']
  • root['schemas']['Instance']['properties']['crossInstanceReplicationConfig']
  • root['schemas']['Instance']['properties']['maintenancePolicy']
  • root['schemas']['Instance']['properties']['maintenanceSchedule']
  • root['schemas']['Instance']['properties']['ondemandMaintenance']
dictionary_item_removed
  • root['schemas']['BillingView']
  • root['schemas']['Exemplar']
  • root['schemas']['GoogleApiServicecontrolV1AttributeValue']
  • root['schemas']['GoogleApiServicecontrolV1Attributes']
  • root['schemas']['GoogleApiServicecontrolV1Distribution']
  • root['schemas']['GoogleApiServicecontrolV1ExplicitBuckets']
  • root['schemas']['GoogleApiServicecontrolV1ExponentialBuckets']
  • root['schemas']['GoogleApiServicecontrolV1HttpRequest']
  • root['schemas']['GoogleApiServicecontrolV1LinearBuckets']
  • root['schemas']['GoogleApiServicecontrolV1LogEntry']
  • root['schemas']['GoogleApiServicecontrolV1LogEntryOperation']
  • root['schemas']['GoogleApiServicecontrolV1LogEntrySourceLocation']
  • root['schemas']['GoogleApiServicecontrolV1MetricValue']
  • root['schemas']['GoogleApiServicecontrolV1MetricValueSet']
  • root['schemas']['GoogleApiServicecontrolV1Operation']
  • root['schemas']['GoogleApiServicecontrolV1QuotaProperties']
  • root['schemas']['GoogleApiServicecontrolV1ReportRequest']
  • root['schemas']['GoogleApiServicecontrolV1ResourceInfo']
  • root['schemas']['GoogleApiServicecontrolV1TraceSpan']
  • root['schemas']['GoogleApiServicecontrolV1TruncatableString']
  • root['schemas']['Money']
values_changed
root['revision']
new_value20250307
old_value20250220
root['schemas']['Instance']['properties']['engineVersion']['description']
new_valueOptional. Engine version of the instance.
old_valueOptional. Immutable. Engine version of the instance.
root['schemas']['Instance']['properties']['nodeType']['description']
new_valueOptional. Machine type for individual nodes of the instance.
old_valueOptional. Immutable. Machine type for individual nodes of the instance.
prod/memorystore-v1beta
dictionary_item_added
  • root['resources']['projects']['resources']['locations']['resources']['instances']['methods']['rescheduleMaintenance']
  • root['schemas']['CrossInstanceReplicationConfig']
  • root['schemas']['MaintenancePolicy']
  • root['schemas']['MaintenanceSchedule']
  • root['schemas']['Membership']
  • root['schemas']['RemoteInstance']
  • root['schemas']['RescheduleMaintenanceRequest']
  • root['schemas']['TimeOfDay']
  • root['schemas']['WeeklyMaintenanceWindow']
  • root['schemas']['Instance']['properties']['crossInstanceReplicationConfig']
  • root['schemas']['Instance']['properties']['maintenancePolicy']
  • root['schemas']['Instance']['properties']['maintenanceSchedule']
  • root['schemas']['Instance']['properties']['ondemandMaintenance']
dictionary_item_removed
  • root['schemas']['BillingView']
  • root['schemas']['Exemplar']
  • root['schemas']['GoogleApiServicecontrolV1AttributeValue']
  • root['schemas']['GoogleApiServicecontrolV1Attributes']
  • root['schemas']['GoogleApiServicecontrolV1Distribution']
  • root['schemas']['GoogleApiServicecontrolV1ExplicitBuckets']
  • root['schemas']['GoogleApiServicecontrolV1ExponentialBuckets']
  • root['schemas']['GoogleApiServicecontrolV1HttpRequest']
  • root['schemas']['GoogleApiServicecontrolV1LinearBuckets']
  • root['schemas']['GoogleApiServicecontrolV1LogEntry']
  • root['schemas']['GoogleApiServicecontrolV1LogEntryOperation']
  • root['schemas']['GoogleApiServicecontrolV1LogEntrySourceLocation']
  • root['schemas']['GoogleApiServicecontrolV1MetricValue']
  • root['schemas']['GoogleApiServicecontrolV1MetricValueSet']
  • root['schemas']['GoogleApiServicecontrolV1Operation']
  • root['schemas']['GoogleApiServicecontrolV1QuotaProperties']
  • root['schemas']['GoogleApiServicecontrolV1ReportRequest']
  • root['schemas']['GoogleApiServicecontrolV1ResourceInfo']
  • root['schemas']['GoogleApiServicecontrolV1TraceSpan']
  • root['schemas']['GoogleApiServicecontrolV1TruncatableString']
  • root['schemas']['Money']
values_changed
root['revision']
new_value20250307
old_value20250220
root['schemas']['Instance']['properties']['engineVersion']['description']
new_valueOptional. Engine version of the instance.
old_valueOptional. Immutable. Engine version of the instance.
root['schemas']['Instance']['properties']['nodeType']['description']
new_valueOptional. Machine type for individual nodes of the instance.
old_valueOptional. Immutable. Machine type for individual nodes of the instance.
prod/meshca-
values_changed
root['revision']
new_value20250307
old_value20250228
prod/meshca-v1
values_changed
root['revision']
new_value20250307
old_value20250228
prod/mlkit-
values_changed
root['revision']
new_value20250312
old_value20250309
prod/mlkit-pa-
values_changed
root['revision']
new_value20250312
old_value20250309
prod/mlkit-pa-v1
values_changed
root['revision']
new_value20250312
old_value20250309
prod/mlkit-v1
values_changed
root['revision']
new_value20250312
old_value20250309
prod/mlkit-v1beta1
values_changed
root['revision']
new_value20250312
old_value20250309
prod/mobilemlaccelerationcompatibility-
values_changed
root['revision']
new_value20250312
old_value20250309
prod/mobilemlaccelerationcompatibility-v1
values_changed
root['revision']
new_value20250312
old_value20250309
prod/mobileperformancereporting-pa-
values_changed
root['revision']
new_value20250312
old_value20250309
prod/mobileperformancereporting-pa-v1
values_changed
root['revision']
new_value20250312
old_value20250309
prod/mobilesdk-pa-
values_changed
root['revision']
new_value20250312
old_value20250307
prod/mobilesdk-pa-v1
values_changed
root['revision']
new_value20250312
old_value20250307
prod/modelarmor-
dictionary_item_added
  • root['schemas']['FilterResult']['properties']['csamFilterFilterResult']
dictionary_item_removed
  • root['schemas']['FilterResult']['properties']['csamFilterResult']
values_changed
root['revision']
new_value20250305
old_value20250226
prod/modelarmor-v1
dictionary_item_added
  • root['schemas']['FilterResult']['properties']['csamFilterFilterResult']
dictionary_item_removed
  • root['schemas']['FilterResult']['properties']['csamFilterResult']
values_changed
root['revision']
new_value20250305
old_value20250226
prod/modelarmor-v1alpha
dictionary_item_added
  • root['schemas']['FilterResult']['properties']['csamFilterFilterResult']
dictionary_item_removed
  • root['schemas']['FilterResult']['properties']['csamFilterResult']
values_changed
root['revision']
new_value20250305
old_value20250226
prod/monospace-pa-
dictionary_item_added
  • root['resources']['billingaccounts']
  • root['resources']['projects']
  • root['schemas']['BillingAccount']
  • root['schemas']['ListBillingAccountsResponse']
  • root['schemas']['ModalityTokenCount']
  • root['schemas']['ProjectBillingInfo']
  • root['schemas']['UsageMetadata']
  • root['schemas']['GeminiGenerateContentResponse']['properties']['usageMetadata']
values_changed
root['revision']
new_value20250313
old_value20250309
prod/monospace-pa-v1
dictionary_item_added
  • root['resources']['billingaccounts']
  • root['resources']['projects']
  • root['schemas']['BillingAccount']
  • root['schemas']['ListBillingAccountsResponse']
  • root['schemas']['ModalityTokenCount']
  • root['schemas']['ProjectBillingInfo']
  • root['schemas']['UsageMetadata']
  • root['schemas']['GeminiGenerateContentResponse']['properties']['usageMetadata']
values_changed
root['revision']
new_value20250313
old_value20250309
prod/moviesanywhere-
values_changed
root['revision']
new_value20250310
old_value20250203
prod/moviesanywhere-v1
values_changed
root['revision']
new_value20250310
old_value20250203
prod/myphonenumbers-pa-
values_changed
root['revision']
new_value20250311
old_value20250304
prod/myphonenumbers-pa-v1
values_changed
root['revision']
new_value20250311
old_value20250304
prod/networkbuildingblocks-pa-
values_changed
root['revision']
new_value20250313
old_value20250310
prod/networkbuildingblocks-pa-v1beta1
values_changed
root['revision']
new_value20250313
old_value20250310
prod/northamerica-northeast1-connectgateway-
values_changed
root['revision']
new_value20250310
old_value20250303
prod/northamerica-northeast1-connectgateway-v1
values_changed
root['revision']
new_value20250310
old_value20250303
prod/northamerica-northeast1-connectgateway-v1beta1
values_changed
root['revision']
new_value20250310
old_value20250303
prod/northamerica-northeast1-containerfilesystem-
values_changed
root['revision']
new_value20250307
old_value20250221
prod/northamerica-northeast1-containerfilesystem-v1
values_changed
root['revision']
new_value20250307
old_value20250221
prod/northamerica-northeast2-connectgateway-
values_changed
root['revision']
new_value20250310
old_value20250303
prod/northamerica-northeast2-connectgateway-v1
values_changed
root['revision']
new_value20250310
old_value20250303
prod/northamerica-northeast2-connectgateway-v1beta1
values_changed
root['revision']
new_value20250310
old_value20250303
prod/northamerica-northeast2-dataproccontrol-
values_changed
root['revision']
new_value20250311
old_value20250306
prod/northamerica-northeast2-dataproccontrol-v1
values_changed
root['revision']
new_value20250311
old_value20250306
prod/notes-pa-
dictionary_item_added
  • root['schemas']['DownSync']['properties']['derivedNoteAttributes']['deprecated']
  • root['schemas']['DownSync']['properties']['derivedNoteAttributes']['description']
  • root['schemas']['DownSyncWriteResult']['properties']['missingEmbeddedImages']['deprecated']
  • root['schemas']['DownSyncWriteResult']['properties']['status']['enumDeprecated']
  • root['schemas']['Node']['properties']['clientChanges']['properties']['commandMetadata']['properties']['imageIdMap']['deprecated']
  • root['schemas']['Node']['properties']['serverChanges']['properties']['images']['deprecated']
  • root['schemas']['UpSync']['properties']['requestHeader']['properties']['modelOptions']['properties']['note']['properties']['commandEncoding']['deprecated']
  • root['schemas']['UpSync']['properties']['requestHeader']['properties']['modelOptions']['properties']['quill']['deprecated']
  • root['schemas']['UpSync']['properties']['requestHeader']['properties']['modelOptions']['properties']['quill']['properties']['commandEncoding']['deprecated']
values_changed
root['revision']
new_value20250304
old_value20250210
root['schemas']['DownSyncWriteResult']['properties']['missingEmbeddedImages']['description']
new_valueThe embedded images referenced by the uploaded commands for which the corresponding data was not found by the server. Clients are expected to re-upload these images before issuing a new sync request.
old_valueThe embedded images referenced by the uploaded commands for which the corresponding data was not found by the server. Clients are expected to re-upload these images before issuing a new sync request. This field is only populated when the status is set to MISSING_EMBEDDED_IMAGE.
root['schemas']['Node']['properties']['clientChanges']['properties']['commandMetadata']['properties']['imageIdMap']['description']
new_valueFor images referenced by the model, maps images' client IDs to server IDs.
old_valueFor images referenced by the model, maps images' client IDs to server IDs.
root['schemas']['Node']['properties']['serverChanges']['properties']['images']['description']
new_valueMetadata on images referenced by the model.
old_valueMetadata on images referenced by the model. This will include all images upon initial sync (no changes) and only images referenced by changes when changes exist.
root['schemas']['DownSyncWriteResult']['properties']['status']['enumDescriptions'][2]
new_valueThe uploaded commands refer to embedded images that have not yet been uploaded. Clients are expected to recover from this error by re-uploading the image before issuing a new sync request.
old_valueThe uploaded commands refer to embedded images that have not yet been uploaded. Clients are expected to recover from this error by re-uploading the image before issuing a new sync request.
prod/notes-pa-v1
dictionary_item_added
  • root['schemas']['DownSync']['properties']['derivedNoteAttributes']['deprecated']
  • root['schemas']['DownSync']['properties']['derivedNoteAttributes']['description']
  • root['schemas']['DownSyncWriteResult']['properties']['missingEmbeddedImages']['deprecated']
  • root['schemas']['DownSyncWriteResult']['properties']['status']['enumDeprecated']
  • root['schemas']['Node']['properties']['clientChanges']['properties']['commandMetadata']['properties']['imageIdMap']['deprecated']
  • root['schemas']['Node']['properties']['serverChanges']['properties']['images']['deprecated']
  • root['schemas']['UpSync']['properties']['requestHeader']['properties']['modelOptions']['properties']['note']['properties']['commandEncoding']['deprecated']
  • root['schemas']['UpSync']['properties']['requestHeader']['properties']['modelOptions']['properties']['quill']['deprecated']
  • root['schemas']['UpSync']['properties']['requestHeader']['properties']['modelOptions']['properties']['quill']['properties']['commandEncoding']['deprecated']
values_changed
root['revision']
new_value20250304
old_value20250210
root['schemas']['DownSyncWriteResult']['properties']['missingEmbeddedImages']['description']
new_valueThe embedded images referenced by the uploaded commands for which the corresponding data was not found by the server. Clients are expected to re-upload these images before issuing a new sync request.
old_valueThe embedded images referenced by the uploaded commands for which the corresponding data was not found by the server. Clients are expected to re-upload these images before issuing a new sync request. This field is only populated when the status is set to MISSING_EMBEDDED_IMAGE.
root['schemas']['Node']['properties']['clientChanges']['properties']['commandMetadata']['properties']['imageIdMap']['description']
new_valueFor images referenced by the model, maps images' client IDs to server IDs.
old_valueFor images referenced by the model, maps images' client IDs to server IDs.
root['schemas']['Node']['properties']['serverChanges']['properties']['images']['description']
new_valueMetadata on images referenced by the model.
old_valueMetadata on images referenced by the model. This will include all images upon initial sync (no changes) and only images referenced by changes when changes exist.
root['schemas']['DownSyncWriteResult']['properties']['status']['enumDescriptions'][2]
new_valueThe uploaded commands refer to embedded images that have not yet been uploaded. Clients are expected to recover from this error by re-uploading the image before issuing a new sync request.
old_valueThe uploaded commands refer to embedded images that have not yet been uploaded. Clients are expected to recover from this error by re-uploading the image before issuing a new sync request.
prod/notifications-pa-
dictionary_item_added
  • root['schemas']['WalletGooglepayCommon__AddHealthCardTarget']
  • root['schemas']['CommunicationPusherProto__AndroidDevicePayload']['properties']['fcmToken']
  • root['schemas']['GoogleInternalTapandpayV1PassesTemplates__AddContentData']['properties']['isPreviousAmount']
  • root['schemas']['GoogleLogsTapandpayAndroid_ClosedLoopEvent_TopupMetadata']['properties']['amountSelected']['deprecated']
  • root['schemas']['GoogleLogsTapandpayAndroid_ClosedLoopEvent_TopupMetadata']['properties']['amountSelected']['description']
  • root['schemas']['NotificationsFrontendDataCommon__SupportedFeatures']['properties']['standaloneInboxSupported']
  • root['schemas']['NotificationsFrontendData_RenderContextDeviceInfo_WebContext']['properties']['webHostOperatingSystem']
  • root['schemas']['NotificationsFrontendData_RenderContextDeviceInfo_WebContext']['properties']['webHostOperatingSystemVersion']
  • root['schemas']['WalletGooglepayCommon__NavigationTarget']['properties']['addHealthCard']
dictionary_item_removed
  • root['schemas']['Sidekick__InlineVideo']
  • root['schemas']['Sidekick__SmallContentModule']['properties']['inlineVideo']
values_changed
root['revision']
new_value20250311
old_value20250309
root['schemas']['WalletGooglepayCommon__NavigationTarget']['description']
new_valueThe target to navigate to. A target should be a pure navigation target. I.e. the target should not represent an action to be taken (besides navigation). Next id: 75
old_valueThe target to navigate to. A target should be a pure navigation target. I.e. the target should not represent an action to be taken (besides navigation). Next id: 74
iterable_item_added
root['schemas']['CommunicationPusherProto__AndroidDevicePayload']['properties']['notificationFeatures']['items']['enum'][3]DIRECT_FCM_DELIVERY
root['schemas']['CommunicationPusherProto__AndroidDevicePayload']['properties']['notificationFeatures']['items']['enumDescriptions'][3]Client supports receiving direct FCM delivery. This bypasses a lot of the Chime latencies.
root['schemas']['SearchNotificationsClientCommon__InboxChimeData']['properties']['category']['enum'][56]GOOGLY_NOTIF
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enum'][438]CONTENT_EXPLORATION_WEB
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enumDescriptions'][438]For exploring web content, as part of the Discover Exploration project. go/discover-exploration-dd.
root['schemas']['Sidekick__SemanticProperties']['properties']['notificationCategory']['enum'][56]GOOGLY_NOTIF
prod/notifications-pa-v1
dictionary_item_added
  • root['schemas']['WalletGooglepayCommon__AddHealthCardTarget']
  • root['schemas']['CommunicationPusherProto__AndroidDevicePayload']['properties']['fcmToken']
  • root['schemas']['GoogleInternalTapandpayV1PassesTemplates__AddContentData']['properties']['isPreviousAmount']
  • root['schemas']['GoogleLogsTapandpayAndroid_ClosedLoopEvent_TopupMetadata']['properties']['amountSelected']['deprecated']
  • root['schemas']['GoogleLogsTapandpayAndroid_ClosedLoopEvent_TopupMetadata']['properties']['amountSelected']['description']
  • root['schemas']['NotificationsFrontendDataCommon__SupportedFeatures']['properties']['standaloneInboxSupported']
  • root['schemas']['NotificationsFrontendData_RenderContextDeviceInfo_WebContext']['properties']['webHostOperatingSystem']
  • root['schemas']['NotificationsFrontendData_RenderContextDeviceInfo_WebContext']['properties']['webHostOperatingSystemVersion']
  • root['schemas']['WalletGooglepayCommon__NavigationTarget']['properties']['addHealthCard']
dictionary_item_removed
  • root['schemas']['Sidekick__InlineVideo']
  • root['schemas']['Sidekick__SmallContentModule']['properties']['inlineVideo']
values_changed
root['revision']
new_value20250311
old_value20250309
root['schemas']['WalletGooglepayCommon__NavigationTarget']['description']
new_valueThe target to navigate to. A target should be a pure navigation target. I.e. the target should not represent an action to be taken (besides navigation). Next id: 75
old_valueThe target to navigate to. A target should be a pure navigation target. I.e. the target should not represent an action to be taken (besides navigation). Next id: 74
iterable_item_added
root['schemas']['CommunicationPusherProto__AndroidDevicePayload']['properties']['notificationFeatures']['items']['enum'][3]DIRECT_FCM_DELIVERY
root['schemas']['CommunicationPusherProto__AndroidDevicePayload']['properties']['notificationFeatures']['items']['enumDescriptions'][3]Client supports receiving direct FCM delivery. This bypasses a lot of the Chime latencies.
root['schemas']['SearchNotificationsClientCommon__InboxChimeData']['properties']['category']['enum'][56]GOOGLY_NOTIF
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enum'][438]CONTENT_EXPLORATION_WEB
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enumDescriptions'][438]For exploring web content, as part of the Discover Exploration project. go/discover-exploration-dd.
root['schemas']['Sidekick__SemanticProperties']['properties']['notificationCategory']['enum'][56]GOOGLY_NOTIF
prod/ogads-pa-
values_changed
root['revision']
new_value20250302
old_value20250309
iterable_item_removed
root['resources']['v1']['methods']['getdata']['parameters']['hostProduct']['enum'][719]CUSTOMER_ENGAGEMENT_AI
root['resources']['v1']['methods']['getdata']['parameters']['hostProduct']['enumDescriptions'][719]go/connect-ai-agent
root['resources']['v1']['methods']['getdata']['parameters']['subproduct']['enum'][719]CUSTOMER_ENGAGEMENT_AI
root['resources']['v1']['methods']['getdata']['parameters']['subproduct']['enumDescriptions'][719]go/connect-ai-agent
prod/ogads-pa-v1
values_changed
root['revision']
new_value20250302
old_value20250309
iterable_item_removed
root['resources']['v1']['methods']['getdata']['parameters']['hostProduct']['enum'][719]CUSTOMER_ENGAGEMENT_AI
root['resources']['v1']['methods']['getdata']['parameters']['hostProduct']['enumDescriptions'][719]go/connect-ai-agent
root['resources']['v1']['methods']['getdata']['parameters']['subproduct']['enum'][719]CUSTOMER_ENGAGEMENT_AI
root['resources']['v1']['methods']['getdata']['parameters']['subproduct']['enumDescriptions'][719]go/connect-ai-agent
prod/opengallery-
values_changed
root['revision']
new_value20250311
old_value20250303
prod/opengallery-v1
values_changed
root['revision']
new_value20250311
old_value20250303
prod/opengallery-v1beta1
values_changed
root['revision']
new_value20250311
old_value20250303
prod/orglifecycle-
values_changed
root['revision']
new_value20250305
old_value20250226
prod/orglifecycle-v1
values_changed
root['revision']
new_value20250305
old_value20250226
prod/paisadatamixer-pa-
values_changed
root['revision']
new_value20250310
old_value20250303
prod/paisadatamixer-pa-v1
values_changed
root['revision']
new_value20250310
old_value20250303
prod/partners-pa-
values_changed
root['revision']
new_value20250311
old_value20250305
prod/partners-pa-v1
values_changed
root['revision']
new_value20250311
old_value20250305
prod/partners-pa-v2
values_changed
root['revision']
new_value20250311
old_value20250305
prod/peoplestack-pa-
values_changed
root['revision']
new_value20250312
old_value20250305
iterable_item_added
root['resources']['autocomplete']['methods']['autocomplete']['parameters']['affinityType']['enum'][310]POLARIS_AFFINITY
root['resources']['autocomplete']['methods']['warmup']['parameters']['affinityType']['enum'][310]POLARIS_AFFINITY
root['schemas']['PeoplestackAutocompleteRequest']['properties']['affinityType']['enum'][310]POLARIS_AFFINITY
root['schemas']['PeoplestackBlockPersonRequest']['properties']['affinityType']['enum'][310]POLARIS_AFFINITY
root['schemas']['PeoplestackCreateGroupRequest']['properties']['affinityType']['enum'][310]POLARIS_AFFINITY
root['schemas']['PeoplestackCreateGroupRequest']['properties']['product']['enum'][13]PRODUCT_UNIVERSAL_SAVES
root['schemas']['PeoplestackDeleteGroupsRequest']['properties']['affinityType']['enum'][310]POLARIS_AFFINITY
root['schemas']['PeoplestackFlexorgsProtoInternalExternal']['properties']['application']['enum'][455]POLARIS
root['schemas']['PeoplestackFlexorgsProtoInternalExternal']['properties']['application']['enumDescriptions'][455]Polaris Team contact: gcs-nexus@google.com
root['schemas']['PeoplestackJoinGroupRequest']['properties']['affinityType']['enum'][310]POLARIS_AFFINITY
root['schemas']['PeoplestackLeaveGroupRequest']['properties']['affinityType']['enum'][310]POLARIS_AFFINITY
root['schemas']['PeoplestackLookupRequest']['properties']['affinityType']['enum'][310]POLARIS_AFFINITY
root['schemas']['PeoplestackMutateConnectionLabelRequest']['properties']['affinityType']['enum'][310]POLARIS_AFFINITY
root['schemas']['PeoplestackReadAllGroupsRequest']['properties']['affinityType']['enum'][310]POLARIS_AFFINITY
root['schemas']['PeoplestackReadGroupsRequest']['properties']['affinityType']['enum'][310]POLARIS_AFFINITY
root['schemas']['PeoplestackSmartAddressRequest']['properties']['affinityType']['enum'][310]POLARIS_AFFINITY
root['schemas']['PeoplestackUpdateGroupRequest']['properties']['affinityType']['enum'][310]POLARIS_AFFINITY
root['schemas']['PeoplestackWarmupRequest']['properties']['affinityType']['enum'][310]POLARIS_AFFINITY
root['schemas']['SocialClientsApplicationProto3Wrapper']['properties']['application']['enum'][455]POLARIS
root['schemas']['SocialClientsApplicationProto3Wrapper']['properties']['application']['enumDescriptions'][455]Polaris Team contact: gcs-nexus@google.com
prod/peoplestack-pa-v1
values_changed
root['revision']
new_value20250312
old_value20250305
iterable_item_added
root['resources']['autocomplete']['methods']['autocomplete']['parameters']['affinityType']['enum'][310]POLARIS_AFFINITY
root['resources']['autocomplete']['methods']['warmup']['parameters']['affinityType']['enum'][310]POLARIS_AFFINITY
root['schemas']['PeoplestackAutocompleteRequest']['properties']['affinityType']['enum'][310]POLARIS_AFFINITY
root['schemas']['PeoplestackBlockPersonRequest']['properties']['affinityType']['enum'][310]POLARIS_AFFINITY
root['schemas']['PeoplestackCreateGroupRequest']['properties']['affinityType']['enum'][310]POLARIS_AFFINITY
root['schemas']['PeoplestackCreateGroupRequest']['properties']['product']['enum'][13]PRODUCT_UNIVERSAL_SAVES
root['schemas']['PeoplestackDeleteGroupsRequest']['properties']['affinityType']['enum'][310]POLARIS_AFFINITY
root['schemas']['PeoplestackFlexorgsProtoInternalExternal']['properties']['application']['enum'][455]POLARIS
root['schemas']['PeoplestackFlexorgsProtoInternalExternal']['properties']['application']['enumDescriptions'][455]Polaris Team contact: gcs-nexus@google.com
root['schemas']['PeoplestackJoinGroupRequest']['properties']['affinityType']['enum'][310]POLARIS_AFFINITY
root['schemas']['PeoplestackLeaveGroupRequest']['properties']['affinityType']['enum'][310]POLARIS_AFFINITY
root['schemas']['PeoplestackLookupRequest']['properties']['affinityType']['enum'][310]POLARIS_AFFINITY
root['schemas']['PeoplestackMutateConnectionLabelRequest']['properties']['affinityType']['enum'][310]POLARIS_AFFINITY
root['schemas']['PeoplestackReadAllGroupsRequest']['properties']['affinityType']['enum'][310]POLARIS_AFFINITY
root['schemas']['PeoplestackReadGroupsRequest']['properties']['affinityType']['enum'][310]POLARIS_AFFINITY
root['schemas']['PeoplestackSmartAddressRequest']['properties']['affinityType']['enum'][310]POLARIS_AFFINITY
root['schemas']['PeoplestackUpdateGroupRequest']['properties']['affinityType']['enum'][310]POLARIS_AFFINITY
root['schemas']['PeoplestackWarmupRequest']['properties']['affinityType']['enum'][310]POLARIS_AFFINITY
root['schemas']['SocialClientsApplicationProto3Wrapper']['properties']['application']['enum'][455]POLARIS
root['schemas']['SocialClientsApplicationProto3Wrapper']['properties']['application']['enumDescriptions'][455]Polaris Team contact: gcs-nexus@google.com
prod/performanceparameters-
values_changed
root['revision']
new_value20250312
old_value20250310
prod/performanceparameters-v1
values_changed
root['revision']
new_value20250312
old_value20250310
prod/policyremediator-
values_changed
root['revision']
new_value20250309
old_value20250302
prod/policyremediator-v1alpha
values_changed
root['revision']
new_value20250309
old_value20250302
prod/ppissuer-
values_changed
root['revision']
new_value20250313
old_value20250310
prod/ppissuer-v1
values_changed
root['revision']
new_value20250313
old_value20250310
prod/preprod-hangouts-
values_changed
root['revision']
new_value20250312
old_value20250310
prod/preprod-hangouts-v1
values_changed
root['revision']
new_value20250312
old_value20250310
prod/preprod-keep-pa-
dictionary_item_added
  • root['schemas']['GetNoteInfoResponse']['properties']['type']['enumDeprecated']
  • root['schemas']['Note']['properties']['quillNote']['deprecated']
values_changed
root['revision']
new_value20250311
old_value20250213
root['schemas']['Note']['properties']['quillNote']['description']
new_valueA quillNote is a note with an empty message.
old_valueA quillNote is a note with an empty message.
prod/preprod-keep-pa-v1
dictionary_item_added
  • root['schemas']['GetNoteInfoResponse']['properties']['type']['enumDeprecated']
  • root['schemas']['Note']['properties']['quillNote']['deprecated']
values_changed
root['revision']
new_value20250311
old_value20250213
root['schemas']['Note']['properties']['quillNote']['description']
new_valueA quillNote is a note with an empty message.
old_valueA quillNote is a note with an empty message.
prod/preprod-notes-pa.sandbox-
dictionary_item_added
  • root['schemas']['DownSync']['properties']['derivedNoteAttributes']['deprecated']
  • root['schemas']['DownSync']['properties']['derivedNoteAttributes']['description']
  • root['schemas']['DownSyncWriteResult']['properties']['missingEmbeddedImages']['deprecated']
  • root['schemas']['DownSyncWriteResult']['properties']['status']['enumDeprecated']
  • root['schemas']['Node']['properties']['clientChanges']['properties']['commandMetadata']['properties']['imageIdMap']['deprecated']
  • root['schemas']['Node']['properties']['serverChanges']['properties']['images']['deprecated']
  • root['schemas']['UpSync']['properties']['requestHeader']['properties']['modelOptions']['properties']['note']['properties']['commandEncoding']['deprecated']
  • root['schemas']['UpSync']['properties']['requestHeader']['properties']['modelOptions']['properties']['quill']['deprecated']
  • root['schemas']['UpSync']['properties']['requestHeader']['properties']['modelOptions']['properties']['quill']['properties']['commandEncoding']['deprecated']
dictionary_item_removed
  • root['schemas']['Node']['properties']['sharerEmail']
values_changed
root['revision']
new_value20250311
old_value20250211
root['schemas']['DownSyncWriteResult']['properties']['missingEmbeddedImages']['description']
new_valueThe embedded images referenced by the uploaded commands for which the corresponding data was not found by the server. Clients are expected to re-upload these images before issuing a new sync request.
old_valueThe embedded images referenced by the uploaded commands for which the corresponding data was not found by the server. Clients are expected to re-upload these images before issuing a new sync request. This field is only populated when the status is set to MISSING_EMBEDDED_IMAGE.
root['schemas']['Node']['properties']['clientChanges']['properties']['commandMetadata']['properties']['imageIdMap']['description']
new_valueFor images referenced by the model, maps images' client IDs to server IDs.
old_valueFor images referenced by the model, maps images' client IDs to server IDs.
root['schemas']['Node']['properties']['serverChanges']['properties']['images']['description']
new_valueMetadata on images referenced by the model.
old_valueMetadata on images referenced by the model. This will include all images upon initial sync (no changes) and only images referenced by changes when changes exist.
root['schemas']['DownSyncWriteResult']['properties']['status']['enumDescriptions'][2]
new_valueThe uploaded commands refer to embedded images that have not yet been uploaded. Clients are expected to recover from this error by re-uploading the image before issuing a new sync request.
old_valueThe uploaded commands refer to embedded images that have not yet been uploaded. Clients are expected to recover from this error by re-uploading the image before issuing a new sync request.
prod/preprod-notes-pa.sandbox-v1
dictionary_item_added
  • root['schemas']['DownSync']['properties']['derivedNoteAttributes']['deprecated']
  • root['schemas']['DownSync']['properties']['derivedNoteAttributes']['description']
  • root['schemas']['DownSyncWriteResult']['properties']['missingEmbeddedImages']['deprecated']
  • root['schemas']['DownSyncWriteResult']['properties']['status']['enumDeprecated']
  • root['schemas']['Node']['properties']['clientChanges']['properties']['commandMetadata']['properties']['imageIdMap']['deprecated']
  • root['schemas']['Node']['properties']['serverChanges']['properties']['images']['deprecated']
  • root['schemas']['UpSync']['properties']['requestHeader']['properties']['modelOptions']['properties']['note']['properties']['commandEncoding']['deprecated']
  • root['schemas']['UpSync']['properties']['requestHeader']['properties']['modelOptions']['properties']['quill']['deprecated']
  • root['schemas']['UpSync']['properties']['requestHeader']['properties']['modelOptions']['properties']['quill']['properties']['commandEncoding']['deprecated']
dictionary_item_removed
  • root['schemas']['Node']['properties']['sharerEmail']
values_changed
root['revision']
new_value20250311
old_value20250211
root['schemas']['DownSyncWriteResult']['properties']['missingEmbeddedImages']['description']
new_valueThe embedded images referenced by the uploaded commands for which the corresponding data was not found by the server. Clients are expected to re-upload these images before issuing a new sync request.
old_valueThe embedded images referenced by the uploaded commands for which the corresponding data was not found by the server. Clients are expected to re-upload these images before issuing a new sync request. This field is only populated when the status is set to MISSING_EMBEDDED_IMAGE.
root['schemas']['Node']['properties']['clientChanges']['properties']['commandMetadata']['properties']['imageIdMap']['description']
new_valueFor images referenced by the model, maps images' client IDs to server IDs.
old_valueFor images referenced by the model, maps images' client IDs to server IDs.
root['schemas']['Node']['properties']['serverChanges']['properties']['images']['description']
new_valueMetadata on images referenced by the model.
old_valueMetadata on images referenced by the model. This will include all images upon initial sync (no changes) and only images referenced by changes when changes exist.
root['schemas']['DownSyncWriteResult']['properties']['status']['enumDescriptions'][2]
new_valueThe uploaded commands refer to embedded images that have not yet been uploaded. Clients are expected to recover from this error by re-uploading the image before issuing a new sync request.
old_valueThe uploaded commands refer to embedded images that have not yet been uploaded. Clients are expected to recover from this error by re-uploading the image before issuing a new sync request.
prod/privacysandboxmaven-
values_changed
root['revision']
new_value20250312
old_value20250310
prod/privacysandboxmaven-v1
values_changed
root['revision']
new_value20250312
old_value20250310
prod/progressiverollout-
values_changed
root['revision']
new_value20250312
old_value20250305
prod/progressiverollout-v1alpha
values_changed
root['revision']
new_value20250312
old_value20250305
prod/progressiverollout-v1beta
values_changed
root['revision']
new_value20250312
old_value20250305
prod/quantum-
values_changed
root['revision']
new_value20250311
old_value20250309
prod/quantum-v1alpha1
values_changed
root['revision']
new_value20250311
old_value20250309
prod/rbmopenmaap-
values_changed
root['revision']
new_value20250313
old_value20250310
prod/rbmopenmaap-v1
values_changed
root['revision']
new_value20250313
old_value20250310
prod/reach-pa-
values_changed
root['revision']
new_value20250313
old_value20250305
prod/reach-pa-v1
values_changed
root['revision']
new_value20250313
old_value20250305
prod/reauth-
values_changed
root['revision']
new_value20250311
old_value20250304
prod/reauth-v1
values_changed
root['revision']
new_value20250311
old_value20250304
prod/reauth-v2
values_changed
root['revision']
new_value20250311
old_value20250304
prod/resultstore-
values_changed
root['revision']
new_value20250311
old_value20250307
prod/resultstore-v2
values_changed
root['revision']
new_value20250311
old_value20250307
prod/riskmanager-
values_changed
root['revision']
new_value20250313
old_value20250309
prod/riskmanager-v1
values_changed
root['revision']
new_value20250313
old_value20250309
prod/riskmanager-v1alpha1
values_changed
root['revision']
new_value20250313
old_value20250309
prod/routeoptimization-
values_changed
root['revision']
new_value20250312
old_value20250309
prod/routeoptimization-v1
values_changed
root['revision']
new_value20250312
old_value20250309
prod/routes-
values_changed
root['revision']
new_value20250312
old_value20250309
prod/routes-v1
values_changed
root['revision']
new_value20250312
old_value20250309
prod/routespreferred-
values_changed
root['revision']
new_value20250312
old_value20250306
prod/routespreferred-v1
values_changed
root['revision']
new_value20250312
old_value20250306
prod/routespreferred-v1alpha
values_changed
root['revision']
new_value20250312
old_value20250306
prod/runapps-
values_changed
root['revision']
new_value20250305
old_value20250226
prod/runapps-v1alpha1
values_changed
root['revision']
new_value20250305
old_value20250226
prod/saasmanagement-
dictionary_item_added
  • root['schemas']['TerraformFlags']
  • root['schemas']['Features']['properties']['terraformFlags']
values_changed
root['resources']['projects']['resources']['locations']['resources']['instanceTypes']['methods']['patch']['parameters']['updateMask']['description']
new_valueRequired. Mask of fields to update. At least one path must be supplied in this field. For the `FieldMask` definition, see https://developers.google.com/protocol-buffers/docs/reference/google.protobuf#fieldmask Supported fieldmask values are: - `labels` - `display_name` - `features` - `features.auto_wipeout` - `features.enable_health_monitoring` - `features.gcp_tenant_project` - `features.gcp_tenant_project_v2` - `features.harpoon` - `features.harpoon.harpoon_requestor_id` - `features.mutation_timeout_minutes` - `features.notification` - `features.reconciliation.reconciliation_policy` - `features.reconciliation.create_conflict_policy` - `features.reconciliation` - `features.slo_config` - `features.slo_config.slos` - `features.update_on_hidden_consumer_project` - `features.terraform_flags.plan_parallelism` - `features.terraform_flags.apply_parallelism`
old_valueRequired. Mask of fields to update. At least one path must be supplied in this field. For the `FieldMask` definition, see https://developers.google.com/protocol-buffers/docs/reference/google.protobuf#fieldmask Supported fieldmask values are: - `labels` - `display_name` - `features` - `features.auto_wipeout` - `features.enable_health_monitoring` - `features.gcp_tenant_project` - `features.gcp_tenant_project_v2` - `features.harpoon` - `features.harpoon.harpoon_requestor_id` - `features.mutation_timeout_minutes` - `features.notification` - `features.reconciliation.reconciliation_policy` - `features.reconciliation.create_conflict_policy` - `features.reconciliation` - `features.slo_config` - `features.slo_config.slos` - `features.update_on_hidden_consumer_project`
root['revision']
new_value20250305
old_value20250219
prod/saasmanagement-v1beta
dictionary_item_added
  • root['schemas']['TerraformFlags']
  • root['schemas']['Features']['properties']['terraformFlags']
values_changed
root['resources']['projects']['resources']['locations']['resources']['instanceTypes']['methods']['patch']['parameters']['updateMask']['description']
new_valueRequired. Mask of fields to update. At least one path must be supplied in this field. For the `FieldMask` definition, see https://developers.google.com/protocol-buffers/docs/reference/google.protobuf#fieldmask Supported fieldmask values are: - `labels` - `display_name` - `features` - `features.auto_wipeout` - `features.enable_health_monitoring` - `features.gcp_tenant_project` - `features.gcp_tenant_project_v2` - `features.harpoon` - `features.harpoon.harpoon_requestor_id` - `features.mutation_timeout_minutes` - `features.notification` - `features.reconciliation.reconciliation_policy` - `features.reconciliation.create_conflict_policy` - `features.reconciliation` - `features.slo_config` - `features.slo_config.slos` - `features.update_on_hidden_consumer_project` - `features.terraform_flags.plan_parallelism` - `features.terraform_flags.apply_parallelism`
old_valueRequired. Mask of fields to update. At least one path must be supplied in this field. For the `FieldMask` definition, see https://developers.google.com/protocol-buffers/docs/reference/google.protobuf#fieldmask Supported fieldmask values are: - `labels` - `display_name` - `features` - `features.auto_wipeout` - `features.enable_health_monitoring` - `features.gcp_tenant_project` - `features.gcp_tenant_project_v2` - `features.harpoon` - `features.harpoon.harpoon_requestor_id` - `features.mutation_timeout_minutes` - `features.notification` - `features.reconciliation.reconciliation_policy` - `features.reconciliation.create_conflict_policy` - `features.reconciliation` - `features.slo_config` - `features.slo_config.slos` - `features.update_on_hidden_consumer_project`
root['revision']
new_value20250305
old_value20250219
prod/salesforceshopping-
values_changed
root['revision']
new_value20250312
old_value20250310
prod/salesforceshopping-v1
values_changed
root['revision']
new_value20250312
old_value20250310
prod/scone-pa-
values_changed
root['revision']
new_value20250312
old_value20250305
iterable_item_added
root['schemas']['EngageApiSharedCmsConfigurationFieldRelationshipDescriptorContext']['properties']['frdIdentifier']['enum'][66]IDENTIFIER_ADS_JOINT_BUSINESS_PLAN_ID
root['schemas']['EngageApiSharedCmsConfigurationFieldRelationshipDescriptorContext']['properties']['frdIdentifier']['enum'][154]IDENTIFIER_ADVERTISER_SERVICE_CATEGORY
root['schemas']['EngageApiSharedCmsConfigurationFieldRelationshipDescriptorContext']['properties']['frdIdentifier']['enum'][277]IDENTIFIER_CASES_WHATSAPP_CONSENT
root['schemas']['EngageApiSharedCmsConfigurationFieldRelationshipDescriptorContext']['properties']['frdIdentifier']['enum'][372]IDENTIFIER_CS_TEAM_ID
root['schemas']['EngageApiSharedCmsConfigurationFieldRelationshipDescriptorContext']['properties']['frdIdentifier']['enum'][727]IDENTIFIER_MENU_OF_SERVICE_ORDER_ID
root['schemas']['EngageApiSharedCmsConfigurationFieldRelationshipDescriptorContext']['properties']['frdIdentifier']['enumDescriptions'][66]b/400713111
root['schemas']['EngageApiSharedCmsConfigurationFieldRelationshipDescriptorContext']['properties']['frdIdentifier']['enumDescriptions'][154]b/399143770
root['schemas']['EngageApiSharedCmsConfigurationFieldRelationshipDescriptorContext']['properties']['frdIdentifier']['enumDescriptions'][277]b/397762924
root['schemas']['EngageApiSharedCmsConfigurationFieldRelationshipDescriptorContext']['properties']['frdIdentifier']['enumDescriptions'][372]b/399076775
root['schemas']['EngageApiSharedCmsConfigurationFieldRelationshipDescriptorContext']['properties']['frdIdentifier']['enumDescriptions'][727]b/399143094
root['schemas']['EngageApiSharedCmsConfigurationFieldRelationshipDescriptorValue']['properties']['frdIdentifier']['enum'][66]IDENTIFIER_ADS_JOINT_BUSINESS_PLAN_ID
root['schemas']['EngageApiSharedCmsConfigurationFieldRelationshipDescriptorValue']['properties']['frdIdentifier']['enum'][154]IDENTIFIER_ADVERTISER_SERVICE_CATEGORY
root['schemas']['EngageApiSharedCmsConfigurationFieldRelationshipDescriptorValue']['properties']['frdIdentifier']['enum'][277]IDENTIFIER_CASES_WHATSAPP_CONSENT
root['schemas']['EngageApiSharedCmsConfigurationFieldRelationshipDescriptorValue']['properties']['frdIdentifier']['enum'][372]IDENTIFIER_CS_TEAM_ID
root['schemas']['EngageApiSharedCmsConfigurationFieldRelationshipDescriptorValue']['properties']['frdIdentifier']['enum'][727]IDENTIFIER_MENU_OF_SERVICE_ORDER_ID
root['schemas']['EngageApiSharedCmsConfigurationFieldRelationshipDescriptorValue']['properties']['frdIdentifier']['enumDescriptions'][66]b/400713111
root['schemas']['EngageApiSharedCmsConfigurationFieldRelationshipDescriptorValue']['properties']['frdIdentifier']['enumDescriptions'][154]b/399143770
root['schemas']['EngageApiSharedCmsConfigurationFieldRelationshipDescriptorValue']['properties']['frdIdentifier']['enumDescriptions'][277]b/397762924
root['schemas']['EngageApiSharedCmsConfigurationFieldRelationshipDescriptorValue']['properties']['frdIdentifier']['enumDescriptions'][372]b/399076775
root['schemas']['EngageApiSharedCmsConfigurationFieldRelationshipDescriptorValue']['properties']['frdIdentifier']['enumDescriptions'][727]b/399143094
root['schemas']['SconeV1CidGetTreeRequest']['properties']['frdId']['enum'][66]IDENTIFIER_ADS_JOINT_BUSINESS_PLAN_ID
root['schemas']['SconeV1CidGetTreeRequest']['properties']['frdId']['enum'][154]IDENTIFIER_ADVERTISER_SERVICE_CATEGORY
root['schemas']['SconeV1CidGetTreeRequest']['properties']['frdId']['enum'][277]IDENTIFIER_CASES_WHATSAPP_CONSENT
root['schemas']['SconeV1CidGetTreeRequest']['properties']['frdId']['enum'][372]IDENTIFIER_CS_TEAM_ID
root['schemas']['SconeV1CidGetTreeRequest']['properties']['frdId']['enum'][727]IDENTIFIER_MENU_OF_SERVICE_ORDER_ID
root['schemas']['SconeV1CidGetTreeRequest']['properties']['frdId']['enumDescriptions'][66]b/400713111
root['schemas']['SconeV1CidGetTreeRequest']['properties']['frdId']['enumDescriptions'][154]b/399143770
root['schemas']['SconeV1CidGetTreeRequest']['properties']['frdId']['enumDescriptions'][277]b/397762924
root['schemas']['SconeV1CidGetTreeRequest']['properties']['frdId']['enumDescriptions'][372]b/399076775
root['schemas']['SconeV1CidGetTreeRequest']['properties']['frdId']['enumDescriptions'][727]b/399143094
root['schemas']['SconeV1CidSearchRequest']['properties']['frdId']['enum'][66]IDENTIFIER_ADS_JOINT_BUSINESS_PLAN_ID
root['schemas']['SconeV1CidSearchRequest']['properties']['frdId']['enum'][154]IDENTIFIER_ADVERTISER_SERVICE_CATEGORY
root['schemas']['SconeV1CidSearchRequest']['properties']['frdId']['enum'][277]IDENTIFIER_CASES_WHATSAPP_CONSENT
root['schemas']['SconeV1CidSearchRequest']['properties']['frdId']['enum'][372]IDENTIFIER_CS_TEAM_ID
root['schemas']['SconeV1CidSearchRequest']['properties']['frdId']['enum'][727]IDENTIFIER_MENU_OF_SERVICE_ORDER_ID
root['schemas']['SconeV1CidSearchRequest']['properties']['frdId']['enumDescriptions'][66]b/400713111
root['schemas']['SconeV1CidSearchRequest']['properties']['frdId']['enumDescriptions'][154]b/399143770
root['schemas']['SconeV1CidSearchRequest']['properties']['frdId']['enumDescriptions'][277]b/397762924
root['schemas']['SconeV1CidSearchRequest']['properties']['frdId']['enumDescriptions'][372]b/399076775
root['schemas']['SconeV1CidSearchRequest']['properties']['frdId']['enumDescriptions'][727]b/399143094
root['schemas']['SconeV1ContactFormGetRequest']['properties']['requestSource']['enum'][143]RS_RISK_MANAGEMENT_AND_COMPLIANCE
root['schemas']['SconeV1GetAvailableValuesForGraphRequest']['properties']['resultFrdIdentifierMask']['items']['enum'][66]IDENTIFIER_ADS_JOINT_BUSINESS_PLAN_ID
root['schemas']['SconeV1GetAvailableValuesForGraphRequest']['properties']['resultFrdIdentifierMask']['items']['enum'][154]IDENTIFIER_ADVERTISER_SERVICE_CATEGORY
root['schemas']['SconeV1GetAvailableValuesForGraphRequest']['properties']['resultFrdIdentifierMask']['items']['enum'][277]IDENTIFIER_CASES_WHATSAPP_CONSENT
root['schemas']['SconeV1GetAvailableValuesForGraphRequest']['properties']['resultFrdIdentifierMask']['items']['enum'][372]IDENTIFIER_CS_TEAM_ID
root['schemas']['SconeV1GetAvailableValuesForGraphRequest']['properties']['resultFrdIdentifierMask']['items']['enum'][727]IDENTIFIER_MENU_OF_SERVICE_ORDER_ID
root['schemas']['SconeV1GetAvailableValuesForGraphRequest']['properties']['resultFrdIdentifierMask']['items']['enumDescriptions'][66]b/400713111
root['schemas']['SconeV1GetAvailableValuesForGraphRequest']['properties']['resultFrdIdentifierMask']['items']['enumDescriptions'][154]b/399143770
root['schemas']['SconeV1GetAvailableValuesForGraphRequest']['properties']['resultFrdIdentifierMask']['items']['enumDescriptions'][277]b/397762924
root['schemas']['SconeV1GetAvailableValuesForGraphRequest']['properties']['resultFrdIdentifierMask']['items']['enumDescriptions'][372]b/399076775
root['schemas']['SconeV1GetAvailableValuesForGraphRequest']['properties']['resultFrdIdentifierMask']['items']['enumDescriptions'][727]b/399143094
root['schemas']['SconeV1RequestSource']['properties']['value']['enum'][143]RS_RISK_MANAGEMENT_AND_COMPLIANCE
root['schemas']['SconeV1UserSpecificFrdValuesGetRequest']['properties']['frdIdentifier']['enum'][66]IDENTIFIER_ADS_JOINT_BUSINESS_PLAN_ID
root['schemas']['SconeV1UserSpecificFrdValuesGetRequest']['properties']['frdIdentifier']['enum'][154]IDENTIFIER_ADVERTISER_SERVICE_CATEGORY
root['schemas']['SconeV1UserSpecificFrdValuesGetRequest']['properties']['frdIdentifier']['enum'][277]IDENTIFIER_CASES_WHATSAPP_CONSENT
root['schemas']['SconeV1UserSpecificFrdValuesGetRequest']['properties']['frdIdentifier']['enum'][372]IDENTIFIER_CS_TEAM_ID
root['schemas']['SconeV1UserSpecificFrdValuesGetRequest']['properties']['frdIdentifier']['enum'][727]IDENTIFIER_MENU_OF_SERVICE_ORDER_ID
root['schemas']['SconeV1UserSpecificFrdValuesGetRequest']['properties']['frdIdentifier']['enumDescriptions'][66]b/400713111
root['schemas']['SconeV1UserSpecificFrdValuesGetRequest']['properties']['frdIdentifier']['enumDescriptions'][154]b/399143770
root['schemas']['SconeV1UserSpecificFrdValuesGetRequest']['properties']['frdIdentifier']['enumDescriptions'][277]b/397762924
root['schemas']['SconeV1UserSpecificFrdValuesGetRequest']['properties']['frdIdentifier']['enumDescriptions'][372]b/399076775
root['schemas']['SconeV1UserSpecificFrdValuesGetRequest']['properties']['frdIdentifier']['enumDescriptions'][727]b/399143094
prod/scone-pa-v1
values_changed
root['revision']
new_value20250312
old_value20250305
iterable_item_added
root['schemas']['EngageApiSharedCmsConfigurationFieldRelationshipDescriptorContext']['properties']['frdIdentifier']['enum'][66]IDENTIFIER_ADS_JOINT_BUSINESS_PLAN_ID
root['schemas']['EngageApiSharedCmsConfigurationFieldRelationshipDescriptorContext']['properties']['frdIdentifier']['enum'][154]IDENTIFIER_ADVERTISER_SERVICE_CATEGORY
root['schemas']['EngageApiSharedCmsConfigurationFieldRelationshipDescriptorContext']['properties']['frdIdentifier']['enum'][277]IDENTIFIER_CASES_WHATSAPP_CONSENT
root['schemas']['EngageApiSharedCmsConfigurationFieldRelationshipDescriptorContext']['properties']['frdIdentifier']['enum'][372]IDENTIFIER_CS_TEAM_ID
root['schemas']['EngageApiSharedCmsConfigurationFieldRelationshipDescriptorContext']['properties']['frdIdentifier']['enum'][727]IDENTIFIER_MENU_OF_SERVICE_ORDER_ID
root['schemas']['EngageApiSharedCmsConfigurationFieldRelationshipDescriptorContext']['properties']['frdIdentifier']['enumDescriptions'][66]b/400713111
root['schemas']['EngageApiSharedCmsConfigurationFieldRelationshipDescriptorContext']['properties']['frdIdentifier']['enumDescriptions'][154]b/399143770
root['schemas']['EngageApiSharedCmsConfigurationFieldRelationshipDescriptorContext']['properties']['frdIdentifier']['enumDescriptions'][277]b/397762924
root['schemas']['EngageApiSharedCmsConfigurationFieldRelationshipDescriptorContext']['properties']['frdIdentifier']['enumDescriptions'][372]b/399076775
root['schemas']['EngageApiSharedCmsConfigurationFieldRelationshipDescriptorContext']['properties']['frdIdentifier']['enumDescriptions'][727]b/399143094
root['schemas']['EngageApiSharedCmsConfigurationFieldRelationshipDescriptorValue']['properties']['frdIdentifier']['enum'][66]IDENTIFIER_ADS_JOINT_BUSINESS_PLAN_ID
root['schemas']['EngageApiSharedCmsConfigurationFieldRelationshipDescriptorValue']['properties']['frdIdentifier']['enum'][154]IDENTIFIER_ADVERTISER_SERVICE_CATEGORY
root['schemas']['EngageApiSharedCmsConfigurationFieldRelationshipDescriptorValue']['properties']['frdIdentifier']['enum'][277]IDENTIFIER_CASES_WHATSAPP_CONSENT
root['schemas']['EngageApiSharedCmsConfigurationFieldRelationshipDescriptorValue']['properties']['frdIdentifier']['enum'][372]IDENTIFIER_CS_TEAM_ID
root['schemas']['EngageApiSharedCmsConfigurationFieldRelationshipDescriptorValue']['properties']['frdIdentifier']['enum'][727]IDENTIFIER_MENU_OF_SERVICE_ORDER_ID
root['schemas']['EngageApiSharedCmsConfigurationFieldRelationshipDescriptorValue']['properties']['frdIdentifier']['enumDescriptions'][66]b/400713111
root['schemas']['EngageApiSharedCmsConfigurationFieldRelationshipDescriptorValue']['properties']['frdIdentifier']['enumDescriptions'][154]b/399143770
root['schemas']['EngageApiSharedCmsConfigurationFieldRelationshipDescriptorValue']['properties']['frdIdentifier']['enumDescriptions'][277]b/397762924
root['schemas']['EngageApiSharedCmsConfigurationFieldRelationshipDescriptorValue']['properties']['frdIdentifier']['enumDescriptions'][372]b/399076775
root['schemas']['EngageApiSharedCmsConfigurationFieldRelationshipDescriptorValue']['properties']['frdIdentifier']['enumDescriptions'][727]b/399143094
root['schemas']['SconeV1CidGetTreeRequest']['properties']['frdId']['enum'][66]IDENTIFIER_ADS_JOINT_BUSINESS_PLAN_ID
root['schemas']['SconeV1CidGetTreeRequest']['properties']['frdId']['enum'][154]IDENTIFIER_ADVERTISER_SERVICE_CATEGORY
root['schemas']['SconeV1CidGetTreeRequest']['properties']['frdId']['enum'][277]IDENTIFIER_CASES_WHATSAPP_CONSENT
root['schemas']['SconeV1CidGetTreeRequest']['properties']['frdId']['enum'][372]IDENTIFIER_CS_TEAM_ID
root['schemas']['SconeV1CidGetTreeRequest']['properties']['frdId']['enum'][727]IDENTIFIER_MENU_OF_SERVICE_ORDER_ID
root['schemas']['SconeV1CidGetTreeRequest']['properties']['frdId']['enumDescriptions'][66]b/400713111
root['schemas']['SconeV1CidGetTreeRequest']['properties']['frdId']['enumDescriptions'][154]b/399143770
root['schemas']['SconeV1CidGetTreeRequest']['properties']['frdId']['enumDescriptions'][277]b/397762924
root['schemas']['SconeV1CidGetTreeRequest']['properties']['frdId']['enumDescriptions'][372]b/399076775
root['schemas']['SconeV1CidGetTreeRequest']['properties']['frdId']['enumDescriptions'][727]b/399143094
root['schemas']['SconeV1CidSearchRequest']['properties']['frdId']['enum'][66]IDENTIFIER_ADS_JOINT_BUSINESS_PLAN_ID
root['schemas']['SconeV1CidSearchRequest']['properties']['frdId']['enum'][154]IDENTIFIER_ADVERTISER_SERVICE_CATEGORY
root['schemas']['SconeV1CidSearchRequest']['properties']['frdId']['enum'][277]IDENTIFIER_CASES_WHATSAPP_CONSENT
root['schemas']['SconeV1CidSearchRequest']['properties']['frdId']['enum'][372]IDENTIFIER_CS_TEAM_ID
root['schemas']['SconeV1CidSearchRequest']['properties']['frdId']['enum'][727]IDENTIFIER_MENU_OF_SERVICE_ORDER_ID
root['schemas']['SconeV1CidSearchRequest']['properties']['frdId']['enumDescriptions'][66]b/400713111
root['schemas']['SconeV1CidSearchRequest']['properties']['frdId']['enumDescriptions'][154]b/399143770
root['schemas']['SconeV1CidSearchRequest']['properties']['frdId']['enumDescriptions'][277]b/397762924
root['schemas']['SconeV1CidSearchRequest']['properties']['frdId']['enumDescriptions'][372]b/399076775
root['schemas']['SconeV1CidSearchRequest']['properties']['frdId']['enumDescriptions'][727]b/399143094
root['schemas']['SconeV1ContactFormGetRequest']['properties']['requestSource']['enum'][143]RS_RISK_MANAGEMENT_AND_COMPLIANCE
root['schemas']['SconeV1GetAvailableValuesForGraphRequest']['properties']['resultFrdIdentifierMask']['items']['enum'][66]IDENTIFIER_ADS_JOINT_BUSINESS_PLAN_ID
root['schemas']['SconeV1GetAvailableValuesForGraphRequest']['properties']['resultFrdIdentifierMask']['items']['enum'][154]IDENTIFIER_ADVERTISER_SERVICE_CATEGORY
root['schemas']['SconeV1GetAvailableValuesForGraphRequest']['properties']['resultFrdIdentifierMask']['items']['enum'][277]IDENTIFIER_CASES_WHATSAPP_CONSENT
root['schemas']['SconeV1GetAvailableValuesForGraphRequest']['properties']['resultFrdIdentifierMask']['items']['enum'][372]IDENTIFIER_CS_TEAM_ID
root['schemas']['SconeV1GetAvailableValuesForGraphRequest']['properties']['resultFrdIdentifierMask']['items']['enum'][727]IDENTIFIER_MENU_OF_SERVICE_ORDER_ID
root['schemas']['SconeV1GetAvailableValuesForGraphRequest']['properties']['resultFrdIdentifierMask']['items']['enumDescriptions'][66]b/400713111
root['schemas']['SconeV1GetAvailableValuesForGraphRequest']['properties']['resultFrdIdentifierMask']['items']['enumDescriptions'][154]b/399143770
root['schemas']['SconeV1GetAvailableValuesForGraphRequest']['properties']['resultFrdIdentifierMask']['items']['enumDescriptions'][277]b/397762924
root['schemas']['SconeV1GetAvailableValuesForGraphRequest']['properties']['resultFrdIdentifierMask']['items']['enumDescriptions'][372]b/399076775
root['schemas']['SconeV1GetAvailableValuesForGraphRequest']['properties']['resultFrdIdentifierMask']['items']['enumDescriptions'][727]b/399143094
root['schemas']['SconeV1RequestSource']['properties']['value']['enum'][143]RS_RISK_MANAGEMENT_AND_COMPLIANCE
root['schemas']['SconeV1UserSpecificFrdValuesGetRequest']['properties']['frdIdentifier']['enum'][66]IDENTIFIER_ADS_JOINT_BUSINESS_PLAN_ID
root['schemas']['SconeV1UserSpecificFrdValuesGetRequest']['properties']['frdIdentifier']['enum'][154]IDENTIFIER_ADVERTISER_SERVICE_CATEGORY
root['schemas']['SconeV1UserSpecificFrdValuesGetRequest']['properties']['frdIdentifier']['enum'][277]IDENTIFIER_CASES_WHATSAPP_CONSENT
root['schemas']['SconeV1UserSpecificFrdValuesGetRequest']['properties']['frdIdentifier']['enum'][372]IDENTIFIER_CS_TEAM_ID
root['schemas']['SconeV1UserSpecificFrdValuesGetRequest']['properties']['frdIdentifier']['enum'][727]IDENTIFIER_MENU_OF_SERVICE_ORDER_ID
root['schemas']['SconeV1UserSpecificFrdValuesGetRequest']['properties']['frdIdentifier']['enumDescriptions'][66]b/400713111
root['schemas']['SconeV1UserSpecificFrdValuesGetRequest']['properties']['frdIdentifier']['enumDescriptions'][154]b/399143770
root['schemas']['SconeV1UserSpecificFrdValuesGetRequest']['properties']['frdIdentifier']['enumDescriptions'][277]b/397762924
root['schemas']['SconeV1UserSpecificFrdValuesGetRequest']['properties']['frdIdentifier']['enumDescriptions'][372]b/399076775
root['schemas']['SconeV1UserSpecificFrdValuesGetRequest']['properties']['frdIdentifier']['enumDescriptions'][727]b/399143094
prod/searchresearcherresults-
values_changed
root['revision']
new_value20250312
old_value20250309
prod/searchresearcherresults-v1
values_changed
root['revision']
new_value20250312
old_value20250309
prod/semanticlocation-pa-
dictionary_item_added
  • root['schemas']['GeostoreMedianProto']
  • root['schemas']['GeostoreMedianProtoSegmentLoopProto']
  • root['schemas']['GeostoreMedianProtoSegmentLoopProtoIndexedComponentProto']
  • root['schemas']['GeostoreCityObjectAttributesTrsAffineTransform']['description']
  • root['schemas']['GeostoreFeatureProto']['properties']['median']
  • root['schemas']['GeostoreRestrictionProto']['properties']['restrictionId']
  • root['schemas']['GeostoreSegmentProto']['properties']['relatedMedian']
  • root['schemas']['LocationPlacesPlacesserverPlaceInfoMobile']['properties']['transitCategory']
dictionary_item_removed
  • root['schemas']['GeostoreAccessPointProto']['properties']['priority']['description']
  • root['schemas']['GeostoreBestLocaleProto']['properties']['metadata']['description']
  • root['schemas']['GeostoreRankSignalProto']['description']
  • root['schemas']['GeostoreRestrictionProto']['properties']['type']['description']
  • root['schemas']['GeostoreSegmentProto']['properties']['priority']['description']
  • root['schemas']['GeostoreSegmentProto']['properties']['surface']['description']
  • root['schemas']['GeostoreSegmentProto']['properties']['usage']['description']
  • root['schemas']['IndexingMoonshineHappyhourTypesLocation']['properties']['semanticType']['description']
values_changed
root['revision']
new_value20250303
old_value20250210
root['schemas']['GeostoreAccessPointProto']['description']
new_valueThis class holds information about a single access point. An access point establishes a relationship between a feature (like a POI or building) and some other feature. For example, consider a TYPE_LOCALITY feature like Seattle. An access point might be the TYPE_AIRPORT feature for Seattle-Tacoma International Airport. The airport feature defines the access point to gain airplane-based access to Seattle. A feature like Seattle will typically have multiple access points. You can get to Seattle using airplanes, various forms of public transit, or by driving a car. Thus Seattle would have multiple access points. You may be able to get to Seattle by flying into SeaTac, or you might be able to fly into Boeing Field, or Paine Field in Everett. You could drive in from the North/South using I-5, or you could drive in from the East using I-90. Many access points are from the road network. Thus the access point for some building at 123 Main Street would likely be a segment that defines the 100-200 block of "Main Street". A feature at the corner of "Hollywood" and "Vine" streets might have access points from both named streets. Access points are an optional field. Data editors may ignore them when creating features or editing other fields. In these cases, other quality teams will synthesize and update them. Several fields are also optional, as they are derivable from other fields. Access points to non-TYPE_SEGMENT features should always have the following fields set: - feature_type - feature_id - point Location and reference fields: BASIC vs DERIVABLE Access points to TYPE_SEGMENT features must have all the following BASIC fields: - feature_type (of the segment, e.g. TYPE_ROAD or TYPE_VIRTUAL_SEGMENT) - point_off_segment (or point; see "fuzzy point" note below) - unsuitable_travel_mode (may be empty) - level (indoor access points only) The following are DERIVABLE fields, which should only be added if the supplier is confident about their accuracy: - feature_id - point_on_segment - segment_position Editing clients are encouraged to set all fields, but they may set only the BASIC fields, in which case quality teams may use the BASIC fields to snap to an appropriate segment and derive the remaining fields. Example: The segment is split, so that the portion that the access point is on has a new feature ID. Quality teams notice that the point_on_segment is no longer on the segment with feature_id, finds the new nearest segment based on feature_type and existing point_on_segment, and re-derives a new feature_id, point_on_segment, and segment_position, keeping other fields consistent. Fuzzy point special case If the editor does not have side-of-road information for access points or is otherwise unsure of the precise placement of the access point, it may supply the point field (and not point_off_segment) as basic data instead, in which case quality teams may generate the point_off_segment. Identity Access points are considered semantically equivalent if they have the same geometry, including derived fields, and the same references to other features (feature_id, level_feature_id). For the exact definition, see cs/symbol:geostore::AreAccessPointsEquivalent.
old_valueThis class holds information about a single access point. An access point establishes a relationship between a feature (like a POI or building) and some other feature. For example, consider a TYPE_LOCALITY feature like Seattle. An access point might be the TYPE_AIRPORT feature for Seattle-Tacoma International Airport. The airport feature defines the access point to gain airplane-based access to Seattle. A feature like Seattle will typically have multiple access points. You can get to Seattle using airplanes, various forms of public transit, or by driving a car. Thus Seattle would have multiple access points. You may be able to get to Seattle by flying into SeaTac, or you might be able to fly into Boeing Field, or Paine Field in Everett. You could drive in from the North/South using I-5, or you could drive in from the East using I-90. Many access points are from the road network. Thus the access point for some building at 123 Main Street would likely be a segment that defines the 100-200 block of "Main Street". A feature at the corner of "Hollywood" and "Vine" streets might have access points from both named streets. Access points are an optional field. Data editors may ignore them when creating features or editing other fields. In these cases, other quality teams will synthesize and update them. Several fields are also optional, as they are derivable from other fields. Access points to non-TYPE_SEGMENT features should always have the following fields set: - feature_type - feature_id - point Location and reference fields: BASIC vs DERIVABLE Access points to TYPE_SEGMENT features must have all the following BASIC fields: - feature_type (of the segment, e.g. TYPE_ROAD or TYPE_VIRTUAL_SEGMENT) - point_off_segment (or point; see "fuzzy point" note below) - unsuitable_travel_mode (may be empty) - level (indoor access points only) The following are DERIVABLE fields, which should only be added if the supplier is confident about their accuracy: - feature_id - point_on_segment - segment_position Editing clients are encouraged to set all fields, but they may set only the BASIC fields, in which case quality teams may use the BASIC fields to snap to an appropriate segment and derive the remaining fields. Example: The segment is split, so that the portion that the access point is on has a new feature ID. Quality teams notice that the point_on_segment is no longer on the segment with feature_id, finds the new nearest segment based on feature_type and existing point_on_segment, and re-derives a new feature_id, point_on_segment, and segment_position, keeping other fields consistent. Fuzzy point special case If the editor does not have side-of-road information for access points or is otherwise unsure of the precise placement of the access point, it may supply the point field (and not point_off_segment) as basic data instead, in which case quality teams may generate the point_off_segment. Identity Access points are considered semantically equivalent if they have the same geometry, including derived fields, and the same references to other features (feature_id, level_feature_id). For the exact definition, see cs/symbol:geostore::AreAccessPointsEquivalent. Field definitions
root['schemas']['GeostoreBestLocaleProto']['description']
new_valueA BestLocaleProto holds information about the best-match locale for a feature. Clients may use this information to determine the appropriate local name of a feature. Field-level metadata for this best locale.
old_valueA BestLocaleProto holds information about the best-match locale for a feature. Clients may use this information to determine the appropriate local name of a feature.
root['schemas']['GeostoreCityObjectAttributes']['properties']['trsAffineTransform']['description']
new_valueA local-to-ECEF affine transform. In the local frame, +X/+Y/+Z represents left/up/forward. It is strongly recommended that clients read from and write to this field using either of the provided public: * Builder library: google3/geostore/base/cityjson/cityjsonproto_builder.h * Converter functions: google3/geostore/base/cityjson/affine/trs_affine_transform_converter.h
old_valueA local-to-ECEF affine transform. In the local frame, +X/+Y/+Z represents left/up/forward. It is strongly recommended that clients read from and write to this field using the provided public converter libraries.
root['schemas']['GeostorePriceRangeProto']['description']
new_valueThis message represents a price range of an attribute. The meaning of the price bounds is domain specific. But mainly they are soft bounds for a normal usage. E.g. "restaurant prices" are subject to an higher level of "soft" bounds than "museum admission price" NOTE: In the future, it could be useful to have a 'factor' field. For example, if you get billed per 2 hours or per 30 minutes.
old_valueThis message represents a price range of an attribute. The meaning of the price bounds is domain specific. But mainly they are soft bounds for a normal usage. E.g. "restaurant prices" are subject to an higher level of "soft" bounds than "museum admission price"
root['schemas']['GeostoreRoadDisruptionProto']['description']
new_valueA road disruption is any temporary deviation from the 'normal' state of the road network that impacts users' travel experience. The normal state means roads follow their specified sets of restrictions and allow safe driving at a relatively normal speed for the road. Disruptions may not always be negative, e.g. a road that is normally closed has been opened as an emergency evacuation route. Disruptions might have additional data depending on their types. Disruption types are mutually exclusive, so at most one of these might apply.
old_valueA road disruption is any temporary deviation from the 'normal' state of the road network that impacts users' travel experience. The normal state means roads follow their specified sets of restrictions and allow safe driving at a relatively normal speed for the road. Disruptions may not always be negative, e.g. a road that is normally closed has been opened as an emergency evacuation route.
root['schemas']['GeostoreSegmentProto']['description']
new_valueWARNING!! If you add new fields to SegmentProto (or submessages), you must: * Maybe update theSegmentSplitter, if there is special logic when a segment is split, e.g. to adjust fractional attributes; most straightforward attributes *should* be copied over automatically: java/com/google/geostore/base/SegmentSplitter.java * Update the SegmentMerger to correctly copy, update, or delete the fields upon a segmenet merge: java/com/google/geostore/base/SegmentMerger.java * Determine whether the fields are irrelevant for rendering high priority roads at far-out zoom levels, and if not clear them: ClearFeature() in maps/render/process-high-priority-roads.cc * Determine whether the fields are required for rendering, and if not clear them: StripFeature() in maps/render/bucketing-util.cc * Update the tests that ensure the above packages are aware of all SegmentProto fields, or the new fields will a) break the Versatile build and/or b) cause performance regressions due to segment merge failures: - process-high-priority-roads_test.cc - bucketing-util_test.cc LINT.IfChange
old_valueWARNING!! If you add new fields to SegmentProto (or submessages), you must: * Maybe update theSegmentSplitter, if there is special logic when a segment is split, e.g. to adjust fractional attributes; most straightforward attributes *should* be copied over automatically: java/com/google/geostore/base/SegmentSplitter.java * Update the SegmentMerger to correctly copy, update, or delete the fields upon a segmenet merge: java/com/google/geostore/base/SegmentMerger.java * Determine whether the fields are irrelevant for rendering high priority roads at far-out zoom levels, and if not clear them: ClearFeature() in maps/render/process-high-priority-roads.cc * Determine whether the fields are required for rendering, and if not clear them: StripFeature() in maps/render/bucketing-util.cc * Update the tests that ensure the above packages are aware of all SegmentProto fields, or the new fields will a) break the Versatile build and/or b) cause performance regressions due to segment merge failures: - process-high-priority-roads_test.cc - bucketing-util_test.cc LINT.IfChange()
root['schemas']['GeostoreSegmentProto']['properties']['legalMinimumSpeed']['description']
new_valueLINT.ThenChange( //depot/google3/geostore/base/internal/segment.cc:has_speed_limit )
old_valueLINT.ThenChange(//depot/google3/geostore/base/internal/segment.cc:has_speed_limit)
root['schemas']['GeostoreVehicleOccupancyRangeProto']['description']
new_valueDescribes the range of occupants in a vehicle.
old_valueDescribes the range of occupants in a vehicle. The minimum number of occupants allowed in the vehicle, including the driver. Must be >= 0.
root['schemas']['LocationPlacesPlacesserverPlaceInfoMobile']['description']
new_valueProto containing all the information about a particular place that is used by CSL and ODLH to compute features. Next tag: 40
old_valueProto containing all the information about a particular place that is used by ELSA to compute features. Next tag: 39
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][274]
new_valueA vertical or nearly vertical slope. Includes escarpments.
old_valueA vertical or nearly vertical slope. Includes escarpments. An elevated place that is notable for having a good view.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][31]
new_valueAlso called a "car transport", a ferry train is a rail service that carries passengers and their vehicles across undrivable terrain. The Channel Tunnel ("Chunnel") is the most famous example, but they are also common in the Alps where they connect neighboring valleys otherwise separated by impassable mountains.
old_valueAlso called a "car transport", a ferry train is a rail service that carries passengers and their vehicles across undrivable terrain. The Channel Tunnel ("Chunnel") is the most famous example, but they are also common in the Alps where they connect neighboring valleys otherwise separated by impassable mountains. Any plausible 1-dimensional path through a 2+ dimensional space, for the purposes of making graph-search-based routing possible. Such segments can be used to model paths through parking lots, squares, floors of buildings and other areas.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][353]
new_valueThis type has been replaced by TYPE_COMPOUND_BUILDING. For further details, see go/oyster-compounds
old_valueThis type has been replaced by TYPE_COMPOUND_BUILDING. For further details, see go/oyster-compounds Establishment POIs can be referenced by TYPE_COMPOUND features using the RELATION_PRIMARILY_OCCUPIED_BY. This is the reciprocal relation of the RELATION_OCCUPIES.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][274]
new_valueA vertical or nearly vertical slope. Includes escarpments.
old_valueA vertical or nearly vertical slope. Includes escarpments. An elevated place that is notable for having a good view.
root['schemas']['GeostoreRestrictionProto']['properties']['type']['enumDescriptions'][8]
new_valueTravel over this segment is prohibited because of signage indicating one-way directionality in the opposite direction. This restriction type may not be used for restrictions with non-empty subpaths.
old_valueTravel over this segment is prohibited because of signage indicating one-way directionality in the opposite direction. This restriction type may not be used for restrictions with non-empty subpaths. Segment is part of a road or area for which through-travel is restricted. This restriction allows for vehicles to be routed on a road only if the destination lies within the restricted area or there is no alternate connectivity to the destination. This restriction type may be used only for restrictions of STYLE_SINGLE.
root['schemas']['GeostoreTransitLineProto']['properties']['vehicleType']['enumDescriptions'][16]
new_valueAn aerial lift (colloquially called "gondola lift") is a means of cable transport in which cabins, cars, gondolas or open chairs are hauled above the ground by means of one or more cables. Examples: gondola lift, aerial tramway.
old_valueAn aerial lift (colloquially called "gondola lift") is a means of cable transport in which cabins, cars, gondolas or open chairs are hauled above the ground by means of one or more cables. Examples: gondola lift, aerial tramway. Funicular is a cable railway in which a pair of tram-like vehicles use each other as counter balance to ascend and descend.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][248]
new_valueIncludes overfalls.
old_valueIncludes overfalls. A natural depression filled with water where animals come to drink.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][315]
new_valueAn address template feature provides region-specific conventions for structuring addresses. These features aren't necessarily defined by physical geographic features, so they are classified as meta-features.
old_valueAn address template feature provides region-specific conventions for structuring addresses. These features aren't necessarily defined by physical geographic features, so they are classified as meta-features. A transit line is a collection of transit legs, associated with some invariant properties of the trips that run over the legs. See also transitline.proto
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][31]
new_valueAlso called a "car transport", a ferry train is a rail service that carries passengers and their vehicles across undrivable terrain. The Channel Tunnel ("Chunnel") is the most famous example, but they are also common in the Alps where they connect neighboring valleys otherwise separated by impassable mountains.
old_valueAlso called a "car transport", a ferry train is a rail service that carries passengers and their vehicles across undrivable terrain. The Channel Tunnel ("Chunnel") is the most famous example, but they are also common in the Alps where they connect neighboring valleys otherwise separated by impassable mountains. Any plausible 1-dimensional path through a 2+ dimensional space, for the purposes of making graph-search-based routing possible. Such segments can be used to model paths through parking lots, squares, floors of buildings and other areas.
root['schemas']['GeostoreRankSignalProto']['properties']['type']['enumDescriptions'][7]
new_valueThis signal derived from the number of documents in DocJoin, which contains keywords of the source feature. For each raw feature, we extract keywords from the feature's name and address. We search the keywords in DocJoin (now only 4B) to get the number of webpages which contains all the keywords of the feature, eg, for Quanjude in Beijing which is a famous restaurant in China, we consider Beijing and Quanjude as its keywords, the page containing both Beijing and Quanjude will be counted in. The number will be mapped by logarithm function into [0, 1]. This signal is based on a simple assumption: the more the name appears in webpage, the more famous it is.
old_valueThis signal derived from the number of documents in DocJoin, which contains keywords of the source feature. For each raw feature, we extract keywords from the feature's name and address. We search the keywords in DocJoin (now only 4B) to get the number of webpages which contains all the keywords of the feature, eg, for Quanjude in Beijing which is a famous restaurant in China, we consider Beijing and Quanjude as its keywords, the page containing both Beijing and Quanjude will be counted in. The number will be mapped by logarithm function into [0, 1]. This signal is based on a simple assumption: the more the name appears in webpage, the more famous it is. These signals are calculated by the Path Radius algorithm, using Pathfinder to figure out in how big a neighborhood this segment is used as a thoroughfare. The popularity is simply the fraction of all paths that use this segment.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][248]
new_valueIncludes overfalls.
old_valueIncludes overfalls. A natural depression filled with water where animals come to drink.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][313]
new_valueA phone number area code is a prefix which also coincides with the area code, or national destination code, of a particular region.
old_valueA phone number area code is a prefix which also coincides with the area code, or national destination code, of a particular region. A Business Corridor is a dense cluster of semantically similar establishments. TYPE_BUSINESS_CORRIDOR features are distinguished from TYPE_COLLOQUIAL_AREA features because the corridors are not under the political hierarchy, are allowed to be nameless, and may not correspond to well-known real world locations. For more details, see go/geo-corridors-schema.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][262]
new_valueA stretch of land projecting into water. Includes capes and spits.
old_valueA stretch of land projecting into water. Includes capes and spits. A strip of land connecting two larger land masses, such as continents.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][60]
new_valueTYPE_TRANSIT_AGENCY was moved to 0xC91. This enum value exists for debugging purposes only.
old_valueTYPE_TRANSIT_AGENCY was moved to 0xC91. This enum value exists for debugging purposes only. A transfer describes the opportunity to transfer from one station to another. See also transittransfer.proto
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][353]
new_valueThis type has been replaced by TYPE_COMPOUND_BUILDING. For further details, see go/oyster-compounds
old_valueThis type has been replaced by TYPE_COMPOUND_BUILDING. For further details, see go/oyster-compounds Establishment POIs can be referenced by TYPE_COMPOUND features using the RELATION_PRIMARILY_OCCUPIED_BY. This is the reciprocal relation of the RELATION_OCCUPIES.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][364]
new_valuee.g. single family dwelling, office building.
old_valuee.g. single family dwelling, office building. e.g. suite, room, hallway, cubicle.
root['schemas']['GeostoreRoadSignComponentProto']['properties']['semanticType']['enumDescriptions'][0]
new_valueDefault value.
old_valueclang-format off Default value.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][62]
new_valueA segment path is a short path through a set of segments. They differ from routes in several ways. First, these paths are typically very short (a handful of segments). Second, these paths list the segments in a specific order. Third, these paths list segments but don't typically include the siblings of the segments.
old_valueA segment path is a short path through a set of segments. They differ from routes in several ways. First, these paths are typically very short (a handful of segments). Second, these paths list the segments in a specific order. Third, these paths list segments but don't typically include the siblings of the segments. Road sign features have names, point geometry, etc. They also have segment_path data (see below) which lists the segments that refer to the sign. See segment.proto for the reference from the segment to the road sign.
root['schemas']['GeostoreRankSignalProto']['properties']['type']['enumDescriptions'][5]
new_valueThis signal will be set on all routes and is derived by the value of the priority of all segments composing the route. It is a "derived" signal instead of a canonical one because it is not only about inheriting some child segment's priority. We actually take into consideration the priorities of all children segments to come up with a raw value for this signal.
old_valueThis signal will be set on all routes and is derived by the value of the priority of all segments composing the route. It is a "derived" signal instead of a canonical one because it is not only about inheriting some child segment's priority. We actually take into consideration the priorities of all children segments to come up with a raw value for this signal. Derived from the number of POI that use this feature as an address component.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][262]
new_valueA stretch of land projecting into water. Includes capes and spits.
old_valueA stretch of land projecting into water. Includes capes and spits. A strip of land connecting two larger land masses, such as continents.
root['schemas']['GeostoreRankSignalProto']['properties']['type']['enumDescriptions'][2]
new_valueMagnitude for features with polygonal geometry.
old_valueMagnitude for features with polygonal geometry. Derived from the number of other features that use this feature as an address component.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][364]
new_valuee.g. single family dwelling, office building.
old_valuee.g. single family dwelling, office building. e.g. suite, room, hallway, cubicle.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][315]
new_valueAn address template feature provides region-specific conventions for structuring addresses. These features aren't necessarily defined by physical geographic features, so they are classified as meta-features.
old_valueAn address template feature provides region-specific conventions for structuring addresses. These features aren't necessarily defined by physical geographic features, so they are classified as meta-features. A transit line is a collection of transit legs, associated with some invariant properties of the trips that run over the legs. See also transitline.proto
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][62]
new_valueA segment path is a short path through a set of segments. They differ from routes in several ways. First, these paths are typically very short (a handful of segments). Second, these paths list the segments in a specific order. Third, these paths list segments but don't typically include the siblings of the segments.
old_valueA segment path is a short path through a set of segments. They differ from routes in several ways. First, these paths are typically very short (a handful of segments). Second, these paths list the segments in a specific order. Third, these paths list segments but don't typically include the siblings of the segments. Road sign features have names, point geometry, etc. They also have segment_path data (see below) which lists the segments that refer to the sign. See segment.proto for the reference from the segment to the road sign.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][313]
new_valueA phone number area code is a prefix which also coincides with the area code, or national destination code, of a particular region.
old_valueA phone number area code is a prefix which also coincides with the area code, or national destination code, of a particular region. A Business Corridor is a dense cluster of semantically similar establishments. TYPE_BUSINESS_CORRIDOR features are distinguished from TYPE_COLLOQUIAL_AREA features because the corridors are not under the political hierarchy, are allowed to be nameless, and may not correspond to well-known real world locations. For more details, see go/geo-corridors-schema.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][60]
new_valueTYPE_TRANSIT_AGENCY was moved to 0xC91. This enum value exists for debugging purposes only.
old_valueTYPE_TRANSIT_AGENCY was moved to 0xC91. This enum value exists for debugging purposes only. A transfer describes the opportunity to transfer from one station to another. See also transittransfer.proto
root['schemas']['GeostorePriceRangeProto']['properties']['units']['enumDescriptions'][0]
new_valueABSTRACT
old_valueABSTRACT The root of the hierarchy. It's an abstract value and shouldn't be present in the repository.
iterable_item_added
root['schemas']['GeostoreDataSourceProto']['properties']['provider']['enum'][743]PROVIDER_PULSE_ENERGY
root['schemas']['GeostoreDataSourceProto']['properties']['provider']['enum'][744]PROVIDER_NUMOCITY
root['schemas']['GeostoreDataSourceProto']['properties']['provider']['enumDescriptions'][744]Note: Next available value is 0x127E.
root['schemas']['GeostoreFeaturePropertyIdProto']['properties']['fieldType']['enum'][83]MEDIAN_GEOMETRY_SEGMENT_LOOP
root['schemas']['GeostoreFeaturePropertyIdProto']['properties']['fieldType']['enum'][150]SEGMENT_RELATED_MEDIAN
root['schemas']['GeostoreInternalSourceSummaryProto']['properties']['provider']['enum'][743]PROVIDER_PULSE_ENERGY
root['schemas']['GeostoreInternalSourceSummaryProto']['properties']['provider']['enum'][744]PROVIDER_NUMOCITY
root['schemas']['GeostoreInternalSourceSummaryProto']['properties']['provider']['enumDescriptions'][744]Note: Next available value is 0x127E.
root['schemas']['GeostoreOntologyRawGConceptInstanceProto']['properties']['provider']['enum'][743]PROVIDER_PULSE_ENERGY
root['schemas']['GeostoreOntologyRawGConceptInstanceProto']['properties']['provider']['enum'][744]PROVIDER_NUMOCITY
root['schemas']['GeostoreOntologyRawGConceptInstanceProto']['properties']['provider']['enumDescriptions'][744]Note: Next available value is 0x127E.
root['schemas']['GeostoreProvenanceProto']['properties']['provider']['enum'][743]PROVIDER_PULSE_ENERGY
root['schemas']['GeostoreProvenanceProto']['properties']['provider']['enum'][744]PROVIDER_NUMOCITY
root['schemas']['GeostoreProvenanceProto']['properties']['provider']['enumDescriptions'][744]Note: Next available value is 0x127E.
root['schemas']['GeostoreSpeedLimitProto']['properties']['category']['enum'][4]STATUTORY
root['schemas']['GeostoreSpeedLimitProto']['properties']['category']['enumDescriptions'][4]Speed limits that are set by statute for a given area (and may also be influenced by various road attributes).
iterable_item_removed
root['schemas']['GeostoreDataSourceProto']['properties']['provider']['enumDescriptions'][742]Note: Next available value is 0x127C.
root['schemas']['GeostoreInternalSourceSummaryProto']['properties']['provider']['enumDescriptions'][742]Note: Next available value is 0x127C.
root['schemas']['GeostoreOntologyRawGConceptInstanceProto']['properties']['provider']['enumDescriptions'][742]Note: Next available value is 0x127C.
root['schemas']['GeostoreProvenanceProto']['properties']['provider']['enumDescriptions'][742]Note: Next available value is 0x127C.
root['schemas']['GeostoreRankSignalProto']['properties']['type']['enumDescriptions'][3]DEPRECATED Derived from the number of local business listings that, once reverse-geocoded, have this feature as an address component.
root['schemas']['GeostoreRankSignalProto']['properties']['type']['enumDescriptions'][37]Rank derived from feature popularity asserted by users. Higher rank values are almost always moderated to verify accuracy, hence reliable.
root['schemas']['GeostoreRankSignalProto']['properties']['type']['enumDescriptions'][64]DEPRECATED Signal for buildings in Japan. This signal is a scale of the map this building label should be rendered.
root['schemas']['GeostoreRankSignalProto']['properties']['type']['enumDescriptions'][65]DEPRECATED Signal for peaks in Japan. This signal is a scale of the map this peak label should be rendered.
root['schemas']['GeostoreSegmentProto']['properties']['barrier']['enumDescriptions'][0]Some barrier which prevents turns in the middle of a segment, but the details are not known (or the tester doesn't care to distinguish between legal and physical barriers).
root['schemas']['GeostoreTransitLineProto']['properties']['vehicleType']['enumDescriptions'][1]ABSTRACT Metropolitan railway transport, mostly for local transit.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][0]ABSTRACT The root of all types. Not a meaningful label of a feature and likewise should never be present in a geostore repository. Useful in that InCategory(t, TYPE_ANY) for all t.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][1]ABSTRACT Feature types that together define a transportation network (routes, segments, and intersections).
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][2]A route is any section of road (or rails, etc.) that has a name. This includes city streets as well as highways. Road segments can belong to multiple routes (e.g. El Camino, CA-82).
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][3]DEPRECATED This type used to have country-specific highway types but has been DEPRECATED long ago in favor of the country-agnostic subtypes of the TYPE_HIGHWAY hierarchy below.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][14]A designated bicycle route, whose segments may consist of any combination of bicycle paths, bicycle lanes, or city streets.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][15]A designated trail, which may consist of paved walkways, dirt paths, fire road, streets or highways, etc.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][32]An intersection consists of a collection of segments that terminate at the same location. This is topological definition: it may not match what a typical user would think of as an "intersection". See TYPE_INTERSECTION_GROUP, below, for more information. Each segment terminating at an intersection has an "endpoint type" that specifies how that segment is terminated: stop sign, yield sign, three-way light, etc.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][63]Our TYPE_INTERSECTION feature, above, models the point where one or more segments terminate. This is topological definition: it may not match what a typical user would think of as an "intersection". Consider the intersections where Hayes, Market, Larkin, and 9th Street meet near (37.77765, -122.41638) in San Francisco. Most people would probably consider this a single feature, even though we model it as four separate TYPE_INTERSECTION features. This TYPE_INTERSECTION_GROUP is used to model the user's concept of a complex intersection.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][64]A Pathway describes a physical pathway in between two features. See also pathway.proto
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][65]A restriction group describes a set of segment restrictions that belong together and have a name or an associated event.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][66]A toll cluster is either a single point on a segment (represented as a point at the end of the segment that has ENDPOINT_TOLL_BOOTH set) or a group of points on various road segments in MapFacts that represents one or more lanes passing through a toll fixture that all go to the same routing destination. Each toll cluster should have at most a single price per payment method. E.g. {CASH = $5, PASS = $1}. Note: If a toll fixture has different prices for multiple routing destinations, drivers need to be in the correct lane before passing through the toll fixture and hence such a fixture is represented by multiple toll clusters. A toll cluster does not necessarily represent a real-world entity, e.g. a particular plaza/structure as perceived by humans. This is because a plaza can be represented by more than one toll cluster. We require toll clusters to have names, but they might be non-unique. For example, a plaza might be represented by multiple toll clusters that may have the same plaza name. For further details, please see go/toll-cluster-schema.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][84]e.g. Silicon Valley
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][86]In countries where localities are not more structured (e.g. US and CA), we don't bother with subcategories.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][91]An entity widely considered to be a city, that is itself made up of several smaller entities, some of which are cities themselves. For example, Sydney, Australia is comprised of many smaller cities, and is colloquially regarded as a city itself. New York City, on the other hand, contains boroughs, but not other cities.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][111]Eventually we'll have more data for disputed areas (e.g., who makes claims on the area, who has de facto control, etc.). For the moment, we just define a type so we can simply mark areas as disputed.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][112]Boundaries representing the jurisdiction of a particular police station.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][113]An area used for aggregating statistical data, eg, a census region.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][114]RESERVED Constituencies that will go into effect at a future start date. They have unique geometries informative to constituents, politicians, and advertisers.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][173]RESERVED Non-logical point, line, or polygon data to draw on a map. This was introduced by the Japan team to make the maps look more pretty. This is a hack we don't want to extend, so this is marked as reserved even though it appears in Zenrin data (whitelisted).
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][189]A line representing the boundary between two features. See border.proto for details.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][191]An association of a point with an address, with no other information.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][208]A flat expanse of salt left by the evaporation of a body of salt water.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][249]DEPRECATED This type is incorrectly under TYPE_TECTONIC instead of TYPE_WATER. This was a mistake and is in the the process of being fixed. b/6537580
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][282]An area containing numerous geologically related mountains.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][297]A feature representing a group or chain of islands.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][298]ABSTRACT Types which are used only as portions of postal addresses. TYPE_POSTAL is concrete in Saudi Arabia but abstract everywhere else.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][299]This is the type for postal codes which are complete and independent enough that there should be a feature for it (e.g. US 5-digit ZIP codes). For even more detailed suffixes that further subdivide a postal code (such as the +4 component in US ZIP codes), store the information in a TYPE_POSTAL_CODE_SUFFIX address component.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][300]A prefix portion of a postal code which does not meet the requirements for TYPE_POSTAL_CODE, but which is useful to search for, for example UK outcodes.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][301]A premise is a location at smaller than street granularity.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][304]The term "post town" is used for a locality-like-entity that is only used for postal addresses. It would not make sense to show such an entity on the map, but it may be searched for and may be in the address of other features.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][305]A named delivery route. For example, in NZ rural addresses take the form "Delivery Route Number, Posttown, Postcode, NZ"
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][316]RESERVED A feature whose geometry is planned to replace the geometry on another feature.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][321]RESERVED A temporary feature that is only used internally to a single application. These features should not be written to Oyster repositories or presented to clients. If the application wishes to use multiple transient types, it is responsible for differentiating them using the temporary_data field or other mechanism.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][322]A portal of entry or exit to another feature. Examples: - Subway station entrance. - Parking lot entrance.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][354]RESERVED Represents service-only establishments (those without a storefront location). NOTE(tcain): Using value 0xD441, since we could find ourselves with a need to differentiate service areas from online-only at this level in the future, but still benefit from being able to group those under a common parent, disjoint from TYPE_ESTABLISHMENT_POI.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][355]The root of types of features that are in the sky, rather than on the earth. There will eventually be a hierarchy of types here.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][356]Features responsible for monitoring traffic on roads (usually for speed). Includes cameras at particular points as well as monitors that cover larger spans. Features of this type should have a corresponding gcid that specifies the correct subtype (e.g. gcid:road_camera or gcid:speed_camera_zone). This type was originally named as TYPE_ROAD_CAMERA.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][360]A feature used to represent a logical level, e.g. floor.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][365]RESERVED A terminal point represents a good location for a user to meet a taxi, ridesharing vehicle, or general driver.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][366]An area controlled in some way by an authoritative source, such as a government-designated COVID containment zone. Features of this type should have one or more gcids corresponding to their specific regulation.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][369]RESERVED A fake feature type so we can csearch for automatically generated files that use the FeatureProto types hierarchy.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][370]A feature of completely unknown type. This should only be used when absolutely necessary. One example in which this type is useful is in the Chinese importer, which must heuristically segment addresses into components - it often does not know what types to make those components. Please note that the Oyster address formatter does not currently support address components of TYPE_UNKNOWN well.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][0]ABSTRACT The root of all types. Not a meaningful label of a feature and likewise should never be present in a geostore repository. Useful in that InCategory(t, TYPE_ANY) for all t.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][1]ABSTRACT Feature types that together define a transportation network (routes, segments, and intersections).
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][2]A route is any section of road (or rails, etc.) that has a name. This includes city streets as well as highways. Road segments can belong to multiple routes (e.g. El Camino, CA-82).
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][3]DEPRECATED This type used to have country-specific highway types but has been DEPRECATED long ago in favor of the country-agnostic subtypes of the TYPE_HIGHWAY hierarchy below.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][14]A designated bicycle route, whose segments may consist of any combination of bicycle paths, bicycle lanes, or city streets.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][15]A designated trail, which may consist of paved walkways, dirt paths, fire road, streets or highways, etc.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][32]An intersection consists of a collection of segments that terminate at the same location. This is topological definition: it may not match what a typical user would think of as an "intersection". See TYPE_INTERSECTION_GROUP, below, for more information. Each segment terminating at an intersection has an "endpoint type" that specifies how that segment is terminated: stop sign, yield sign, three-way light, etc.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][63]Our TYPE_INTERSECTION feature, above, models the point where one or more segments terminate. This is topological definition: it may not match what a typical user would think of as an "intersection". Consider the intersections where Hayes, Market, Larkin, and 9th Street meet near (37.77765, -122.41638) in San Francisco. Most people would probably consider this a single feature, even though we model it as four separate TYPE_INTERSECTION features. This TYPE_INTERSECTION_GROUP is used to model the user's concept of a complex intersection.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][64]A Pathway describes a physical pathway in between two features. See also pathway.proto
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][65]A restriction group describes a set of segment restrictions that belong together and have a name or an associated event.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][66]A toll cluster is either a single point on a segment (represented as a point at the end of the segment that has ENDPOINT_TOLL_BOOTH set) or a group of points on various road segments in MapFacts that represents one or more lanes passing through a toll fixture that all go to the same routing destination. Each toll cluster should have at most a single price per payment method. E.g. {CASH = $5, PASS = $1}. Note: If a toll fixture has different prices for multiple routing destinations, drivers need to be in the correct lane before passing through the toll fixture and hence such a fixture is represented by multiple toll clusters. A toll cluster does not necessarily represent a real-world entity, e.g. a particular plaza/structure as perceived by humans. This is because a plaza can be represented by more than one toll cluster. We require toll clusters to have names, but they might be non-unique. For example, a plaza might be represented by multiple toll clusters that may have the same plaza name. For further details, please see go/toll-cluster-schema.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][84]e.g. Silicon Valley
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][86]In countries where localities are not more structured (e.g. US and CA), we don't bother with subcategories.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][91]An entity widely considered to be a city, that is itself made up of several smaller entities, some of which are cities themselves. For example, Sydney, Australia is comprised of many smaller cities, and is colloquially regarded as a city itself. New York City, on the other hand, contains boroughs, but not other cities.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][111]Eventually we'll have more data for disputed areas (e.g., who makes claims on the area, who has de facto control, etc.). For the moment, we just define a type so we can simply mark areas as disputed.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][112]Boundaries representing the jurisdiction of a particular police station.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][113]An area used for aggregating statistical data, eg, a census region.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][114]RESERVED Constituencies that will go into effect at a future start date. They have unique geometries informative to constituents, politicians, and advertisers.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][173]RESERVED Non-logical point, line, or polygon data to draw on a map. This was introduced by the Japan team to make the maps look more pretty. This is a hack we don't want to extend, so this is marked as reserved even though it appears in Zenrin data (whitelisted).
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][189]A line representing the boundary between two features. See border.proto for details.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][191]An association of a point with an address, with no other information.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][208]A flat expanse of salt left by the evaporation of a body of salt water.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][249]DEPRECATED This type is incorrectly under TYPE_TECTONIC instead of TYPE_WATER. This was a mistake and is in the the process of being fixed. b/6537580
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][282]An area containing numerous geologically related mountains.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][297]A feature representing a group or chain of islands.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][298]ABSTRACT Types which are used only as portions of postal addresses. TYPE_POSTAL is concrete in Saudi Arabia but abstract everywhere else.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][299]This is the type for postal codes which are complete and independent enough that there should be a feature for it (e.g. US 5-digit ZIP codes). For even more detailed suffixes that further subdivide a postal code (such as the +4 component in US ZIP codes), store the information in a TYPE_POSTAL_CODE_SUFFIX address component.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][300]A prefix portion of a postal code which does not meet the requirements for TYPE_POSTAL_CODE, but which is useful to search for, for example UK outcodes.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][301]A premise is a location at smaller than street granularity.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][304]The term "post town" is used for a locality-like-entity that is only used for postal addresses. It would not make sense to show such an entity on the map, but it may be searched for and may be in the address of other features.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][305]A named delivery route. For example, in NZ rural addresses take the form "Delivery Route Number, Posttown, Postcode, NZ"
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][316]RESERVED A feature whose geometry is planned to replace the geometry on another feature.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][321]RESERVED A temporary feature that is only used internally to a single application. These features should not be written to Oyster repositories or presented to clients. If the application wishes to use multiple transient types, it is responsible for differentiating them using the temporary_data field or other mechanism.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][322]A portal of entry or exit to another feature. Examples: - Subway station entrance. - Parking lot entrance.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][354]RESERVED Represents service-only establishments (those without a storefront location). NOTE(tcain): Using value 0xD441, since we could find ourselves with a need to differentiate service areas from online-only at this level in the future, but still benefit from being able to group those under a common parent, disjoint from TYPE_ESTABLISHMENT_POI.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][355]The root of types of features that are in the sky, rather than on the earth. There will eventually be a hierarchy of types here.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][356]Features responsible for monitoring traffic on roads (usually for speed). Includes cameras at particular points as well as monitors that cover larger spans. Features of this type should have a corresponding gcid that specifies the correct subtype (e.g. gcid:road_camera or gcid:speed_camera_zone). This type was originally named as TYPE_ROAD_CAMERA.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][360]A feature used to represent a logical level, e.g. floor.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][365]RESERVED A terminal point represents a good location for a user to meet a taxi, ridesharing vehicle, or general driver.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][366]An area controlled in some way by an authoritative source, such as a government-designated COVID containment zone. Features of this type should have one or more gcids corresponding to their specific regulation.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][369]RESERVED A fake feature type so we can csearch for automatically generated files that use the FeatureProto types hierarchy.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][370]A feature of completely unknown type. This should only be used when absolutely necessary. One example in which this type is useful is in the Chinese importer, which must heuristically segment addresses into components - it often does not know what types to make those components. Please note that the Oyster address formatter does not currently support address components of TYPE_UNKNOWN well.
prod/semanticlocation-pa-v1
dictionary_item_added
  • root['schemas']['GeostoreMedianProto']
  • root['schemas']['GeostoreMedianProtoSegmentLoopProto']
  • root['schemas']['GeostoreMedianProtoSegmentLoopProtoIndexedComponentProto']
  • root['schemas']['GeostoreCityObjectAttributesTrsAffineTransform']['description']
  • root['schemas']['GeostoreFeatureProto']['properties']['median']
  • root['schemas']['GeostoreRestrictionProto']['properties']['restrictionId']
  • root['schemas']['GeostoreSegmentProto']['properties']['relatedMedian']
  • root['schemas']['LocationPlacesPlacesserverPlaceInfoMobile']['properties']['transitCategory']
dictionary_item_removed
  • root['schemas']['GeostoreAccessPointProto']['properties']['priority']['description']
  • root['schemas']['GeostoreBestLocaleProto']['properties']['metadata']['description']
  • root['schemas']['GeostoreRankSignalProto']['description']
  • root['schemas']['GeostoreRestrictionProto']['properties']['type']['description']
  • root['schemas']['GeostoreSegmentProto']['properties']['priority']['description']
  • root['schemas']['GeostoreSegmentProto']['properties']['surface']['description']
  • root['schemas']['GeostoreSegmentProto']['properties']['usage']['description']
  • root['schemas']['IndexingMoonshineHappyhourTypesLocation']['properties']['semanticType']['description']
values_changed
root['revision']
new_value20250303
old_value20250210
root['schemas']['GeostoreAccessPointProto']['description']
new_valueThis class holds information about a single access point. An access point establishes a relationship between a feature (like a POI or building) and some other feature. For example, consider a TYPE_LOCALITY feature like Seattle. An access point might be the TYPE_AIRPORT feature for Seattle-Tacoma International Airport. The airport feature defines the access point to gain airplane-based access to Seattle. A feature like Seattle will typically have multiple access points. You can get to Seattle using airplanes, various forms of public transit, or by driving a car. Thus Seattle would have multiple access points. You may be able to get to Seattle by flying into SeaTac, or you might be able to fly into Boeing Field, or Paine Field in Everett. You could drive in from the North/South using I-5, or you could drive in from the East using I-90. Many access points are from the road network. Thus the access point for some building at 123 Main Street would likely be a segment that defines the 100-200 block of "Main Street". A feature at the corner of "Hollywood" and "Vine" streets might have access points from both named streets. Access points are an optional field. Data editors may ignore them when creating features or editing other fields. In these cases, other quality teams will synthesize and update them. Several fields are also optional, as they are derivable from other fields. Access points to non-TYPE_SEGMENT features should always have the following fields set: - feature_type - feature_id - point Location and reference fields: BASIC vs DERIVABLE Access points to TYPE_SEGMENT features must have all the following BASIC fields: - feature_type (of the segment, e.g. TYPE_ROAD or TYPE_VIRTUAL_SEGMENT) - point_off_segment (or point; see "fuzzy point" note below) - unsuitable_travel_mode (may be empty) - level (indoor access points only) The following are DERIVABLE fields, which should only be added if the supplier is confident about their accuracy: - feature_id - point_on_segment - segment_position Editing clients are encouraged to set all fields, but they may set only the BASIC fields, in which case quality teams may use the BASIC fields to snap to an appropriate segment and derive the remaining fields. Example: The segment is split, so that the portion that the access point is on has a new feature ID. Quality teams notice that the point_on_segment is no longer on the segment with feature_id, finds the new nearest segment based on feature_type and existing point_on_segment, and re-derives a new feature_id, point_on_segment, and segment_position, keeping other fields consistent. Fuzzy point special case If the editor does not have side-of-road information for access points or is otherwise unsure of the precise placement of the access point, it may supply the point field (and not point_off_segment) as basic data instead, in which case quality teams may generate the point_off_segment. Identity Access points are considered semantically equivalent if they have the same geometry, including derived fields, and the same references to other features (feature_id, level_feature_id). For the exact definition, see cs/symbol:geostore::AreAccessPointsEquivalent.
old_valueThis class holds information about a single access point. An access point establishes a relationship between a feature (like a POI or building) and some other feature. For example, consider a TYPE_LOCALITY feature like Seattle. An access point might be the TYPE_AIRPORT feature for Seattle-Tacoma International Airport. The airport feature defines the access point to gain airplane-based access to Seattle. A feature like Seattle will typically have multiple access points. You can get to Seattle using airplanes, various forms of public transit, or by driving a car. Thus Seattle would have multiple access points. You may be able to get to Seattle by flying into SeaTac, or you might be able to fly into Boeing Field, or Paine Field in Everett. You could drive in from the North/South using I-5, or you could drive in from the East using I-90. Many access points are from the road network. Thus the access point for some building at 123 Main Street would likely be a segment that defines the 100-200 block of "Main Street". A feature at the corner of "Hollywood" and "Vine" streets might have access points from both named streets. Access points are an optional field. Data editors may ignore them when creating features or editing other fields. In these cases, other quality teams will synthesize and update them. Several fields are also optional, as they are derivable from other fields. Access points to non-TYPE_SEGMENT features should always have the following fields set: - feature_type - feature_id - point Location and reference fields: BASIC vs DERIVABLE Access points to TYPE_SEGMENT features must have all the following BASIC fields: - feature_type (of the segment, e.g. TYPE_ROAD or TYPE_VIRTUAL_SEGMENT) - point_off_segment (or point; see "fuzzy point" note below) - unsuitable_travel_mode (may be empty) - level (indoor access points only) The following are DERIVABLE fields, which should only be added if the supplier is confident about their accuracy: - feature_id - point_on_segment - segment_position Editing clients are encouraged to set all fields, but they may set only the BASIC fields, in which case quality teams may use the BASIC fields to snap to an appropriate segment and derive the remaining fields. Example: The segment is split, so that the portion that the access point is on has a new feature ID. Quality teams notice that the point_on_segment is no longer on the segment with feature_id, finds the new nearest segment based on feature_type and existing point_on_segment, and re-derives a new feature_id, point_on_segment, and segment_position, keeping other fields consistent. Fuzzy point special case If the editor does not have side-of-road information for access points or is otherwise unsure of the precise placement of the access point, it may supply the point field (and not point_off_segment) as basic data instead, in which case quality teams may generate the point_off_segment. Identity Access points are considered semantically equivalent if they have the same geometry, including derived fields, and the same references to other features (feature_id, level_feature_id). For the exact definition, see cs/symbol:geostore::AreAccessPointsEquivalent. Field definitions
root['schemas']['GeostoreBestLocaleProto']['description']
new_valueA BestLocaleProto holds information about the best-match locale for a feature. Clients may use this information to determine the appropriate local name of a feature. Field-level metadata for this best locale.
old_valueA BestLocaleProto holds information about the best-match locale for a feature. Clients may use this information to determine the appropriate local name of a feature.
root['schemas']['GeostoreCityObjectAttributes']['properties']['trsAffineTransform']['description']
new_valueA local-to-ECEF affine transform. In the local frame, +X/+Y/+Z represents left/up/forward. It is strongly recommended that clients read from and write to this field using either of the provided public: * Builder library: google3/geostore/base/cityjson/cityjsonproto_builder.h * Converter functions: google3/geostore/base/cityjson/affine/trs_affine_transform_converter.h
old_valueA local-to-ECEF affine transform. In the local frame, +X/+Y/+Z represents left/up/forward. It is strongly recommended that clients read from and write to this field using the provided public converter libraries.
root['schemas']['GeostorePriceRangeProto']['description']
new_valueThis message represents a price range of an attribute. The meaning of the price bounds is domain specific. But mainly they are soft bounds for a normal usage. E.g. "restaurant prices" are subject to an higher level of "soft" bounds than "museum admission price" NOTE: In the future, it could be useful to have a 'factor' field. For example, if you get billed per 2 hours or per 30 minutes.
old_valueThis message represents a price range of an attribute. The meaning of the price bounds is domain specific. But mainly they are soft bounds for a normal usage. E.g. "restaurant prices" are subject to an higher level of "soft" bounds than "museum admission price"
root['schemas']['GeostoreRoadDisruptionProto']['description']
new_valueA road disruption is any temporary deviation from the 'normal' state of the road network that impacts users' travel experience. The normal state means roads follow their specified sets of restrictions and allow safe driving at a relatively normal speed for the road. Disruptions may not always be negative, e.g. a road that is normally closed has been opened as an emergency evacuation route. Disruptions might have additional data depending on their types. Disruption types are mutually exclusive, so at most one of these might apply.
old_valueA road disruption is any temporary deviation from the 'normal' state of the road network that impacts users' travel experience. The normal state means roads follow their specified sets of restrictions and allow safe driving at a relatively normal speed for the road. Disruptions may not always be negative, e.g. a road that is normally closed has been opened as an emergency evacuation route.
root['schemas']['GeostoreSegmentProto']['description']
new_valueWARNING!! If you add new fields to SegmentProto (or submessages), you must: * Maybe update theSegmentSplitter, if there is special logic when a segment is split, e.g. to adjust fractional attributes; most straightforward attributes *should* be copied over automatically: java/com/google/geostore/base/SegmentSplitter.java * Update the SegmentMerger to correctly copy, update, or delete the fields upon a segmenet merge: java/com/google/geostore/base/SegmentMerger.java * Determine whether the fields are irrelevant for rendering high priority roads at far-out zoom levels, and if not clear them: ClearFeature() in maps/render/process-high-priority-roads.cc * Determine whether the fields are required for rendering, and if not clear them: StripFeature() in maps/render/bucketing-util.cc * Update the tests that ensure the above packages are aware of all SegmentProto fields, or the new fields will a) break the Versatile build and/or b) cause performance regressions due to segment merge failures: - process-high-priority-roads_test.cc - bucketing-util_test.cc LINT.IfChange
old_valueWARNING!! If you add new fields to SegmentProto (or submessages), you must: * Maybe update theSegmentSplitter, if there is special logic when a segment is split, e.g. to adjust fractional attributes; most straightforward attributes *should* be copied over automatically: java/com/google/geostore/base/SegmentSplitter.java * Update the SegmentMerger to correctly copy, update, or delete the fields upon a segmenet merge: java/com/google/geostore/base/SegmentMerger.java * Determine whether the fields are irrelevant for rendering high priority roads at far-out zoom levels, and if not clear them: ClearFeature() in maps/render/process-high-priority-roads.cc * Determine whether the fields are required for rendering, and if not clear them: StripFeature() in maps/render/bucketing-util.cc * Update the tests that ensure the above packages are aware of all SegmentProto fields, or the new fields will a) break the Versatile build and/or b) cause performance regressions due to segment merge failures: - process-high-priority-roads_test.cc - bucketing-util_test.cc LINT.IfChange()
root['schemas']['GeostoreSegmentProto']['properties']['legalMinimumSpeed']['description']
new_valueLINT.ThenChange( //depot/google3/geostore/base/internal/segment.cc:has_speed_limit )
old_valueLINT.ThenChange(//depot/google3/geostore/base/internal/segment.cc:has_speed_limit)
root['schemas']['GeostoreVehicleOccupancyRangeProto']['description']
new_valueDescribes the range of occupants in a vehicle.
old_valueDescribes the range of occupants in a vehicle. The minimum number of occupants allowed in the vehicle, including the driver. Must be >= 0.
root['schemas']['LocationPlacesPlacesserverPlaceInfoMobile']['description']
new_valueProto containing all the information about a particular place that is used by CSL and ODLH to compute features. Next tag: 40
old_valueProto containing all the information about a particular place that is used by ELSA to compute features. Next tag: 39
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][274]
new_valueA vertical or nearly vertical slope. Includes escarpments.
old_valueA vertical or nearly vertical slope. Includes escarpments. An elevated place that is notable for having a good view.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][31]
new_valueAlso called a "car transport", a ferry train is a rail service that carries passengers and their vehicles across undrivable terrain. The Channel Tunnel ("Chunnel") is the most famous example, but they are also common in the Alps where they connect neighboring valleys otherwise separated by impassable mountains.
old_valueAlso called a "car transport", a ferry train is a rail service that carries passengers and their vehicles across undrivable terrain. The Channel Tunnel ("Chunnel") is the most famous example, but they are also common in the Alps where they connect neighboring valleys otherwise separated by impassable mountains. Any plausible 1-dimensional path through a 2+ dimensional space, for the purposes of making graph-search-based routing possible. Such segments can be used to model paths through parking lots, squares, floors of buildings and other areas.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][353]
new_valueThis type has been replaced by TYPE_COMPOUND_BUILDING. For further details, see go/oyster-compounds
old_valueThis type has been replaced by TYPE_COMPOUND_BUILDING. For further details, see go/oyster-compounds Establishment POIs can be referenced by TYPE_COMPOUND features using the RELATION_PRIMARILY_OCCUPIED_BY. This is the reciprocal relation of the RELATION_OCCUPIES.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][274]
new_valueA vertical or nearly vertical slope. Includes escarpments.
old_valueA vertical or nearly vertical slope. Includes escarpments. An elevated place that is notable for having a good view.
root['schemas']['GeostoreRestrictionProto']['properties']['type']['enumDescriptions'][8]
new_valueTravel over this segment is prohibited because of signage indicating one-way directionality in the opposite direction. This restriction type may not be used for restrictions with non-empty subpaths.
old_valueTravel over this segment is prohibited because of signage indicating one-way directionality in the opposite direction. This restriction type may not be used for restrictions with non-empty subpaths. Segment is part of a road or area for which through-travel is restricted. This restriction allows for vehicles to be routed on a road only if the destination lies within the restricted area or there is no alternate connectivity to the destination. This restriction type may be used only for restrictions of STYLE_SINGLE.
root['schemas']['GeostoreTransitLineProto']['properties']['vehicleType']['enumDescriptions'][16]
new_valueAn aerial lift (colloquially called "gondola lift") is a means of cable transport in which cabins, cars, gondolas or open chairs are hauled above the ground by means of one or more cables. Examples: gondola lift, aerial tramway.
old_valueAn aerial lift (colloquially called "gondola lift") is a means of cable transport in which cabins, cars, gondolas or open chairs are hauled above the ground by means of one or more cables. Examples: gondola lift, aerial tramway. Funicular is a cable railway in which a pair of tram-like vehicles use each other as counter balance to ascend and descend.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][248]
new_valueIncludes overfalls.
old_valueIncludes overfalls. A natural depression filled with water where animals come to drink.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][315]
new_valueAn address template feature provides region-specific conventions for structuring addresses. These features aren't necessarily defined by physical geographic features, so they are classified as meta-features.
old_valueAn address template feature provides region-specific conventions for structuring addresses. These features aren't necessarily defined by physical geographic features, so they are classified as meta-features. A transit line is a collection of transit legs, associated with some invariant properties of the trips that run over the legs. See also transitline.proto
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][31]
new_valueAlso called a "car transport", a ferry train is a rail service that carries passengers and their vehicles across undrivable terrain. The Channel Tunnel ("Chunnel") is the most famous example, but they are also common in the Alps where they connect neighboring valleys otherwise separated by impassable mountains.
old_valueAlso called a "car transport", a ferry train is a rail service that carries passengers and their vehicles across undrivable terrain. The Channel Tunnel ("Chunnel") is the most famous example, but they are also common in the Alps where they connect neighboring valleys otherwise separated by impassable mountains. Any plausible 1-dimensional path through a 2+ dimensional space, for the purposes of making graph-search-based routing possible. Such segments can be used to model paths through parking lots, squares, floors of buildings and other areas.
root['schemas']['GeostoreRankSignalProto']['properties']['type']['enumDescriptions'][7]
new_valueThis signal derived from the number of documents in DocJoin, which contains keywords of the source feature. For each raw feature, we extract keywords from the feature's name and address. We search the keywords in DocJoin (now only 4B) to get the number of webpages which contains all the keywords of the feature, eg, for Quanjude in Beijing which is a famous restaurant in China, we consider Beijing and Quanjude as its keywords, the page containing both Beijing and Quanjude will be counted in. The number will be mapped by logarithm function into [0, 1]. This signal is based on a simple assumption: the more the name appears in webpage, the more famous it is.
old_valueThis signal derived from the number of documents in DocJoin, which contains keywords of the source feature. For each raw feature, we extract keywords from the feature's name and address. We search the keywords in DocJoin (now only 4B) to get the number of webpages which contains all the keywords of the feature, eg, for Quanjude in Beijing which is a famous restaurant in China, we consider Beijing and Quanjude as its keywords, the page containing both Beijing and Quanjude will be counted in. The number will be mapped by logarithm function into [0, 1]. This signal is based on a simple assumption: the more the name appears in webpage, the more famous it is. These signals are calculated by the Path Radius algorithm, using Pathfinder to figure out in how big a neighborhood this segment is used as a thoroughfare. The popularity is simply the fraction of all paths that use this segment.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][248]
new_valueIncludes overfalls.
old_valueIncludes overfalls. A natural depression filled with water where animals come to drink.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][313]
new_valueA phone number area code is a prefix which also coincides with the area code, or national destination code, of a particular region.
old_valueA phone number area code is a prefix which also coincides with the area code, or national destination code, of a particular region. A Business Corridor is a dense cluster of semantically similar establishments. TYPE_BUSINESS_CORRIDOR features are distinguished from TYPE_COLLOQUIAL_AREA features because the corridors are not under the political hierarchy, are allowed to be nameless, and may not correspond to well-known real world locations. For more details, see go/geo-corridors-schema.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][262]
new_valueA stretch of land projecting into water. Includes capes and spits.
old_valueA stretch of land projecting into water. Includes capes and spits. A strip of land connecting two larger land masses, such as continents.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][60]
new_valueTYPE_TRANSIT_AGENCY was moved to 0xC91. This enum value exists for debugging purposes only.
old_valueTYPE_TRANSIT_AGENCY was moved to 0xC91. This enum value exists for debugging purposes only. A transfer describes the opportunity to transfer from one station to another. See also transittransfer.proto
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][353]
new_valueThis type has been replaced by TYPE_COMPOUND_BUILDING. For further details, see go/oyster-compounds
old_valueThis type has been replaced by TYPE_COMPOUND_BUILDING. For further details, see go/oyster-compounds Establishment POIs can be referenced by TYPE_COMPOUND features using the RELATION_PRIMARILY_OCCUPIED_BY. This is the reciprocal relation of the RELATION_OCCUPIES.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][364]
new_valuee.g. single family dwelling, office building.
old_valuee.g. single family dwelling, office building. e.g. suite, room, hallway, cubicle.
root['schemas']['GeostoreRoadSignComponentProto']['properties']['semanticType']['enumDescriptions'][0]
new_valueDefault value.
old_valueclang-format off Default value.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][62]
new_valueA segment path is a short path through a set of segments. They differ from routes in several ways. First, these paths are typically very short (a handful of segments). Second, these paths list the segments in a specific order. Third, these paths list segments but don't typically include the siblings of the segments.
old_valueA segment path is a short path through a set of segments. They differ from routes in several ways. First, these paths are typically very short (a handful of segments). Second, these paths list the segments in a specific order. Third, these paths list segments but don't typically include the siblings of the segments. Road sign features have names, point geometry, etc. They also have segment_path data (see below) which lists the segments that refer to the sign. See segment.proto for the reference from the segment to the road sign.
root['schemas']['GeostoreRankSignalProto']['properties']['type']['enumDescriptions'][5]
new_valueThis signal will be set on all routes and is derived by the value of the priority of all segments composing the route. It is a "derived" signal instead of a canonical one because it is not only about inheriting some child segment's priority. We actually take into consideration the priorities of all children segments to come up with a raw value for this signal.
old_valueThis signal will be set on all routes and is derived by the value of the priority of all segments composing the route. It is a "derived" signal instead of a canonical one because it is not only about inheriting some child segment's priority. We actually take into consideration the priorities of all children segments to come up with a raw value for this signal. Derived from the number of POI that use this feature as an address component.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][262]
new_valueA stretch of land projecting into water. Includes capes and spits.
old_valueA stretch of land projecting into water. Includes capes and spits. A strip of land connecting two larger land masses, such as continents.
root['schemas']['GeostoreRankSignalProto']['properties']['type']['enumDescriptions'][2]
new_valueMagnitude for features with polygonal geometry.
old_valueMagnitude for features with polygonal geometry. Derived from the number of other features that use this feature as an address component.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][364]
new_valuee.g. single family dwelling, office building.
old_valuee.g. single family dwelling, office building. e.g. suite, room, hallway, cubicle.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][315]
new_valueAn address template feature provides region-specific conventions for structuring addresses. These features aren't necessarily defined by physical geographic features, so they are classified as meta-features.
old_valueAn address template feature provides region-specific conventions for structuring addresses. These features aren't necessarily defined by physical geographic features, so they are classified as meta-features. A transit line is a collection of transit legs, associated with some invariant properties of the trips that run over the legs. See also transitline.proto
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][62]
new_valueA segment path is a short path through a set of segments. They differ from routes in several ways. First, these paths are typically very short (a handful of segments). Second, these paths list the segments in a specific order. Third, these paths list segments but don't typically include the siblings of the segments.
old_valueA segment path is a short path through a set of segments. They differ from routes in several ways. First, these paths are typically very short (a handful of segments). Second, these paths list the segments in a specific order. Third, these paths list segments but don't typically include the siblings of the segments. Road sign features have names, point geometry, etc. They also have segment_path data (see below) which lists the segments that refer to the sign. See segment.proto for the reference from the segment to the road sign.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][313]
new_valueA phone number area code is a prefix which also coincides with the area code, or national destination code, of a particular region.
old_valueA phone number area code is a prefix which also coincides with the area code, or national destination code, of a particular region. A Business Corridor is a dense cluster of semantically similar establishments. TYPE_BUSINESS_CORRIDOR features are distinguished from TYPE_COLLOQUIAL_AREA features because the corridors are not under the political hierarchy, are allowed to be nameless, and may not correspond to well-known real world locations. For more details, see go/geo-corridors-schema.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][60]
new_valueTYPE_TRANSIT_AGENCY was moved to 0xC91. This enum value exists for debugging purposes only.
old_valueTYPE_TRANSIT_AGENCY was moved to 0xC91. This enum value exists for debugging purposes only. A transfer describes the opportunity to transfer from one station to another. See also transittransfer.proto
root['schemas']['GeostorePriceRangeProto']['properties']['units']['enumDescriptions'][0]
new_valueABSTRACT
old_valueABSTRACT The root of the hierarchy. It's an abstract value and shouldn't be present in the repository.
iterable_item_added
root['schemas']['GeostoreDataSourceProto']['properties']['provider']['enum'][743]PROVIDER_PULSE_ENERGY
root['schemas']['GeostoreDataSourceProto']['properties']['provider']['enum'][744]PROVIDER_NUMOCITY
root['schemas']['GeostoreDataSourceProto']['properties']['provider']['enumDescriptions'][744]Note: Next available value is 0x127E.
root['schemas']['GeostoreFeaturePropertyIdProto']['properties']['fieldType']['enum'][83]MEDIAN_GEOMETRY_SEGMENT_LOOP
root['schemas']['GeostoreFeaturePropertyIdProto']['properties']['fieldType']['enum'][150]SEGMENT_RELATED_MEDIAN
root['schemas']['GeostoreInternalSourceSummaryProto']['properties']['provider']['enum'][743]PROVIDER_PULSE_ENERGY
root['schemas']['GeostoreInternalSourceSummaryProto']['properties']['provider']['enum'][744]PROVIDER_NUMOCITY
root['schemas']['GeostoreInternalSourceSummaryProto']['properties']['provider']['enumDescriptions'][744]Note: Next available value is 0x127E.
root['schemas']['GeostoreOntologyRawGConceptInstanceProto']['properties']['provider']['enum'][743]PROVIDER_PULSE_ENERGY
root['schemas']['GeostoreOntologyRawGConceptInstanceProto']['properties']['provider']['enum'][744]PROVIDER_NUMOCITY
root['schemas']['GeostoreOntologyRawGConceptInstanceProto']['properties']['provider']['enumDescriptions'][744]Note: Next available value is 0x127E.
root['schemas']['GeostoreProvenanceProto']['properties']['provider']['enum'][743]PROVIDER_PULSE_ENERGY
root['schemas']['GeostoreProvenanceProto']['properties']['provider']['enum'][744]PROVIDER_NUMOCITY
root['schemas']['GeostoreProvenanceProto']['properties']['provider']['enumDescriptions'][744]Note: Next available value is 0x127E.
root['schemas']['GeostoreSpeedLimitProto']['properties']['category']['enum'][4]STATUTORY
root['schemas']['GeostoreSpeedLimitProto']['properties']['category']['enumDescriptions'][4]Speed limits that are set by statute for a given area (and may also be influenced by various road attributes).
iterable_item_removed
root['schemas']['GeostoreDataSourceProto']['properties']['provider']['enumDescriptions'][742]Note: Next available value is 0x127C.
root['schemas']['GeostoreInternalSourceSummaryProto']['properties']['provider']['enumDescriptions'][742]Note: Next available value is 0x127C.
root['schemas']['GeostoreOntologyRawGConceptInstanceProto']['properties']['provider']['enumDescriptions'][742]Note: Next available value is 0x127C.
root['schemas']['GeostoreProvenanceProto']['properties']['provider']['enumDescriptions'][742]Note: Next available value is 0x127C.
root['schemas']['GeostoreRankSignalProto']['properties']['type']['enumDescriptions'][3]DEPRECATED Derived from the number of local business listings that, once reverse-geocoded, have this feature as an address component.
root['schemas']['GeostoreRankSignalProto']['properties']['type']['enumDescriptions'][37]Rank derived from feature popularity asserted by users. Higher rank values are almost always moderated to verify accuracy, hence reliable.
root['schemas']['GeostoreRankSignalProto']['properties']['type']['enumDescriptions'][64]DEPRECATED Signal for buildings in Japan. This signal is a scale of the map this building label should be rendered.
root['schemas']['GeostoreRankSignalProto']['properties']['type']['enumDescriptions'][65]DEPRECATED Signal for peaks in Japan. This signal is a scale of the map this peak label should be rendered.
root['schemas']['GeostoreSegmentProto']['properties']['barrier']['enumDescriptions'][0]Some barrier which prevents turns in the middle of a segment, but the details are not known (or the tester doesn't care to distinguish between legal and physical barriers).
root['schemas']['GeostoreTransitLineProto']['properties']['vehicleType']['enumDescriptions'][1]ABSTRACT Metropolitan railway transport, mostly for local transit.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][0]ABSTRACT The root of all types. Not a meaningful label of a feature and likewise should never be present in a geostore repository. Useful in that InCategory(t, TYPE_ANY) for all t.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][1]ABSTRACT Feature types that together define a transportation network (routes, segments, and intersections).
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][2]A route is any section of road (or rails, etc.) that has a name. This includes city streets as well as highways. Road segments can belong to multiple routes (e.g. El Camino, CA-82).
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][3]DEPRECATED This type used to have country-specific highway types but has been DEPRECATED long ago in favor of the country-agnostic subtypes of the TYPE_HIGHWAY hierarchy below.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][14]A designated bicycle route, whose segments may consist of any combination of bicycle paths, bicycle lanes, or city streets.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][15]A designated trail, which may consist of paved walkways, dirt paths, fire road, streets or highways, etc.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][32]An intersection consists of a collection of segments that terminate at the same location. This is topological definition: it may not match what a typical user would think of as an "intersection". See TYPE_INTERSECTION_GROUP, below, for more information. Each segment terminating at an intersection has an "endpoint type" that specifies how that segment is terminated: stop sign, yield sign, three-way light, etc.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][63]Our TYPE_INTERSECTION feature, above, models the point where one or more segments terminate. This is topological definition: it may not match what a typical user would think of as an "intersection". Consider the intersections where Hayes, Market, Larkin, and 9th Street meet near (37.77765, -122.41638) in San Francisco. Most people would probably consider this a single feature, even though we model it as four separate TYPE_INTERSECTION features. This TYPE_INTERSECTION_GROUP is used to model the user's concept of a complex intersection.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][64]A Pathway describes a physical pathway in between two features. See also pathway.proto
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][65]A restriction group describes a set of segment restrictions that belong together and have a name or an associated event.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][66]A toll cluster is either a single point on a segment (represented as a point at the end of the segment that has ENDPOINT_TOLL_BOOTH set) or a group of points on various road segments in MapFacts that represents one or more lanes passing through a toll fixture that all go to the same routing destination. Each toll cluster should have at most a single price per payment method. E.g. {CASH = $5, PASS = $1}. Note: If a toll fixture has different prices for multiple routing destinations, drivers need to be in the correct lane before passing through the toll fixture and hence such a fixture is represented by multiple toll clusters. A toll cluster does not necessarily represent a real-world entity, e.g. a particular plaza/structure as perceived by humans. This is because a plaza can be represented by more than one toll cluster. We require toll clusters to have names, but they might be non-unique. For example, a plaza might be represented by multiple toll clusters that may have the same plaza name. For further details, please see go/toll-cluster-schema.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][84]e.g. Silicon Valley
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][86]In countries where localities are not more structured (e.g. US and CA), we don't bother with subcategories.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][91]An entity widely considered to be a city, that is itself made up of several smaller entities, some of which are cities themselves. For example, Sydney, Australia is comprised of many smaller cities, and is colloquially regarded as a city itself. New York City, on the other hand, contains boroughs, but not other cities.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][111]Eventually we'll have more data for disputed areas (e.g., who makes claims on the area, who has de facto control, etc.). For the moment, we just define a type so we can simply mark areas as disputed.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][112]Boundaries representing the jurisdiction of a particular police station.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][113]An area used for aggregating statistical data, eg, a census region.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][114]RESERVED Constituencies that will go into effect at a future start date. They have unique geometries informative to constituents, politicians, and advertisers.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][173]RESERVED Non-logical point, line, or polygon data to draw on a map. This was introduced by the Japan team to make the maps look more pretty. This is a hack we don't want to extend, so this is marked as reserved even though it appears in Zenrin data (whitelisted).
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][189]A line representing the boundary between two features. See border.proto for details.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][191]An association of a point with an address, with no other information.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][208]A flat expanse of salt left by the evaporation of a body of salt water.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][249]DEPRECATED This type is incorrectly under TYPE_TECTONIC instead of TYPE_WATER. This was a mistake and is in the the process of being fixed. b/6537580
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][282]An area containing numerous geologically related mountains.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][297]A feature representing a group or chain of islands.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][298]ABSTRACT Types which are used only as portions of postal addresses. TYPE_POSTAL is concrete in Saudi Arabia but abstract everywhere else.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][299]This is the type for postal codes which are complete and independent enough that there should be a feature for it (e.g. US 5-digit ZIP codes). For even more detailed suffixes that further subdivide a postal code (such as the +4 component in US ZIP codes), store the information in a TYPE_POSTAL_CODE_SUFFIX address component.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][300]A prefix portion of a postal code which does not meet the requirements for TYPE_POSTAL_CODE, but which is useful to search for, for example UK outcodes.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][301]A premise is a location at smaller than street granularity.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][304]The term "post town" is used for a locality-like-entity that is only used for postal addresses. It would not make sense to show such an entity on the map, but it may be searched for and may be in the address of other features.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][305]A named delivery route. For example, in NZ rural addresses take the form "Delivery Route Number, Posttown, Postcode, NZ"
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][316]RESERVED A feature whose geometry is planned to replace the geometry on another feature.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][321]RESERVED A temporary feature that is only used internally to a single application. These features should not be written to Oyster repositories or presented to clients. If the application wishes to use multiple transient types, it is responsible for differentiating them using the temporary_data field or other mechanism.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][322]A portal of entry or exit to another feature. Examples: - Subway station entrance. - Parking lot entrance.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][354]RESERVED Represents service-only establishments (those without a storefront location). NOTE(tcain): Using value 0xD441, since we could find ourselves with a need to differentiate service areas from online-only at this level in the future, but still benefit from being able to group those under a common parent, disjoint from TYPE_ESTABLISHMENT_POI.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][355]The root of types of features that are in the sky, rather than on the earth. There will eventually be a hierarchy of types here.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][356]Features responsible for monitoring traffic on roads (usually for speed). Includes cameras at particular points as well as monitors that cover larger spans. Features of this type should have a corresponding gcid that specifies the correct subtype (e.g. gcid:road_camera or gcid:speed_camera_zone). This type was originally named as TYPE_ROAD_CAMERA.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][360]A feature used to represent a logical level, e.g. floor.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][365]RESERVED A terminal point represents a good location for a user to meet a taxi, ridesharing vehicle, or general driver.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][366]An area controlled in some way by an authoritative source, such as a government-designated COVID containment zone. Features of this type should have one or more gcids corresponding to their specific regulation.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][369]RESERVED A fake feature type so we can csearch for automatically generated files that use the FeatureProto types hierarchy.
root['schemas']['IndexingMoonshineHappyhourTypesGeostoreTypedFeatureId']['properties']['type']['enumDescriptions'][370]A feature of completely unknown type. This should only be used when absolutely necessary. One example in which this type is useful is in the Chinese importer, which must heuristically segment addresses into components - it often does not know what types to make those components. Please note that the Oyster address formatter does not currently support address components of TYPE_UNKNOWN well.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][0]ABSTRACT The root of all types. Not a meaningful label of a feature and likewise should never be present in a geostore repository. Useful in that InCategory(t, TYPE_ANY) for all t.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][1]ABSTRACT Feature types that together define a transportation network (routes, segments, and intersections).
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][2]A route is any section of road (or rails, etc.) that has a name. This includes city streets as well as highways. Road segments can belong to multiple routes (e.g. El Camino, CA-82).
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][3]DEPRECATED This type used to have country-specific highway types but has been DEPRECATED long ago in favor of the country-agnostic subtypes of the TYPE_HIGHWAY hierarchy below.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][14]A designated bicycle route, whose segments may consist of any combination of bicycle paths, bicycle lanes, or city streets.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][15]A designated trail, which may consist of paved walkways, dirt paths, fire road, streets or highways, etc.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][32]An intersection consists of a collection of segments that terminate at the same location. This is topological definition: it may not match what a typical user would think of as an "intersection". See TYPE_INTERSECTION_GROUP, below, for more information. Each segment terminating at an intersection has an "endpoint type" that specifies how that segment is terminated: stop sign, yield sign, three-way light, etc.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][63]Our TYPE_INTERSECTION feature, above, models the point where one or more segments terminate. This is topological definition: it may not match what a typical user would think of as an "intersection". Consider the intersections where Hayes, Market, Larkin, and 9th Street meet near (37.77765, -122.41638) in San Francisco. Most people would probably consider this a single feature, even though we model it as four separate TYPE_INTERSECTION features. This TYPE_INTERSECTION_GROUP is used to model the user's concept of a complex intersection.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][64]A Pathway describes a physical pathway in between two features. See also pathway.proto
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][65]A restriction group describes a set of segment restrictions that belong together and have a name or an associated event.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][66]A toll cluster is either a single point on a segment (represented as a point at the end of the segment that has ENDPOINT_TOLL_BOOTH set) or a group of points on various road segments in MapFacts that represents one or more lanes passing through a toll fixture that all go to the same routing destination. Each toll cluster should have at most a single price per payment method. E.g. {CASH = $5, PASS = $1}. Note: If a toll fixture has different prices for multiple routing destinations, drivers need to be in the correct lane before passing through the toll fixture and hence such a fixture is represented by multiple toll clusters. A toll cluster does not necessarily represent a real-world entity, e.g. a particular plaza/structure as perceived by humans. This is because a plaza can be represented by more than one toll cluster. We require toll clusters to have names, but they might be non-unique. For example, a plaza might be represented by multiple toll clusters that may have the same plaza name. For further details, please see go/toll-cluster-schema.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][84]e.g. Silicon Valley
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][86]In countries where localities are not more structured (e.g. US and CA), we don't bother with subcategories.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][91]An entity widely considered to be a city, that is itself made up of several smaller entities, some of which are cities themselves. For example, Sydney, Australia is comprised of many smaller cities, and is colloquially regarded as a city itself. New York City, on the other hand, contains boroughs, but not other cities.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][111]Eventually we'll have more data for disputed areas (e.g., who makes claims on the area, who has de facto control, etc.). For the moment, we just define a type so we can simply mark areas as disputed.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][112]Boundaries representing the jurisdiction of a particular police station.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][113]An area used for aggregating statistical data, eg, a census region.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][114]RESERVED Constituencies that will go into effect at a future start date. They have unique geometries informative to constituents, politicians, and advertisers.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][173]RESERVED Non-logical point, line, or polygon data to draw on a map. This was introduced by the Japan team to make the maps look more pretty. This is a hack we don't want to extend, so this is marked as reserved even though it appears in Zenrin data (whitelisted).
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][189]A line representing the boundary between two features. See border.proto for details.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][191]An association of a point with an address, with no other information.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][208]A flat expanse of salt left by the evaporation of a body of salt water.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][249]DEPRECATED This type is incorrectly under TYPE_TECTONIC instead of TYPE_WATER. This was a mistake and is in the the process of being fixed. b/6537580
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][282]An area containing numerous geologically related mountains.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][297]A feature representing a group or chain of islands.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][298]ABSTRACT Types which are used only as portions of postal addresses. TYPE_POSTAL is concrete in Saudi Arabia but abstract everywhere else.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][299]This is the type for postal codes which are complete and independent enough that there should be a feature for it (e.g. US 5-digit ZIP codes). For even more detailed suffixes that further subdivide a postal code (such as the +4 component in US ZIP codes), store the information in a TYPE_POSTAL_CODE_SUFFIX address component.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][300]A prefix portion of a postal code which does not meet the requirements for TYPE_POSTAL_CODE, but which is useful to search for, for example UK outcodes.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][301]A premise is a location at smaller than street granularity.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][304]The term "post town" is used for a locality-like-entity that is only used for postal addresses. It would not make sense to show such an entity on the map, but it may be searched for and may be in the address of other features.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][305]A named delivery route. For example, in NZ rural addresses take the form "Delivery Route Number, Posttown, Postcode, NZ"
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][316]RESERVED A feature whose geometry is planned to replace the geometry on another feature.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][321]RESERVED A temporary feature that is only used internally to a single application. These features should not be written to Oyster repositories or presented to clients. If the application wishes to use multiple transient types, it is responsible for differentiating them using the temporary_data field or other mechanism.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][322]A portal of entry or exit to another feature. Examples: - Subway station entrance. - Parking lot entrance.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][354]RESERVED Represents service-only establishments (those without a storefront location). NOTE(tcain): Using value 0xD441, since we could find ourselves with a need to differentiate service areas from online-only at this level in the future, but still benefit from being able to group those under a common parent, disjoint from TYPE_ESTABLISHMENT_POI.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][355]The root of types of features that are in the sky, rather than on the earth. There will eventually be a hierarchy of types here.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][356]Features responsible for monitoring traffic on roads (usually for speed). Includes cameras at particular points as well as monitors that cover larger spans. Features of this type should have a corresponding gcid that specifies the correct subtype (e.g. gcid:road_camera or gcid:speed_camera_zone). This type was originally named as TYPE_ROAD_CAMERA.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][360]A feature used to represent a logical level, e.g. floor.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][365]RESERVED A terminal point represents a good location for a user to meet a taxi, ridesharing vehicle, or general driver.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][366]An area controlled in some way by an authoritative source, such as a government-designated COVID containment zone. Features of this type should have one or more gcids corresponding to their specific regulation.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][369]RESERVED A fake feature type so we can csearch for automatically generated files that use the FeatureProto types hierarchy.
root['schemas']['IndexingMoonshineHappyhourTypesLocationGeoLocationProperties']['properties']['typeCategory']['enumDescriptions'][370]A feature of completely unknown type. This should only be used when absolutely necessary. One example in which this type is useful is in the Chinese importer, which must heuristically segment addresses into components - it often does not know what types to make those components. Please note that the Oyster address formatter does not currently support address components of TYPE_UNKNOWN well.
prod/shoppingdataintegration-
values_changed
root['revision']
new_value20250312
old_value20250310
prod/shoppingdataintegration-v1
values_changed
root['revision']
new_value20250312
old_value20250310
prod/southamerica-east1-containerfilesystem-
values_changed
root['revision']
new_value20250307
old_value20250221
prod/southamerica-east1-containerfilesystem-v1
values_changed
root['revision']
new_value20250307
old_value20250221
prod/southamerica-east1-dataproccontrol-
values_changed
root['revision']
new_value20250311
old_value20250224
prod/southamerica-east1-dataproccontrol-v1
values_changed
root['revision']
new_value20250311
old_value20250224
prod/staging-identitytoolkit.sandbox-v1
values_changed
root['revision']
new_value20250312
old_value20250311
prod/staging-identitytoolkit.sandbox-v2
values_changed
root['revision']
new_value20250312
old_value20250311
prod/staging-identitytoolkit.sandbox-v2alpha1
values_changed
root['revision']
new_value20250312
old_value20250311
prod/staging-identitytoolkit.sandbox-v2beta1
values_changed
root['revision']
new_value20250312
old_value20250311
prod/staging-keep-pa-
dictionary_item_added
  • root['schemas']['GetNoteInfoResponse']['properties']['type']['enumDeprecated']
  • root['schemas']['Note']['properties']['quillNote']['deprecated']
values_changed
root['revision']
new_value20250311
old_value20250213
root['schemas']['Note']['properties']['quillNote']['description']
new_valueA quillNote is a note with an empty message.
old_valueA quillNote is a note with an empty message.
prod/staging-keep-pa-v1
dictionary_item_added
  • root['schemas']['GetNoteInfoResponse']['properties']['type']['enumDeprecated']
  • root['schemas']['Note']['properties']['quillNote']['deprecated']
values_changed
root['revision']
new_value20250311
old_value20250213
root['schemas']['Note']['properties']['quillNote']['description']
new_valueA quillNote is a note with an empty message.
old_valueA quillNote is a note with an empty message.
prod/staging-notifications-pa.sandbox-
dictionary_item_added
  • root['schemas']['GmmNotifications__GmmClientGunsExtension']['properties']['inboxCapabilities']
  • root['schemas']['GoogleInternalTapandpayV1PassesTemplates__AddContentData']['properties']['isPreviousAmount']
  • root['schemas']['GoogleLogsTapandpayAndroid_ClosedLoopEvent_TopupMetadata']['properties']['amountSelected']['deprecated']
  • root['schemas']['GoogleLogsTapandpayAndroid_ClosedLoopEvent_TopupMetadata']['properties']['amountSelected']['description']
  • root['schemas']['NotificationsBackendCommonMessage_AndroidMessageHint_NotificationBehavior']['properties']['silentOnReplacement']
  • root['schemas']['NotificationsBackendCommonMessage__IosMessageHint']['properties']['silentOnReplacement']
  • root['schemas']['NotificationsFrontendData_RenderContext_DeviceInfo']['properties']['iosSdkGeneration']
  • root['schemas']['PhotosEffects__HdrGainmapEffectParams']['properties']['gainMapEditStrategy']
  • root['schemas']['PhotosEffects__HdrGainmapEffectParams']['properties']['gainmapState']['description']
values_changed
root['revision']
new_value20250313
old_value20250311
root['schemas']['NotificationsBackendCommonMessage__IosMessageHint']['description']
new_valueIosMessageHint can be included with the GenericMessage proto to achieve customizations of the generic message specifically for iOS devices. Any fields in IosMessageHint that overlap with fields in GenericMessage will be resolved in favor of the IosMessageHint. Next ID: 36
old_valueIosMessageHint can be included with the GenericMessage proto to achieve customizations of the generic message specifically for iOS devices. Any fields in IosMessageHint that overlap with fields in GenericMessage will be resolved in favor of the IosMessageHint. Next ID: 35
root['schemas']['Proto2Bridge__MessageSet']['description']
new_valueLINT.ThenChange( //depot/google3/third_party/protobuf/github/src/google/protobuf/bridge/message_set.proto ) This is proto2's version of MessageSet.
old_valueThis is proto2's version of MessageSet.
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enumDescriptions'][274]
new_valuego/follow related Pickers. String-only pickers.
old_valuego/follow related Pickers.
iterable_item_added
root['schemas']['GaiaData__AccountNotificationEvent']['properties']['eventType']['enum'][304]OAUTH_TOKEN_EXPIRATION_NOTIFICATION_UNICORN_EMAIL
root['schemas']['GaiaData__AccountNotificationEvent']['properties']['eventType']['enumDescriptions'][304]Send email notifications to Unicorn users to notify them about their expiring app access.
root['schemas']['GoogleLogsTapandpayAndroid__DynamicAidRegistrationEvent']['properties']['registrationReason']['enum'][13]ACCOUNT_CHANGED
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enum'][277]UPSELL_CREATOR_PICKER
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enum'][609]WEBKICK_UGC_CONTENT
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enumDescriptions'][276]Creator Picker
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enumDescriptions'][278]Sports team picker
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enumDescriptions'][609]Need bundle type for UGC content in Discover. go/discover-ugc-content-retrieval
root['schemas']['Sidekick__SemanticProperties']['properties']['cardCategory']['enum'][903]CONTENT_EXPLORATION_WEB
root['schemas']['Sidekick__SemanticProperties']['properties']['cardCategory']['enum'][1071]HOME_STACK_UTILITY_FOLLOW_MANAGEMENT
root['schemas']['Sidekick__SemanticProperties']['properties']['cardCategory']['enum'][1072]COMMUNITY_DISCUSSIONS
root['schemas']['Sidekick__SemanticProperties']['properties']['cardCategory']['enum'][1474]WEBKICK_INTEREST_UGC
root['schemas']['Sidekick__SemanticProperties']['properties']['cardCategory']['enum'][1539]DEPRECATED_UCP_DELAYED_NOTES_CREATION_PROMPT_CARD
root['schemas']['Sidekick__SemanticProperties']['properties']['cardCategory']['enumDescriptions'][1474]Next available Cardmaker tag: 60078
iterable_item_removed
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enum'][543]UCP_DELAYED_NOTES_CREATION_PROMPT_CARD
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enumDescriptions'][543]Need bundle type for Modern Creators & Formats (go/mcf-pulse) delayed notes creation prompt card. go/link-notes-delayed-creation-in-discover-dd.
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enumDescriptions'][549]Need bundle type for upselling a query picker to users more likely to follow queries.
root['schemas']['Sidekick__SemanticProperties']['properties']['cardCategory']['enum'][1000]UCP_DELAYED_NOTES_CREATION_PROMPT_CARD
prod/staging-notifications-pa.sandbox-v1
dictionary_item_added
  • root['schemas']['GmmNotifications__GmmClientGunsExtension']['properties']['inboxCapabilities']
  • root['schemas']['GoogleInternalTapandpayV1PassesTemplates__AddContentData']['properties']['isPreviousAmount']
  • root['schemas']['GoogleLogsTapandpayAndroid_ClosedLoopEvent_TopupMetadata']['properties']['amountSelected']['deprecated']
  • root['schemas']['GoogleLogsTapandpayAndroid_ClosedLoopEvent_TopupMetadata']['properties']['amountSelected']['description']
  • root['schemas']['NotificationsBackendCommonMessage_AndroidMessageHint_NotificationBehavior']['properties']['silentOnReplacement']
  • root['schemas']['NotificationsBackendCommonMessage__IosMessageHint']['properties']['silentOnReplacement']
  • root['schemas']['NotificationsFrontendData_RenderContext_DeviceInfo']['properties']['iosSdkGeneration']
  • root['schemas']['PhotosEffects__HdrGainmapEffectParams']['properties']['gainMapEditStrategy']
  • root['schemas']['PhotosEffects__HdrGainmapEffectParams']['properties']['gainmapState']['description']
values_changed
root['revision']
new_value20250313
old_value20250311
root['schemas']['NotificationsBackendCommonMessage__IosMessageHint']['description']
new_valueIosMessageHint can be included with the GenericMessage proto to achieve customizations of the generic message specifically for iOS devices. Any fields in IosMessageHint that overlap with fields in GenericMessage will be resolved in favor of the IosMessageHint. Next ID: 36
old_valueIosMessageHint can be included with the GenericMessage proto to achieve customizations of the generic message specifically for iOS devices. Any fields in IosMessageHint that overlap with fields in GenericMessage will be resolved in favor of the IosMessageHint. Next ID: 35
root['schemas']['Proto2Bridge__MessageSet']['description']
new_valueLINT.ThenChange( //depot/google3/third_party/protobuf/github/src/google/protobuf/bridge/message_set.proto ) This is proto2's version of MessageSet.
old_valueThis is proto2's version of MessageSet.
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enumDescriptions'][274]
new_valuego/follow related Pickers. String-only pickers.
old_valuego/follow related Pickers.
iterable_item_added
root['schemas']['GaiaData__AccountNotificationEvent']['properties']['eventType']['enum'][304]OAUTH_TOKEN_EXPIRATION_NOTIFICATION_UNICORN_EMAIL
root['schemas']['GaiaData__AccountNotificationEvent']['properties']['eventType']['enumDescriptions'][304]Send email notifications to Unicorn users to notify them about their expiring app access.
root['schemas']['GoogleLogsTapandpayAndroid__DynamicAidRegistrationEvent']['properties']['registrationReason']['enum'][13]ACCOUNT_CHANGED
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enum'][277]UPSELL_CREATOR_PICKER
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enum'][609]WEBKICK_UGC_CONTENT
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enumDescriptions'][276]Creator Picker
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enumDescriptions'][278]Sports team picker
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enumDescriptions'][609]Need bundle type for UGC content in Discover. go/discover-ugc-content-retrieval
root['schemas']['Sidekick__SemanticProperties']['properties']['cardCategory']['enum'][903]CONTENT_EXPLORATION_WEB
root['schemas']['Sidekick__SemanticProperties']['properties']['cardCategory']['enum'][1071]HOME_STACK_UTILITY_FOLLOW_MANAGEMENT
root['schemas']['Sidekick__SemanticProperties']['properties']['cardCategory']['enum'][1072]COMMUNITY_DISCUSSIONS
root['schemas']['Sidekick__SemanticProperties']['properties']['cardCategory']['enum'][1474]WEBKICK_INTEREST_UGC
root['schemas']['Sidekick__SemanticProperties']['properties']['cardCategory']['enum'][1539]DEPRECATED_UCP_DELAYED_NOTES_CREATION_PROMPT_CARD
root['schemas']['Sidekick__SemanticProperties']['properties']['cardCategory']['enumDescriptions'][1474]Next available Cardmaker tag: 60078
iterable_item_removed
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enum'][543]UCP_DELAYED_NOTES_CREATION_PROMPT_CARD
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enumDescriptions'][543]Need bundle type for Modern Creators & Formats (go/mcf-pulse) delayed notes creation prompt card. go/link-notes-delayed-creation-in-discover-dd.
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enumDescriptions'][549]Need bundle type for upselling a query picker to users more likely to follow queries.
root['schemas']['Sidekick__SemanticProperties']['properties']['cardCategory']['enum'][1000]UCP_DELAYED_NOTES_CREATION_PROMPT_CARD
prod/staging-qual-qa-notifications-pa.sandbox-
dictionary_item_added
  • root['schemas']['GmmNotifications__GmmClientGunsExtension']['properties']['inboxCapabilities']
  • root['schemas']['GoogleInternalTapandpayV1PassesTemplates__AddContentData']['properties']['isPreviousAmount']
  • root['schemas']['GoogleLogsTapandpayAndroid_ClosedLoopEvent_TopupMetadata']['properties']['amountSelected']['deprecated']
  • root['schemas']['GoogleLogsTapandpayAndroid_ClosedLoopEvent_TopupMetadata']['properties']['amountSelected']['description']
  • root['schemas']['NotificationsBackendCommonMessage_AndroidMessageHint_NotificationBehavior']['properties']['silentOnReplacement']
  • root['schemas']['NotificationsBackendCommonMessage__IosMessageHint']['properties']['silentOnReplacement']
  • root['schemas']['NotificationsFrontendData_RenderContext_DeviceInfo']['properties']['iosSdkGeneration']
  • root['schemas']['PhotosEffects__HdrGainmapEffectParams']['properties']['gainMapEditStrategy']
  • root['schemas']['PhotosEffects__HdrGainmapEffectParams']['properties']['gainmapState']['description']
values_changed
root['revision']
new_value20250313
old_value20250311
root['schemas']['NotificationsBackendCommonMessage__IosMessageHint']['description']
new_valueIosMessageHint can be included with the GenericMessage proto to achieve customizations of the generic message specifically for iOS devices. Any fields in IosMessageHint that overlap with fields in GenericMessage will be resolved in favor of the IosMessageHint. Next ID: 36
old_valueIosMessageHint can be included with the GenericMessage proto to achieve customizations of the generic message specifically for iOS devices. Any fields in IosMessageHint that overlap with fields in GenericMessage will be resolved in favor of the IosMessageHint. Next ID: 35
root['schemas']['Proto2Bridge__MessageSet']['description']
new_valueLINT.ThenChange( //depot/google3/third_party/protobuf/github/src/google/protobuf/bridge/message_set.proto ) This is proto2's version of MessageSet.
old_valueThis is proto2's version of MessageSet.
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enumDescriptions'][274]
new_valuego/follow related Pickers. String-only pickers.
old_valuego/follow related Pickers.
iterable_item_added
root['schemas']['GaiaData__AccountNotificationEvent']['properties']['eventType']['enum'][304]OAUTH_TOKEN_EXPIRATION_NOTIFICATION_UNICORN_EMAIL
root['schemas']['GaiaData__AccountNotificationEvent']['properties']['eventType']['enumDescriptions'][304]Send email notifications to Unicorn users to notify them about their expiring app access.
root['schemas']['GoogleLogsTapandpayAndroid__DynamicAidRegistrationEvent']['properties']['registrationReason']['enum'][13]ACCOUNT_CHANGED
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enum'][277]UPSELL_CREATOR_PICKER
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enum'][609]WEBKICK_UGC_CONTENT
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enumDescriptions'][276]Creator Picker
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enumDescriptions'][278]Sports team picker
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enumDescriptions'][609]Need bundle type for UGC content in Discover. go/discover-ugc-content-retrieval
root['schemas']['Sidekick__SemanticProperties']['properties']['cardCategory']['enum'][903]CONTENT_EXPLORATION_WEB
root['schemas']['Sidekick__SemanticProperties']['properties']['cardCategory']['enum'][1071]HOME_STACK_UTILITY_FOLLOW_MANAGEMENT
root['schemas']['Sidekick__SemanticProperties']['properties']['cardCategory']['enum'][1072]COMMUNITY_DISCUSSIONS
root['schemas']['Sidekick__SemanticProperties']['properties']['cardCategory']['enum'][1474]WEBKICK_INTEREST_UGC
root['schemas']['Sidekick__SemanticProperties']['properties']['cardCategory']['enum'][1539]DEPRECATED_UCP_DELAYED_NOTES_CREATION_PROMPT_CARD
root['schemas']['Sidekick__SemanticProperties']['properties']['cardCategory']['enumDescriptions'][1474]Next available Cardmaker tag: 60078
iterable_item_removed
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enum'][543]UCP_DELAYED_NOTES_CREATION_PROMPT_CARD
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enumDescriptions'][543]Need bundle type for Modern Creators & Formats (go/mcf-pulse) delayed notes creation prompt card. go/link-notes-delayed-creation-in-discover-dd.
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enumDescriptions'][549]Need bundle type for upselling a query picker to users more likely to follow queries.
root['schemas']['Sidekick__SemanticProperties']['properties']['cardCategory']['enum'][1000]UCP_DELAYED_NOTES_CREATION_PROMPT_CARD
prod/staging-qual-qa-notifications-pa.sandbox-v1
dictionary_item_added
  • root['schemas']['GmmNotifications__GmmClientGunsExtension']['properties']['inboxCapabilities']
  • root['schemas']['GoogleInternalTapandpayV1PassesTemplates__AddContentData']['properties']['isPreviousAmount']
  • root['schemas']['GoogleLogsTapandpayAndroid_ClosedLoopEvent_TopupMetadata']['properties']['amountSelected']['deprecated']
  • root['schemas']['GoogleLogsTapandpayAndroid_ClosedLoopEvent_TopupMetadata']['properties']['amountSelected']['description']
  • root['schemas']['NotificationsBackendCommonMessage_AndroidMessageHint_NotificationBehavior']['properties']['silentOnReplacement']
  • root['schemas']['NotificationsBackendCommonMessage__IosMessageHint']['properties']['silentOnReplacement']
  • root['schemas']['NotificationsFrontendData_RenderContext_DeviceInfo']['properties']['iosSdkGeneration']
  • root['schemas']['PhotosEffects__HdrGainmapEffectParams']['properties']['gainMapEditStrategy']
  • root['schemas']['PhotosEffects__HdrGainmapEffectParams']['properties']['gainmapState']['description']
values_changed
root['revision']
new_value20250313
old_value20250311
root['schemas']['NotificationsBackendCommonMessage__IosMessageHint']['description']
new_valueIosMessageHint can be included with the GenericMessage proto to achieve customizations of the generic message specifically for iOS devices. Any fields in IosMessageHint that overlap with fields in GenericMessage will be resolved in favor of the IosMessageHint. Next ID: 36
old_valueIosMessageHint can be included with the GenericMessage proto to achieve customizations of the generic message specifically for iOS devices. Any fields in IosMessageHint that overlap with fields in GenericMessage will be resolved in favor of the IosMessageHint. Next ID: 35
root['schemas']['Proto2Bridge__MessageSet']['description']
new_valueLINT.ThenChange( //depot/google3/third_party/protobuf/github/src/google/protobuf/bridge/message_set.proto ) This is proto2's version of MessageSet.
old_valueThis is proto2's version of MessageSet.
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enumDescriptions'][274]
new_valuego/follow related Pickers. String-only pickers.
old_valuego/follow related Pickers.
iterable_item_added
root['schemas']['GaiaData__AccountNotificationEvent']['properties']['eventType']['enum'][304]OAUTH_TOKEN_EXPIRATION_NOTIFICATION_UNICORN_EMAIL
root['schemas']['GaiaData__AccountNotificationEvent']['properties']['eventType']['enumDescriptions'][304]Send email notifications to Unicorn users to notify them about their expiring app access.
root['schemas']['GoogleLogsTapandpayAndroid__DynamicAidRegistrationEvent']['properties']['registrationReason']['enum'][13]ACCOUNT_CHANGED
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enum'][277]UPSELL_CREATOR_PICKER
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enum'][609]WEBKICK_UGC_CONTENT
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enumDescriptions'][276]Creator Picker
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enumDescriptions'][278]Sports team picker
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enumDescriptions'][609]Need bundle type for UGC content in Discover. go/discover-ugc-content-retrieval
root['schemas']['Sidekick__SemanticProperties']['properties']['cardCategory']['enum'][903]CONTENT_EXPLORATION_WEB
root['schemas']['Sidekick__SemanticProperties']['properties']['cardCategory']['enum'][1071]HOME_STACK_UTILITY_FOLLOW_MANAGEMENT
root['schemas']['Sidekick__SemanticProperties']['properties']['cardCategory']['enum'][1072]COMMUNITY_DISCUSSIONS
root['schemas']['Sidekick__SemanticProperties']['properties']['cardCategory']['enum'][1474]WEBKICK_INTEREST_UGC
root['schemas']['Sidekick__SemanticProperties']['properties']['cardCategory']['enum'][1539]DEPRECATED_UCP_DELAYED_NOTES_CREATION_PROMPT_CARD
root['schemas']['Sidekick__SemanticProperties']['properties']['cardCategory']['enumDescriptions'][1474]Next available Cardmaker tag: 60078
iterable_item_removed
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enum'][543]UCP_DELAYED_NOTES_CREATION_PROMPT_CARD
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enumDescriptions'][543]Need bundle type for Modern Creators & Formats (go/mcf-pulse) delayed notes creation prompt card. go/link-notes-delayed-creation-in-discover-dd.
root['schemas']['Sidekick__ClusterMetadata']['properties']['needBundleType']['enumDescriptions'][549]Need bundle type for upselling a query picker to users more likely to follow queries.
root['schemas']['Sidekick__SemanticProperties']['properties']['cardCategory']['enum'][1000]UCP_DELAYED_NOTES_CREATION_PROMPT_CARD
prod/staging-userlocation.sandbox-
values_changed
root['revision']
new_value20250311
old_value20250304
prod/staging-userlocation.sandbox-v1
values_changed
root['revision']
new_value20250311
old_value20250304
prod/subscribewithgoogle-
values_changed
root['revision']
new_value20250312
old_value20250309
prod/subscribewithgoogle-v1
values_changed
root['revision']
new_value20250312
old_value20250309
prod/takeout-pa-
values_changed
root['revision']
new_value20250310
old_value20250227
prod/takeout-pa-v1
values_changed
root['revision']
new_value20250310
old_value20250227
prod/takeout-pa-v2
values_changed
root['revision']
new_value20250310
old_value20250227
prod/tasks-pa-
values_changed
root['revision']
new_value20250311
old_value20250307
prod/tasks-pa-v1
values_changed
root['revision']
new_value20250311
old_value20250307
prod/tenor-
values_changed
root['revision']
new_value20250310
old_value20250303
prod/tenor-v1
values_changed
root['revision']
new_value20250310
old_value20250303
prod/tenor-v2
values_changed
root['revision']
new_value20250310
old_value20250303
prod/tile-
values_changed
root['revision']
new_value20250312
old_value20250309
prod/tile-v1
values_changed
root['revision']
new_value20250312
old_value20250309
prod/transferappliance-v1alpha1
values_changed
root['revision']
new_value20250306
old_value20250227
prod/travelpartnerprices-
values_changed
root['revision']
new_value20250312
old_value20250309
prod/travelpartnerprices-v1
values_changed
root['revision']
new_value20250312
old_value20250309
prod/ulp1p-pa-
values_changed
root['revision']
new_value20250313
old_value20250213
iterable_item_added
root['resources']['languagePreferences']['resources']['version']['methods']['get']['parameters']['userLocation.metadata.internal.sourceSummary.provider']['enum'][743]PROVIDER_PULSE_ENERGY
root['resources']['languagePreferences']['resources']['version']['methods']['get']['parameters']['userLocation.metadata.internal.sourceSummary.provider']['enum'][744]PROVIDER_NUMOCITY
root['resources']['languagePreferences']['resources']['version']['methods']['get']['parameters']['userLocation.metadata.internal.sourceSummary.provider']['enumDescriptions'][744]Note: Next available value is 0x127E.
root['schemas']['IncludeDataSource']['properties']['allowedUlsOverrideAppIds']['items']['enum'][718]CODE_ASSIST
root['schemas']['IncludeDataSource']['properties']['allowedUlsOverrideAppIds']['items']['enum'][719]CUSTOMER_ENGAGEMENT_AI
root['schemas']['IncludeDataSource']['properties']['allowedUlsOverrideAppIds']['items']['enumDescriptions'][718]go/crescendo-ux
root['schemas']['IncludeDataSource']['properties']['allowedUlsOverrideAppIds']['items']['enumDescriptions'][719]go/connect-ai-agent
root['schemas']['InternalSourceSummaryProto']['properties']['provider']['enum'][743]PROVIDER_PULSE_ENERGY
root['schemas']['InternalSourceSummaryProto']['properties']['provider']['enum'][744]PROVIDER_NUMOCITY
root['schemas']['InternalSourceSummaryProto']['properties']['provider']['enumDescriptions'][744]Note: Next available value is 0x127E.
root['schemas']['LanguagePreferenceParams']['properties']['appId']['enum'][718]CODE_ASSIST
root['schemas']['LanguagePreferenceParams']['properties']['appId']['enum'][719]CUSTOMER_ENGAGEMENT_AI
root['schemas']['LanguagePreferenceParams']['properties']['appId']['enumDescriptions'][718]go/crescendo-ux
root['schemas']['LanguagePreferenceParams']['properties']['appId']['enumDescriptions'][719]go/connect-ai-agent
iterable_item_removed
root['resources']['languagePreferences']['resources']['version']['methods']['get']['parameters']['userLocation.metadata.internal.sourceSummary.provider']['enumDescriptions'][742]Note: Next available value is 0x127C.
root['schemas']['InternalSourceSummaryProto']['properties']['provider']['enumDescriptions'][742]Note: Next available value is 0x127C.
prod/ulp1p-pa-v1
values_changed
root['revision']
new_value20250313
old_value20250213
iterable_item_added
root['resources']['languagePreferences']['resources']['version']['methods']['get']['parameters']['userLocation.metadata.internal.sourceSummary.provider']['enum'][743]PROVIDER_PULSE_ENERGY
root['resources']['languagePreferences']['resources']['version']['methods']['get']['parameters']['userLocation.metadata.internal.sourceSummary.provider']['enum'][744]PROVIDER_NUMOCITY
root['resources']['languagePreferences']['resources']['version']['methods']['get']['parameters']['userLocation.metadata.internal.sourceSummary.provider']['enumDescriptions'][744]Note: Next available value is 0x127E.
root['schemas']['IncludeDataSource']['properties']['allowedUlsOverrideAppIds']['items']['enum'][718]CODE_ASSIST
root['schemas']['IncludeDataSource']['properties']['allowedUlsOverrideAppIds']['items']['enum'][719]CUSTOMER_ENGAGEMENT_AI
root['schemas']['IncludeDataSource']['properties']['allowedUlsOverrideAppIds']['items']['enumDescriptions'][718]go/crescendo-ux
root['schemas']['IncludeDataSource']['properties']['allowedUlsOverrideAppIds']['items']['enumDescriptions'][719]go/connect-ai-agent
root['schemas']['InternalSourceSummaryProto']['properties']['provider']['enum'][743]PROVIDER_PULSE_ENERGY
root['schemas']['InternalSourceSummaryProto']['properties']['provider']['enum'][744]PROVIDER_NUMOCITY
root['schemas']['InternalSourceSummaryProto']['properties']['provider']['enumDescriptions'][744]Note: Next available value is 0x127E.
root['schemas']['LanguagePreferenceParams']['properties']['appId']['enum'][718]CODE_ASSIST
root['schemas']['LanguagePreferenceParams']['properties']['appId']['enum'][719]CUSTOMER_ENGAGEMENT_AI
root['schemas']['LanguagePreferenceParams']['properties']['appId']['enumDescriptions'][718]go/crescendo-ux
root['schemas']['LanguagePreferenceParams']['properties']['appId']['enumDescriptions'][719]go/connect-ai-agent
iterable_item_removed
root['resources']['languagePreferences']['resources']['version']['methods']['get']['parameters']['userLocation.metadata.internal.sourceSummary.provider']['enumDescriptions'][742]Note: Next available value is 0x127C.
root['schemas']['InternalSourceSummaryProto']['properties']['provider']['enumDescriptions'][742]Note: Next available value is 0x127C.
prod/us-alpha-vision-
values_changed
root['revision']
new_value20250312
old_value20250228
prod/us-alpha-vision-v1
values_changed
root['revision']
new_value20250312
old_value20250228
prod/us-alpha-vision-v1p1beta1
values_changed
root['revision']
new_value20250312
old_value20250228
prod/us-alpha-vision-v1p2beta1
values_changed
root['revision']
new_value20250312
old_value20250228
prod/us-alpha-vision-v1p3beta1
values_changed
root['revision']
new_value20250312
old_value20250228
prod/us-alpha-vision-v1p4beta1
values_changed
root['revision']
new_value20250312
old_value20250228
prod/us-chronicle-
values_changed
root['resources']['projects']['resources']['locations']['resources']['instances']['methods']['get']['parameters']['name']['description']
new_valueRequired. The name of the instance to retrieve. Format: projects/{project_id}/locations/{location}/instances/{instance}
old_valueRequired. The name of the instance to retrieve. Format: projects/{project_id}/locations/{region}/instances/{instance}
root['revision']
new_value20250310
old_value20250227
root['schemas']
new_value
AIOverview
descriptionAI generated overview for the search results.
idAIOverview
properties
aiSummary
descriptionAI summary for the search results. Markdown formatted.
typestring
complete
descriptionWhether AI overview generation is complete.
typeboolean
suggestions
descriptionSuggested actions to continue the investigation in chat.
items
$refAction
typearray
typeobject
Action
descriptionAction represents an action that can be performed in the host UI.
idAction
properties
actionType
descriptionOutput only. Type of action.
enum
  • ACTION_TYPE_UNSPECIFIED
  • FOLLOW_UP
  • NAVIGATION
  • EXECUTION
enumDescriptions
  • The action type is unspecified.
  • The action is a follow up action.
  • The action is a navigation action.
  • The action is an execution action.
readOnlyTrue
typestring
displayText
descriptionOutput only. The text that'll be displayed to the user if this is rendered in the UI as a suggested action.
readOnlyTrue
typestring
execution
$refExecution
descriptionMetadata for execution action.
followUp
$refFollowUp
descriptionMetadata for follow up action.
navigation
$refNavigation
descriptionMetadata for navigation action.
useCaseId
descriptionOutput only. The use case ID of the action. It's used internally to identify in which context the action is used.
readOnlyTrue
typestring
typeobject
AlertFieldAggregation
idAlertFieldAggregation
properties
alertCount
formatint32
typeinteger
allValues
items
$refAlertFieldValueCount
typearray
baselineAlertCount
formatint32
typeinteger
bottomValues
items
$refAlertFieldValueCount
typearray
fieldName
typestring
tooManyValues
typeboolean
topValues
items
$refAlertFieldValueCount
typearray
valueCount
formatint32
typeinteger
typeobject
AlertFieldAggregations
idAlertFieldAggregations
properties
fields
items
$refAlertFieldAggregation
typearray
typeobject
AlertFieldValue
idAlertFieldValue
properties
boolValue
typeboolean
bytesValue
formatbyte
typestring
doubleValue
formatdouble
typenumber
enumValue
typestring
floatValue
formatfloat
typenumber
int32Value
formatint32
typeinteger
int64Value
formatint64
typestring
stringValue
typestring
uint32Value
formatuint32
typeinteger
uint64Value
formatuint64
typestring
typeobject
AlertFieldValueCount
idAlertFieldValueCount
properties
alertCount
formatint32
typeinteger
baselineAlertCount
formatint32
typeinteger
value
$refAlertFieldValue
typeobject
AnalystVerdict
descriptionVerdict provided by the human analyst. These fields are used to model Mandiant sources.
idAnalystVerdict
properties
confidenceScore
descriptionConfidence score of the verdict.
formatint32
typeinteger
verdictResponse
descriptionDetails of the verdict.
enum
  • VERDICT_RESPONSE_UNSPECIFIED
  • MALICIOUS
  • BENIGN
enumDescriptions
  • The default verdict response type.
  • VerdictResponse resulted a threat as malicious.
  • VerdictResponse resulted a threat as benign.
typestring
verdictTime
descriptionTimestamp at which the verdict was generated.
formatgoogle-datetime
typestring
typeobject
AnalyticsMetadata
descriptionStores information about an analytics metric used in a rule.
idAnalyticsMetadata
properties
analytic
descriptionName of the analytic.
typestring
typeobject
Annotation
descriptionExtra parameters that don't fit anywhere else, captured as key/value. For example "VendorID/42" in BlackBerry user agents. The following keys are modified with reduced User-Agent and no client hints (go/ua-reduction-ua-string-reference): * "Chrome" (see `browser_version`) * "ChromiumBrowser" (unavailable) * "ChromeWebview" (unavailable) * "OS_VERSION" (see `os`) * "Rest" (unavailable) * "misc" (see `device`)
idAnnotation
properties
key
typestring
value
typestring
typeobject
Artifact
descriptionInformation about an artifact. The artifact can only be an IP.
idArtifact
properties
anonymous
descriptionWhether the VPN tunnels are configured for anonymous browsing or not.
typeboolean
artifactClient
$refArtifactClient
descriptionEntity or software accessing or utilizing network resources.
asOwner
descriptionOwner of the Autonomous System to which the IP address belongs.
typestring
asn
descriptionAutonomous System Number to which the IP address belongs.
formatint64
typestring
firstSeenTime
descriptionFirst seen timestamp of the IP in the customer's environment.
formatgoogle-datetime
typestring
ip
descriptionIP address of the artifact. This field can be used as an entity indicator for an external destination IP entity.
typestring
jarm
descriptionThe JARM hash for the IP address. (https://engineering.salesforce.com/easily-identify-malicious-servers-on-the-internet-with-jarm-e095edac525a).
typestring
lastHttpsCertificate
$refSSLCertificate
descriptionSSL certificate information about the IP address.
lastHttpsCertificateDate
descriptionMost recent date for the certificate in VirusTotal.
formatgoogle-datetime
typestring
lastSeenTime
descriptionLast seen timestamp of the IP address in the customer's environment.
formatgoogle-datetime
typestring
location
$refLocation
descriptionLocation of the Artifact's IP address.
network
$refNetwork
descriptionNetwork information related to the Artifact's IP address.
prevalence
$refPrevalence
descriptionThe prevalence of the artifact within the customer's environment.
regionalInternetRegistry
descriptionRIR (one of the current RIRs: AFRINIC, ARIN, APNIC, LACNIC or RIPE NCC).
typestring
risks
descriptionThis field lists potential risks associated with the network activity.
items
typestring
typearray
tags
descriptionIdentification attributes
items
typestring
typearray
tunnels
descriptionVPN tunnels.
items
$refTunnels
typearray
whois
descriptionWHOIS information as returned from the pertinent WHOIS server.
typestring
whoisDate
descriptionDate of the last update of the WHOIS record in VirusTotal.
formatgoogle-datetime
typestring
typeobject
ArtifactClient
descriptionEntity or software accessing or utilizing network resources.
idArtifactClient
properties
behaviors
descriptionThe behaviors of the client accessing the network.
items
typestring
typearray
proxies
descriptionThe type of proxies used by the client.
items
typestring
typearray
typeobject
Asset
descriptionInformation about a compute asset such as a workstation, laptop, phone, virtual desktop, or VM.
idAsset
properties
assetId
descriptionThe asset ID. Value must contain the ':' character. For example, cs:abcdd23434. This field can be used as an entity indicator for asset entities.
typestring
attribute
$refAttribute
descriptionGeneric entity metadata attributes of the asset.
category
descriptionThe category of the asset (e.g. "End User Asset", "Workstation", "Server").
typestring
creationTime
deprecatedTrue
descriptionTime the asset was created or provisioned. Deprecate: creation_time should be populated in Attribute as generic metadata.
formatgoogle-datetime
typestring
deploymentStatus
descriptionThe deployment status of the asset for device lifecycle purposes.
enum
  • DEPLOYMENT_STATUS_UNSPECIFIED
  • ACTIVE
  • PENDING_DECOMISSION
  • DECOMISSIONED
enumDescriptions
  • Unspecified deployment status.
  • Asset is active, functional and deployed.
  • Asset is pending decommission and no longer deployed.
  • Asset is decommissioned.
typestring
firstDiscoverTime
descriptionTime the asset was first discovered (by asset management/discoverability software).
formatgoogle-datetime
typestring
firstSeenTime
descriptionThe first observed time for an asset. The value is calculated on the basis of the first time the identifier was observed.
formatgoogle-datetime
typestring
hardware
descriptionThe asset hardware specifications.
items
$refHardware
typearray
hostname
descriptionAsset hostname or domain name field. This field can be used as an entity indicator for asset entities.
typestring
ip
descriptionA list of IP addresses associated with an asset. This field can be used as an entity indicator for asset entities.
items
typestring
typearray
labels
deprecatedTrue
descriptionMetadata labels for the asset. Deprecated: labels should be populated in Attribute as generic metadata.
items
$refLabel
typearray
lastBootTime
descriptionTime the asset was last boot started.
formatgoogle-datetime
typestring
lastDiscoverTime
descriptionTime the asset was last discovered (by asset management/discoverability software).
formatgoogle-datetime
typestring
location
$refLocation
descriptionLocation of the asset.
mac
descriptionList of MAC addresses associated with an asset. This field can be used as an entity indicator for asset entities.
items
typestring
typearray
natIp
descriptionList of NAT IP addresses associated with an asset.
items
typestring
typearray
networkDomain
descriptionThe network domain of the asset (e.g. "corp.acme.com")
typestring
platformSoftware
$refPlatformSoftware
descriptionThe asset operating system platform software.
productObjectId
descriptionA vendor-specific identifier to uniquely identify the entity (a GUID or similar). This field can be used as an entity indicator for asset entities.
typestring
software
descriptionThe asset software details.
items
$refSoftware
typearray
systemLastUpdateTime
descriptionTime the asset system or OS was last updated. For all other operations that are not system updates (such as resizing a VM), use Attribute.last_update_time.
formatgoogle-datetime
typestring
type
descriptionThe type of the asset (e.g. workstation or laptop or server).
enum
  • ROLE_UNSPECIFIED
  • WORKSTATION
  • LAPTOP
  • IOT
  • NETWORK_ATTACHED_STORAGE
  • PRINTER
  • SCANNER
  • SERVER
  • TAPE_LIBRARY
  • MOBILE
enumDescriptions
  • Unspecified asset role.
  • A workstation or desktop.
  • A laptop computer.
  • An IOT asset.
  • A network attached storage device.
  • A printer.
  • A scanner.
  • A server.
  • A tape library device.
  • A mobile device such as a mobile phone or PDA.
typestring
vulnerabilities
descriptionVulnerabilities discovered on asset.
items
$refVulnerability
typearray
typeobject
Association
descriptionAssociations represents different metadata about malware and threat actors involved with an IoC.
idAssociation
properties
alias
descriptionDifferent aliases of the threat actor given by different sources.
items
$refAssociationAlias
typearray
associatedActors
descriptionList of associated threat actors for a malware. Not applicable for threat actors.
items
$refAssociation
typearray
countryCode
descriptionCountry from which the threat actor/ malware is originated.
items
typestring
typearray
description
descriptionHuman readable description about the association.
typestring
firstReferenceTime
descriptionFirst time the threat actor was referenced or seen.
formatgoogle-datetime
typestring
id
descriptionUnique association id generated by mandiant.
typestring
industriesAffected
descriptionList of industries the threat actor affects.
items
typestring
typearray
lastReferenceTime
descriptionLast time the threat actor was referenced or seen.
formatgoogle-datetime
typestring
name
descriptionName of the threat actor/malware.
typestring
regionCode
$refLocation
descriptionName of the country, the threat is originating from.
role
descriptionRole of the malware. Not applicable for threat actor.
typestring
sourceCountry
deprecatedTrue
descriptionName of the country the threat originated from.
typestring
sponsorRegion
$refLocation
descriptionSponsor region of the threat actor.
tags
descriptionTags.
items
typestring
typearray
targetedRegions
descriptionTargeted regions.
items
$refLocation
typearray
type
descriptionSignifies the type of association.
enum
  • ASSOCIATION_TYPE_UNSPECIFIED
  • THREAT_ACTOR
  • MALWARE
enumDescriptions
  • The default Association Type.
  • Association type Threat actor.
  • Association type Malware.
typestring
typeobject
AssociationAlias
descriptionAssociation Alias used to represent Mandiant Threat Intelligence.
idAssociationAlias
properties
company
descriptionName of the provider who gave the association's name.
typestring
name
descriptionName of the alias.
typestring
typeobject
AttackDetails
descriptionMITRE ATT&CK details.
idAttackDetails
properties
tactics
descriptionTactics employed.
items
$refTactic
typearray
techniques
descriptionTechniques employed.
items
$refTechnique
typearray
version
descriptionATT&CK version (e.g. 12.1).
typestring
typeobject
Attribute
descriptionAttribute is a container for generic entity attributes including common attributes across core entities (such as, user or asset). For example, Cloud is a generic entity attribute since it can apply to an asset (for example, a VM) or a user (for example, an identity service account).
idAttribute
properties
cloud
$refCloud
descriptionCloud metadata attributes such as project ID, account ID, or organizational hierarchy.
creationTime
descriptionTime the resource or entity was created or provisioned.
formatgoogle-datetime
typestring
labels
descriptionSet of labels for the entity. Should only be used for product labels (for example, Google Cloud resource labels or Azure AD sensitivity labels. Should not be used for arbitrary key-value mappings.
items
$refLabel
typearray
lastUpdateTime
descriptionTime the resource or entity was last updated.
formatgoogle-datetime
typestring
permissions
descriptionSystem permissions for IAM entity (human principal, service account, group).
items
$refPermission
typearray
roles
descriptionSystem IAM roles to be assumed by resources to use the role's permissions for access control.
items
$refRole
typearray
typeobject
Authentication
descriptionThe Authentication extension captures details specific to authentication events. General guidelines for authentication events: * Details about the source of the authentication event (for example, client IP or hostname), should be captured in principal. The principal may be empty if we have no details about the source of the login. * Details about the target of the authentication event (for example, details about the machine that is being logged into or logged out of) should be captured in target. * Some authentication events may involve a third-party. For example, a user logs into a cloud service (for example, Chronicle) via their company's SSO (the event is logged by their SSO solution). In this case, the principal captures information about the user's device, the target captures details about the cloud service they logged into, and the intermediary captures details about the SSO solution.
idAuthentication
properties
authDetails
descriptionThe vendor defined details of the authentication.
typestring
mechanism
descriptionThe authentication mechanism.
items
enum
  • MECHANISM_UNSPECIFIED
  • USERNAME_PASSWORD
  • OTP
  • HARDWARE_KEY
  • LOCAL
  • REMOTE
  • REMOTE_INTERACTIVE
  • MECHANISM_OTHER
  • BADGE_READER
  • NETWORK
  • BATCH
  • SERVICE
  • UNLOCK
  • NETWORK_CLEAR_TEXT
  • NEW_CREDENTIALS
  • INTERACTIVE
  • CACHED_INTERACTIVE
  • CACHED_REMOTE_INTERACTIVE
  • CACHED_UNLOCK
  • BIOMETRIC
  • WEARABLE
enumDescriptions
  • The default mechanism.
  • Username + password authentication.
  • OTP authentication.
  • Hardware key authentication.
  • Local authentication.
  • Remote authentication.
  • RDP, Terminal Services, or VNC.
  • Some other mechanism that is not defined here.
  • Badge reader authentication
  • Network authentication.
  • Batch authentication.
  • Service authentication
  • Direct human-interactive unlock authentication.
  • Network clear text authentication.
  • Authentication with new credentials.
  • Interactive authentication.
  • Interactive authentication using cached credentials.
  • Cached Remote Interactive authentication using cached credentials.
  • Cached Remote Interactive authentication using cached credentials.
  • Biometric device such as a fingerprint reader.
  • Wearable such as an Apple Watch.
typestring
typearray
type
descriptionThe type of authentication.
enum
  • AUTHTYPE_UNSPECIFIED
  • MACHINE
  • SSO
  • VPN
  • PHYSICAL
  • TACACS
enumDescriptions
  • The default type.
  • A machine authentication.
  • An SSO authentication.
  • A VPN authentication.
  • A Physical authentication (e.g. "Badge reader").
  • A TACACS family protocol for networked systems authentication (e.g. TACACS, TACACS+).
typestring
typeobject
AuthorityKeyId
descriptionIdentifies the public key to be used to verify the signature on this certificate or CRL.
idAuthorityKeyId
properties
keyid
descriptionKey hexdump.
typestring
serialNumber
descriptionSerial number hexdump.
typestring
typeobject
BackstoryEntity
descriptionAn Entity provides additional context about an item in a UDM event. For example, a PROCESS_LAUNCH event describes that user 'abc@example.corp' launched process 'shady.exe'. The event does not include information that user 'abc@example.com' is a recently terminated employee who administers a server storing finance data. Information stored in one or more Entities can add this additional context.
idBackstoryEntity
properties
additional
additionalProperties
descriptionProperties of the object.
typeany
descriptionImportant entity data that cannot be adequately represented within the formal sections of the Entity.
typeobject
entity
$refNoun
descriptionNoun in the UDM event that this entity represents.
metadata
$refEntityMetadata
descriptionEntity metadata such as timestamp, product, etc.
metric
$refMetric
descriptionStores statistical metrics about the entity. Used if metadata.entity_type is METRIC.
relations
descriptionOne or more relationships between the entity (a) and other entities, including the relationship type and related entity.
items
$refRelation
typearray
riskScore
$refEntityRisk
descriptionStores information related to the entity's risk score.
typeobject
BackstoryFile
descriptionInformation about a file.
idBackstoryFile
properties
ahash
deprecatedTrue
descriptionDeprecated. Use authentihash instead.
typestring
authentihash
descriptionAuthentihash of the file.
typestring
capabilitiesTags
descriptionCapabilities tags.
items
typestring
typearray
createTime
descriptionTimestamp when the file was created.
formatgoogle-datetime
typestring
embeddedDomains
descriptionEmbedded domains found in the file.
items
typestring
typearray
embeddedIps
descriptionEmbedded IP addresses found in the file.
items
typestring
typearray
embeddedUrls
descriptionEmbedded urls found in the file.
items
typestring
typearray
exifInfo
$refExifInfo
descriptionExif metadata from different file formats extracted by exiftool.
fileMetadata
$refFileMetadata
deprecatedTrue
descriptionMetadata associated with the file. Deprecate FileMetadata in favor of using fields in File.
fileType
descriptionFileType field.
enum
  • FILE_TYPE_UNSPECIFIED
  • FILE_TYPE_PE_EXE
  • FILE_TYPE_PE_DLL
  • FILE_TYPE_MSI
  • FILE_TYPE_NE_EXE
  • FILE_TYPE_NE_DLL
  • FILE_TYPE_DOS_EXE
  • FILE_TYPE_DOS_COM
  • FILE_TYPE_COFF
  • FILE_TYPE_ELF
  • FILE_TYPE_LINUX_KERNEL
  • FILE_TYPE_RPM
  • FILE_TYPE_LINUX
  • FILE_TYPE_MACH_O
  • FILE_TYPE_JAVA_BYTECODE
  • FILE_TYPE_DMG
  • FILE_TYPE_DEB
  • FILE_TYPE_PKG
  • FILE_TYPE_PYC
  • FILE_TYPE_LNK
  • FILE_TYPE_DESKTOP_ENTRY
  • FILE_TYPE_JPEG
  • FILE_TYPE_TIFF
  • FILE_TYPE_GIF
  • FILE_TYPE_PNG
  • FILE_TYPE_BMP
  • FILE_TYPE_GIMP
  • FILE_TYPE_IN_DESIGN
  • FILE_TYPE_PSD
  • FILE_TYPE_TARGA
  • FILE_TYPE_XWD
  • FILE_TYPE_DIB
  • FILE_TYPE_JNG
  • FILE_TYPE_ICO
  • FILE_TYPE_FPX
  • FILE_TYPE_EPS
  • FILE_TYPE_SVG
  • FILE_TYPE_EMF
  • FILE_TYPE_WEBP
  • FILE_TYPE_DWG
  • FILE_TYPE_DXF
  • FILE_TYPE_THREEDS
  • FILE_TYPE_OGG
  • FILE_TYPE_FLC
  • FILE_TYPE_FLI
  • FILE_TYPE_MP3
  • FILE_TYPE_FLAC
  • FILE_TYPE_WAV
  • FILE_TYPE_MIDI
  • FILE_TYPE_AVI
  • FILE_TYPE_MPEG
  • FILE_TYPE_QUICKTIME
  • FILE_TYPE_ASF
  • FILE_TYPE_DIVX
  • FILE_TYPE_FLV
  • FILE_TYPE_WMA
  • FILE_TYPE_WMV
  • FILE_TYPE_RM
  • FILE_TYPE_MOV
  • FILE_TYPE_MP4
  • FILE_TYPE_T3GP
  • FILE_TYPE_WEBM
  • FILE_TYPE_MKV
  • FILE_TYPE_PDF
  • FILE_TYPE_PS
  • FILE_TYPE_DOC
  • FILE_TYPE_DOCX
  • FILE_TYPE_PPT
  • FILE_TYPE_PPTX
  • FILE_TYPE_XLS
  • FILE_TYPE_XLSX
  • FILE_TYPE_RTF
  • FILE_TYPE_PPSX
  • FILE_TYPE_ODP
  • FILE_TYPE_ODS
  • FILE_TYPE_ODT
  • FILE_TYPE_HWP
  • FILE_TYPE_GUL
  • FILE_TYPE_ODF
  • FILE_TYPE_ODG
  • FILE_TYPE_ONE_NOTE
  • FILE_TYPE_OOXML
  • FILE_TYPE_SLK
  • FILE_TYPE_EBOOK
  • FILE_TYPE_LATEX
  • FILE_TYPE_TTF
  • FILE_TYPE_EOT
  • FILE_TYPE_WOFF
  • FILE_TYPE_CHM
  • FILE_TYPE_ZIP
  • FILE_TYPE_GZIP
  • FILE_TYPE_BZIP
  • FILE_TYPE_RZIP
  • FILE_TYPE_DZIP
  • FILE_TYPE_SEVENZIP
  • FILE_TYPE_CAB
  • FILE_TYPE_JAR
  • FILE_TYPE_RAR
  • FILE_TYPE_MSCOMPRESS
  • FILE_TYPE_ACE
  • FILE_TYPE_ARC
  • FILE_TYPE_ARJ
  • FILE_TYPE_ASD
  • FILE_TYPE_BLACKHOLE
  • FILE_TYPE_KGB
  • FILE_TYPE_ZLIB
  • FILE_TYPE_TAR
  • FILE_TYPE_ZST
  • FILE_TYPE_LZFSE
  • FILE_TYPE_PYTHON_WHL
  • FILE_TYPE_PYTHON_PKG
  • FILE_TYPE_MSIX
  • FILE_TYPE_TEXT
  • FILE_TYPE_SCRIPT
  • FILE_TYPE_PHP
  • FILE_TYPE_PYTHON
  • FILE_TYPE_PERL
  • FILE_TYPE_RUBY
  • FILE_TYPE_C
  • FILE_TYPE_CPP
  • FILE_TYPE_JAVA
  • FILE_TYPE_SHELLSCRIPT
  • FILE_TYPE_PASCAL
  • FILE_TYPE_AWK
  • FILE_TYPE_DYALOG
  • FILE_TYPE_FORTRAN
  • FILE_TYPE_JAVASCRIPT
  • FILE_TYPE_POWERSHELL
  • FILE_TYPE_VBA
  • FILE_TYPE_M4
  • FILE_TYPE_OBJETIVEC
  • FILE_TYPE_JMOD
  • FILE_TYPE_MAKEFILE
  • FILE_TYPE_INI
  • FILE_TYPE_CLJ
  • FILE_TYPE_PDB
  • FILE_TYPE_SQL
  • FILE_TYPE_NEKO
  • FILE_TYPE_WER
  • FILE_TYPE_GOLANG
  • FILE_TYPE_M3U
  • FILE_TYPE_BAT
  • FILE_TYPE_MSC
  • FILE_TYPE_RDP
  • FILE_TYPE_SYMBIAN
  • FILE_TYPE_PALMOS
  • FILE_TYPE_WINCE
  • FILE_TYPE_ANDROID
  • FILE_TYPE_IPHONE
  • FILE_TYPE_HTML
  • FILE_TYPE_XML
  • FILE_TYPE_SWF
  • FILE_TYPE_FLA
  • FILE_TYPE_COOKIE
  • FILE_TYPE_TORRENT
  • FILE_TYPE_EMAIL_TYPE
  • FILE_TYPE_OUTLOOK
  • FILE_TYPE_SGML
  • FILE_TYPE_JSON
  • FILE_TYPE_CSV
  • FILE_TYPE_HTA
  • FILE_TYPE_INTERNET_SHORTCUT
  • FILE_TYPE_CAP
  • FILE_TYPE_ISOIMAGE
  • FILE_TYPE_SQUASHFS
  • FILE_TYPE_VHD
  • FILE_TYPE_APPLE
  • FILE_TYPE_MACINTOSH
  • FILE_TYPE_APPLESINGLE
  • FILE_TYPE_APPLEDOUBLE
  • FILE_TYPE_MACINTOSH_HFS
  • FILE_TYPE_APPLE_PLIST
  • FILE_TYPE_MACINTOSH_LIB
  • FILE_TYPE_APPLESCRIPT
  • FILE_TYPE_APPLESCRIPT_COMPILED
  • FILE_TYPE_CRX
  • FILE_TYPE_XPI
  • FILE_TYPE_ROM
  • FILE_TYPE_IPS
  • FILE_TYPE_PEM
  • FILE_TYPE_PGP
  • FILE_TYPE_CRT
enumDescriptions
  • File type is UNSPECIFIED.
  • File type is PE_EXE.
  • Although DLLs are actually portable executables, this value enables the file type to be identified separately. File type is PE_DLL.
  • File type is MSI.
  • File type is NE_EXE.
  • File type is NE_DLL.
  • File type is DOS_EXE.
  • File type is DOS_COM.
  • File type is COFF.
  • File type is ELF.
  • File type is LINUX_KERNEL.
  • File type is RPM.
  • File type is LINUX.
  • File type is MACH_O.
  • File type is JAVA_BYTECODE.
  • File type is DMG.
  • File type is DEB.
  • File type is PKG.
  • File type is PYC.
  • File type is LNK.
  • File type is DESKTOP_ENTRY.
  • File type is JPEG.
  • File type is TIFF.
  • File type is GIF.
  • File type is PNG.
  • File type is BMP.
  • File type is GIMP.
  • File type is Adobe InDesign.
  • File type is PSD. Adobe Photoshop.
  • File type is TARGA.
  • File type is XWD.
  • File type is DIB.
  • File type is JNG.
  • File type is ICO.
  • File type is FPX.
  • File type is EPS.
  • File type is SVG.
  • File type is EMF.
  • File type is WEBP.
  • File type is DWG.
  • File type is DXF.
  • File type is 3DS.
  • File type is OGG.
  • File type is FLC.
  • File type is FLI.
  • File type is MP3.
  • File type is FLAC.
  • File type is WAV.
  • File type is MIDI.
  • File type is AVI.
  • File type is MPEG.
  • File type is QUICKTIME.
  • File type is ASF.
  • File type is DIVX.
  • File type is FLV.
  • File type is WMA.
  • File type is WMV.
  • File type is RM. RealMedia type.
  • File type is MOV.
  • File type is MP4.
  • File type is T3GP.
  • File type is WEBM.
  • File type is MKV.
  • File type is PDF.
  • File type is PS.
  • File type is DOC.
  • File type is DOCX.
  • File type is PPT.
  • File type is PPTX.
  • File type is XLS.
  • File type is XLSX.
  • File type is RTF.
  • File type is PPSX.
  • File type is ODP.
  • File type is ODS.
  • File type is ODT.
  • File type is HWP.
  • File type is GUL.
  • File type is ODF.
  • File type is ODG.
  • File type is ONE_NOTE.
  • File type is OOXML.
  • File type is SLK.
  • File type is EBOOK.
  • File type is LATEX.
  • File type is TTF.
  • File type is EOT.
  • File type is WOFF.
  • File type is CHM.
  • File type is ZIP.
  • File type is GZIP.
  • File type is BZIP.
  • File type is RZIP.
  • File type is DZIP.
  • File type is SEVENZIP.
  • File type is CAB.
  • File type is JAR.
  • File type is RAR.
  • File type is MSCOMPRESS.
  • File type is ACE.
  • File type is ARC.
  • File type is ARJ.
  • File type is ASD.
  • File type is BLACKHOLE.
  • File type is KGB.
  • File type is ZLIB.
  • File type is TAR.
  • File type is ZST.
  • File type is LZFSE.
  • File type is PYTHON_WHL.
  • File type is PYTHON_PKG.
  • File type is MSIX, new Windows app package format.
  • File type is TEXT.
  • File type is SCRIPT.
  • File type is PHP.
  • File type is PYTHON.
  • File type is PERL.
  • File type is RUBY.
  • File type is C.
  • File type is CPP.
  • File type is JAVA.
  • File type is SHELLSCRIPT.
  • File type is PASCAL.
  • File type is AWK.
  • File type is DYALOG.
  • File type is FORTRAN.
  • File type is JAVASCRIPT.
  • File type is POWERSHELL.
  • File type is VBA.
  • File type is M4.
  • File type is OBJETIVEC.
  • File type is JMOD.
  • File type is MAKEFILE.
  • File type is INI.
  • File type is CLJ.
  • File type is PDB.
  • File type is SQL.
  • File type is NEKO.
  • File type is WER.
  • File type is GOLANG.
  • File type is M3U.
  • File type is BAT, Windows .bat/.cmd (old files are tagged as SHELLSCRIPT).
  • File type is MSC, Microsoft Management Console (MMC).
  • File type is RDP, Microsoft Remote Desktop Protocol (RDP) file.
  • File type is SYMBIAN.
  • File type is PALMOS.
  • File type is WINCE.
  • File type is ANDROID.
  • File type is IPHONE.
  • File type is HTML.
  • File type is XML.
  • File type is SWF.
  • File type is FLA.
  • File type is COOKIE.
  • File type is TORRENT.
  • File type is EMAIL_TYPE.
  • File type is OUTLOOK.
  • File type is SGML.
  • File type is JSON.
  • File type is CSV.
  • File type is HTA (HTML Application).
  • File type is MSHTML .url.
  • File type is CAP.
  • File type is ISOIMAGE.
  • File type is SQUASHFS.
  • File type is VHD.
  • File type is APPLE.
  • File type is MACINTOSH.
  • File type is APPLESINGLE.
  • File type is APPLEDOUBLE.
  • File type is MACINTOSH_HFS.
  • File type is APPLE_PLIST.
  • File type is MACINTOSH_LIB.
  • File type is APPLESCRIPT.
  • File type is APPLESCRIPT_COMPILED .
  • File type is CRX.
  • File type is XPI.
  • File type is ROM.
  • File type is IPS.
  • File type is PEM.
  • File type is PGP.
  • File type is CRT.
typestring
firstSeenTime
descriptionTimestamp the file was first seen in the customer's environment.
formatgoogle-datetime
typestring
firstSubmissionTime
descriptionFirst submission time of the file.
formatgoogle-datetime
typestring
fullPath
descriptionThe full path identifying the location of the file on the system. This field can be used as an entity indicator for file entities.
typestring
lastAccessTime
descriptionTimestamp when the file was accessed.
formatgoogle-datetime
typestring
lastAnalysisTime
descriptionTimestamp the file was last analysed.
formatgoogle-datetime
typestring
lastModificationTime
descriptionTimestamp when the file was last updated.
formatgoogle-datetime
typestring
lastSeenTime
descriptionTimestamp the file was last seen in the customer's environment.
formatgoogle-datetime
typestring
lastSubmissionTime
descriptionLast submission time of the file.
formatgoogle-datetime
typestring
mainIcon
$refFavicon
descriptionIcon's relevant hashes.
md5
descriptionThe MD5 hash of the file, as a hex-encoded string. This field can be used as an entity indicator for file entities.
typestring
mimeType
descriptionThe MIME (Multipurpose Internet Mail Extensions) type of the file, for example "PE", "PDF", or "powershell script".
typestring
names
descriptionNames fields.
items
typestring
typearray
ntfs
$refNtfsFileMetadata
descriptionNTFS metadata.
pdfInfo
$refPDFInfo
descriptionInformation about the PDF file structure.
peFile
$refFileMetadataPE
descriptionMetadata about the Portable Executable (PE) file.
prevalence
$refPrevalence
descriptionPrevalence of the file hash in the customer's environment.
securityResult
$refSecurityResult
descriptionGoogle Cloud Threat Intelligence (GCTI) security result for the file including threat context and detection metadata.
sha1
descriptionThe SHA1 hash of the file, as a hex-encoded string. This field can be used as an entity indicator for file entities.
typestring
sha256
descriptionThe SHA256 hash of the file, as a hex-encoded string. This field can be used as an entity indicator for file entities.
typestring
signatureInfo
$refSignatureInfo
descriptionFile signature information extracted from different tools.
size
descriptionThe size of the file in bytes.
formatuint64
typestring
ssdeep
descriptionSsdeep of the file
typestring
statDev
descriptionThe file system identifier to which the object belongs.
formatuint64
typestring
statFlags
descriptionUser defined flags for file.
formatuint32
typeinteger
statInode
descriptionThe file identifier. Unique identifier of object within a file system.
formatuint64
typestring
statMode
descriptionThe mode of the file. A bit string indicating the permissions and privileges of the file.
formatuint64
typestring
statNlink
descriptionNumber of links to file.
formatuint64
typestring
symhash
descriptionSymHash of the file. Used for Mach-O (e.g. MacOS) binaries, to identify similar files based on their symbol table.
typestring
tags
descriptionTags for the file.
items
typestring
typearray
vhash
descriptionVhash of the file.
typestring
typeobject
BoolSequence
descriptionBoolSequence represents a sequence of bools.
idBoolSequence
properties
boolVals
descriptionbool sequence.
items
typeboolean
typearray
typeobject
BytesSequence
descriptionBytesSequence represents a sequence of bytes.
idBytesSequence
properties
bytesVals
descriptionbytes sequence.
items
formatbyte
typestring
typearray
typeobject
CancelOperationRequest
descriptionThe request message for Operations.CancelOperation.
idCancelOperationRequest
properties
typeobject
CertSignature
descriptionCertificate's signature and algorithm.
idCertSignature
properties
signature
descriptionSignature.
typestring
signatureAlgorithm
descriptionAlgorithm.
typestring
typeobject
Certificate
descriptionCertificate information
idCertificate
properties
issuer
descriptionIssuer of the certificate.
typestring
md5
descriptionThe MD5 hash of the certificate, as a hex-encoded string.
typestring
notAfter
descriptionIndicates when the certificate is no longer valid.
formatgoogle-datetime
typestring
notBefore
descriptionIndicates when the certificate is first valid.
formatgoogle-datetime
typestring
serial
descriptionCertificate serial number.
typestring
sha1
descriptionThe SHA1 hash of the certificate, as a hex-encoded string.
typestring
sha256
descriptionThe SHA256 hash of the certificate, as a hex-encoded string.
typestring
subject
descriptionSubject of the certificate.
typestring
version
descriptionCertificate version.
typestring
typeobject
Chip
idChip
properties
text
typestring
type
enum
  • UNSPECIFIED
  • ALERT
  • NETWORK_CONNECTION
  • EDR
  • UNPARSED_RAW_LOG
  • LOGIN_EVENT
  • EMAIL_EVENT
  • GENERIC
  • TELEMETRY
enumDescriptions
typestring
typeobject
Client
descriptionTransport Layer Security (TLS) information associated with the client (for example, Certificate or JA3 hash).
idClient
properties
certificate
$refCertificate
descriptionClient certificate.
ja3
descriptionJA3 hash from the TLS ClientHello, as a hex-encoded string.
typestring
serverName
descriptionHost name of the server, that the client is connecting to.
typestring
supportedCiphers
descriptionCiphers supported by the client during client hello.
items
typestring
typearray
typeobject
Cloud
descriptionMetadata related to the cloud environment.
idCloud
properties
availabilityZone
descriptionThe cloud environment availability zone (different from region which is location.name).
typestring
environment
descriptionThe Cloud environment.
enum
  • UNSPECIFIED_CLOUD_ENVIRONMENT
  • GOOGLE_CLOUD_PLATFORM
  • AMAZON_WEB_SERVICES
  • MICROSOFT_AZURE
enumDescriptions
  • Default.
  • Google Cloud Platform.
  • Amazon Web Services.
  • Microsoft Azure.
typestring
project
$refResource
deprecatedTrue
descriptionThe cloud environment project information. Deprecated: Use Resource.resource_ancestors
vpc
$refResource
deprecatedTrue
descriptionThe cloud environment VPC. Deprecated.
typeobject
Collection
descriptionCollection represents a container of objects (such as events, entity context metadata, detection finding metadata) and state (such as investigation details). BEGIN GOOGLE-INTERNAL See go/udm:collections for additional details. END GOOGLE-INTERNAL An example use case for Collection is to model a detection and investigation from detection finding metadata to investigative state collected in the course of the investigation. For more complex investigation and response workflows a Collection could represent an incident consisting of multiple child findings or incidents. This can be expanded on to model remediation elements of a full detection and response workflow. NEXT TAG: 20
idCollection
properties
caseName
descriptionThe resource name of the Case that this collection belongs to. Example: projects/{project id}/locations/{region}/chronicle/cases/{internal_case_id}
typestring
collectionElements
descriptionConstituent elements of the collection. Each element shares an association that groups it together and is a component of the overall collection. For example, a detection collection may have several constituent elements that each share a correlation association that together represent a particular pattern or behavior.
items
$refElement
typearray
createdTime
descriptionTime the collection was created.
formatgoogle-datetime
typestring
dataAccessScope
descriptionThe resource name of the DataAccessScope of this collection. BEGIN GOOGLE-INTERNAL We may change this name based on the final resource design of the scope. END GOOGLE-INTERNAL
typestring
detection
descriptionDetection metadata for findings that represent detections, can include rule details, machine learning model metadata, and indicators implicated in the detection (using the .about field).
items
$refSecurityResult
typearray
detectionTime
descriptionTimestamp within the time_window related to the time of the collection_elements. For Rule Detections, this timestamp is the end of the the time_window for multi-event rules or the time of the event for single event rules. For late-arriving events that trigger new alerts, the detection_time will be the event time of the event.
formatgoogle-datetime
typestring
feedbackHistory
descriptionThe history of feedback submitted by analysts for this finding, in descending order by timestamp. This field is limited to the most recent 1000 feedback events. The primary feedback will also be included in this list.
items
$refFeedback
typearray
feedbackSummary
$refFeedback
descriptionThe current primary analyst feedback. This does not include the history of feedback given, which may be supplied in `feedback`.
id
descriptionUnique ID for the collection. The ID is specific to the type of collection. For example, with rule detections this is the detection ID.
typestring
idNamespace
descriptionThe ID namespace used for the Collection.
enum
  • NORMALIZED_TELEMETRY
  • RAW_TELEMETRY
  • RULE_DETECTIONS
  • UPPERCASE
  • MACHINE_INTELLIGENCE
  • SECURITY_COMMAND_CENTER
  • UNSPECIFIED
  • SOAR_ALERT
  • VIRUS_TOTAL
enumDescriptions
  • Ingested and Normalized telemetry events
  • Ingested Raw telemetry
  • Chronicle Rules engine
  • Uppercase
  • DSML - Machine Intelligence
  • A normalized telemetry event from Google Security Command Center.
  • Unspecified Namespace
  • An alert coming from other SIEMs via Chronicle SOAR.
  • VirusTotal.
typestring
investigation
$refInvestigation
descriptionConsolidated investigation details (categorization, status, etc) typically for collections that begin as detection findings and then evolve with analyst action and feedback into investigations around the detection output.
lastUpdatedTime
descriptionTime the collection was last updated.
formatgoogle-datetime
typestring
responsePlatformInfo
$refResponsePlatformInfo
descriptionAlert related info of this same alert in customer's SOAR platform.
soarAlert
descriptionA boolean field indicating that the alert is present in SOAR.
typeboolean
soarAlertMetadata
$refSoarAlertMetadata
descriptionMetadata fields of alerts coming from other SIEM systems via SOAR.
tags
descriptionTags set by UC/DSML/RE for the Finding during creation.
items
typestring
typearray
timeWindow
$refInterval
descriptionTime interval that the collection represents.
type
descriptionWhat the collection represents.
enum
  • COLLECTION_TYPE_UNSPECIFIED
  • TELEMETRY_ALERT
  • GCTI_FINDING
  • UPPERCASE_ALERT
  • RULE_DETECTION
  • MACHINE_INTELLIGENCE_ALERT
  • SOAR_ALERT
enumDescriptions
  • An unspecified collection type.
  • An alert reported in customer telemetry.
  • A finding from the Uppercase team.
  • A detection found by applying a rule.
  • An alert generated by Chronicle machine learning models.
  • An alert coming from other SIEMs via Chronicle SOAR.
typestring
typeobject
ColumnNames
idColumnNames
properties
names
items
typestring
typearray
typeobject
CompilationDiagnostic
descriptionCompilationDiagnostic represents a compilation diagnostic generated during a rule's compilation, such as a compilation error or a compilation warning.
idCompilationDiagnostic
properties
message
descriptionOutput only. The diagnostic message.
readOnlyTrue
typestring
position
$refCompilationPosition
descriptionOutput only. The approximate position in the rule text associated with the compilation diagnostic. Compilation Position may be empty.
readOnlyTrue
severity
descriptionOutput only. The severity of a rule's compilation diagnostic.
enum
  • SEVERITY_UNSPECIFIED
  • WARNING
  • ERROR
enumDescriptions
  • An unspecified severity level.
  • A compilation warning.
  • A compilation error.
readOnlyTrue
typestring
uri
descriptionOutput only. Link to documentation that describes a diagnostic in more detail.
readOnlyTrue
typestring
typeobject
CompilationPosition
descriptionCompilationPosition represents the location of a compilation diagnostic in rule text.
idCompilationPosition
properties
endColumn
descriptionOutput only. End column number, beginning at 1.
formatint32
readOnlyTrue
typeinteger
endLine
descriptionOutput only. End line number, beginning at 1.
formatint32
readOnlyTrue
typeinteger
startColumn
descriptionOutput only. Start column number, beginning at 1.
formatint32
readOnlyTrue
typeinteger
startLine
descriptionOutput only. Start line number, beginning at 1.
formatint32
readOnlyTrue
typeinteger
typeobject
CreateParserExtensionMetadata
descriptionOperation metadata for creating a parser extension.
idCreateParserExtensionMetadata
properties
state
descriptionThe state of the parser extension creation process.
enum
  • STATE_UNSPECIFIED
  • NEW
  • VALIDATING
  • LIVE
  • REJECTED
  • INTERNAL_ERROR
  • VALIDATED
  • ARCHIVED
enumDescriptions
  • The state for this parser extension was not specified.
  • The parser extension has been newly submitted and is waiting to be validated.
  • The parser extension is currently going through the validation pipeline.
  • The parser extension is live in production. Only configs that have successfully passed the validation stage will be set to LIVE.
  • Validation completed, but the parser extension was rejected with errors.
  • An error occurred when processing this parser extension.
  • Extension is validated.
  • Extension is archived and is no more being used.
typestring
stateLastChangedTime
descriptionThe time the config state was last changed.
formatgoogle-datetime
typestring
validationErrors
descriptionAny validation error while validating the extension, this have cap of size 10
items
typestring
typearray
validationReport
descriptionThe validation report generated during validation of the parser extension.
typestring
typeobject
CreateParserMetadata
descriptionOperation metadata for creating a parser.
idCreateParserMetadata
properties
stage
descriptionThe validation stage of the parser creation process.
enum
  • VALIDATION_STAGE_UNSPECIFIED
  • NEW
  • VALIDATING
  • PASSED
  • FAILED
  • DELETE_CANDIDATE
enumDescriptions
  • The validation stage is not specified.
  • The custom parser is submitted for validation.
  • The custom parser is currently going through the validation pipeline
  • The custom parser has successfully passed the validation.
  • The custom parser has failed validation.
  • The parser is no good, It is available for auto deletion.
typestring
validationReport
descriptionThe validation report generated during validation of the parser.
typestring
typeobject
DNSRecord
descriptionDNS record.
idDNSRecord
properties
expire
descriptionExpire.
formatgoogle-duration
typestring
minimum
descriptionMinimum.
formatgoogle-duration
typestring
priority
descriptionPriority.
formatint64
typestring
refresh
descriptionRefresh.
formatgoogle-duration
typestring
retry
descriptionRetry.
formatint64
typestring
rname
descriptionRname.
typestring
serial
descriptionSerial.
formatint64
typestring
ttl
descriptionTime to live.
formatgoogle-duration
typestring
type
descriptionType.
typestring
value
descriptionValue.
typestring
typeobject
DataAccessIngestionLabel
idDataAccessIngestionLabel
properties
key
descriptionThe key.
typestring
value
descriptionThe value.
typestring
typeobject
DataAccessLabel
descriptionA DataAccessLabel is a label on events to define user access to data.
idDataAccessLabel
properties
author
descriptionOutput only. The user who created the data access label.
readOnlyTrue
typestring
createTime
descriptionOutput only. The time at which the data access label was created.
formatgoogle-datetime
readOnlyTrue
typestring
description
descriptionOptional. A description of the data access label for a human reader.
typestring
displayName
descriptionOutput only. The short name displayed for the label as it appears on event data.
readOnlyTrue
typestring
lastEditor
descriptionOutput only. The user who last updated the data access label.
readOnlyTrue
typestring
name
descriptionRequired. The unique resource name of the data access label.
typestring
udmQuery
descriptionA UDM query over event data.
typestring
updateTime
descriptionOutput only. The time at which the data access label was last updated.
formatgoogle-datetime
readOnlyTrue
typestring
typeobject
DataAccessLabelReference
descriptionReference object to a data access label.
idDataAccessLabelReference
properties
assetNamespace
descriptionThe asset namespace configured in the forwarder of the customer's events.
typestring
dataAccessLabel
descriptionThe name of the data access label.
typestring
displayName
descriptionOutput only. The display name of the label. Data access label and log types's name will match the display name of the resource. The asset namespace will match the namespace itself. The ingestion key value pair will match the key of the tuple.
readOnlyTrue
typestring
ingestionLabel
$refIngestionLabel
descriptionThe ingestion label configured in the forwarder of the customer's events.
logType
descriptionThe name of the log type.
typestring
typeobject
DataAccessLabels
idDataAccessLabels
properties
allowScopedAccess
descriptionAre the labels ready for scoped access
typeboolean
customLabels
descriptionAll the complex labels (UDM search syntax based).
items
typestring
typearray
ingestionKvLabels
descriptionAll the ingestion labels (key/value pairs).
items
$refDataAccessIngestionLabel
typearray
ingestionLabels
deprecatedTrue
descriptionAll the ingestion labels.
items
typestring
typearray
logTypes
descriptionAll the LogType labels.
items
typestring
typearray
namespaces
descriptionAll the namespaces.
items
typestring
typearray
typeobject
DataAccessScope
descriptionA DataAccessScope is a boolean expression of data access labels used to restrict access to data for users.
idDataAccessScope
properties
allowAll
descriptionOptional. Whether or not the scope allows all labels, allow_all and allowed_data_access_labels are mutually exclusive and one of them must be present. denied_data_access_labels can still be used along with allow_all. When combined with denied_data_access_labels, access will be granted to all data that doesn't have labels mentioned in denied_data_access_labels. E.g.: A customer with scope with denied labels A and B and allow_all will be able to see all data except data labeled with A and data labeled with B and data with labels A and B.
typeboolean
allowedDataAccessLabels
descriptionOptional. The allowed labels for the scope. Either allow_all or allowed_data_access_labels needs to be provided. When provided, there has to be at least one label allowed for the scope to be valid. The logical operator for evaluation of the allowed labels is OR. E.g.: A customer with scope with allowed labels A and B will be able to see data with labeled with A or B or (A and B).
items
$refDataAccessLabelReference
typearray
author
descriptionOutput only. The user who created the data access scope.
readOnlyTrue
typestring
createTime
descriptionOutput only. The time at which the data access scope was created.
formatgoogle-datetime
readOnlyTrue
typestring
deniedDataAccessLabels
descriptionOptional. The denied labels for the scope. The logical operator for evaluation of the denied labels is AND. E.g.: A customer with scope with denied labels A and B won't be able to see data labeled with A and data labeled with B and data with labels A and B.
items
$refDataAccessLabelReference
typearray
description
descriptionOptional. A description of the data access scope for a human reader.
typestring
displayName
descriptionOutput only. The name to be used for display to customers of the data access scope.
readOnlyTrue
typestring
lastEditor
descriptionOutput only. The user who last updated the data access scope.
readOnlyTrue
typestring
name
descriptionRequired. The unique full name of the data access scope. The name should comply with https://google.aip.dev/122 standards.
typestring
updateTime
descriptionOutput only. The time at which the data access scope was last updated.
formatgoogle-datetime
readOnlyTrue
typestring
typeobject
Date
descriptionRepresents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values. * A month and day, with a zero year (for example, an anniversary). * A year on its own, with a zero month and a zero day. * A year and month, with a zero day (for example, a credit card expiration date). Related types: * google.type.TimeOfDay * google.type.DateTime * google.protobuf.Timestamp
idDate
properties
day
descriptionDay of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.
formatint32
typeinteger
month
descriptionMonth of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.
formatint32
typeinteger
year
descriptionYear of the date. Must be from 1 to 9999, or 0 to specify a date without a year.
formatint32
typeinteger
typeobject
Detections
idDetections
properties
baselineAlertsCount
formatint32
typeinteger
complete
typeboolean
detectionFieldAggregations
$refAlertFieldAggregations
detections
items
$refCollection
typearray
filteredAlertsCount
formatint32
typeinteger
tooManyDetections
typeboolean
validSnapshotQuery
typeboolean
typeobject
Dhcp
descriptionDHCP information.
idDhcp
properties
chaddr
descriptionClient hardware address (chaddr).
typestring
ciaddr
descriptionClient IP address (ciaddr).
typestring
clientHostname
descriptionClient hostname. See RFC2132, section 3.14.
typestring
clientIdentifier
descriptionClient identifier. See RFC2132, section 9.14. Note: Make sure to update the client_identifier_string field as well if you update this field.
formatbyte
typestring
clientIdentifierString
descriptionClient identifier as string. See RFC2132, section 9.14. This field holds the string value of the client_identifier.
typestring
file
descriptionBoot image filename.
typestring
flags
descriptionFlags.
formatuint32
typeinteger
giaddr
descriptionRelay agent IP address (giaddr).
typestring
hlen
descriptionHardware address length.
formatuint32
typeinteger
hops
descriptionHardware ops.
formatuint32
typeinteger
htype
descriptionHardware address type.
formatuint32
typeinteger
leaseTimeSeconds
descriptionLease time in seconds. See RFC2132, section 9.2.
formatuint32
typeinteger
opcode
descriptionThe BOOTP op code.
enum
  • UNKNOWN_OPCODE
  • BOOTREQUEST
  • BOOTREPLY
enumDescriptions
  • Default opcode.
  • Request.
  • Reply.
typestring
options
descriptionList of DHCP options.
items
$refOption
typearray
requestedAddress
descriptionRequested IP address. See RFC2132, section 9.1.
typestring
seconds
descriptionSeconds elapsed since client began address acquisition/renewal process.
formatuint32
typeinteger
siaddr
descriptionIP address of the next bootstrap server.
typestring
sname
descriptionServer name that the client wishes to boot from.
typestring
transactionId
descriptionTransaction ID.
formatuint32
typeinteger
type
descriptionDHCP message type.
enum
  • UNKNOWN_MESSAGE_TYPE
  • DISCOVER
  • OFFER
  • REQUEST
  • DECLINE
  • ACK
  • NAK
  • RELEASE
  • INFORM
  • WIN_DELETED
  • WIN_EXPIRED
enumDescriptions
  • Default message type.
  • DHCPDISCOVER.
  • DHCPOFFER.
  • DHCPREQUEST.
  • DHCPDECLINE.
  • DHCPACK.
  • DHCPNAK.
  • DHCPRELEASE.
  • DHCPINFORM.
  • Microsoft Windows DHCP "lease deleted".
  • Microsoft Windows DHCP "lease expired".
typestring
yiaddr
descriptionYour IP address (yiaddr).
typestring
typeobject
Dns
descriptionDNS information.
idDns
properties
additional
descriptionA list of additional domain name servers that can be used to verify the answer to the domain.
items
$refResourceRecord
typearray
answers
descriptionA list of answers to the domain name query.
items
$refResourceRecord
typearray
authoritative
descriptionOther DNS header flags. See RFC1035, section 4.1.1.
typeboolean
authority
descriptionA list of domain name servers which verified the answers to the domain name queries.
items
$refResourceRecord
typearray
id
descriptionDNS query id.
formatuint32
typeinteger
opcode
descriptionThe DNS OpCode used to specify the type of DNS query (for example, QUERY, IQUERY, or STATUS).
formatuint32
typeinteger
questions
descriptionA list of domain protocol message questions.
items
$refQuestion
typearray
recursionAvailable
descriptionWhether a recursive DNS lookup is available.
typeboolean
recursionDesired
descriptionWhether a recursive DNS lookup is desired.
typeboolean
response
descriptionSet to true if the event is a DNS response. See QR field from RFC1035.
typeboolean
responseCode
descriptionResponse code. See RCODE from RFC1035.
formatuint32
typeinteger
truncated
descriptionWhether the DNS response was truncated.
typeboolean
typeobject
Domain
descriptionInformation about a domain.
idDomain
properties
admin
$refUser
descriptionParsed contact information for the administrative contact for the domain.
auditUpdateTime
descriptionAudit updated time.
formatgoogle-datetime
typestring
billing
$refUser
descriptionParsed contact information for the billing contact of the domain.
categories
descriptionCategories assign to the domain as retrieved from VirusTotal.
items
typestring
typearray
contactEmail
descriptionContact email address.
typestring
creationTime
descriptionDomain creation time.
formatgoogle-datetime
typestring
expirationTime
descriptionExpiration time.
formatgoogle-datetime
typestring
favicon
$refFavicon
descriptionIncludes difference hash and MD5 hash of the domain's favicon.
firstSeenTime
descriptionFirst seen timestamp of the domain in the customer's environment.
formatgoogle-datetime
typestring
ianaRegistrarId
descriptionIANA Registrar ID. See https://www.iana.org/assignments/registrar-ids/registrar-ids.xhtml
formatint32
typeinteger
jarm
descriptionDomain's JARM hash.
typestring
lastDnsRecords
descriptionDomain's DNS records from the last scan.
items
$refDNSRecord
typearray
lastDnsRecordsTime
descriptionDate when the DNS records list was retrieved by VirusTotal.
formatgoogle-datetime
typestring
lastHttpsCertificate
$refSSLCertificate
descriptionSSL certificate object retrieved last time the domain was analyzed.
lastHttpsCertificateTime
descriptionWhen the certificate was retrieved by VirusTotal.
formatgoogle-datetime
typestring
lastSeenTime
descriptionLast seen timestamp of the domain in the customer's environment.
formatgoogle-datetime
typestring
name
descriptionThe domain name. This field can be used as an entity indicator for Domain entities.
typestring
nameServer
descriptionRepeated list of name servers.
items
typestring
typearray
popularityRanks
descriptionDomain's position in popularity ranks such as Alexa, Quantcast, Statvoo, etc
items
$refPopularityRank
typearray
prevalence
$refPrevalence
descriptionThe prevalence of the domain within the customer's environment.
privateRegistration
descriptionIndicates whether the domain appears to be using a private registration service to mask the owner's contact information.
typeboolean
registrant
$refUser
descriptionParsed contact information for the registrant of the domain.
registrar
descriptionRegistrar name . FOr example, "Wild West Domains, Inc. (R120-LROR)", "GoDaddy.com, LLC", or "PDR LTD. D/B/A PUBLICDOMAINREGISTRY.COM".
typestring
registryDataRawText
descriptionRegistry Data raw text.
formatbyte
typestring
status
descriptionDomain status. See https://www.icann.org/resources/pages/epp-status-codes-2014-06-16-en for meanings of possible values
typestring
tags
descriptionList of representative attributes.
items
typestring
typearray
tech
$refUser
descriptionParsed contact information for the technical contact for the domain
updateTime
descriptionLast updated time.
formatgoogle-datetime
typestring
whoisRecordRawText
descriptionWHOIS raw text.
formatbyte
typestring
whoisServer
descriptionWhois server name.
typestring
whoisTime
descriptionDate of the last update of the WHOIS record.
formatgoogle-datetime
typestring
zone
$refUser
descriptionParsed contact information for the zone.
typeobject
DoubleSequence
descriptionDoubleSequence represents a sequence of doubles.
idDoubleSequence
properties
doubleVals
descriptiondouble sequence.
items
formatdouble
typenumber
typearray
typeobject
EC
descriptionEC public key information.
idEC
properties
oid
descriptionCurve name.
typestring
pub
descriptionPublic key hexdump.
typestring
typeobject
Element
descriptionNEXT TAG: 5
idElement
properties
association
$refSecurityResult
descriptionMetadata that provides the relevant association for the references in the element. For a detection, this can be the correlated aspect of the references that contributed to the overall detection. For example, may include sub-rule condition, machine learning model metadata, and/or indicators implicated in this component of the detection (using the .about field).
label
descriptionA name that labels the entire references group.
typestring
references
descriptionReferences to model primatives including events and entities that share a common association. Even though a reference can have both UDM and entity, a collection of references (of a single element) will only have one type of message in it (either UDM / Entity).
items
$refReference
typearray
referencesSampled
descriptionCopied from the detection event_sample.too_many_event_samples field. If true, the number of references will be capped at the sample limit (set at rule service). This is applicable to both UDM references and Entity references.
typeboolean
typeobject
Email
descriptionEmail info.
idEmail
properties
bcc
descriptionA list of 'bcc' addresses.
items
typestring
typearray
bounceAddress
descriptionThe envelope from address. https://en.wikipedia.org/wiki/Bounce_address
typestring
cc
descriptionA list of 'cc' addresses.
items
typestring
typearray
from
descriptionThe 'from' address.
typestring
mailId
descriptionThe mail (or message) ID.
typestring
replyTo
descriptionThe 'reply to' address.
typestring
subject
descriptionThe subject line(s) of the email.
items
typestring
typearray
to
descriptionA list of 'to' addresses.
items
typestring
typearray
typeobject
Empty
descriptionA generic empty message that you can re-use to avoid defining duplicated empty messages in your APIs. A typical example is to use it as the request or the response type of an API method. For instance: service Foo { rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty); }
idEmpty
properties
typeobject
EntityChangedCountTimelineBucket
idEntityChangedCountTimelineBucket
properties
entityChangedInfo
items
$refEntityChangedInfo
typearray
totalChangedEntitiesCount
formatint32
typeinteger
typeobject
EntityChangedInfo
idEntityChangedInfo
properties
artifacts
$refFieldAndValue
entityCount
formatint32
typeinteger
typeobject
EntityCount
descriptionCount of different types of entities in the watchlist.
idEntityCount
properties
asset
descriptionOutput only. Count of asset type entities in the watchlist.
formatint32
readOnlyTrue
typeinteger
user
descriptionOutput only. Count of user type entities in the watchlist.
formatint32
readOnlyTrue
typeinteger
typeobject
EntityMetadata
descriptionInformation about the Entity and the product where the entity was created. Next Tag: 17
idEntityMetadata
properties
collectedTimestamp
descriptionGMT timestamp when the entity information was collected by the vendor's local collection infrastructure.
formatgoogle-datetime
typestring
creationTimestamp
descriptionGMT timestamp when the entity described by the product_entity_id was created on the system where data was collected.
formatgoogle-datetime
typestring
description
descriptionHuman-readable description of the entity.
typestring
entityType
descriptionEntity type. If an entity has multiple possible types, this specifies the most specific type.
enum
  • UNKNOWN_ENTITYTYPE
  • ASSET
  • USER
  • GROUP
  • RESOURCE
  • IP_ADDRESS
  • FILE
  • DOMAIN_NAME
  • URL
  • MUTEX
  • METRIC
enumDescriptions
  • @hide_from_doc
  • An asset, such as workstation, laptop, phone, virtual machine, etc.
  • User.
  • Group.
  • Resource.
  • An external IP address.
  • A file.
  • A domain.
  • A url.
  • A mutex.
  • A metric.
typestring
eventMetadata
$refMetadata
descriptionMetadata field from the event.
extracted
additionalProperties
descriptionProperties of the object.
typeany
descriptionFlattened fields extracted from the log.
typeobject
feed
descriptionVendor feed name for a threat indicator feed.
typestring
interval
$refInterval
descriptionValid existence time range for the version of the entity represented by this entity data.
productEntityId
descriptionA vendor-specific identifier that uniquely identifies the entity (e.g. a GUID, LDAP, OID, or similar).
typestring
productName
descriptionProduct name that produced the entity information.
typestring
productVersion
descriptionVersion of the product that produced the entity information.
typestring
sourceLabels
descriptionEntity source metadata labels.
items
$refLabel
typearray
sourceType
descriptionThe source of the entity.
enum
  • SOURCE_TYPE_UNSPECIFIED
  • ENTITY_CONTEXT
  • DERIVED_CONTEXT
  • GLOBAL_CONTEXT
enumDescriptions
  • Default source type
  • Entities ingested from customers (e.g. AD_CONTEXT, DLP_CONTEXT)
  • Entities derived from customer data such as prevalence, artifact first/last seen, or asset/user first seen stats.
  • Global contextual entities such as WHOIS or Safe Browsing.
typestring
structuredFields
additionalProperties
descriptionProperties of the object.
typeany
deprecatedTrue
descriptionStructured fields extracted from the log.
typeobject
threat
descriptionMetadata provided by a threat intelligence feed that identified the entity as malicious.
items
$refSecurityResult
typearray
vendorName
descriptionVendor name of the product that produced the entity information.
typestring
typeobject
EntityPopulationMechanism
descriptionMechanism to populate entities in the watchlist.
idEntityPopulationMechanism
properties
manual
$refManual
descriptionOptional. Entities are added manually.
typeobject
EntityRisk
descriptionStores information related to the risk score of an entity. Next ID: 15
idEntityRisk
properties
DEPRECATEDRiskScore
deprecatedTrue
descriptionDeprecated risk score.
formatint32
typeinteger
detailUri
descriptionLink to the Google Security Operations UI with information about the entity risk score. If the SecOps instance has multiple frontend paths configured, this will be a relative path that can be used to construct the full URL.
typestring
detectionsCount
descriptionNumber of detections that make up the risk score within the time window.
formatint32
typeinteger
firstDetectionTime
descriptionTimestamp of the first detection within the specified time window. This field is empty when there are no detections.
formatgoogle-datetime
typestring
lastDetectionTime
descriptionTimestamp of the last detection within the specified time window. This field is empty when there are no detections.
formatgoogle-datetime
typestring
lastResetTime
descriptionTimestamp for UEBA risk score reset based deduplication. Used specifically for risk based meta rules.
formatgoogle-datetime
typestring
normalizedRiskScore
descriptionNormalized risk score for the entity. This value is between 0-1000.
formatint32
typeinteger
rawRiskDelta
$refRiskDelta
descriptionRepresents the change in raw risk score for an entity between the end of the previous time window and the end of the current time window.
riskDelta
$refRiskDelta
descriptionRepresents the change in risk score for an entity between the end of the previous time window and the end of the current time window.
riskScore
descriptionRaw risk score for the entity.
formatfloat
typenumber
riskVersion
descriptionVersion of the risk score calculation algorithm.
typestring
riskWindow
$refInterval
descriptionTime window used when computing the risk score for an entity, for example 24 hours or 7 days.
riskWindowHasNewDetections
descriptionWhether there are new detections for the risk window.
typeboolean
riskWindowSize
descriptionRisk window duration for the entity.
formatgoogle-duration
typestring
typeobject
ErrorMessage
idErrorMessage
properties
errorText
typestring
type
enum
  • UNDEFINED_ERROR_TYPE
  • INVALID_QUERY_TYPE
  • INVALID_FIELD_PATH_TYPE
  • UNCLOSED_BRACKET_TYPE
  • BACKEND_ERROR_TYPE
  • UNCLOSED_QUOTES_TYPE
  • QUERY_TOO_LARGE_TYPE
enumDescriptions
typestring
typeobject
EventCountTimeline
idEventCountTimeline
properties
buckets
items
$refEventCountTimelineBucket
typearray
sizeOfBucketMs
formatint64
typestring
typeobject
EventCountTimelineBucket
idEventCountTimelineBucket
properties
alertCount
formatint32
typeinteger
baselineAlertCount
formatint32
typeinteger
baselineEventCount
formatint32
typeinteger
baselineTimedEntityCount
formatint32
typeinteger
entityChangedCount
$refEntityChangedCountTimelineBucket
eventCount
formatint32
typeinteger
filteredTimedEntityCount
formatint32
typeinteger
typeobject
Execution
descriptionExecution can be used to store metadata required for what action the UI should execute.
idExecution
properties
metadata
additionalProperties
typestring
descriptionOutput only. The payload to use when executing the action.
readOnlyTrue
typeobject
typeobject
ExifInfo
descriptionExif information.
idExifInfo
properties
company
descriptioncompany name.
typestring
compilationTime
descriptionCompilation time.
formatgoogle-datetime
typestring
entryPoint
descriptionentry point.
formatint64
typestring
fileDescription
descriptiondescription of a file.
typestring
originalFile
descriptionoriginal file name.
typestring
product
descriptionproduct name.
typestring
typeobject
Extension
descriptionCertificate's extensions.
idExtension
properties
authorityKeyId
$refAuthorityKeyId
descriptionIdentifies the public key to be used to verify the signature on this certificate or CRL.
ca
descriptionWhether the subject acts as a certificate authority (CA) or not.
typeboolean
caInfoAccess
descriptionAuthority information access locations are URLs that are added to a certificate in its authority information access extension.
typestring
certTemplateNameDc
descriptionBMP data value "DomainController". See MS Q291010.
typestring
certificatePolicies
descriptionDifferent certificate policies will relate to different applications which may use the certified key.
typestring
crlDistributionPoints
descriptionCRL distribution points to which a certificate user should refer to ascertain if the certificate has been revoked.
typestring
extendedKeyUsage
descriptionOne or more purposes for which the certified public key may be used, in addition to or in place of the basic purposes indicated in the key usage extension field.
typestring
keyUsage
descriptionThe purpose for which the certified public key is used.
typestring
netscapeCertComment
descriptionUsed to include free-form text comments inside certificates.
typestring
netscapeCertificate
descriptionIdentify whether the certificate subject is an SSL client, an SSL server, or a CA.
typeboolean
oldAuthorityKeyId
descriptionWhether the certificate has an old authority key identifier extension.
typeboolean
peLogotype
descriptionWhether the certificate includes a logotype.
typeboolean
subjectAlternativeName
descriptionContains one or more alternative names, using any of a variety of name forms, for the entity that is bound by the CA to the certified public key.
typestring
subjectKeyId
descriptionIdentifies the public key being certified.
typestring
typeobject
Extensions
descriptionExtensions to a UDM event.
idExtensions
properties
auth
$refAuthentication
descriptionAn authentication extension.
entityRisk
$refEntityRisk
descriptionAn entity risk change extension.
vulns
$refVulnerabilities
descriptionA vulnerability extension.
typeobject
Favicon
descriptionDifference hash and MD5 hash of the domain's favicon.
idFavicon
properties
dhash
descriptionDifference hash.
typestring
rawMd5
descriptionFavicon's MD5 hash.
typestring
typeobject
Feedback
idFeedback
properties
comment
descriptionOptional.
typestring
confidenceScore
formatint32
typeinteger
createdTime
formatgoogle-datetime
typestring
disregarded
typeboolean
idpUserId
typestring
priority
descriptionOptional.
enum
  • PRIORITY_UNSPECIFIED
  • PRIORITY_INFO
  • PRIORITY_LOW
  • PRIORITY_MEDIUM
  • PRIORITY_HIGH
  • PRIORITY_CRITICAL
enumDescriptions
  • Default priority level.
  • Informational priority.
  • Low priority.
  • Medium priority.
  • High priority.
  • Critical priority.
typestring
priorityDisplay
descriptionOptional.
typestring
reason
descriptionOptional.
enum
  • REASON_UNSPECIFIED
  • REASON_NOT_MALICIOUS
  • REASON_MALICIOUS
  • REASON_MAINTENANCE
enumDescriptions
  • Default reason.
  • Case or Alert not malicious.
  • Case or Alert is malicious.
  • Case or Alert is under maintenance.
typestring
reputation
enum
  • REPUTATION_UNSPECIFIED
  • USEFUL
  • NOT_USEFUL
enumDescriptions
  • An unspecified reputation.
  • A categorization of the finding as useful.
  • A categorization of the finding as not useful.
typestring
riskScore
formatint32
typeinteger
rootCause
descriptionOptional.
typestring
severity
formatint32
typeinteger
severityDisplay
descriptionOptional.
typestring
status
descriptionOptional.
enum
  • STATUS_UNSPECIFIED
  • NEW
  • REVIEWED
  • CLOSED
  • OPEN
enumDescriptions
  • Unspecified finding status.
  • New finding.
  • When a finding has feedback.
  • When an analyst closes an finding.
  • Open. Used to indicate that a Case / Alert is open.
typestring
verdict
enum
  • VERDICT_UNSPECIFIED
  • TRUE_POSITIVE
  • FALSE_POSITIVE
enumDescriptions
  • An unspecified verdict.
  • A categorization of the finding as a "true positive".
  • A categorization of the finding as a "false positive".
typestring
typeobject
FieldAndValue
idFieldAndValue
properties
entityNamespace
typestring
fieldPath
typestring
kvalueType
enum
  • UNKNOWN
  • COLLECTOR_ID
  • EVENT_SHARD
  • ASSET_IP_ADDRESS
  • MAC
  • HOSTNAME
  • PRODUCT_SPECIFIC_ID
  • NAMESPACE
  • DOMAIN_NAME
  • RESOLVED_IP_ADDRESS
  • STEMMED_DOMAIN_NAME
  • PROCESS_ID
  • FULL_COMMAND_LINE
  • FILE_NAME
  • FILE_PATH
  • HASH_MD5
  • HASH_SHA256
  • HASH_SHA1
  • RAW_PID
  • PARENT_PROCESS_ID
  • EMAIL
  • USERNAME
  • WINDOWS_SID
  • EMPLOYEE_ID
  • PRODUCT_OBJECT_ID
  • USER_DISPLAY_NAME
  • CLOUD_RESOURCE_NAME
  • REGISTRY_KEY
  • REGISTRY_VALUE_DATA
  • REGISTRY_VALUE_NAME
enumDescriptions
typestring
value
typestring
typeobject
FileMetadata
descriptionMetadata about a file. Place metadata about different file types here, for example data from the Microsoft Windows VersionInfo block or digital signer details. Use a different sub-message per file type.
idFileMetadata
properties
pe
$refPeFileMetadata
deprecatedTrue
descriptionMetadata for Microsoft Windows PE files. Deprecate PeFileMetadata in favor of single File proto.
typeobject
FileMetadataCodesign
descriptionFile metadata from the codesign utility.
idFileMetadataCodesign
properties
compilationTime
descriptionCode sign timestamp
formatgoogle-datetime
typestring
format
descriptionCode sign format.
typestring
id
descriptionCode sign identifier.
typestring
teamId
descriptionThe assigned team identifier of the developer who signed the application.
typestring
typeobject
FileMetadataImports
descriptionFile metadata imports.
idFileMetadataImports
properties
functions
descriptionFunction field.
items
typestring
typearray
library
descriptionLibrary field.
typestring
typeobject
FileMetadataPE
descriptionMetadata about the Portable Executable (PE) file.
idFileMetadataPE
properties
compilationExiftoolTime
descriptioninfo.exiftool.TimeStamp.
formatgoogle-datetime
typestring
compilationTime
descriptioninfo.pe-timestamp.
formatgoogle-datetime
typestring
entryPoint
descriptioninfo.pe-entry-point.
formatint64
typestring
entryPointExiftool
descriptioninfo.exiftool.EntryPoint.
formatint64
typestring
imphash
descriptionImphash of the file.
typestring
imports
descriptionFilemetadataImports fields.
items
$refFileMetadataImports
typearray
resource
descriptionFilemetadataPeResourceInfo fields.
items
$refFileMetadataPeResourceInfo
typearray
resourcesLanguageCount
deprecatedTrue
descriptionDeprecated: use resources_language_count_str.
items
$refStringToInt64MapEntry
typearray
resourcesLanguageCountStr
descriptionNumber of resources by language. Example: NEUTRAL: 20, ENGLISH US: 10
items
$refLabel
typearray
resourcesTypeCount
deprecatedTrue
descriptionDeprecated: use resources_type_count_str.
items
$refStringToInt64MapEntry
typearray
resourcesTypeCountStr
descriptionNumber of resources by resource type. Example: RT_ICON: 10, RT_DIALOG: 5
items
$refLabel
typearray
section
descriptionFilemetadataSection fields.
items
$refFileMetadataSection
typearray
signatureInfo
$refFileMetadataSignatureInfo
deprecatedTrue
descriptionFilemetadataSignatureInfo field. deprecated, user File.signature_info instead.
typeobject
FileMetadataPeResourceInfo
descriptionFile metadata for PE resource.
idFileMetadataPeResourceInfo
properties
entropy
descriptionEntropy of the resource.
formatdouble
typenumber
fileType
descriptionFile type. Note that this value may not match any of the well-known type identifiers defined in the ResourceType enum.
typestring
filetypeMagic
descriptionType of resource content, as identified by the magic Python module.
typestring
languageCode
descriptionHuman-readable version of the language and sublanguage identifiers, as defined in the Microsoft Windows PE specification. Examples: | Language | Sublanguage | Field value | | LANG_NEUTRAL | SUBLANG_NEUTRAL | NEUTRAL | | LANG_FRENCH | - | FRENCH | | LANG_ENGLISH | SUBLANG_ENGLISH US | ENGLISH US |
typestring
sha256Hex
descriptionSHA256_hex field..
typestring
typeobject
FileMetadataSection
descriptionFile metadata section.
idFileMetadataSection
properties
entropy
descriptionEntropy of the section.
formatdouble
typenumber
md5Hex
descriptionMD5 hex of the file.
typestring
name
descriptionName of the section.
typestring
rawSizeBytes
descriptionRaw file size in bytes.
formatint64
typestring
virtualSizeBytes
descriptionVirtual file size in bytes.
formatint64
typestring
typeobject
FileMetadataSignatureInfo
descriptionSignature information.
idFileMetadataSignatureInfo
properties
signer
deprecatedTrue
descriptionDeprecated: use signers field.
items
typestring
typearray
signers
descriptionFile metadata signer information. The order of the signers matters. Each element is a higher level authority, being the last the root authority.
items
$refSignerInfo
typearray
verificationMessage
descriptionStatus of the certificate. Valid values are "Signed", "Unsigned" or a description of the certificate anomaly, if found.
typestring
verified
descriptionTrue if verification_message == "Signed"
typeboolean
x509
descriptionList of certificates.
items
$refX509
typearray
typeobject
FilterProperties
idFilterProperties
properties
hidden
typeboolean
stringProperties
additionalProperties
$refStringValues
typeobject
typeobject
FindingVariable
descriptionA structure that holds the value and associated metadata for values extracted while producing a Finding.
idFindingVariable
properties
boolSeq
$refBoolSequence
descriptionThe value in boolsequence format.
boolVal
descriptionThe value in boolean format.
typeboolean
bytesSeq
$refBytesSequence
descriptionThe value in bytessequence format.
bytesVal
descriptionThe value in bytes format.
formatbyte
typestring
doubleSeq
$refDoubleSequence
descriptionThe value in doublesequence format.
doubleVal
descriptionThe value in double format.
formatdouble
typenumber
int64Seq
$refInt64Sequence
descriptionThe value in int64sequence format.
int64Val
descriptionThe value in int64 format.
formatint64
typestring
nullVal
descriptionWhether the value is null.
typeboolean
sourcePath
descriptionThe UDM field path for the field which this value was derived from. Example: `principal.user.username`
typestring
stringSeq
$refStringSequence
descriptionThe value in stringsequence format.
stringVal
descriptionThe value in string format. Enum values are returned as strings.
typestring
type
descriptionThe type of the variable.
enum
  • TYPE_UNSPECIFIED
  • MATCH
  • OUTCOME
enumDescriptions
  • An unspecified variable type.
  • A variable coming from the match conditions.
  • A variable representing significant data that was found in the detection logic.
typestring
uint64Seq
$refUint64Sequence
descriptionThe value in uint64sequence format.
uint64Val
descriptionThe value in uint64 format.
formatuint64
typestring
value
descriptionThe value in string form.
typestring
typeobject
FollowUp
descriptionFollowUp can be used to store metadata required to send a follow up message by the UI.
idFollowUp
properties
followUp
descriptionOutput only. The text to use as input when generating the follow up message.
readOnlyTrue
typestring
typeobject
Ftp
descriptionFTP info.
idFtp
properties
command
descriptionThe FTP command.
typestring
typeobject
FunctionResponse
idFunctionResponse
properties
rows
items
$refFunctionResponseRow
typearray
tooManyRows
typeboolean
typeobject
FunctionResponseRow
idFunctionResponseRow
properties
values
items
$refUdmFieldValue
typearray
typeobject
GoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStats
descriptionLINT.IfChange(stats_data) Stats results when the query is for statistics NEXT TAG = 6;
idGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStats
properties
dataQueryExpression
descriptionExpression that represent the subset of the requested query used to filter data. The expression will be used to enable features such as drill-down from stats results to UDM events. In that case, the new query will be composed by this expression and the expression related to a stats result.
typestring
results
descriptionResult rows that are queried.
items
$refGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnData
typearray
sortOrder
descriptionIndicates the columns used for sorting and the order in which they are sorted. If no ORDER section is specified in the query, this will be empty.
items
$refGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnSort
typearray
tooManyResults
descriptionIf true, there are too many results to return and some have been omitted.
typeboolean
totalResults
descriptionThe total number of results returned.
formatint32
typeinteger
typeobject
GoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnData
descriptionRepresents a single column in the set of columns returned as the stats query result.
idGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnData
properties
column
descriptionUsed to store column names.
typestring
filterExpression
descriptionExpression used to compose a query for filtering/drill-downs related to the data in this column.
typestring
filterable
descriptionTo identify if the column can be used for filtering/drill-downs.
typeboolean
values
descriptionTo store store column data.
items
$refGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnType
typearray
typeobject
GoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnSort
descriptionContains the column name and which direction the column is sorted (ascending or descenging).
idGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnSort
properties
descending
descriptionWhether the column is sorted in descending order (ascending by default);
typeboolean
name
descriptionName of the column.
typestring
typeobject
GoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnType
descriptionSingular vs list of values in a column.
idGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnType
properties
list
$refGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnTypeList
descriptionList of values in a column e.g. IPs
value
$refGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnValue
descriptionSingle value in a column.
typeobject
GoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnTypeList
descriptionStore list of values in a column.
idGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnTypeList
properties
values
descriptionList of values in one cell of the column.
items
$refGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnValue
typearray
typeobject
GoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnValue
descriptionValue of the column based on data type
idGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnValue
properties
boolVal
descriptionBoolean value.
typeboolean
bytesVal
descriptionBytes value.
formatbyte
typestring
dateVal
$refDate
descriptionDate values.
doubleVal
descriptionDouble value.
formatdouble
typenumber
int64Val
descriptionInteger value (signed).
formatint64
typestring
nullVal
descriptionTrue if the value is NULL.
typeboolean
protoVal
additionalProperties
descriptionProperties of the object. Contains field @type with type URL.
typeany
descriptionFor any proto values that are not any of the above.
typeobject
stringVal
descriptionString value. Enum values are returned as strings.
typestring
timestampVal
descriptionTimestamp values.
formatgoogle-datetime
typestring
uint64Val
descriptionUn-signed integer value.
formatuint64
typestring
typeobject
Group
descriptionInformation about an organizational group.
idGroup
properties
attribute
$refAttribute
descriptionGeneric entity metadata attributes of the group.
creationTime
deprecatedTrue
descriptionGroup creation time. Deprecated: creation_time should be populated in Attribute as generic metadata.
formatgoogle-datetime
typestring
emailAddresses
descriptionEmail addresses of the group.
items
typestring
typearray
groupDisplayName
descriptionGroup display name. e.g. "Finance".
typestring
productObjectId
descriptionProduct globally unique user object identifier, such as an LDAP Object Identifier.
typestring
windowsSid
descriptionMicrosoft Windows SID of the group.
typestring
typeobject
GroupAggregationByField
idGroupAggregationByField
properties
baselineEventCount
formatint32
typeinteger
eventCount
formatint32
typeinteger
fieldName
typestring
fieldValue
$refUdmFieldValue
fields
items
$refUdmFieldAggregation
typearray
valueCount
formatint32
typeinteger
typeobject
Hardware
descriptionHardware specification details for a resource, including both physical and virtual hardware.
idHardware
properties
cpuClockSpeed
descriptionClock speed of the hardware CPU in MHz.
formatuint64
typestring
cpuMaxClockSpeed
descriptionMaximum possible clock speed of the hardware CPU in MHz.
formatuint64
typestring
cpuModel
descriptionModel description of the hardware CPU (e.g. "2.8 GHz Quad-Core Intel Core i5").
typestring
cpuNumberCores
descriptionNumber of CPU cores.
formatuint64
typestring
cpuPlatform
descriptionPlatform of the hardware CPU (e.g. "Intel Broadwell").
typestring
manufacturer
descriptionHardware manufacturer.
typestring
model
descriptionHardware model.
typestring
ram
descriptionAmount of the hardware ramdom access memory (RAM) in Mb.
formatuint64
typestring
serialNumber
descriptionHardware serial number.
typestring
typeobject
Http
descriptionSpecify the full URL of the HTTP request within "target". Also specify any uploaded or downloaded file information within "source" or "target".
idHttp
properties
method
descriptionThe HTTP request method (e.g. "GET", "POST", "PATCH", "DELETE").
typestring
parsedUserAgent
$refUserAgentProto
descriptionThe parsed user_agent string.
referralUrl
descriptionThe URL for the HTTP referer.
typestring
responseCode
descriptionThe response status code, for example 200, 302, 404, or 500.
formatint32
typeinteger
userAgent
descriptionThe User-Agent request header which includes the application type, operating system, software vendor or software version of the requesting software user agent.
typestring
typeobject
Id
descriptionIdentifier to identify a UDM object like a UDM event, Entity, Collection. The full identifier for persistence is created by setting the 32 most significant bits as the Id.Namespace enum and the rest according to go/udm:ids. This is a convenience wrapper to define the id space enum values and provide an easy interface for RPCs, most persistence use cases should use a denormalized form. See go/udm:ids for background and details.
idId
properties
id
descriptionFull raw ID.
formatbyte
typestring
namespace
descriptionNamespace the id belongs to.
enum
  • NORMALIZED_TELEMETRY
  • RAW_TELEMETRY
  • RULE_DETECTIONS
  • UPPERCASE
  • MACHINE_INTELLIGENCE
  • SECURITY_COMMAND_CENTER
  • UNSPECIFIED
  • SOAR_ALERT
  • VIRUS_TOTAL
enumDescriptions
  • Ingested and Normalized telemetry events
  • Ingested Raw telemetry
  • Chronicle Rules engine
  • Uppercase
  • DSML - Machine Intelligence
  • A normalized telemetry event from Google Security Command Center.
  • Unspecified Namespace
  • An alert coming from other SIEMs via Chronicle SOAR.
  • VirusTotal.
typestring
stringId
descriptionSome ids are stored as strings that are not able to be translated to bytes, so store these separately. Ex. detection id of the form de_aaaaaaaa-aaaa...
typestring
typeobject
IngestionLabel
descriptionRepresentation of an ingestion label type.
idIngestionLabel
properties
ingestionLabelKey
descriptionRequired. The key of the ingestion label. Always required.
typestring
ingestionLabelValue
descriptionOptional. The value of the ingestion label. Optional. An object with no provided value and some key provided would match against the given key and ANY value.
typestring
typeobject
InputsUsed
descriptionInputsUsed is a convenience field that tells us which sources of events (if any) were used in the rule. NEXT TAG: 4
idInputsUsed
properties
usesDetection
descriptionOptional. Whether the rule queries detections.
typeboolean
usesEntity
descriptionOptional. Whether the rule queries entity events.
typeboolean
usesUdm
descriptionOptional. Whether the rule queries UDM events.
typeboolean
typeobject
Instance
descriptionA Instance represents an instantiation of the Instance product.
idInstance
properties
name
descriptionOutput only. The resource name of this instance. Format: projects/{project}/locations/{location}/instances/{instance}
readOnlyTrue
typestring
typeobject
InstanceUdmSearchResponse
idInstanceUdmSearchResponse
properties
baselineEventsCount
formatint32
typeinteger
complete
typeboolean
detections
$refDetections
filteredEventsCount
formatint32
typeinteger
instanceId
typestring
prevalence
$refUdmPrevalenceResponse
progress
formatdouble
typenumber
runtimeErrors
$refRuntimeError
timeline
$refEventCountTimeline
tooManyEvents
typeboolean
typeobject
Int64Sequence
descriptionInt64Sequence represents a sequence of int64s.
idInt64Sequence
properties
int64Vals
descriptionint64 sequence.
items
formatint64
typestring
typearray
typeobject
Interval
descriptionRepresents a time interval, encoded as a Timestamp start (inclusive) and a Timestamp end (exclusive). The start must be less than or equal to the end. When the start equals the end, the interval is empty (matches no time). When both start and end are unspecified, the interval matches any time.
idInterval
properties
endTime
descriptionOptional. Exclusive end of the interval. If specified, a Timestamp matching this interval will have to be before the end.
formatgoogle-datetime
typestring
startTime
descriptionOptional. Inclusive start of the interval. If specified, a Timestamp matching this interval will have to be the same or after the start.
formatgoogle-datetime
typestring
typeobject
Investigation
descriptionRepresents the aggregated state of an investigation such as categorization, severity, and status. Can be expanded to include analyst assignment details and more.
idInvestigation
properties
comments
descriptionComment added by the Analyst.
items
typestring
typearray
priority
descriptionPriority of the Alert or Finding set by analyst.
enum
  • PRIORITY_UNSPECIFIED
  • PRIORITY_INFO
  • PRIORITY_LOW
  • PRIORITY_MEDIUM
  • PRIORITY_HIGH
  • PRIORITY_CRITICAL
enumDescriptions
  • Default priority level.
  • Informational priority.
  • Low priority.
  • Medium priority.
  • High priority.
  • Critical priority.
typestring
reason
descriptionReason for closing the Case or Alert.
enum
  • REASON_UNSPECIFIED
  • REASON_NOT_MALICIOUS
  • REASON_MALICIOUS
  • REASON_MAINTENANCE
enumDescriptions
  • Default reason.
  • Case or Alert not malicious.
  • Case or Alert is malicious.
  • Case or Alert is under maintenance.
typestring
reputation
descriptionDescribes whether a finding was useful or not-useful.
enum
  • REPUTATION_UNSPECIFIED
  • USEFUL
  • NOT_USEFUL
enumDescriptions
  • An unspecified reputation.
  • A categorization of the finding as useful.
  • A categorization of the finding as not useful.
typestring
riskScore
descriptionRisk score for a finding set by an analyst.
formatuint32
typeinteger
rootCause
descriptionRoot cause of the Alert or Finding set by analyst.
typestring
severityScore
descriptionSeverity score for a finding set by an analyst.
formatuint32
typeinteger
status
descriptionDescribes the workflow status of a finding.
enum
  • STATUS_UNSPECIFIED
  • NEW
  • REVIEWED
  • CLOSED
  • OPEN
enumDescriptions
  • Unspecified finding status.
  • New finding.
  • When a finding has feedback.
  • When an analyst closes an finding.
  • Open. Used to indicate that a Case / Alert is open.
typestring
verdict
descriptionDescribes reason a finding investigation was resolved.
enum
  • VERDICT_UNSPECIFIED
  • TRUE_POSITIVE
  • FALSE_POSITIVE
enumDescriptions
  • An unspecified verdict.
  • A categorization of the finding as a "true positive".
  • A categorization of the finding as a "false positive".
typestring
typeobject
IoCStats
descriptionInformation about the threat intelligence source. These fields are used to model Mandiant sources.
idIoCStats
properties
benignCount
descriptionCount of responses where the IoC was identified as benign.
formatint32
typeinteger
firstLevelSource
descriptionName of first level IoC source, for example Mandiant or a third-party.
typestring
iocStatsType
descriptionDescribes the source of the IoCStat.
enum
  • UNSPECIFIED_IOC_STATS_TYPE
  • MANDIANT_SOURCES
  • THIRD_PARTY_SOURCES
  • THREAT_INTELLIGENCE_IOC_STATS
enumDescriptions
  • IoCStat source is unidentified.
  • IoCStat is from a Mandiant Source.
  • IoCStat is from a third-party source.
  • IoCStat is from a threat intelligence feed.
typestring
maliciousCount
descriptionCount of responses where the IoC was identified as malicious.
formatint32
typeinteger
quality
descriptionLevel of confidence in the IoC mapping extracted from the source.
enum
  • UNKNOWN_CONFIDENCE
  • LOW_CONFIDENCE
  • MEDIUM_CONFIDENCE
  • HIGH_CONFIDENCE
enumDescriptions
  • The default confidence level.
  • Low confidence.
  • Medium confidence.
  • High confidence.
typestring
responseCount
descriptionTotal number of response from the source.
formatint32
typeinteger
secondLevelSource
descriptionName of the second-level IoC source, for example Crowdsourced Threat Analysis or Knowledge Graph.
typestring
sourceCount
descriptionNumber of sources from which information was extracted.
formatint32
typeinteger
typeobject
Label
descriptionKey value labels.
idLabel
properties
key
descriptionThe key.
typestring
rbacEnabled
descriptionIndicates whether this label can be used for Data RBAC
typeboolean
source
descriptionWhere the label is derived from.
typestring
value
descriptionThe value.
typestring
typeobject
LatLng
descriptionAn object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges.
idLatLng
properties
latitude
descriptionThe latitude in degrees. It must be in the range [-90.0, +90.0].
formatdouble
typenumber
longitude
descriptionThe longitude in degrees. It must be in the range [-180.0, +180.0].
formatdouble
typenumber
typeobject
LegacyFederatedUdmSearchViewResponse
descriptionResponse to a Federated UDM Search query. This will be used by StreamSearchOperation RPC to return the results of a federated search operation.
idLegacyFederatedUdmSearchViewResponse
properties
activityTimeline
$refEventCountTimeline
descriptionTimeline of event counts broken into hourly/daily buckets to identify activity.
aiOverview
$refAIOverview
descriptionLINT.ThenChange( //depot/google3/google/cloud/chronicle/v1main/dashboard_query.proto:data_sources, //depot/google3/googlex/security/malachite/proto/udm_search.proto:data_sources ) AI generated overview for the search results. Only populated if the AI features are enabled for the customer and generate_ai_overview is set to true in the request.
baselineEventsCount
descriptionThe number of events in the baseline query.
formatint32
typeinteger
complete
descriptionStreaming for this response is done. There will be no additional updates.
typeboolean
dataSources
descriptionDatasource of the query and results in case of a statistics query
items
enum
  • SEARCH_DATA_SOURCE_UNSPECIFIED
  • SEARCH_UDM
  • SEARCH_ENTITY
  • SEARCH_RULE_DETECTIONS
  • SEARCH_RULESETS
enumDescriptions
  • Unspecified data source.
  • Events
  • Entities
  • To be used for detections data source.
  • To be used for ruleset with detections datasource.
typestring
typearray
detectionFieldAggregations
$refAlertFieldAggregations
descriptionList of detection fields with aggregated values. This enabled filtering in the Alerts panel for federated search.
events
$refUdmEventList
descriptionList of UDM events. NOTE: After complete is set to true, the `UdmEventList` message will be omitted from the response. The latest message should be used as reference. If the `UdmEventList` message is returned again, then it should replace the previous value.
fieldAggregations
$refUdmFieldAggregations
descriptionList of UDM fields with aggregated values.
filteredEventsCount
descriptionThe number of events in the snapshot that match the snapshot_query. This is <= `baseline_events_count`. If the snapshot query is empty this will be equivalent to `baseline_events_count`.
formatint32
typeinteger
groupedFieldAggregations
$refUdmFieldAggregations
descriptionList of grouped fields with aggregated values.
instanceAggregations
$refUdmFieldAggregations
descriptionInstance aggregations for the search results. Provides information on the number of events per instance for the aggregations panel in the UI. This allows users to easily drill-down into the individual instances.
instanceUdmSearchResponses
descriptionAll the instance specific UDM search responses.
items
$refInstanceUdmSearchResponse
typearray
operation
descriptionThe name of the operation resource representing the UDM Search operation. This can be passed to `StreamSearchOperation` to fetch stored results or stream the results of an in-progress operation. The metadata type of the operation is `UdmSearchMetadata`. The response type is `LegacyFetchUdmSearchViewResponse`. Format: projects/{project}/locations/{location}/instances/{instance}/operations/{operation}
typestring
progress
descriptionProgress of the query represented as a double between 0 and 1.
formatdouble
typenumber
queryValidationErrors
descriptionParse error for the baseline_query and/or the snapshot_query.
items
$refErrorMessage
typearray
runtimeErrors
descriptionRuntime errors.
items
$refRuntimeError
typearray
stats
$refGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStats
descriptionStats results when the query is for statistics
statsFunctionParameterValidationErrorMessage
descriptionIf the request's stats_function_parameter` is invalid, this field will contain the detailed error message.
typestring
statsFunctionResponse
$refFunctionResponse
descriptionResult for statistical function.
timeline
$refEventCountTimeline
descriptionTimeline of event counts broken into buckets. This populates the trend-over-time chart in the UI.
tooLargeResponse
descriptionIf true, the response to be returned to the UI is too large and some events have been omitted.
typeboolean
tooManyEvents
descriptionIf true, there are too many events to return and some have been omitted.
typeboolean
validBaselineQuery
descriptionIndicates whether the request baseline_query is a valid structured query or not. If not, `query_validation_errors` will include the parse error.
typeboolean
validSnapshotQuery
descriptionIndicates whether the request baseline and snapshot queries are valid. If not, `query_validation_errors` will include the parse error.
typeboolean
typeobject
ListDataAccessLabelsResponse
descriptionResponse message for ListDataAccessLabels.
idListDataAccessLabelsResponse
properties
dataAccessLabels
descriptionList of data access labels.
items
$refDataAccessLabel
typearray
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
typeobject
ListDataAccessScopesResponse
descriptionResponse message for ListDataAccessScopes.
idListDataAccessScopesResponse
properties
dataAccessScopes
descriptionList of data access scopes.
items
$refDataAccessScope
typearray
globalDataAccessScopeGranted
descriptionWhether or not global scope is granted to the user.
typeboolean
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
typeobject
ListOperationsResponse
descriptionThe response message for Operations.ListOperations.
idListOperationsResponse
properties
nextPageToken
descriptionThe standard List next-page token.
typestring
operations
descriptionA list of operations that matches the specified filter in the request.
items
$refOperation
typearray
typeobject
ListReferenceListsResponse
descriptionA response to a request for a list of reference lists.
idListReferenceListsResponse
properties
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
referenceLists
descriptionThe reference lists. Ordered in ascending alphabetical order by name.
items
$refReferenceList
typearray
typeobject
ListRetrohuntsResponse
descriptionResponse message for ListRetrohunts method.
idListRetrohuntsResponse
properties
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
retrohunts
descriptionThe retrohunts from the specified rule.
items
$refRetrohunt
typearray
typeobject
ListRuleDeploymentsResponse
descriptionResponse message for ListRuleDeployments.
idListRuleDeploymentsResponse
properties
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
ruleDeployments
descriptionThe rule deployments from all rules.
items
$refRuleDeployment
typearray
typeobject
ListRuleRevisionsResponse
descriptionResponse message for ListRuleRevisions method.
idListRuleRevisionsResponse
properties
nextPageToken
descriptionA token that can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
rules
descriptionThe revisions of the rule.
items
$refRule
typearray
typeobject
ListRulesResponse
descriptionResponse message for ListRules method.
idListRulesResponse
properties
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
rules
descriptionThe rules from the specified instance.
items
$refRule
typearray
typeobject
ListWatchlistsResponse
descriptionResponse message for listing watchlists.
idListWatchlistsResponse
properties
nextPageToken
descriptionOptional. A token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
watchlists
descriptionOptional. The watchlists from the specified instance.
items
$refWatchlist
typearray
typeobject
Location
descriptionInformation about a location.
idLocation
properties
city
descriptionThe city.
typestring
countryOrRegion
descriptionThe country or region.
typestring
deskName
descriptionDesk name or individual location, typically for an employee in an office. (e.g. "IN-BLR-BCPC-11-1121D").
typestring
floorName
descriptionFloor name, number or a combination of the two for a building. (e.g. "1-A").
typestring
name
descriptionCustom location name (e.g. building or site name like "London Office"). For cloud environments, this is the region (e.g. "us-west2").
typestring
regionCoordinates
$refLatLng
descriptionCoordinates for the associated region. See https://cloud.google.com/vision/docs/reference/rest/v1/LatLng for a description of the fields.
regionLatitude
deprecatedTrue
descriptionDeprecated: use region_coordinates.
formatfloat
typenumber
regionLongitude
deprecatedTrue
descriptionDeprecated: use region_coordinates.
formatfloat
typenumber
state
descriptionThe state.
typestring
typeobject
Manual
descriptionEntities are added manually.
idManual
properties
typeobject
Measure
descriptionDescribes the precomputed measure.
idMeasure
properties
aggregateFunction
descriptionFunction used to calculate the aggregated measure.
enum
  • AGGREGATE_FUNCTION_UNSPECIFIED
  • MIN
  • MAX
  • COUNT
  • SUM
  • AVG
  • STDDEV
enumDescriptions
  • Default value.
  • Minimum.
  • Maximum.
  • Count.
  • Sum.
  • Average.
  • Standard Deviation.
typestring
value
descriptionValue of the aggregated measure.
formatdouble
typenumber
typeobject
Metadata
descriptionGeneral information associated with a UDM event.
idMetadata
properties
baseLabels
$refDataAccessLabels
descriptionData access labels on the base event.
collectedTimestamp
descriptionThe GMT timestamp when the event was collected by the vendor's local collection infrastructure.
formatgoogle-datetime
typestring
description
descriptionA human-readable unparsable description of the event.
typestring
enrichmentLabels
$refDataAccessLabels
descriptionData access labels from all the contextual events used to enrich the base event.
enrichmentState
descriptionThe enrichment state.
enum
  • ENRICHMENT_STATE_UNSPECIFIED
  • ENRICHED
  • UNENRICHED
enumDescriptions
  • Unspecified.
  • The event has been enriched by Chronicle.
  • The event has not been enriched by Chronicle.
typestring
eventTimestamp
descriptionThe GMT timestamp when the event was generated.
formatgoogle-datetime
typestring
eventType
descriptionThe event type. If an event has multiple possible types, this specifies the most specific type.
enum
  • EVENTTYPE_UNSPECIFIED
  • PROCESS_UNCATEGORIZED
  • PROCESS_LAUNCH
  • PROCESS_INJECTION
  • PROCESS_PRIVILEGE_ESCALATION
  • PROCESS_TERMINATION
  • PROCESS_OPEN
  • PROCESS_MODULE_LOAD
  • REGISTRY_UNCATEGORIZED
  • REGISTRY_CREATION
  • REGISTRY_MODIFICATION
  • REGISTRY_DELETION
  • SETTING_UNCATEGORIZED
  • SETTING_CREATION
  • SETTING_MODIFICATION
  • SETTING_DELETION
  • MUTEX_UNCATEGORIZED
  • MUTEX_CREATION
  • FILE_UNCATEGORIZED
  • FILE_CREATION
  • FILE_DELETION
  • FILE_MODIFICATION
  • FILE_READ
  • FILE_COPY
  • FILE_OPEN
  • FILE_MOVE
  • FILE_SYNC
  • USER_UNCATEGORIZED
  • USER_LOGIN
  • USER_LOGOUT
  • USER_CREATION
  • USER_CHANGE_PASSWORD
  • USER_CHANGE_PERMISSIONS
  • USER_STATS
  • USER_BADGE_IN
  • USER_DELETION
  • USER_RESOURCE_CREATION
  • USER_RESOURCE_UPDATE_CONTENT
  • USER_RESOURCE_UPDATE_PERMISSIONS
  • USER_COMMUNICATION
  • USER_RESOURCE_ACCESS
  • USER_RESOURCE_DELETION
  • GROUP_UNCATEGORIZED
  • GROUP_CREATION
  • GROUP_DELETION
  • GROUP_MODIFICATION
  • EMAIL_UNCATEGORIZED
  • EMAIL_TRANSACTION
  • EMAIL_URL_CLICK
  • NETWORK_UNCATEGORIZED
  • NETWORK_FLOW
  • NETWORK_CONNECTION
  • NETWORK_FTP
  • NETWORK_DHCP
  • NETWORK_DNS
  • NETWORK_HTTP
  • NETWORK_SMTP
  • STATUS_UNCATEGORIZED
  • STATUS_HEARTBEAT
  • STATUS_STARTUP
  • STATUS_SHUTDOWN
  • STATUS_UPDATE
  • SCAN_UNCATEGORIZED
  • SCAN_FILE
  • SCAN_PROCESS_BEHAVIORS
  • SCAN_PROCESS
  • SCAN_HOST
  • SCAN_VULN_HOST
  • SCAN_VULN_NETWORK
  • SCAN_NETWORK
  • SCHEDULED_TASK_UNCATEGORIZED
  • SCHEDULED_TASK_CREATION
  • SCHEDULED_TASK_DELETION
  • SCHEDULED_TASK_ENABLE
  • SCHEDULED_TASK_DISABLE
  • SCHEDULED_TASK_MODIFICATION
  • SYSTEM_AUDIT_LOG_UNCATEGORIZED
  • SYSTEM_AUDIT_LOG_WIPE
  • SERVICE_UNSPECIFIED
  • SERVICE_CREATION
  • SERVICE_DELETION
  • SERVICE_START
  • SERVICE_STOP
  • SERVICE_MODIFICATION
  • GENERIC_EVENT
  • RESOURCE_CREATION
  • RESOURCE_DELETION
  • RESOURCE_PERMISSIONS_CHANGE
  • RESOURCE_READ
  • RESOURCE_WRITTEN
  • DEVICE_FIRMWARE_UPDATE
  • DEVICE_CONFIG_UPDATE
  • DEVICE_PROGRAM_UPLOAD
  • DEVICE_PROGRAM_DOWNLOAD
  • ANALYST_UPDATE_VERDICT
  • ANALYST_UPDATE_REPUTATION
  • ANALYST_UPDATE_SEVERITY_SCORE
  • ANALYST_UPDATE_STATUS
  • ANALYST_ADD_COMMENT
  • ANALYST_UPDATE_PRIORITY
  • ANALYST_UPDATE_ROOT_CAUSE
  • ANALYST_UPDATE_REASON
  • ANALYST_UPDATE_RISK_SCORE
  • ENTITY_RISK_CHANGE
enumDeprecated
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • True
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • True
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • True
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
enumDescriptions
  • Default event type
  • Activity related to a process which does not match any other event types.
  • Process launch.
  • Process injecting into another process.
  • Process privilege escalation.
  • Process termination.
  • Process being opened.
  • Process loading a module.
  • Registry event which does not match any of the other event types.
  • Registry creation.
  • Registry modification.
  • Registry deletion.
  • Settings-related event which does not match any of the other event types.
  • Setting creation.
  • Setting modification.
  • Setting deletion.
  • Any mutex event other than creation.
  • Mutex creation.
  • File event which does not match any of the other event types.
  • File created.
  • File deleted.
  • File modified.
  • File read.
  • File copied. Used for file copies, for example, to a thumb drive.
  • File opened.
  • File moved or renamed.
  • File synced (for example, Google Drive, Dropbox, backup).
  • User activity which does not match any of the other event types.
  • User login.
  • User logout.
  • User creation.
  • User password change event.
  • Change in user permissions.
  • Deprecated. Used to update user info for an LDAP dump.
  • User physically badging into a location.
  • User deletion.
  • User creating a virtual resource. This is equivalent to RESOURCE_CREATION.
  • User updating content of a virtual resource. This is equivalent to RESOURCE_WRITTEN.
  • User updating permissions of a virtual resource. This is equivalent to RESOURCE_PERMISSIONS_CHANGE.
  • User initiating communication through a medium (for example, video).
  • User accessing a virtual resource. This is equivalent to RESOURCE_READ.
  • User deleting a virtual resource. This is equivalent to RESOURCE_DELETION.
  • A group activity that does not fall into one of the other event types.
  • A group creation.
  • A group deletion.
  • A group modification.
  • Email messages
  • An email transaction.
  • Deprecated: use NETWORK_HTTP instead. An email URL click event.
  • A network event that does not fit into one of the other event types.
  • Aggregated flow stats like netflow.
  • Network connection details like from a FW.
  • FTP telemetry.
  • DHCP payload.
  • DNS payload.
  • HTTP telemetry.
  • SMTP telemetry.
  • A status message that does not fit into one of the other event types.
  • Heartbeat indicating product is alive.
  • An agent startup.
  • An agent shutdown.
  • A software or fingerprint update.
  • Scan item that does not fit into one of the other event types.
  • A file scan.
  • Scan process behaviors. Please use SCAN_PROCESS instead.
  • Scan process.
  • Scan results from scanning an entire host device for threats/sensitive documents.
  • Vulnerability scan logs about host vulnerabilities (e.g., out of date software) and network vulnerabilities (e.g., unprotected service detected via a network scan).
  • Vulnerability scan logs about network vulnerabilities.
  • Scan network for suspicious activity
  • Scheduled task event that does not fall into one of the other event types.
  • Scheduled task creation.
  • Scheduled task deletion.
  • Scheduled task being enabled.
  • Scheduled task being disabled.
  • Scheduled task being modified.
  • A system audit log event that is not a wipe.
  • A system audit log wipe.
  • Service event that does not fit into one of the other event types.
  • A service creation.
  • A service deletion.
  • A service start.
  • A service stop.
  • A service modification.
  • Operating system events that are not described by any of the other event types. Might include uncategorized Microsoft Windows event logs.
  • The resource was created/provisioned. This is equivalent to USER_RESOURCE_CREATION.
  • The resource was deleted/deprovisioned. This is equivalent to USER_RESOURCE_DELETION.
  • The resource had it's permissions or ACLs updated. This is equivalent to USER_RESOURCE_UPDATE_PERMISSIONS.
  • The resource was read. This is equivalent to USER_RESOURCE_ACCESS.
  • The resource was written to. This is equivalent to USER_RESOURCE_UPDATE_CONTENT.
  • Firmware update.
  • Configuration update.
  • A program or application uploaded to a device.
  • A program or application downloaded to a device.
  • Analyst update about the Verdict (such as true positive, false positive, or disregard) of a finding.
  • Analyst update about the Reputation (such as useful or not useful) of a finding.
  • Analyst update about the Severity score (0-100) of a finding.
  • Analyst update about the finding status.
  • Analyst addition of a comment for a finding.
  • Analyst update about the priority (such as low, medium, or high) for a finding.
  • Analyst update about the root cause for a finding.
  • Analyst update about the reason (such as malicious or not malicious) for a finding.
  • Analyst update about the risk score (0-100) of a finding.
  • An update to an entity risk score. This event type is restricted to events published by Google Securit Operations Risk Analytics.
typestring
id
descriptionID of the UDM event. Can be used for raw and normalized event retrieval.
formatbyte
typestring
ingestedTimestamp
descriptionThe GMT timestamp when the event was ingested (received) by Chronicle.
formatgoogle-datetime
typestring
ingestionLabels
descriptionUser-configured ingestion metadata labels.
items
$refLabel
typearray
logType
descriptionThe string value of log type.
typestring
productDeploymentId
descriptionThe deployment identifier assigned by the vendor for a product deployment.
typestring
productEventType
descriptionA short, descriptive, human-readable, product-specific event name or type (e.g. "Scanned X", "User account created", "process_start").
typestring
productLogId
descriptionA vendor-specific event identifier to uniquely identify the event (e.g. a GUID).
typestring
productName
descriptionThe name of the product.
typestring
productVersion
descriptionThe version of the product.
typestring
structuredFields
additionalProperties
descriptionProperties of the object.
typeany
deprecatedTrue
descriptionFlattened fields extracted from the log.
typeobject
tags
$refTags
descriptionTags added by Chronicle after an event is parsed. It is an error to populate this field from within a parser.
urlBackToProduct
descriptionA URL that takes the user to the source product console for this event.
typestring
vendorName
descriptionThe name of the product vendor.
typestring
typeobject
Metric
descriptionStores precomputed aggregated analytic data for an entity.
idMetric
properties
dimensions
descriptionAll group by clauses used to calculate the metric.
items
enum
  • DIMENSION_UNSPECIFIED
  • PRINCIPAL_DEVICE
  • TARGET_USER
  • TARGET_DEVICE
  • PRINCIPAL_USER
  • TARGET_IP
  • PRINCIPAL_FILE_HASH
  • PRINCIPAL_COUNTRY
  • SECURITY_CATEGORY
  • NETWORK_ASN
  • CLIENT_CERTIFICATE_HASH
  • DNS_QUERY_TYPE
  • DNS_DOMAIN
  • HTTP_USER_AGENT
  • EVENT_TYPE
  • PRODUCT_NAME
  • PRODUCT_EVENT_TYPE
  • PARENT_FOLDER_PATH
  • TARGET_RESOURCE_NAME
  • PRINCIPAL_APPLICATION
  • TARGET_APPLICATION
  • EMAIL_TO_ADDRESS
  • EMAIL_FROM_ADDRESS
  • MAIL_ID
  • PRINCIPAL_IP
  • SECURITY_ACTION
  • SECURITY_RULE_ID
  • TARGET_NETWORK_ORGANIZATION_NAME
  • PRINCIPAL_NETWORK_ORGANIZATION_NAME
  • PRINCIPAL_PROCESS_FILE_PATH
  • PRINCIPAL_PROCESS_FILE_HASH
  • SECURITY_RESULT_RULE_NAME
  • TARGET_RESOURCE_LABEL_KEY
  • VENDOR_NAME
  • TARGET_RESOURCE_TYPE
  • TARGET_LOCATION_NAME
enumDescriptions
  • Default
  • Principal Device
  • Target User
  • Target Device
  • Principal User
  • Target IP
  • Principal File Hash
  • Principal Country
  • Security Category
  • Network ASN
  • Client Certificate Hash
  • DNS Query Type
  • DNS Domain
  • HTTP User Agent
  • Event Type
  • Product Name
  • Product Event Type
  • Parent Folder Path
  • Target resource Name
  • Principal Application.
  • Target Application.
  • Email To Address.
  • Email From Address.
  • Mail Id.
  • Principal IP.
  • Security Action.
  • Security Rule Id.
  • Target Network Organization name.
  • Principal Network Organization name.
  • Principal Process File Path.
  • Principal Process File SHA256 Hash.
  • Security Result rule name.
  • Target Resource label key.
  • Vendor name.
  • Target Resource type.
  • Target Location name.
typestring
typearray
exportWindow
descriptionExport window for which the metric was exported.
formatint64
typestring
firstSeen
descriptionTimestamp of the first time the entity was seen in the environment.
formatgoogle-datetime
typestring
lastSeen
descriptionTime stamp of the last time last time the entity was seen in the environment.
formatgoogle-datetime
typestring
metricName
descriptionName of the analytic.
enum
  • METRIC_NAME_UNSPECIFIED
  • NETWORK_BYTES_INBOUND
  • NETWORK_BYTES_OUTBOUND
  • NETWORK_BYTES_TOTAL
  • AUTH_ATTEMPTS_SUCCESS
  • AUTH_ATTEMPTS_FAIL
  • AUTH_ATTEMPTS_TOTAL
  • DNS_BYTES_OUTBOUND
  • NETWORK_FLOWS_INBOUND
  • NETWORK_FLOWS_OUTBOUND
  • NETWORK_FLOWS_TOTAL
  • DNS_QUERIES_SUCCESS
  • DNS_QUERIES_FAIL
  • DNS_QUERIES_TOTAL
  • FILE_EXECUTIONS_SUCCESS
  • FILE_EXECUTIONS_FAIL
  • FILE_EXECUTIONS_TOTAL
  • HTTP_QUERIES_SUCCESS
  • HTTP_QUERIES_FAIL
  • HTTP_QUERIES_TOTAL
  • WORKSPACE_EMAILS_SENT_TOTAL
  • WORKSPACE_TOTAL_DOWNLOAD_ACTIONS
  • WORKSPACE_TOTAL_CHANGE_ACTIONS
  • WORKSPACE_AUTH_ATTEMPTS_TOTAL
  • WORKSPACE_NETWORK_BYTES_OUTBOUND
  • WORKSPACE_NETWORK_BYTES_TOTAL
  • ALERT_EVENT_NAME_COUNT
  • RESOURCE_CREATION_TOTAL
  • RESOURCE_CREATION_SUCCESS
  • RESOURCE_READ_SUCCESS
  • RESOURCE_READ_FAIL
  • RESOURCE_DELETION_SUCCESS
enumDescriptions
  • Default
  • Total received network bytes.
  • Total network sent bytes.
  • Total network sent bytes and received bytes.
  • Successful authentication attempts.
  • Failed authentication attempts.
  • Total authentication attempts.
  • Total number of sent bytes for DNS events.
  • Total number of events having non-null received bytes.
  • Total number of events having non-null sent bytes.
  • Total events having non-null sent or received bytes.
  • DNS query success count - Number of events with response_code = 0.
  • Number of events with response_code != 0.
  • Total number of DNS queries made.
  • Number of successfule file executions.
  • Number of failed file executions.
  • Total number file executions.
  • Number of successful HTTP queries.
  • Number of failed HTTP queries.
  • Total number of HTTP queries.
  • Total number of emails sent in Google Workspace.
  • Total number of download actions in Google Workspace.
  • Total number of change actions in Google Workspace.
  • Total number of authentication attempts in Google Workspace.
  • Number of outbound network bytes (total sent) in Google Workspace.
  • Total number of network bytes (both sent and received) in Google Workspace.
  • Track number of alerts fired by EDR/SENTINEL/MICROSOFT_GRAPH.
  • First-time analytic tracking successful resource creations.
  • Volume-based analytic tracking successful resource creations.
  • Volume-based analytic tracking successful resource reads.
  • Volume-based analytic tracking failed resource reads.
  • Volume-based analytic tracking successful resource deletions.
typestring
sumMeasure
$refMeasure
descriptionSum of all precomputed measures for the given metric.
totalEvents
descriptionTotal number of events used to calculate the given precomputed metric.
formatint64
typestring
typeobject
Navigation
descriptionNavigation can be used to store the metadata required to navigate the user to a new URL.
idNavigation
properties
targetUri
descriptionOutput only. The URI to redirect the user to.
readOnlyTrue
typestring
typeobject
Network
descriptionA network event.
idNetwork
properties
applicationProtocol
descriptionThe application protocol.
enum
  • UNKNOWN_APPLICATION_PROTOCOL
  • AFP
  • APPC
  • AMQP
  • ATOM
  • BEEP
  • BITCOIN
  • BIT_TORRENT
  • CFDP
  • CIP
  • COAP
  • COTP
  • DCERPC
  • DDS
  • DEVICE_NET
  • DHCP
  • DICOM
  • DNP3
  • DNS
  • E_DONKEY
  • ENRP
  • FAST_TRACK
  • FINGER
  • FREENET
  • FTAM
  • GOOSE
  • GOPHER
  • GRPC
  • HL7
  • H323
  • HTTP
  • HTTPS
  • IEC104
  • IRCP
  • KADEMLIA
  • KRB5
  • LDAP
  • LPD
  • MIME
  • MMS
  • MODBUS
  • MQTT
  • NETCONF
  • NFS
  • NIS
  • NNTP
  • NTCIP
  • NTP
  • OSCAR
  • PNRP
  • PTP
  • QUIC
  • RDP
  • RELP
  • RIP
  • RLOGIN
  • RPC
  • RTMP
  • RTP
  • RTPS
  • RTSP
  • SAP
  • SDP
  • SIP
  • SLP
  • SMB
  • SMTP
  • SNMP
  • SNTP
  • SSH
  • SSMS
  • STYX
  • SV
  • TCAP
  • TDS
  • TOR
  • TSP
  • VTP
  • WHOIS
  • WEB_DAV
  • X400
  • X500
  • XMPP
enumDescriptions
  • The default application protocol.
  • Apple Filing Protocol.
  • Advanced Program-to-Program Communication.
  • Advanced Message Queuing Protocol.
  • Publishing Protocol.
  • Block Extensible Exchange Protocol.
  • Crypto currency protocol.
  • Peer-to-peer file sharing.
  • Coherent File Distribution Protocol.
  • Common Industrial Protocol.
  • Constrained Application Protocol.
  • Connection Oriented Transport Protocol.
  • DCE/RPC.
  • Data Distribution Service.
  • Automation industry protocol.
  • DHCP.
  • Digital Imaging and Communications in Medicine Protocol.
  • Distributed Network Protocol 3 (DNP3)
  • DNS.
  • Classic file sharing protocol.
  • Endpoint Handlespace Redundancy Protocol.
  • Filesharing peer-to-peer protocol.
  • User Information Protocol.
  • Censorship resistant peer-to-peer network.
  • File Transfer Access and Management.
  • GOOSE Protocol.
  • Gopher protocol.
  • gRPC Remote Procedure Call.
  • Health Level Seven.
  • Packet-based multimedia communications system.
  • HTTP.
  • HTTPS.
  • IEC 60870-5-104 (IEC 104) Protocol.
  • Internet Relay Chat Protocol.
  • Peer-to-peer hashtables.
  • Kerberos 5.
  • Lightweight Directory Access Protocol.
  • Line Printer Daemon Protocol.
  • Multipurpose Internet Mail Extensions and Secure MIME.
  • Multimedia Messaging Service.
  • Serial communications protocol.
  • Message Queuing Telemetry Transport.
  • Network Configuration.
  • Network File System.
  • Network Information Service.
  • Network News Transfer Protocol.
  • National Transportation Communications for Intelligent Transportation System.
  • Network Time Protocol.
  • AOL Instant Messenger Protocol.
  • Peer Name Resolution Protocol.
  • Precision Time Protocol.
  • QUIC.
  • Remote Desktop Protocol.
  • Reliable Event Logging Protocol.
  • Routing Information Protocol.
  • Remote Login in UNIX Systems.
  • Remote Procedure Call.
  • Real Time Messaging Protocol.
  • Real-time Transport Protocol.
  • Real Time Publish Subscribe.
  • Real Time Streaming Protocol.
  • Session Announcement Protocol.
  • Session Description Protocol.
  • Session Initiation Protocol.
  • Service Location Protocol.
  • Server Message Block.
  • Simple Mail Transfer Protocol.
  • Simple Network Management Protocol.
  • Simple Network Time Protocol.
  • Secure Shell.
  • Secure SMS Messaging Protocol.
  • Styx/9P - Plan 9 from Bell Labs distributed file system protocol.
  • Sampled Values Protocol.
  • Transaction Capabilities Application Part.
  • Tabular Data Stream.
  • Anonymity network.
  • Time Stamp Protocol.
  • Virtual Terminal Protocol.
  • Remote Directory Access Protocol.
  • Web Distributed Authoring and Versioning.
  • Message Handling Service Protocol.
  • Directory Access Protocol (DAP).
  • Extensible Messaging and Presence Protocol.
typestring
applicationProtocolVersion
descriptionThe version of the application protocol. e.g. "1.1, 2.0"
typestring
asn
descriptionAutonomous system number.
typestring
carrierName
descriptionCarrier identification.
typestring
communityId
descriptionCommunity ID network flow value.
typestring
dhcp
$refDhcp
descriptionDHCP info.
direction
descriptionThe direction of network traffic.
enum
  • UNKNOWN_DIRECTION
  • INBOUND
  • OUTBOUND
  • BROADCAST
enumDescriptions
  • The default direction.
  • An inbound request.
  • An outbound request.
  • A broadcast.
typestring
dns
$refDns
descriptionDNS info.
dnsDomain
descriptionDNS domain name.
typestring
email
$refEmail
descriptionEmail info for the sender/recipient.
ftp
$refFtp
descriptionFTP info.
http
$refHttp
descriptionHTTP info.
ipProtocol
descriptionThe IP protocol.
enum
  • UNKNOWN_IP_PROTOCOL
  • ICMP
  • IGMP
  • TCP
  • UDP
  • IP6IN4
  • GRE
  • ESP
  • ICMP6
  • EIGRP
  • ETHERIP
  • PIM
  • VRRP
  • SCTP
enumDescriptions
  • The default protocol.
  • ICMP.
  • IGMP
  • TCP.
  • UDP.
  • IPv6 Encapsulation
  • Generic Routing Encapsulation
  • Encapsulating Security Payload
  • ICMPv6
  • Enhanced Interior Gateway Routing
  • Ethernet-within-IP Encapsulation
  • Protocol Independent Multicast
  • Virtual Router Redundancy Protocol
  • Stream Control Transmission Protocol
typestring
ipSubnetRange
descriptionAssociated human-readable IP subnet range (e.g. 10.1.2.0/24).
typestring
organizationName
descriptionOrganization name (e.g Google).
typestring
parentSessionId
descriptionThe ID of the parent network session.
typestring
receivedBytes
descriptionThe number of bytes received.
formatuint64
typestring
receivedPackets
descriptionThe number of packets received.
formatint64
typestring
sentBytes
descriptionThe number of bytes sent.
formatuint64
typestring
sentPackets
descriptionThe number of packets sent.
formatint64
typestring
sessionDuration
descriptionThe duration of the session as the number of seconds and nanoseconds. For seconds, network.session_duration.seconds, the type is a 64-bit integer. For nanoseconds, network.session_duration.nanos, the type is a 32-bit integer.
formatgoogle-duration
typestring
sessionId
descriptionThe ID of the network session.
typestring
smtp
$refSmtp
descriptionSMTP info. Store fields specific to SMTP not covered by Email.
tls
$refTls
descriptionTLS info.
typeobject
Noun
descriptionThe Noun type is used to represent the different entities in an event: principal, src, target, observer, intermediary, and about. It stores attributes known about the entity. For example, if the entity is a device with multiple IP or MAC addresses, it stores the IP and MAC addresses that are relevant to the event.
idNoun
properties
administrativeDomain
descriptionDomain which the device belongs to (for example, the Microsoft Windows domain).
typestring
application
descriptionThe name of an application or service. Some SSO solutions only capture the name of a target application such as "Atlassian" or "Chronicle".
typestring
artifact
$refArtifact
descriptionInformation about an artifact.
asset
$refAsset
descriptionInformation about the asset.
assetId
descriptionThe asset ID. This field can be used as an entity indicator for asset entities.
typestring
cloud
$refCloud
deprecatedTrue
descriptionCloud metadata. Deprecated: cloud should be populated in entity Attribute as generic metadata (e.g. asset.attribute.cloud).
domain
$refDomain
descriptionInformation about the domain.
email
descriptionEmail address. Only filled in for security_result.about
typestring
file
$refBackstoryFile
descriptionInformation about the file.
group
$refGroup
descriptionInformation about the group.
hostname
descriptionClient hostname or domain name field. Hostname also doubles as the domain for remote entities. This field can be used as an entity indicator for asset entities.
typestring
investigation
$refInvestigation
descriptionAnalyst feedback/investigation for alerts.
ip
descriptionA list of IP addresses associated with a network connection. This field can be used as an entity indicator for asset entities.
items
typestring
typearray
ipGeoArtifact
descriptionEnriched geographic information corresponding to an IP address. Specifically, location and network data.
items
$refArtifact
typearray
ipLocation
deprecatedTrue
descriptionDeprecated: use ip_geo_artifact.location instead.
items
$refLocation
typearray
labels
deprecatedTrue
descriptionLabels are key-value pairs. For example: key = "env", value = "prod". Deprecated: labels should be populated in entity Attribute as generic metadata (e.g. user.attribute.labels).
items
$refLabel
typearray
location
$refLocation
descriptionPhysical location. For cloud environments, set the region in location.name.
mac
descriptionList of MAC addresses associated with a device. This field can be used as an entity indicator for asset entities.
items
typestring
typearray
namespace
descriptionNamespace which the device belongs to, such as "AD forest". Uses for this field include Microsoft Windows AD forest, the name of subsidiary, or the name of acquisition. This field can be used along with an asset indicator to identify an asset.
typestring
natIp
descriptionA list of NAT translated IP addresses associated with a network connection.
items
typestring
typearray
natPort
descriptionNAT external network port number when a specific network connection is described within an event.
formatint32
typeinteger
network
$refNetwork
descriptionNetwork details, including sub-messages with details on each protocol (for example, DHCP, DNS, or HTTP).
objectReference
$refId
descriptionFinding to which the Analyst updated the feedback.
platform
descriptionPlatform.
enum
  • UNKNOWN_PLATFORM
  • WINDOWS
  • MAC
  • LINUX
  • GCP
  • AWS
  • AZURE
  • IOS
  • ANDROID
  • CHROME_OS
enumDeprecated
  • False
  • False
  • False
  • False
  • True
  • True
  • True
  • False
  • False
  • False
enumDescriptions
  • Default value.
  • Microsoft Windows.
  • macOS.
  • Linux.
  • Deprecated: see cloud.environment.
  • Deprecated: see cloud.environment.
  • Deprecated: see cloud.environment.
  • IOS
  • Android
  • Chrome OS
typestring
platformPatchLevel
descriptionPlatform patch level. For example, "Build 17134.48"
typestring
platformVersion
descriptionPlatform version. For example, "Microsoft Windows 1803".
typestring
port
descriptionSource or destination network port number when a specific network connection is described within an event.
formatint32
typeinteger
process
$refProcess
descriptionInformation about the process.
processAncestors
descriptionInformation about the process's ancestors ordered from immediate ancestor (parent process) to root. Note: process_ancestors is only populated when data is exported to BigQuery since recursive fields (e.g. process.parent_process) are not supported by BigQuery.
items
$refProcess
typearray
registry
$refRegistry
descriptionRegistry information.
resource
$refResource
descriptionInformation about the resource (e.g. scheduled task, calendar entry). This field should not be used for files, registry, or processes because these objects are already part of Noun.
resourceAncestors
descriptionInformation about the resource's ancestors ordered from immediate ancestor (starting with parent resource).
items
$refResource
typearray
securityResult
descriptionA list of security results.
items
$refSecurityResult
typearray
url
descriptionThe URL.
typestring
urlMetadata
$refUrl
descriptionInformation about the URL.
user
$refUser
descriptionInformation about the user.
userManagementChain
descriptionInformation about the user's management chain (reporting hierarchy). Note: user_management_chain is only populated when data is exported to BigQuery since recursive fields (e.g. user.managers) are not supported by BigQuery.
items
$refUser
typearray
typeobject
NtfsFileMetadata
descriptionNTFS-specific file metadata.
idNtfsFileMetadata
properties
changeTime
descriptionNTFS MFT entry changed timestamp.
formatgoogle-datetime
typestring
filenameAccessTime
descriptionNTFS $FILE_NAME attribute accessed timestamp.
formatgoogle-datetime
typestring
filenameChangeTime
descriptionNTFS $FILE_NAME attribute changed timestamp.
formatgoogle-datetime
typestring
filenameCreateTime
descriptionNTFS $FILE_NAME attribute created timestamp.
formatgoogle-datetime
typestring
filenameModifyTime
descriptionNTFS $FILE_NAME attribute modified timestamp.
formatgoogle-datetime
typestring
typeobject
Operation
descriptionThis resource represents a long-running operation that is the result of a network API call.
idOperation
properties
done
descriptionIf the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available.
typeboolean
error
$refStatus
descriptionThe error result of the operation in case of failure or cancellation.
metadata
additionalProperties
descriptionProperties of the object. Contains field @type with type URL.
typeany
descriptionService-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any.
typeobject
name
descriptionThe server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`.
typestring
response
additionalProperties
descriptionProperties of the object. Contains field @type with type URL.
typeany
descriptionThe normal, successful response of the operation. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`.
typeobject
typeobject
Option
descriptionDHCP options.
idOption
properties
code
descriptionCode. See RFC1533.
formatuint32
typeinteger
data
descriptionData.
formatbyte
typestring
typeobject
PDFInfo
descriptionInformation about the PDF file structure. See https://developers.virustotal.com/reference/pdf_info
idPDFInfo
properties
acroform
descriptionNumber of /AcroForm tags found in the PDF.
formatint64
typestring
autoaction
descriptionNumber of /AA tags found in the PDF.
formatint64
typestring
embeddedFile
descriptionNumber of /EmbeddedFile tags found in the PDF.
formatint64
typestring
encrypted
descriptionWhether the document is encrypted or not. This is defined by the /Encrypt tag.
formatint64
typestring
endobjCount
descriptionNumber of object definitions (endobj keyword).
formatint64
typestring
endstreamCount
descriptionNumber of defined stream objects (stream keyword).
formatint64
typestring
flash
descriptionNumber of /RichMedia tags found in the PDF.
formatint64
typestring
header
descriptionPDF version.
typestring
javascript
descriptionNumber of /JavaScript tags found in the PDF file. Should be the same as the js field in normal scenarios.
formatint64
typestring
jbig2Compression
descriptionNumber of /JBIG2Decode tags found in the PDF.
formatint64
typestring
js
descriptionNumber of /JS tags found in the PDF file. Should be the same as javascript field in normal scenarios.
formatint64
typestring
launchActionCount
descriptionNumber of /Launch tags found in the PDF file.
formatint64
typestring
objCount
descriptionNumber of objects definitions (obj keyword).
formatint64
typestring
objectStreamCount
descriptionNumber of object streams.
formatint64
typestring
openaction
descriptionNumber of /OpenAction tags found in the PDF.
formatint64
typestring
pageCount
descriptionNumber of pages in the PDF.
formatint64
typestring
startxref
descriptionNumber of startxref keywords in the PDF.
formatint64
typestring
streamCount
descriptionNumber of defined stream objects (stream keyword).
formatint64
typestring
suspiciousColors
descriptionNumber of colors expressed with more than 3 bytes (CVE-2009-3459).
formatint64
typestring
trailer
descriptionNumber of trailer keywords in the PDF.
formatint64
typestring
xfa
descriptionNumber of \XFA tags found in the PDF.
formatint64
typestring
xref
descriptionNumber of xref keywords in the PDF.
formatint64
typestring
typeobject
PeFileMetadata
descriptionMetadata about a Microsoft Windows Portable Executable.
idPeFileMetadata
properties
importHash
descriptionHash of PE imports.
typestring
typeobject
Permission
descriptionSystem permission for resource access and modification.
idPermission
properties
description
descriptionDescription of the permission (e.g. 'Ability to update detect rules').
typestring
name
descriptionName of the permission (e.g. chronicle.analyst.updateRule).
typestring
type
descriptionType of the permission.
enum
  • UNKNOWN_PERMISSION_TYPE
  • ADMIN_WRITE
  • ADMIN_READ
  • DATA_WRITE
  • DATA_READ
enumDescriptions
  • Default permission type.
  • Administrator write permission.
  • Administrator read permission.
  • Data resource access write permission.
  • Data resource access read permission.
typestring
typeobject
PlatformSoftware
descriptionPlatform software information about an operating system.
idPlatformSoftware
properties
platform
descriptionThe platform operating system.
enum
  • UNKNOWN_PLATFORM
  • WINDOWS
  • MAC
  • LINUX
  • GCP
  • AWS
  • AZURE
  • IOS
  • ANDROID
  • CHROME_OS
enumDeprecated
  • False
  • False
  • False
  • False
  • True
  • True
  • True
  • False
  • False
  • False
enumDescriptions
  • Default value.
  • Microsoft Windows.
  • macOS.
  • Linux.
  • Deprecated: see cloud.environment.
  • Deprecated: see cloud.environment.
  • Deprecated: see cloud.environment.
  • IOS
  • Android
  • Chrome OS
typestring
platformPatchLevel
descriptionThe platform software patch level ( e.g. "Build 17134.48", "SP1").
typestring
platformVersion
descriptionThe platform software version ( e.g. "Microsoft Windows 1803").
typestring
typeobject
PopularityRank
descriptionDomain's position in popularity ranks for sources such as Alexa, Quantcast, or Statvoo.
idPopularityRank
properties
giver
descriptionName of the rank serial number hexdump.
typestring
ingestionTime
descriptionTimestamp when the rank was ingested.
formatgoogle-datetime
typestring
rank
descriptionRank position.
formatint64
typestring
typeobject
Prevalence
descriptionThe prevalence of a resource within the customer's environment. This measures how common it is for assets to access the resource.
idPrevalence
properties
dayCount
descriptionThe number of days over which rolling_max is calculated.
formatint32
typeinteger
dayMax
descriptionThe max prevalence score in a day interval window.
formatint32
typeinteger
dayMaxSubDomains
descriptionThe max prevalence score in a day interval window across sub-domains. This field is only valid for domains.
formatint32
typeinteger
rollingMax
descriptionThe maximum number of assets per day accessing the resource over the trailing day_count days.
formatint32
typeinteger
rollingMaxSubDomains
descriptionThe maximum number of assets per day accessing the domain along with sub-domains over the trailing day_count days. This field is only valid for domains.
formatint32
typeinteger
typeobject
Process
descriptionInformation about a process.
idProcess
properties
accessMask
descriptionA bit mask representing the level of access.
formatuint64
typestring
commandLine
descriptionThe command line command that created the process. This field can be used as an entity indicator for process entities.
typestring
commandLineHistory
descriptionThe command line history of the process.
items
typestring
typearray
egid
descriptionThe effective group ID of the process.
typestring
euid
descriptionThe effective user ID of the process.
typestring
file
$refBackstoryFile
descriptionInformation about the file in use by the process.
integrityLevelRid
descriptionThe Microsoft Windows integrity level relative ID (RID) of the process.
formatuint64
typestring
parentPid
deprecatedTrue
descriptionThe ID of the parent process. Deprecated: use parent_process.pid instead.
typestring
parentProcess
$refProcess
descriptionInformation about the parent process.
pgid
descriptionThe identifier that points to the process group ID leader.
typestring
pid
descriptionThe process ID. This field can be used as an entity indicator for process entities.
typestring
productSpecificParentProcessId
deprecatedTrue
descriptionA product specific id for the parent process. Please use parent_process.product_specific_process_id instead.
typestring
productSpecificProcessId
descriptionA product specific process id.
typestring
rgid
descriptionThe real group ID of the process.
typestring
ruid
descriptionThe real user ID of the process.
typestring
sessionLeaderPid
descriptionThe process ID of the session leader process.
typestring
tokenElevationType
descriptionThe elevation type of the process on Microsoft Windows. This determines if any privileges are removed when UAC is enabled.
enum
  • UNKNOWN
  • TYPE_1
  • TYPE_2
  • TYPE_3
enumDescriptions
  • An undetermined token type.
  • A full token with no privileges removed or groups disabled.
  • An elevated token with no privileges removed or groups disabled. Used when running as administrator.
  • A limited token with administrative privileges removed and administrative groups disabled.
typestring
tty
descriptionThe teletype terminal which the command was executed within.
typestring
typeobject
ProviderMLVerdict
descriptionDeprecated. MLVerdict result provided from threat providers, like Mandiant. These fields are used to model Mandiant sources.
idProviderMLVerdict
properties
benignCount
descriptionCount of responses where this IoC was marked benign.
formatint32
typeinteger
confidenceScore
descriptionConfidence score of the verdict.
formatint32
typeinteger
maliciousCount
descriptionCount of responses where this IoC was marked malicious.
formatint32
typeinteger
mandiantSources
descriptionList of mandiant sources from which the verdict was generated.
items
$refSource
typearray
sourceProvider
descriptionSource provider giving the ML verdict.
typestring
thirdPartySources
descriptionList of third-party sources from which the verdict was generated.
items
$refSource
typearray
typeobject
PublicKey
descriptionSubject public key info.
idPublicKey
properties
algorithm
descriptionAny of "RSA", "DSA" or "EC". Indicates the algorithm used to generate the certificate.
typestring
rsa
$refRSA
descriptionRSA public key information.
typeobject
Question
descriptionDNS Questions. See RFC1035, section 4.1.2.
idQuestion
properties
class
descriptionThe code specifying the class of the query.
formatuint32
typeinteger
name
descriptionThe domain name.
typestring
prevalence
$refPrevalence
descriptionThe prevalence of the domain within the customer's environment.
type
descriptionThe code specifying the type of the query.
formatuint32
typeinteger
typeobject
RSA
descriptionRSA public key information.
idRSA
properties
exponent
descriptionKey exponent hexdump.
typestring
keySize
descriptionKey size.
formatint64
typestring
modulus
descriptionKey modulus hexdump.
typestring
typeobject
Reference
descriptionReference to model primatives including event and entity. As support is added for fast retrieval of objects by identifiers, this will be expanded to include ID references rather than full object copies. BEGIN GOOGLE-INTERNAL See go/udm:ids for additional details. END GOOGLE-INTERNAL
idReference
properties
entity
$refBackstoryEntity
descriptionEntity being referenced. End one-of
event
$refUDM
descriptionOnly one of event or entity will be populated for a single reference. Start one-of Event being referenced.
id
$refId
descriptionId being referenced. This field will also be populated for both event and entity with the event id. For detections, only this field will be populated.
typeobject
ReferenceList
descriptionA reference list. Reference lists are user-defined lists of values which users can use in multiple Rules.
idReferenceList
properties
description
descriptionRequired. A user-provided description of the reference list.
typestring
displayName
descriptionOutput only. The unique display name of the reference list.
readOnlyTrue
typestring
entries
descriptionRequired. The entries of the reference list. When listed, they are returned in the order that was specified at creation or update. The combined size of the values of the reference list may not exceed 6MB. This is returned only when the view is REFERENCE_LIST_VIEW_FULL.
items
$refReferenceListEntry
typearray
name
descriptionOutput only. The resource name of the reference list. Format: projects/{project}/locations/{location}/instances/{instance}/referenceLists/{reference_list}
readOnlyTrue
typestring
revisionCreateTime
descriptionOutput only. The timestamp when the reference list was last updated.
formatgoogle-datetime
readOnlyTrue
typestring
ruleAssociationsCount
descriptionOutput only. The count of self-authored rules using the reference list.
formatint32
readOnlyTrue
typeinteger
rules
descriptionOutput only. The resource names for the associated self-authored Rules that use this reference list. This is returned only when the view is REFERENCE_LIST_VIEW_FULL.
items
typestring
readOnlyTrue
typearray
scopeInfo
$refScopeInfo
descriptionOutput only. The scope info of the reference list. During reference list creation, if this field is not set, the reference list without scopes (an unscoped list) will be created for an unscoped user. For a scoped user, this field must be set. During reference list update, if scope_info is requested to be updated, this field must be set.
readOnlyTrue
syntaxType
descriptionRequired. The syntax type indicating how list entries should be validated.
enum
  • REFERENCE_LIST_SYNTAX_TYPE_UNSPECIFIED
  • REFERENCE_LIST_SYNTAX_TYPE_PLAIN_TEXT_STRING
  • REFERENCE_LIST_SYNTAX_TYPE_REGEX
  • REFERENCE_LIST_SYNTAX_TYPE_CIDR
enumDescriptions
  • Defaults to REFERENCE_LIST_SYNTAX_TYPE_PLAIN_TEXT_STRING.
  • List contains plain text patterns.
  • List contains only Regular Expression patterns.
  • List contains only CIDR patterns.
typestring
typeobject
ReferenceListEntry
descriptionAn entry in a reference list.
idReferenceListEntry
properties
value
descriptionRequired. The value of the entry. Maximum length is 512 characters.
typestring
typeobject
ReferenceListScope
descriptionReferenceListScope specifies the list of scope names of the reference list.
idReferenceListScope
properties
scopeNames
descriptionOptional. The list of scope names of the reference list. The scope names should be full resource names and should be of the format: "projects/{project}/locations/{location}/instances/{instance}/dataAccessScopes/{scope_name}".
items
typestring
typearray
typeobject
Registry
descriptionInformation about a registry key or value.
idRegistry
properties
registryKey
descriptionRegistry key associated with an application or system component (e.g., HKEY_, HKCU\Environment...).
typestring
registryValueData
descriptionData associated with a registry value (e.g. %USERPROFILE%\Local Settings\Temp).
typestring
registryValueName
descriptionName of the registry value associated with an application or system component (e.g. TEMP).
typestring
registryValueType
descriptionType of the registry value.
enum
  • TYPE_UNSPECIFIED
  • NONE
  • SZ
  • EXPAND_SZ
  • BINARY
  • DWORD
  • DWORD_LITTLE_ENDIAN
  • DWORD_BIG_ENDIAN
  • LINK
  • MULTI_SZ
  • RESOURCE_LIST
  • QWORD
  • QWORD_LITTLE_ENDIAN
enumDescriptions
  • Default registry value type used when the type is unknown.
  • The registry value is not set and only the key exists.
  • A null-terminated string.
  • A null-terminated string that contains unexpanded references to environment variables
  • Binary data in any form.
  • A 32-bit number.
  • A 32-bit number in little-endian format.
  • A 32-bit number in big-endian format.
  • A null-terminated Unicode string that contains the target path of a symbolic link.
  • A sequence of null-terminated strings, terminated by an empty string
  • A device driver resource list.
  • A 64-bit number.
  • A 64-bit number in little-endian format.
typestring
typeobject
Relation
descriptionDefines the relationship between the entity (a) and another entity (b).
idRelation
properties
direction
descriptionDirectionality of relationship between primary entity (a) and the related entity (b).
enum
  • DIRECTIONALITY_UNSPECIFIED
  • BIDIRECTIONAL
  • UNIDIRECTIONAL
enumDescriptions
  • Default value.
  • Modeled in both directions. Primary entity (a) to related entity (b) and related entity (b) to primary entity (a).
  • Modeled in a single direction. Primary entity (a) to related entity (b).
typestring
entity
$refNoun
descriptionEntity (b) that the primary entity (a) is related to.
entityLabel
descriptionLabel to identify the Noun of the relation.
enum
  • ENTITY_LABEL_UNSPECIFIED
  • PRINCIPAL
  • TARGET
  • OBSERVER
  • SRC
  • NETWORK
  • SECURITY_RESULT
  • INTERMEDIARY
enumDescriptions
  • Default value.
  • The Noun represents a principal type object.
  • The Noun represents a target type object.
  • The Noun represents an observer type object.
  • The Noun represents src type object.
  • The Noun represents a network type object.
  • The Noun represents a SecurityResult object.
  • The Noun represents an intermediary type object.
typestring
entityType
descriptionType of the related entity (b) in this relationship.
enum
  • UNKNOWN_ENTITYTYPE
  • ASSET
  • USER
  • GROUP
  • RESOURCE
  • IP_ADDRESS
  • FILE
  • DOMAIN_NAME
  • URL
  • MUTEX
  • METRIC
enumDescriptions
  • @hide_from_doc
  • An asset, such as workstation, laptop, phone, virtual machine, etc.
  • User.
  • Group.
  • Resource.
  • An external IP address.
  • A file.
  • A domain.
  • A url.
  • A mutex.
  • A metric.
typestring
relationship
descriptionType of relationship.
enum
  • RELATIONSHIP_UNSPECIFIED
  • OWNS
  • ADMINISTERS
  • MEMBER
  • EXECUTES
  • DOWNLOADED_FROM
  • CONTACTS
enumDescriptions
  • Default value
  • Related entity is owned by the primary entity (e.g. user owns device asset).
  • Related entity is administered by the primary entity (e.g. user administers a group).
  • Primary entity is a member of the related entity (e.g. user is a member of a group).
  • Primary entity may have executed the related entity.
  • Primary entity may have been downloaded from the related entity.
  • Primary entity contacts the related entity.
typestring
uid
descriptionUID of the relationship.
formatbyte
typestring
typeobject
Resource
descriptionInformation about a resource such as a task, Cloud Storage bucket, database, disk, logical policy, or something similar.
idResource
properties
attribute
$refAttribute
descriptionGeneric entity metadata attributes of the resource.
id
deprecatedTrue
descriptionDeprecated: Use resource.name or resource.product_object_id.
typestring
name
descriptionThe full name of the resource. For example, Google Cloud: //cloudresourcemanager.googleapis.com/projects/wombat-123, and AWS: arn:aws:iam::123456789012:user/johndoe.
typestring
parent
deprecatedTrue
descriptionThe parent of the resource. For a database table, the parent is the database. For a storage object, the bucket name. Deprecated: use resource_ancestors.name.
typestring
productObjectId
descriptionA vendor-specific identifier to uniquely identify the entity (a GUID, OID, or similar) This field can be used as an entity indicator for a Resource entity.
typestring
resourceSubtype
descriptionResource sub-type (e.g. "BigQuery", "Bigtable").
typestring
resourceType
descriptionResource type.
enum
  • UNSPECIFIED
  • MUTEX
  • TASK
  • PIPE
  • DEVICE
  • FIREWALL_RULE
  • MAILBOX_FOLDER
  • VPC_NETWORK
  • VIRTUAL_MACHINE
  • STORAGE_BUCKET
  • STORAGE_OBJECT
  • DATABASE
  • TABLE
  • CLOUD_PROJECT
  • CLOUD_ORGANIZATION
  • SERVICE_ACCOUNT
  • ACCESS_POLICY
  • CLUSTER
  • SETTING
  • DATASET
  • BACKEND_SERVICE
  • POD
  • CONTAINER
  • FUNCTION
  • RUNTIME
  • IP_ADDRESS
  • DISK
  • VOLUME
  • IMAGE
  • SNAPSHOT
  • REPOSITORY
  • CREDENTIAL
  • LOAD_BALANCER
  • GATEWAY
  • SUBNET
  • USER
enumDescriptions
  • Default type.
  • Mutex.
  • Task.
  • Named pipe.
  • Device.
  • Firewall rule.
  • Mailbox folder.
  • VPC Network.
  • Virtual machine.
  • Storage bucket.
  • Storage object.
  • Database.
  • Data table.
  • Cloud project.
  • Cloud organization.
  • Service account.
  • Access policy.
  • Cluster.
  • Settings.
  • Dataset.
  • Endpoint that receive traffic from a load balancer or proxy.
  • Pod, which is a collection of containers. Often used in Kubernetes.
  • Container.
  • Cloud function.
  • Runtime.
  • IP address.
  • Disk.
  • Volume.
  • Machine image.
  • Snapshot.
  • Repository.
  • Credential, e.g. access keys, ssh keys, tokens, certificates.
  • Load balancer.
  • Gateway.
  • Subnet.
  • User.
typestring
type
deprecatedTrue
descriptionDeprecated: use resource_type instead.
typestring
typeobject
ResourceRecord
descriptionDNS Resource Records. See RFC1035, section 4.1.3.
idResourceRecord
properties
binaryData
descriptionThe raw bytes of any non-UTF8 strings that might be included as part of a DNS response.
formatbyte
typestring
class
descriptionThe code specifying the class of the resource record.
formatuint32
typeinteger
data
descriptionThe payload or response to the DNS question for all responses encoded in UTF-8 format
typestring
name
descriptionThe name of the owner of the resource record.
typestring
ttl
descriptionThe time interval for which the resource record can be cached before the source of the information should again be queried.
formatuint32
typeinteger
type
descriptionThe code specifying the type of the resource record.
formatuint32
typeinteger
typeobject
ResponsePlatformInfo
descriptionRelated info of an Alert in customer's SOAR platform.
idResponsePlatformInfo
properties
alertId
descriptionId of the alert in SOAR product.
typestring
responsePlatformType
descriptionType of SOAR product.
enum
  • RESPONSE_PLATFORM_TYPE_UNSPECIFIED
  • RESPONSE_PLATFORM_TYPE_SIEMPLIFY
enumDescriptions
  • Response platform not specified.
  • Siemplify
typestring
typeobject
Retrohunt
descriptionRetrohunt is an execution of a Rule over a time range in the past.
idRetrohunt
properties
executionInterval
$refInterval
descriptionOutput only. The start and end time of the retrohunt execution. If the retrohunt is not yet finished, the end time of the interval will not be populated.
readOnlyTrue
name
descriptionThe resource name of the retrohunt. Retrohunt is the child of a rule revision. {rule} in the format below is structured as {rule_id@revision_id}. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}/retrohunts/{retrohunt}
typestring
processInterval
$refInterval
descriptionRequired. The start and end time of the event time range this retrohunt processes.
progressPercentage
descriptionOutput only. Percent progress of the retrohunt towards completion, from 0.00 to 100.00.
formatfloat
readOnlyTrue
typenumber
state
descriptionOutput only. The state of the retrohunt.
enum
  • STATE_UNSPECIFIED
  • RUNNING
  • DONE
  • CANCELLED
  • FAILED
enumDescriptions
  • Unspecified or unknown retrohunt state.
  • Running state.
  • Done state.
  • Cancelled state.
  • Failed state.
readOnlyTrue
typestring
typeobject
RetrohuntMetadata
descriptionOperation Metadata for Retrohunts.
idRetrohuntMetadata
properties
executionInterval
$refInterval
descriptionThe start and end time of the retrohunt execution. If the retrohunt is not yet finished, the end time of the interval will not be filled.
progressPercentage
descriptionPercent progress of the retrohunt towards completion, from 0.00 to 100.00.
formatfloat
typenumber
retrohunt
descriptionThe name of the retrohunt. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}/retrohunts/{retrohunt}
typestring
typeobject
RiskDelta
descriptionDescribes the difference in risk score between two points in time.
idRiskDelta
properties
previousRangeEndTime
descriptionEnd time of the previous time window.
formatgoogle-datetime
typestring
previousRiskScore
descriptionRisk score from previous risk window
formatint32
typeinteger
riskScoreDelta
descriptionDifference in the normalized risk score from the previous recorded value.
formatint32
typeinteger
riskScoreNumericDelta
descriptionNumeric change between current and previous risk score
formatint32
typeinteger
typeobject
Role
descriptionSystem role for resource access and modification.
idRole
properties
description
descriptionSystem role description for user.
typestring
name
descriptionSystem role name for user.
typestring
type
descriptionSystem role type for well known roles.
enum
  • TYPE_UNSPECIFIED
  • ADMINISTRATOR
  • SERVICE_ACCOUNT
enumDescriptions
  • Default user role.
  • Product administrator with elevated privileges.
  • System service account for automated privilege access.
typestring
typeobject
Rule
descriptionThe Rule resource represents a user-created rule. NEXT TAG: 21
idRule
properties
allowedRunFrequencies
descriptionOutput only. The run frequencies that are allowed for the rule. Populated in BASIC view and FULL view.
items
enum
  • RUN_FREQUENCY_UNSPECIFIED
  • LIVE
  • HOURLY
  • DAILY
enumDescriptions
  • The run frequency is unspecified/unknown.
  • Executes in real time.
  • Executes once per hour.
  • Executes once per day.
typestring
readOnlyTrue
typearray
author
descriptionOutput only. The author of the rule. Extracted from the meta section of text. Populated in BASIC view and FULL view.
readOnlyTrue
typestring
compilationDiagnostics
descriptionOutput only. A list of a rule's corresponding compilation diagnostic messages such as compilation errors and compilation warnings. Populated in FULL view.
items
$refCompilationDiagnostic
readOnlyTrue
typearray
compilationState
descriptionOutput only. The current compilation state of the rule. Populated in FULL view.
enum
  • COMPILATION_STATE_UNSPECIFIED
  • SUCCEEDED
  • FAILED
enumDescriptions
  • The compilation state is unspecified/unknown.
  • The Rule can successfully compile.
  • The Rule cannot successfully compile. This is possible if a backwards-incompatible change was made to the compiler.
readOnlyTrue
typestring
createTime
descriptionOutput only. The timestamp of when the rule was created. Populated in FULL view.
formatgoogle-datetime
readOnlyTrue
typestring
dataTables
descriptionOutput only. Resource names of the data tables used in this rule.
items
typestring
readOnlyTrue
typearray
displayName
descriptionOutput only. Display name of the rule. Populated in BASIC view and FULL view.
readOnlyTrue
typestring
etag
descriptionThe etag for this rule. If this is provided on update, the request will succeed if and only if it matches the server-computed value, and will fail with an ABORTED error otherwise. Populated in BASIC view and FULL view.
typestring
inputsUsed
$refInputsUsed
descriptionOutput only. The set of inputs used in the rule. For example, if the rule uses $e.principal.hostname, then the uses_udm field will be true.
readOnlyTrue
metadata
additionalProperties
typestring
descriptionOutput only. Additional metadata specified in the meta section of text. Populated in FULL view.
readOnlyTrue
typeobject
name
descriptionFull resource name for the rule. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}
typestring
nearRealTimeLiveRuleEligible
descriptionOutput only. Indicate the rule can run in near real time live rule. If this is true, the rule uses the near real time live rule when the run frequency is set to LIVE.
readOnlyTrue
typeboolean
referenceLists
descriptionOutput only. Resource names of the reference lists used in this rule. Populated in FULL view.
items
typestring
readOnlyTrue
typearray
revisionCreateTime
descriptionOutput only. The timestamp of when the rule revision was created. Populated in FULL, REVISION_METADATA_ONLY views.
formatgoogle-datetime
readOnlyTrue
typestring
revisionId
descriptionOutput only. The revision ID of the rule. A new revision is created whenever the rule text is changed in any way. Format: v_{10 digits}_{9 digits} Populated in REVISION_METADATA_ONLY view and FULL view.
readOnlyTrue
typestring
scope
descriptionResource name of the DataAccessScope bound to this rule. Populated in BASIC view and FULL view. If reference lists are used in the rule, validations will be performed against this scope to ensure that the reference lists are compatible with both the user's and the rule's scopes. The scope should be in the format: "projects/{project}/locations/{location}/instances/{instance}/dataAccessScopes/{scope}".
typestring
severity
$refSeverity
descriptionOutput only. The severity of the rule as specified in the meta section of text. Populated in BASIC view and FULL view.
readOnlyTrue
text
descriptionThe YARA-L content of the rule. Populated in FULL view.
typestring
type
descriptionOutput only. User-facing type of the rule. Extracted from the events section of rule text. Populated in BASIC view and FULL view.
enum
  • RULE_TYPE_UNSPECIFIED
  • SINGLE_EVENT
  • MULTI_EVENT
enumDescriptions
  • The rule type is unspecified/unknown.
  • Rule checks for the existence of a single event.
  • Rule checks for correlation between multiple events
readOnlyTrue
typestring
typeobject
RuleDeployment
descriptionThe RuleDeployment resource represents the deployment state of a Rule.
idRuleDeployment
properties
alerting
descriptionWhether detections resulting from this deployment should be considered alerts.
typeboolean
archiveTime
descriptionOutput only. The timestamp when the rule deployment archive state was last set to true. If the rule deployment's current archive state is not set to true, the field will be empty.
formatgoogle-datetime
readOnlyTrue
typestring
archived
descriptionThe archive state of the rule deployment. Cannot be set to true unless enabled is set to false. If set to true, alerting will automatically be set to false. If currently set to true, enabled, alerting, and run_frequency cannot be updated.
typeboolean
consumerRules
descriptionOutput only. The names of the associated/chained consumer rules. Rules are considered consumers of this rule if their rule text explicitly filters on this rule's ruleid. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}
items
typestring
readOnlyTrue
typearray
enabled
descriptionWhether the rule is currently deployed continuously against incoming data.
typeboolean
executionState
descriptionOutput only. The execution state of the rule deployment.
enum
  • EXECUTION_STATE_UNSPECIFIED
  • DEFAULT
  • LIMITED
  • PAUSED
enumDescriptions
  • Unspecified or unknown execution state.
  • Default execution state.
  • Rules in limited state may not have their executions guaranteed.
  • Paused rules are not executed at all.
readOnlyTrue
typestring
lastAlertStatusChangeTime
descriptionOutput only. The timestamp when the rule deployment alert state was lastly changed. This is filled regardless of the current alert state. E.g. if the current alert status is false, this timestamp will be the timestamp when the alert status was changed to false.
formatgoogle-datetime
readOnlyTrue
typestring
name
descriptionRequired. The resource name of the rule deployment. Note that RuleDeployment is a child of the overall Rule, not any individual revision, so the resource ID segment for the Rule resource must not reference a specific revision. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}/deployment
typestring
producerRules
descriptionOutput only. The names of the associated/chained producer rules. Rules are considered producers for this rule if this rule explicitly filters on their ruleid. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}
items
typestring
readOnlyTrue
typearray
runFrequency
descriptionThe run frequency of the rule deployment.
enum
  • RUN_FREQUENCY_UNSPECIFIED
  • LIVE
  • HOURLY
  • DAILY
enumDescriptions
  • The run frequency is unspecified/unknown.
  • Executes in real time.
  • Executes once per hour.
  • Executes once per day.
typestring
typeobject
RuntimeError
idRuntimeError
properties
errorText
typestring
timeRange
$refInterval
typeobject
SSLCertificate
descriptionSSL certificate.
idSSLCertificate
properties
certExtensions
additionalProperties
descriptionProperties of the object.
typeany
descriptionCertificate's extensions.
typeobject
certSignature
$refCertSignature
descriptionCertificate's signature and algorithm.
ec
$refEC
descriptionEC public key information.
extension
$refExtension
deprecatedTrue
description(DEPRECATED) certificate's extension.
firstSeenTime
descriptionDate the certificate was first retrieved by VirusTotal.
formatgoogle-datetime
typestring
issuer
$refSubject
descriptionCertificate's issuer data.
publicKey
$refPublicKey
descriptionPublic key information.
serialNumber
descriptionCertificate's serial number hexdump.
typestring
signatureAlgorithm
descriptionAlgorithm used for the signature (for example, "sha1RSA").
typestring
size
descriptionCertificate content length.
formatint64
typestring
subject
$refSubject
descriptionCertificate's subject data.
thumbprint
descriptionCertificate's content SHA1 hash.
typestring
thumbprintSha256
descriptionCertificate's content SHA256 hash.
typestring
validity
$refValidity
descriptionCertificate's validity period.
version
descriptionCertificate version (typically "V1", "V2" or "V3").
typestring
typeobject
ScopeInfo
descriptionScopeInfo specifies the scope info of the reference list.
idScopeInfo
properties
referenceListScope
$refReferenceListScope
descriptionRequired. The list of scope names of the reference list, if the list is empty the reference list is treated as unscoped.
typeobject
SearchDataTableColumnInfo
idSearchDataTableColumnInfo
properties
isDefault
typeboolean
originalColumn
typestring
typeobject
SearchDataTableInfo
idSearchDataTableInfo
properties
columnInfo
items
$refSearchDataTableColumnInfo
typearray
dataTable
typestring
typeobject
SearchDataTableRow
idSearchDataTableRow
properties
column
typestring
value
typestring
typeobject
SearchDataTableRowInfo
idSearchDataTableRowInfo
properties
dataTable
typestring
rows
items
$refSearchDataTableRow
typearray
typeobject
SecurityResult
descriptionSecurity related metadata for the event. A security result might be something like "virus detected and quarantined," "malicious connection blocked," or "sensitive data included in document foo.doc." Each security result, of which there may be more than one, may either pertain to the whole event, or to a specific object or device referenced in the event (e.g. a malicious file that was detected, or a sensitive document sent as an email attachment). For security results that apply to a particular object referenced in the event, the security_results message MUST contain details about the implicated object (such as process, user, IP, domain, URL, IP, or email address) in the about field. For security results that apply to the entire event (e.g. SPAM found in this email), the about field must remain empty.
idSecurityResult
properties
about
$refNoun
descriptionIf the security result is about a specific entity (Noun), add it here. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
action
descriptionActions taken for this event. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
items
enum
  • UNKNOWN_ACTION
  • ALLOW
  • BLOCK
  • ALLOW_WITH_MODIFICATION
  • QUARANTINE
  • FAIL
  • CHALLENGE
enumDescriptions
  • The default action.
  • Allowed.
  • Blocked.
  • Strip, modify something (e.g. File or email was disinfected or rewritten and still forwarded).
  • Put somewhere for later analysis (does NOT imply block).
  • Failed (e.g. the event was allowed but failed).
  • Challenged (e.g. the user was challenged by a Captcha, 2FA).
typestring
typearray
actionDetails
descriptionThe detail of the action taken as provided by the vendor. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
typestring
alertState
descriptionThe alerting types of this security result. This is primarily set for rule-generated detections and alerts.
enum
  • UNSPECIFIED
  • NOT_ALERTING
  • ALERTING
enumDescriptions
  • The security result type is not known.
  • The security result is not an alert.
  • The security result is an alert.
typestring
analyticsMetadata
descriptionStores metadata about each risk analytic metric the rule uses. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
items
$refAnalyticsMetadata
typearray
associations
descriptionAssociations related to the threat. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
items
$refAssociation
typearray
attackDetails
$refAttackDetails
descriptionMITRE ATT&CK details. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
campaigns
descriptionCampaigns using this IOC threat. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
items
typestring
typearray
category
descriptionThe security category. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
items
enum
  • UNKNOWN_CATEGORY
  • SOFTWARE_MALICIOUS
  • SOFTWARE_SUSPICIOUS
  • SOFTWARE_PUA
  • NETWORK_MALICIOUS
  • NETWORK_SUSPICIOUS
  • NETWORK_CATEGORIZED_CONTENT
  • NETWORK_DENIAL_OF_SERVICE
  • NETWORK_RECON
  • NETWORK_COMMAND_AND_CONTROL
  • ACL_VIOLATION
  • AUTH_VIOLATION
  • EXPLOIT
  • DATA_EXFILTRATION
  • DATA_AT_REST
  • DATA_DESTRUCTION
  • TOR_EXIT_NODE
  • MAIL_SPAM
  • MAIL_PHISHING
  • MAIL_SPOOFING
  • POLICY_VIOLATION
  • SOCIAL_ENGINEERING
  • PHISHING
enumDescriptions
  • The default category.
  • Malware, spyware, rootkit.
  • Below the conviction threshold; probably bad.
  • Potentially Unwanted App (such as adware).
  • Includes C&C or network exploit.
  • Suspicious activity, such as potential reverse tunnel.
  • Non-security related: URL has category like gambling or porn.
  • DoS, DDoS.
  • Port scan detected by an IDS, probing of web app.
  • If we know this is a C&C channel.
  • Unauthorized access attempted, including attempted access to files, web services, processes, web objects, etc.
  • Authentication failed (e.g. bad password or bad 2-factor authentication).
  • Exploit: For all manner of exploits including attempted overflows, bad protocol encodings, ROP, SQL injection, etc. For both network and host- based exploits.
  • DLP: Sensitive data transmission, copy to thumb drive.
  • DLP: Sensitive data found at rest in a scan.
  • Attempt to destroy/delete data.
  • TOR Exit Nodes.
  • Spam email, message, etc.
  • Phishing email, chat messages, etc.
  • Spoofed source email address, etc.
  • Security-related policy violation (e.g. firewall/proxy/HIPS rule violated, NAC block action).
  • Threats which manipulate to break normal security procedures.
  • Phishing pages, pops, https phishing etc.
typestring
typearray
categoryDetails
descriptionFor vendor-specific categories. For web categorization, put type in here such as "gambling" or "porn". This field is not populated when the SecurityResult appears in a finding (a detection or alert).
items
typestring
typearray
confidence
descriptionThe confidence level of the result as estimated by the product. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
enum
  • UNKNOWN_CONFIDENCE
  • LOW_CONFIDENCE
  • MEDIUM_CONFIDENCE
  • HIGH_CONFIDENCE
enumDescriptions
  • The default confidence level.
  • Low confidence.
  • Medium confidence.
  • High confidence.
typestring
confidenceDetails
descriptionAdditional detail with regards to the confidence of a security event as estimated by the product vendor. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
typestring
confidenceScore
descriptionThe confidence score of the security result. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
formatfloat
typenumber
description
descriptionA human-readable description (e.g. "user password was wrong"). This can be more detailed than the summary.
typestring
detectionDepth
descriptionThe depth of the detection chain. Applies only to composite detections.
formatint64
typestring
detectionFields
descriptionAn ordered list of values, that represent fields in detections for a security finding. This list represents mapping of names of requested entities to their values (the security result matched variables). This is only populated when the SecurityResult appears in a finding (a detection or alert).
items
$refLabel
typearray
firstDiscoveredTime
descriptionFirst time the IoC threat was discovered in the provider. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
formatgoogle-datetime
typestring
lastDiscoveredTime
descriptionLast time the IoC was seen in the provider data. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
formatgoogle-datetime
typestring
lastUpdatedTime
descriptionLast time the IoC threat was updated in the provider. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
formatgoogle-datetime
typestring
outcomes
descriptionA list of outcomes that represent the results of this security finding. This list represents a mapping of names of the requested outcomes, to a stringified version of their values. This is only populated when the SecurityResult appears in a finding (a detection or alert).
items
$refLabel
typearray
priority
descriptionThe priority of the result. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
enum
  • UNKNOWN_PRIORITY
  • LOW_PRIORITY
  • MEDIUM_PRIORITY
  • HIGH_PRIORITY
enumDescriptions
  • Default priority level.
  • Low priority.
  • Medium priority.
  • High priority.
typestring
priorityDetails
descriptionVendor-specific information about the security result priority. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
typestring
reports
descriptionReports that reference this IOC threat. These are the report IDs. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
items
typestring
typearray
riskScore
descriptionThe risk score of the security result.
formatfloat
typenumber
ruleAuthor
descriptionAuthor of the security rule. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
typestring
ruleId
descriptionA vendor-specific ID for a rule, varying by observer type (e.g. "08123", "5d2b44d0-5ef6-40f5-a704-47d61d3babbe").
typestring
ruleLabels
descriptionA list of rule labels that can't be captured by the other fields in security result (e.g. "reference : AnotherRule", "contributor : John"). This is primarily set in rule-generated detections and alerts.
items
$refLabel
typearray
ruleName
descriptionName of the security rule (e.g. "BlockInboundToOracle").
typestring
ruleSet
descriptionThe curated detection's rule set identifier. (for example, "windows-threats") This is primarily set in rule-generated detections and alerts.
typestring
ruleSetDisplayName
descriptionThe curated detections rule set display name. This is primarily set in rule-generated detections and alerts.
typestring
ruleType
descriptionThe type of security rule.
typestring
ruleVersion
descriptionVersion of the security rule. (e.g. "v1.1", "00001", "1604709794", "2020-11-16T23:04:19+00:00"). Note that rule versions are source-dependant and lexical ordering should not be assumed.
typestring
rulesetCategoryDisplayName
descriptionThe curated detection rule set category display name. (for example, if rule_set_display_name is "CDIR SCC Enhanced Exfiltration", the rule_set_category is "Cloud Threats"). This is primarily set in rule-generated detections and alerts.
typestring
severity
descriptionThe severity of the result.
enum
  • UNKNOWN_SEVERITY
  • INFORMATIONAL
  • ERROR
  • NONE
  • LOW
  • MEDIUM
  • HIGH
  • CRITICAL
enumDescriptions
  • The default severity level.
  • Info severity.
  • An error.
  • No malicious result.
  • Low-severity malicious result.
  • Medium-severity malicious result.
  • High-severity malicious result.
  • Critical-severity malicious result.
typestring
severityDetails
descriptionVendor-specific severity. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
typestring
summary
descriptionA short human-readable summary (e.g. "failed login occurred")
typestring
threatFeedName
descriptionVendor feed name for a threat indicator feed. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
typestring
threatId
descriptionVendor-specific ID for a threat. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
typestring
threatIdNamespace
descriptionThe attribute threat_id_namespace qualifies threat_id with an id namespace to get an unique id. The attribute threat_id by itself is not unique across Chronicle as it is a vendor specific id. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
enum
  • NORMALIZED_TELEMETRY
  • RAW_TELEMETRY
  • RULE_DETECTIONS
  • UPPERCASE
  • MACHINE_INTELLIGENCE
  • SECURITY_COMMAND_CENTER
  • UNSPECIFIED
  • SOAR_ALERT
  • VIRUS_TOTAL
enumDescriptions
  • Ingested and Normalized telemetry events
  • Ingested Raw telemetry
  • Chronicle Rules engine
  • Uppercase
  • DSML - Machine Intelligence
  • A normalized telemetry event from Google Security Command Center.
  • Unspecified Namespace
  • An alert coming from other SIEMs via Chronicle SOAR.
  • VirusTotal.
typestring
threatName
descriptionA vendor-assigned classification common across multiple customers (for example, "W32/File-A", "Slammer"). This field is not populated when the SecurityResult appears in a finding (a detection or alert).
typestring
threatStatus
descriptionCurrent status of the threat This field is not populated when the SecurityResult appears in a finding (a detection or alert).
enum
  • THREAT_STATUS_UNSPECIFIED
  • ACTIVE
  • CLEARED
  • FALSE_POSITIVE
enumDescriptions
  • Default threat status
  • Active threat.
  • Cleared threat.
  • False positive.
typestring
threatVerdict
descriptionGCTI threat verdict on the security result entity. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
enum
  • THREAT_VERDICT_UNSPECIFIED
  • UNDETECTED
  • SUSPICIOUS
  • MALICIOUS
enumDescriptions
  • Unspecified threat verdict level.
  • Undetected threat verdict level.
  • Suspicious threat verdict level.
  • Malicious threat verdict level.
typestring
urlBackToProduct
descriptionURL that takes the user to the source product console for this event. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
typestring
variables
additionalProperties
$refFindingVariable
descriptionA list of outcomes and match variables that represent the results of this security finding. This list represents a mapping of names of the requested outcomes or match variables, to their values. This is only populated when the SecurityResult appears in a finding (a detection or alert).
typeobject
verdict
$refVerdict
deprecatedTrue
descriptionVerdict about the IoC from the provider. This field is now deprecated. Use VerdictInfo instead.
verdictInfo
descriptionVerdict information about the IoC from the provider. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
items
$refVerdictInfo
typearray
typeobject
Server
descriptionTransport Layer Security (TLS) information associated with the server (for example, Certificate or JA3 hash).
idServer
properties
certificate
$refCertificate
descriptionServer certificate.
ja3s
descriptionJA3 hash from the TLS ServerHello, as a hex-encoded string.
typestring
typeobject
Severity
descriptionSeverity represents the severity level of the rule.
idSeverity
properties
displayName
descriptionThe display name of the severity level. Extracted from the meta section of the rule text.
typestring
typeobject
SignatureInfo
descriptionFile signature information extracted from different tools.
idSignatureInfo
properties
codesign
$refFileMetadataCodesign
descriptionSignature information extracted from the codesign utility.
sigcheck
$refFileMetadataSignatureInfo
descriptionSignature information extracted from the sigcheck tool.
typeobject
SignerInfo
descriptionFile metadata related to the signer information.
idSignerInfo
properties
certIssuer
descriptionCompany that issued the certificate.
typestring
name
descriptionCommon name of the signers/certificate. The order of the signers matters. Each element is a higher level authority, the last being the root authority.
typestring
status
descriptionIt can say "Valid" or state the problem with the certificate if any (e.g. "This certificate or one of the certificates in the certificate chain is not time valid.").
typestring
validUsage
descriptionIndicates which situations the certificate is valid for (e.g. "Code Signing").
typestring
typeobject
Smtp
descriptionSMTP info. See RFC 2821.
idSmtp
properties
helo
descriptionThe client's 'HELO'/'EHLO' string.
typestring
isTls
descriptionIf the connection switched to TLS.
typeboolean
isWebmail
descriptionIf the message was sent via a webmail client.
typeboolean
mailFrom
descriptionThe client's 'MAIL FROM' string.
typestring
messagePath
descriptionThe message's path (extracted from the headers).
typestring
rcptTo
descriptionThe client's 'RCPT TO' string(s).
items
typestring
typearray
serverResponse
descriptionThe server's response(s) to the client.
items
typestring
typearray
typeobject
SoarAlertMetadata
descriptionMetadata fields of alerts coming from other SIEM systems.
idSoarAlertMetadata
properties
alertId
descriptionAlert ID in the source SIEM system.
typestring
product
descriptionName of the product the alert is coming from.
typestring
sourceRule
descriptionName of the rule triggering the alert in the source SIEM.
typestring
sourceSystem
descriptionName of the Source SIEM system.
typestring
sourceSystemTicketId
descriptionTicket id for the alert in the source system.
typestring
sourceSystemUri
descriptionUrl to the source SIEM system.
typestring
vendor
descriptionName of the vendor.
typestring
typeobject
Software
descriptionInformation about a software package or application.
idSoftware
properties
description
descriptionThe description of the software.
typestring
name
descriptionThe name of the software.
typestring
permissions
descriptionSystem permissions granted to the software. For example, "android.permission.WRITE_EXTERNAL_STORAGE"
items
$refPermission
typearray
vendorName
descriptionThe name of the software vendor.
typestring
version
descriptionThe version of the software.
typestring
typeobject
Source
descriptionDeprecated. Information about the threat intelligence source. These fields are used to model Mandiant sources.
idSource
properties
benignCount
descriptionCount of responses where this IoC was marked benign.
formatint32
typeinteger
maliciousCount
descriptionCount of responses where this IoC was marked malicious.
formatint32
typeinteger
name
descriptionName of the IoC source.
typestring
quality
descriptionQuality of the IoC mapping extracted from the source.
enum
  • UNKNOWN_CONFIDENCE
  • LOW_CONFIDENCE
  • MEDIUM_CONFIDENCE
  • HIGH_CONFIDENCE
enumDescriptions
  • The default confidence level.
  • Low confidence.
  • Medium confidence.
  • High confidence.
typestring
responseCount
descriptionTotal response count from this source.
formatint32
typeinteger
sourceCount
descriptionNumber of sources from which intelligence was extracted.
formatint32
typeinteger
threatIntelligenceSources
descriptionDifferent threat intelligence sources from which IoC info was extracted.
items
$refSource
typearray
typeobject
Status
descriptionThe `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors).
idStatus
properties
code
descriptionThe status code, which should be an enum value of google.rpc.Code.
formatint32
typeinteger
details
descriptionA list of messages that carry the error details. There is a common set of message types for APIs to use.
items
additionalProperties
descriptionProperties of the object. Contains field @type with type URL.
typeany
typeobject
typearray
message
descriptionA developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
typestring
typeobject
StringSequence
descriptionStringSequence represents a sequence of string.
idStringSequence
properties
stringVals
descriptionstring sequence.
items
typestring
typearray
typeobject
StringToInt64MapEntry
idStringToInt64MapEntry
properties
key
descriptionKey field.
typestring
value
descriptionValue field.
formatint64
typestring
typeobject
StringValue
idStringValue
properties
displayValue
typestring
rawValue
typestring
typeobject
StringValues
idStringValues
properties
values
items
$refStringValue
typearray
typeobject
Subject
descriptionSubject data.
idSubject
properties
commonName
descriptionCN: CommonName.
typestring
countryName
descriptionC: Country name.
typestring
locality
descriptionL: Locality.
typestring
organization
descriptionO: Organization.
typestring
organizationalUnit
descriptionOU: OrganizationalUnit.
typestring
stateOrProvinceName
descriptionST: StateOrProvinceName.
typestring
typeobject
Tactic
descriptionTactic information related to an attack or threat.
idTactic
properties
id
descriptionTactic ID (e.g. "TA0043").
typestring
name
descriptionTactic Name (e.g. "Reconnaissance")
typestring
typeobject
Tags
descriptionTags are event metadata which is set by examining event contents post-parsing. For example, a UDM event may be assigned a tenant_id based on certain customer-defined parameters.
idTags
properties
dataTapConfigName
descriptionA list of sink name values defined in DataTap configurations.
items
typestring
typearray
tenantId
descriptionA list of subtenant ids that this event belongs to.
items
formatbyte
typestring
typearray
typeobject
Technique
descriptionTechnique information related to an attack or threat.
idTechnique
properties
id
descriptionTechnique ID (e.g. "T1595").
typestring
name
descriptionTechnique Name (e.g. "Active Scanning").
typestring
subtechniqueId
descriptionSubtechnique ID (e.g. "T1595.001").
typestring
subtechniqueName
descriptionSubtechnique Name (e.g. "Scanning IP Blocks").
typestring
typeobject
TimeOff
descriptionSystem record for leave/time-off from a Human Capital Management (HCM) system.
idTimeOff
properties
description
descriptionDescription of the leave if available (e.g. 'Vacation').
typestring
interval
$refInterval
descriptionInterval duration of the leave.
typeobject
Tls
descriptionTransport Layer Security (TLS) information.
idTls
properties
cipher
descriptionCipher used during the connection.
typestring
client
$refClient
descriptionCertificate information for the client certificate.
curve
descriptionElliptical curve used for a given cipher.
typestring
established
descriptionIndicates whether the TLS negotiation was successful.
typeboolean
nextProtocol
descriptionProtocol to be used for tunnel.
typestring
resumed
descriptionIndicates whether the TLS connection was resumed from a previous TLS negotiation.
typeboolean
server
$refServer
descriptionCertificate information for the server certificate.
version
descriptionTLS version.
typestring
versionProtocol
descriptionProtocol.
typestring
typeobject
Tracker
descriptionURL Tracker.
idTracker
properties
id
descriptionTracker ID, if available.
typestring
timestamp
descriptionTracker ingestion date.
formatgoogle-datetime
typestring
tracker
descriptionTracker name.
typestring
url
descriptionTracker script URL.
typestring
typeobject
Tunnels
descriptionVPN tunnels.
idTunnels
properties
provider
descriptionThe provider of the VPN tunnels being used.
typestring
type
descriptionThe type of the VPN tunnels.
typestring
typeobject
UDM
descriptionA Unified Data Model event.
idUDM
properties
about
descriptionRepresents entities referenced by the event that are not otherwise described in principal, src, target, intermediary or observer. For example, it could be used to track email file attachments, domains/URLs/IPs embedded within an email body, and DLLs that are loaded during a PROCESS_LAUNCH event.
items
$refNoun
typearray
additional
additionalProperties
descriptionProperties of the object.
typeany
descriptionAny important vendor-specific event data that cannot be adequately represented within the formal sections of the UDM model.
typeobject
extensions
$refExtensions
descriptionAll other first-class, event-specific metadata goes in this message. Do not place protocol metadata in Extensions; put it in Network.
extracted
additionalProperties
descriptionProperties of the object.
typeany
descriptionFlattened fields extracted from the log.
typeobject
intermediary
descriptionRepresents details on one or more intermediate entities processing activity described in the event. This includes device details about a proxy server or SMTP relay server. If an active event (that has a principal and possibly target) passes through any intermediaries, they're added here. Intermediaries can impact the overall action, for example blocking or modifying an ongoing request. A rule of thumb here is that 'principal', 'target', and description of the initial action should be the same regardless of the intermediary or its action. A successful network connection from A->B should look the same in principal/target/intermediary as one blocked by firewall C: principal: A, target: B (intermediary: C).
items
$refNoun
typearray
metadata
$refMetadata
descriptionEvent metadata such as timestamp, source product, etc.
network
$refNetwork
descriptionAll network details go here, including sub-messages with details on each protocol (for example, DHCP, DNS, or HTTP).
observer
$refNoun
descriptionRepresents an observer entity (for example, a packet sniffer or network-based vulnerability scanner), which is not a direct intermediary, but which observes and reports on the event in question.
principal
$refNoun
descriptionRepresents the acting entity that originates the activity described in the event. The principal must include at least one machine detail (hostname, MACs, IPs, port, product-specific identifiers like an EDR asset ID) or user detail (for example, username), and optionally include process details. It must NOT include any of the following fields: email, files, registry keys or values.
securityResult
descriptionA list of security results.
items
$refSecurityResult
typearray
src
$refNoun
descriptionRepresents a source entity being acted upon by the participant along with the device or process context for the source object (the machine where the source object resides). For example, if user U copies file A on machine X to file B on machine Y, both file A and machine X would be specified in the src portion of the UDM event.
target
$refNoun
descriptionRepresents a target entity being referenced by the event or an object on the target entity. For example, in a firewall connection from device A to device B, A is described as the principal and B is described as the target. For a process injection by process C into target process D, process C is described as the principal and process D is described as the target.
typeobject
UdmColumnList
idUdmColumnList
properties
values
items
$refUdmColumnValue
typearray
typeobject
UdmColumnType
idUdmColumnType
properties
list
$refUdmColumnList
value
$refUdmColumnValue
typeobject
UdmColumnValue
idUdmColumnValue
properties
boolVal
typeboolean
bytesVal
formatbyte
typestring
dateVal
$refDate
doubleVal
formatdouble
typenumber
int64Val
formatint64
typestring
nullVal
typeboolean
protoVal
additionalProperties
descriptionProperties of the object. Contains field @type with type URL.
typeany
typeobject
stringVal
typestring
timestampVal
formatgoogle-datetime
typestring
uint64Val
formatuint64
typestring
typeobject
UdmEventInfo
idUdmEventInfo
properties
alertNumber
formatint32
typeinteger
annotations
items
enum
  • ANNOTATION_UNSPECIFIED
  • ANNOTATION_ALERT
enumDescriptions
typestring
typearray
chip
$refChip
deprecatedTrue
connectedComponentLabel
descriptionOptional.
formatbyte
typestring
datatableRowInfo
items
$refSearchDataTableRowInfo
typearray
detections
items
$refCollection
typearray
displayName
deprecatedTrue
typestring
entity
$refBackstoryEntity
event
$refUDM
eventLogToken
typestring
filterProperties
$refFilterProperties
deprecatedTrue
outcomes
items
$refUdmColumnType
typearray
tenantId
descriptionOptional.
typestring
uid
formatbyte
typestring
typeobject
UdmEventList
idUdmEventList
properties
columnNames
$refColumnNames
complete
typeboolean
datatableInfo
items
$refSearchDataTableInfo
typearray
events
items
$refUdmEventInfo
typearray
progress
formatdouble
typenumber
tooManyEvents
typeboolean
typeobject
UdmFieldAggregation
idUdmFieldAggregation
properties
aggregationType
enum
  • UNSPECIFIED_FIELD_AGGREGATION_TYPE
  • UDM_FIELD_AGGREGATION_TYPE
  • ENTITY_FIELD_AGGREGATION_TYPE
enumDescriptions
typestring
allValues
items
$refUdmValueCount
typearray
baselineEventCount
formatint32
typeinteger
bottomValues
items
$refUdmValueCount
typearray
eventCount
formatint32
typeinteger
fieldName
typestring
tooManyValues
typeboolean
topValues
items
$refUdmValueCount
typearray
valueCount
formatint32
typeinteger
typeobject
UdmFieldAggregations
idUdmFieldAggregations
properties
complete
typeboolean
fields
items
$refUdmFieldAggregation
typearray
groupByFields
items
$refGroupAggregationByField
typearray
typeobject
UdmFieldValue
idUdmFieldValue
properties
boolValue
typeboolean
bytesValue
formatbyte
typestring
doubleValue
formatdouble
typenumber
enumValue
typestring
floatValue
formatfloat
typenumber
int32Value
formatint32
typeinteger
int64Value
formatint64
typestring
isNull
typeboolean
stringValue
typestring
timestampValue
formatgoogle-datetime
typestring
uint32Value
formatuint32
typeinteger
uint64Value
formatuint64
typestring
typeobject
UdmPrevalence
idUdmPrevalence
properties
artifacts
items
$refFieldAndValue
typearray
prevalence
formatint32
typeinteger
typeobject
UdmPrevalenceBucket
idUdmPrevalenceBucket
properties
prevalence
items
$refUdmPrevalence
typearray
typeobject
UdmPrevalenceResponse
idUdmPrevalenceResponse
properties
buckets
items
$refUdmPrevalenceBucket
typearray
partialPrevalence
typeboolean
typeobject
UdmSearchOperationMetadata
descriptionInformation about a UDM Search operation. This message is used to populate the `metadata` field of `Operation` resources created by UDM Search.
idUdmSearchOperationMetadata
properties
baselineEventsCount
descriptionThe number of events matching the baseline query so far.
formatint32
typeinteger
baselineQuery
descriptionQuery used to search for events.
typestring
baselineTimeRange
$refInterval
descriptionThe time range used for the baseline query [inclusive start time, exclusive end time).
caseInsensitive
descriptionIf true, the search was performed in a case-insensitive manner.
typeboolean
endTime
descriptionThe end time of the operation, if done.
formatgoogle-datetime
typestring
expireTime
descriptionThe time when the operation results expire. This time may change while the operation is in progress. If unset, the results never expire.
formatgoogle-datetime
typestring
filteredEventsCount
descriptionThe number of events matching the snapshot query so far. This is <= `baseline_events_count`. If the snapshot query is empty, this will be equal to `baseline_events_count`.
formatint32
typeinteger
progress
descriptionA value from 0 to 1 representing the progress of the operation.
formatdouble
typenumber
snapshotQuery
descriptionQuery used to filter the baseline query's events.
typestring
snapshotTimeRange
$refInterval
descriptionTime range used to filter the baseline query's events [inclusive start time, exclusive end time). This time range is completely within `baseline_time_range`. If not set, it is assumed to match `baseline_time_range`.
startTime
descriptionThe start time of the operation.
formatgoogle-datetime
typestring
statsRowsCount
descriptionThe total number of rows returned for a stats query.
formatint32
typeinteger
typeobject
UdmValueCount
idUdmValueCount
properties
baselineEventCount
formatint32
typeinteger
eventCount
formatint32
typeinteger
value
$refUdmFieldValue
typeobject
Uint64Sequence
descriptionUint64Sequence represents a sequence of uint64s.
idUint64Sequence
properties
uint64Vals
descriptionuint64 sequence.
items
formatuint64
typestring
typearray
typeobject
Url
descriptionUrl.
idUrl
properties
categories
descriptionCategorisation done by VirusTotal partners.
items
typestring
typearray
favicon
$refFavicon
descriptionDifference hash and MD5 hash of the URL's.
htmlMeta
additionalProperties
descriptionProperties of the object.
typeany
descriptionMeta tags (only for URLs downloading HTML).
typeobject
lastFinalUrl
descriptionIf the original URL redirects, where does it end.
typestring
lastHttpResponseCode
descriptionHTTP response code of the last response.
formatint32
typeinteger
lastHttpResponseContentLength
descriptionLength in bytes of the content received.
formatint64
typestring
lastHttpResponseContentSha256
descriptionURL response body's SHA256 hash.
typestring
lastHttpResponseCookies
additionalProperties
descriptionProperties of the object.
typeany
descriptionWebsite's cookies.
typeobject
lastHttpResponseHeaders
additionalProperties
descriptionProperties of the object.
typeany
descriptionHeaders and values of the last HTTP response.
typeobject
tags
descriptionTags.
items
typestring
typearray
title
descriptionWebpage title.
typestring
trackers
descriptionTrackers found in the URL in a historical manner.
items
$refTracker
typearray
url
descriptionURL.
typestring
typeobject
User
descriptionInformation about a user.
idUser
properties
accountExpirationTime
descriptionUser account expiration timestamp.
formatgoogle-datetime
typestring
accountLockoutTime
descriptionUser account lockout timestamp.
formatgoogle-datetime
typestring
accountType
descriptionType of user account (for example, service, domain, or cloud). This is somewhat aligned to: https://attack.mitre.org/techniques/T1078/
enum
  • ACCOUNT_TYPE_UNSPECIFIED
  • DOMAIN_ACCOUNT_TYPE
  • LOCAL_ACCOUNT_TYPE
  • CLOUD_ACCOUNT_TYPE
  • SERVICE_ACCOUNT_TYPE
  • DEFAULT_ACCOUNT_TYPE
enumDescriptions
  • Default user account type.
  • A human account part of some domain in directory services.
  • A local machine account.
  • A SaaS service account type (such as Slack or GitHub).
  • A non-human account for data access.
  • A system built in default account.
typestring
attribute
$refAttribute
descriptionGeneric entity metadata attributes of the user.
companyName
descriptionUser job company name.
typestring
department
descriptionUser job department
items
typestring
typearray
emailAddresses
descriptionEmail addresses of the user. This field can be used as an entity indicator for user entities.
items
typestring
typearray
employeeId
descriptionHuman capital management identifier. This field can be used as an entity indicator for user entities.
typestring
firstName
descriptionFirst name of the user (e.g. "John").
typestring
firstSeenTime
descriptionThe first observed time for a user. The value is calculated on the basis of the first time the identifier was observed.
formatgoogle-datetime
typestring
groupIdentifiers
descriptionProduct object identifiers of the group(s) the user belongs to A vendor-specific identifier to uniquely identify the group(s) the user belongs to (a GUID, LDAP OID, or similar).
items
typestring
typearray
groupid
deprecatedTrue
descriptionThe ID of the group that the user belongs to. Deprecated in favor of the repeated group_identifiers field.
typestring
hireDate
descriptionUser job employment hire date.
formatgoogle-datetime
typestring
lastBadPasswordAttemptTime
descriptionUser last bad password attempt timestamp.
formatgoogle-datetime
typestring
lastLoginTime
descriptionUser last login timestamp.
formatgoogle-datetime
typestring
lastName
descriptionLast name of the user (e.g. "Locke").
typestring
lastPasswordChangeTime
descriptionUser last password change timestamp.
formatgoogle-datetime
typestring
managers
descriptionUser job manager(s).
items
$refUser
typearray
middleName
descriptionMiddle name of the user.
typestring
officeAddress
$refLocation
descriptionUser job office location.
passwordExpirationTime
descriptionUser password expiration timestamp.
formatgoogle-datetime
typestring
personalAddress
$refLocation
descriptionPersonal address of the user.
phoneNumbers
descriptionPhone numbers for the user.
items
typestring
typearray
productObjectId
descriptionA vendor-specific identifier to uniquely identify the entity (e.g. a GUID, LDAP, OID, or similar). This field can be used as an entity indicator for user entities.
typestring
roleDescription
deprecatedTrue
descriptionSystem role description for user. Deprecated: use attribute.roles.
typestring
roleName
deprecatedTrue
descriptionSystem role name for user. Deprecated: use attribute.roles.
typestring
terminationDate
descriptionUser job employment termination date.
formatgoogle-datetime
typestring
timeOff
descriptionUser time off leaves from active work.
items
$refTimeOff
typearray
title
descriptionUser job title.
typestring
userAuthenticationStatus
descriptionSystem authentication status for user.
enum
  • UNKNOWN_AUTHENTICATION_STATUS
  • ACTIVE
  • SUSPENDED
  • NO_ACTIVE_CREDENTIALS
  • DELETED
enumDescriptions
  • The default authentication status.
  • The authentication method is in active state.
  • The authentication method is in suspended/disabled state.
  • The authentication method has no active credentials.
  • The authentication method has been deleted.
typestring
userDisplayName
descriptionThe display name of the user (e.g. "John Locke").
typestring
userRole
deprecatedTrue
descriptionSystem role for user. Deprecated: use attribute.roles.
enum
  • UNKNOWN_ROLE
  • ADMINISTRATOR
  • SERVICE_ACCOUNT
enumDeprecated
  • False
  • False
  • True
enumDescriptions
  • Default user role.
  • Product administrator with elevated privileges.
  • System service account for automated privilege access. Deprecated: not a role, instead set User.account_type.
typestring
userid
descriptionThe ID of the user. This field can be used as an entity indicator for user entities.
typestring
windowsSid
descriptionThe Microsoft Windows SID of the user. This field can be used as an entity indicator for user entities.
typestring
typeobject
UserAgentProto
idUserAgentProto
properties
annotation
items
$refAnnotation
typearray
browser
descriptionProduct brand within the family: Firefox, Netscape, Camino etc.. Or Earth, Windows-Media-Player etc.. for non-browser user agents.
typestring
browserEngineVersion
descriptionVersion of the rendering engine e.g. "8.01" for "Opera/8.01"
typestring
browserVersion
descriptionMinor and lower versions unavailable with reduced User-Agent and no client hints (go/ua-reduction-ua-string-reference).
typestring
carrier
descriptionMobile specific: name of mobile carrier
typestring
device
description(Usually) Mobile specific: name of hardware device, may or may not contain the full model name. e.g. iPhone, Palm750, SPH-M800. Reduced to "K" for Android devices with reduced User-Agent and no client hints (go/ua-reduction-ua-string-reference).
typestring
deviceVersion
description(Usually) Mobile specific: version of hardware device Unavailable with reduced User-Agent and no client hints (go/ua-reduction-ua-string-reference).
typestring
family
descriptionUser agent family captures the type of browser/app at a high-level e.g. MSIE, Gecko, Safari etc..
enum
  • USER_DEFINED
  • MSIE
  • GECKO
  • APPLEWEBKIT
  • OPERA
  • KHTML
  • OTHER
  • APPLE
  • BLACKBERRY
  • DOCOMO
  • GOOGLE
  • OPENWAVE
  • POLARIS
  • OBIGO
  • TELECA
  • MICROSOFT
  • NOKIA
  • NETFRONT
  • SEMC
  • SMIT
  • KOREAN
  • CLIENT_HINTS
enumDescriptions
  • Used to represent new families supported by user-defined parsers
  • Desktop user agent families
  • WebKit based browsers e.g. Safari
  • e.g. Konqueror
  • Mobile and non-browser user agent families UA's w/o enough data to fit into a family
  • Apple apps e.g. YouTube on iPhone
  • Google Earth, Sketchup, UpdateChecker etc...
  • UP.Browser
  • Windows Media Player, RSS platform etc...
  • Sony Ericsson Mobile Communications
  • SKT, LGT
  • Constructed from UA-CH instead of UserAgent string.
typestring
googleToolbarVersion
descriptionVersion number of GoogleToolbar, if installed. Applies only to MSIE and Firefox at this time.
typestring
javaConfiguration
descriptionMobile specific: e.g. Configuration/CLDC-1.1
typestring
javaConfigurationVersion
typestring
javaProfile
descriptionMobile specific: e.g. Profile/MIDP-2.0
typestring
javaProfileVersion
typestring
locale
descriptionLocale in which the browser is running as country code and optionally language pair. Unavailable with reduced User-Agent and no client hints (go/ua-reduction-ua-string-reference).
typestring
messaging
descriptionMobile specific: e.g. MMP/2.0
typestring
messagingVersion
typestring
os
descriptionFull name of the operating system e.g. "Darwin/9.7.0", "Android 1.5", "Windows 98" Version is reduced, and other data might also be missing, for reduced User-Agent and no client hints (go/ua-reduction-ua-string-reference).
typestring
osVariant
descriptionExtra qualifier for the OS e.g. "(i386)", "Build/CUPCAKE", "PalmSource/Palm-D061" Unavailable with reduced User-Agent and no client hints (go/ua-reduction-ua-string-reference).
typestring
platform
descriptionThe platform describes the environment in which the browser or app runs. For desktop user agents, Platform is a string describing the OS family e.g. Windows, Macintosh, Linux. For mobile user agents, Platform either describes the OS family (if available) or the hardware maker. e.g. Linux, or HTC, LG, Palm.
typestring
security
descriptionSecurity level reported by user agent, either U, I or N. Unavailable with reduced User-Agent and no client hints (go/ua-reduction-ua-string-reference).
typestring
subFamily
descriptionSub-family identifies individual regexps when a family has more than 1. This is used to generate the right UA string from a protobuf. Examples in the AppleWebKit family: Chrome and Safari. Can also be an arbitrary identifier.
typestring
typeobject
UserError
descriptionThis message exists solely to get the `UserErrorReason` enum to appear in the service discovery document.
idUserError
properties
reason
descriptionThe reason for a specific error that should be shown to the app user.
enum
  • USER_ERROR_REASON_UNSPECIFIED
  • RULE_REFERENCES_OUT_OF_SCOPE
  • RULE_ARCHIVED
  • RULE_STALE_VERSION
  • RULE_ACTIVE
  • RULE_RETROHUNT_RUNNING
  • RULE_LIVE
  • RULE_ALREADY_DISABLED
  • EXPENSIVE_RULE_LARGE_WINDOW
  • RULE_LIMITED_PAUSED
  • REFERENCE_LIST_NOT_FOUND
  • UEBA_RULES_NO_SCOPE
  • RULE_TESTING_INTERVAL_TOO_SHORT
  • SEARCH_CSV_FIELDS_NOT_SUPPORTED
  • INVALID_ARGUMENT_FOR_DASHBOARD_FILTER
  • INVALID_CONFIG_FOR_DASHBOARD_IMPORT
  • RETROHUNT_LIMIT_REACHED
enumDescriptions
  • Do not use this default value.
  • The rule text references resources, such as reference lists, that are out of scope for the rule. Example of an ErrorInfo for this reason: { "reason": "RULE_REFERENCES_OUT_OF_SCOPE", "domain": "chronicle.googleapis.com", "metadata": { "reference_lists": "list_name1,list_name2,list_name3,", } }
  • The rule being operated on (saving or setting run frequency) is archived, and so the operation can't be done.
  • The rule version being operated on is not the latest, and so the operation can't be done.
  • The rule can't be archived because it is live (detecting) and a retrohunt is running.
  • The rule can't be archived because a retrohunt is running against it.
  • The rule can't be archived because it is live (detecting).
  • The rule can't be disabled because is is already disabled.
  • The rule's match time window is too large for its current run frequency.
  • The rule can't be enabled because it has been limited or paused because of high resource use.
  • The list being referred to doesn't exist.
  • UEBA rules may not be assigned a data access scope.
  • The rule's match window is longer than the time range it's being tested over. Returns the match window duration and testing interval duration as metadata labeled `match_window_duration` and `testing_interval_duration`, formatted as Go durations. Example ErrorInfo: { "reason": "RULE_TESTING_INTERVAL_TOO_SHORT", "domain": "chronicle.googleapis.com", "metadata": { "match_window_duration": "24h", "testing_interval_duration": "12h", } }
  • The CSV fields are not supported for download. Returns the unsupported fields as metadata labeled `unsupported_fields`. Example ErrorInfo: { "reason": "SEARCH_CSV_FIELDS_NOT_SUPPORTED", "domain": "chronicle.googleapis.com", "metadata": { "unsupported_fields": "udm.about.security_result.variables,udm.network.http.parsed_user_agent.family", } }
  • Invalid argument for dashboard chart filters. Returns the filter name, filter value, operator, and expected type as metadata labeled `filter_name`, `filter_value`, `operator`, and `expected_type`, respectively. Example ErrorInfo: { "reason": "INVALID_ARGUMENT_FOR_DASHBOARD_FILTER", "domain": "chronicle.googleapis.com", "metadata": { "filter_name": "filter_name", "filter_value": "filter_value", "operater": "operator", "expected_type": "expected_type", } }
  • Invalid config for dashboard import. Example ErrorInfo: { "reason": "INVALID_CONFIG_FOR_DASHBOARD_IMPORT", "domain": "chronicle.googleapis.com", }
  • The user has reached the limit of retrohunts that can be run. Returns the retrohunt limit as metadata labeled `retrohunt_limit`. Example ErrorInfo: { "reason": "RETROHUNT_LIMIT_REACHED", "domain": "chronicle.googleapis.com", "metadata": { "retrohunt_limit": "10", } }
typestring
typeobject
Validity
descriptionDefines certificate's validity period.
idValidity
properties
expiryTime
descriptionExpiry date.
formatgoogle-datetime
typestring
issueTime
descriptionIssue date.
formatgoogle-datetime
typestring
typeobject
Verdict
descriptionDeprecated. Encapsulates the threat verdict provided by human analysts and ML models. These fields are used to model Mandiant sources.
idVerdict
properties
analystVerdict
$refAnalystVerdict
descriptionHuman analyst verdict provided by sources like Mandiant.
neighbourInfluence
descriptionDescribes the neighbour influence of the verdict.
typestring
responseCount
descriptionTotal response count across all sources.
formatint32
typeinteger
sourceCount
descriptionNumber of sources from which intelligence was extracted.
formatint32
typeinteger
verdict
$refProviderMLVerdict
descriptionML Verdict provided by sources like Mandiant.
typeobject
VerdictInfo
descriptionDescribes the threat verdict provided by human analysts and machine learning models. These fields are used to model Mandiant sources.
idVerdictInfo
properties
benignCount
descriptionCount of responses where this IoC was marked as benign.
formatint32
typeinteger
categoryDetails
descriptionTags related to the verdict.
typestring
confidenceScore
descriptionConfidence score of the verdict.
formatint32
typeinteger
globalCustomerCount
descriptionGlobal customer count over the last 30 days
formatint32
typeinteger
globalHitsCount
descriptionGlobal hit count over the last 30 days.
formatint32
typeinteger
iocStats
descriptionList of IoCStats from which the verdict was generated.
items
$refIoCStats
typearray
maliciousCount
descriptionCount of responses where this IoC was marked as malicious.
formatint32
typeinteger
neighbourInfluence
descriptionDescribes the near neighbor influence of the verdict.
typestring
pwn
descriptionWhether one or more Mandiant incident response customers had this indicator in their environment.
typeboolean
pwnFirstTaggedTime
descriptionThe timestamp of the first time a pwn was associated to this entity.
formatgoogle-datetime
typestring
responseCount
descriptionTotal response count across all sources.
formatint32
typeinteger
sourceCount
descriptionNumber of sources from which intelligence was extracted.
formatint32
typeinteger
sourceProvider
descriptionSource provider giving the machine learning verdict.
typestring
verdictResponse
descriptionDetails about the verdict.
enum
  • VERDICT_RESPONSE_UNSPECIFIED
  • MALICIOUS
  • BENIGN
enumDescriptions
  • The default verdict response type.
  • VerdictResponse resulted a threat as malicious.
  • VerdictResponse resulted a threat as benign.
typestring
verdictTime
descriptionTimestamp when the verdict was generated.
formatgoogle-datetime
typestring
verdictType
descriptionType of verdict.
enum
  • VERDICT_TYPE_UNSPECIFIED
  • PROVIDER_ML_VERDICT
  • ANALYST_VERDICT
enumDescriptions
  • Verdict category not specified.
  • MLVerdict result provided from threat providers, like Mandiant. These fields are used to model Mandiant sources.
  • Verdict provided by the human analyst. These fields are used to model Mandiant sources.
typestring
typeobject
Vulnerabilities
descriptionThe Vulnerabilities extension captures details on observed/detected vulnerabilities.
idVulnerabilities
properties
vulnerabilities
descriptionA list of vulnerabilities.
items
$refVulnerability
typearray
typeobject
Vulnerability
descriptionA vulnerability.
idVulnerability
properties
about
$refNoun
descriptionIf the vulnerability is about a specific noun (e.g. executable), then add it here.
cveDescription
descriptionCommon Vulnerabilities and Exposures Description. https://cve.mitre.org/about/faqs.html#what_is_cve_record
typestring
cveId
descriptionCommon Vulnerabilities and Exposures Id. https://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures https://cve.mitre.org/about/faqs.html#what_is_cve_id
typestring
cvssBaseScore
descriptionCVSS Base Score in the range of 0.0 to 10.0. Useful for sorting.
formatfloat
typenumber
cvssVector
descriptionVector of CVSS properties (e.g. "AV:L/AC:H/Au:N/C:N/I:P/A:C") Can be linked to via: https://nvd.nist.gov/vuln-metrics/cvss/v2-calculator
typestring
cvssVersion
descriptionVersion of CVSS Vector/Score.
typestring
description
descriptionDescription of the vulnerability.
typestring
firstFound
descriptionProducts that maintain a history of vuln scans should populate first_found with the time that a scan first detected the vulnerability on this asset.
formatgoogle-datetime
typestring
lastFound
descriptionProducts that maintain a history of vuln scans should populate last_found with the time that a scan last detected the vulnerability on this asset.
formatgoogle-datetime
typestring
name
descriptionName of the vulnerability (e.g. "Unsupported OS Version detected").
typestring
scanEndTime
descriptionIf the vulnerability was discovered during an asset scan, then this field should be populated with the time the scan ended. This field can be left unset if the end time is not available or not applicable.
formatgoogle-datetime
typestring
scanStartTime
descriptionIf the vulnerability was discovered during an asset scan, then this field should be populated with the time the scan started. This field can be left unset if the start time is not available or not applicable.
formatgoogle-datetime
typestring
severity
descriptionThe severity of the vulnerability.
enum
  • UNKNOWN_SEVERITY
  • LOW
  • MEDIUM
  • HIGH
  • CRITICAL
enumDescriptions
  • The default severity level.
  • Low severity.
  • Medium severity.
  • High severity.
  • Critical severity.
typestring
severityDetails
descriptionVendor-specific severity
typestring
vendor
descriptionVendor of scan that discovered vulnerability.
typestring
vendorKnowledgeBaseArticleId
descriptionVendor specific knowledge base article (e.g. "KBXXXXXX" from Microsoft). https://en.wikipedia.org/wiki/Microsoft_Knowledge_Base https://access.redhat.com/knowledgebase
typestring
vendorVulnerabilityId
descriptionVendor specific vulnerability id (e.g. Microsoft security bulletin id).
typestring
typeobject
Watchlist
descriptionA watchlist is a list of entities that allows for bulk operations over the included entities.
idWatchlist
properties
createTime
descriptionOutput only. Time the watchlist was created.
formatgoogle-datetime
readOnlyTrue
typestring
description
descriptionOptional. Description of the watchlist.
typestring
displayName
descriptionRequired. Display name of the watchlist. Note that it must be at least one character and less than 63 characters (https://google.aip.dev/148).
typestring
entityCount
$refEntityCount
descriptionOutput only. Entity count in the watchlist.
readOnlyTrue
entityPopulationMechanism
$refEntityPopulationMechanism
descriptionRequired. Mechanism to populate entities in the watchlist.
multiplyingFactor
descriptionOptional. Weight applied to the risk score for entities in this watchlist. The default is 1.0 if it is not specified.
formatfloat
typenumber
name
descriptionIdentifier. Resource name of the watchlist. Format: projects/{project}/locations/{location}/instances/{instance}/watchlists/{watchlist}
typestring
updateTime
descriptionOutput only. Time the watchlist was last updated.
formatgoogle-datetime
readOnlyTrue
typestring
watchlistUserPreferences
$refWatchlistUserPreferences
descriptionOptional. User preferences for watchlist configuration.
typeobject
WatchlistUserPreferences
descriptionA collection of user preferences for watchlist UI configuration.
idWatchlistUserPreferences
properties
pinned
descriptionOptional. Whether the watchlist is pinned on the dashboard.
typeboolean
typeobject
X509
descriptionFile certificate.
idX509
properties
algorithm
descriptionCertificate algorithm.
typestring
certIssuer
descriptionIssuer of the certificate.
typestring
name
descriptionCertificate name.
typestring
serialNumber
descriptionCertificate serial number.
typestring
thumbprint
descriptionCertificate thumbprint.
typestring
typeobject
old_value
CancelOperationRequest
descriptionThe request message for Operations.CancelOperation.
idCancelOperationRequest
properties
typeobject
CompilationDiagnostic
descriptionCompilationDiagnostic represents a compilation diagnostic generated during a rule's compilation, such as a compilation error or a compilation warning.
idCompilationDiagnostic
properties
message
descriptionOutput only. The diagnostic message.
readOnlyTrue
typestring
position
$refCompilationPosition
descriptionOutput only. The approximate position in the rule text associated with the compilation diagnostic. Compilation Position may be empty.
readOnlyTrue
severity
descriptionOutput only. The severity of a rule's compilation diagnostic.
enum
  • SEVERITY_UNSPECIFIED
  • WARNING
  • ERROR
enumDescriptions
  • An unspecified severity level.
  • A compilation warning.
  • A compilation error.
readOnlyTrue
typestring
uri
descriptionOutput only. Link to documentation that describes a diagnostic in more detail.
readOnlyTrue
typestring
typeobject
CompilationPosition
descriptionCompilationPosition represents the location of a compilation diagnostic in rule text.
idCompilationPosition
properties
endColumn
descriptionOutput only. End column number, beginning at 1.
formatint32
readOnlyTrue
typeinteger
endLine
descriptionOutput only. End line number, beginning at 1.
formatint32
readOnlyTrue
typeinteger
startColumn
descriptionOutput only. Start column number, beginning at 1.
formatint32
readOnlyTrue
typeinteger
startLine
descriptionOutput only. Start line number, beginning at 1.
formatint32
readOnlyTrue
typeinteger
typeobject
CreateParserExtensionMetadata
descriptionOperation metadata for creating a parser extension.
idCreateParserExtensionMetadata
properties
state
descriptionThe state of the parser extension creation process.
enum
  • STATE_UNSPECIFIED
  • NEW
  • VALIDATING
  • LIVE
  • REJECTED
  • INTERNAL_ERROR
  • VALIDATED
  • ARCHIVED
enumDescriptions
  • The state for this parser extension was not specified.
  • The parser extension has been newly submitted and is waiting to be validated.
  • The parser extension is currently going through the validation pipeline.
  • The parser extension is live in production. Only configs that have successfully passed the validation stage will be set to LIVE.
  • Validation completed, but the parser extension was rejected with errors.
  • An error occurred when processing this parser extension.
  • Extension is validated.
  • Extension is archived and is no more being used.
typestring
stateLastChangedTime
descriptionThe time the config state was last changed.
formatgoogle-datetime
typestring
validationErrors
descriptionAny validation error while validating the extension, this have cap of size 10
items
typestring
typearray
validationReport
descriptionThe validation report generated during validation of the parser extension.
typestring
typeobject
CreateParserMetadata
descriptionOperation metadata for creating a parser.
idCreateParserMetadata
properties
stage
descriptionThe validation stage of the parser creation process.
enum
  • VALIDATION_STAGE_UNSPECIFIED
  • NEW
  • VALIDATING
  • PASSED
  • FAILED
  • DELETE_CANDIDATE
enumDescriptions
  • The validation stage is not specified.
  • The custom parser is submitted for validation.
  • The custom parser is currently going through the validation pipeline
  • The custom parser has successfully passed the validation.
  • The custom parser has failed validation.
  • The parser is no good, It is available for auto deletion.
typestring
validationReport
descriptionThe validation report generated during validation of the parser.
typestring
typeobject
DataAccessLabel
descriptionA DataAccessLabel is a label on events to define user access to data.
idDataAccessLabel
properties
author
descriptionOutput only. The user who created the data access label.
readOnlyTrue
typestring
createTime
descriptionOutput only. The time at which the data access label was created.
formatgoogle-datetime
readOnlyTrue
typestring
description
descriptionOptional. A description of the data access label for a human reader.
typestring
displayName
descriptionOutput only. The short name displayed for the label as it appears on event data.
readOnlyTrue
typestring
lastEditor
descriptionOutput only. The user who last updated the data access label.
readOnlyTrue
typestring
name
descriptionRequired. The unique resource name of the data access label.
typestring
udmQuery
descriptionA UDM query over event data.
typestring
updateTime
descriptionOutput only. The time at which the data access label was last updated.
formatgoogle-datetime
readOnlyTrue
typestring
typeobject
DataAccessLabelReference
descriptionReference object to a data access label.
idDataAccessLabelReference
properties
assetNamespace
descriptionThe asset namespace configured in the forwarder of the customer's events.
typestring
dataAccessLabel
descriptionThe name of the data access label.
typestring
displayName
descriptionOutput only. The display name of the label. Data access label and log types's name will match the display name of the resource. The asset namespace will match the namespace itself. The ingestion key value pair will match the key of the tuple.
readOnlyTrue
typestring
ingestionLabel
$refIngestionLabel
descriptionThe ingestion label configured in the forwarder of the customer's events.
logType
descriptionThe name of the log type.
typestring
typeobject
DataAccessScope
descriptionA DataAccessScope is a boolean expression of data access labels used to restrict access to data for users.
idDataAccessScope
properties
allowAll
descriptionOptional. Whether or not the scope allows all labels, allow_all and allowed_data_access_labels are mutually exclusive and one of them must be present. denied_data_access_labels can still be used along with allow_all. When combined with denied_data_access_labels, access will be granted to all data that doesn't have labels mentioned in denied_data_access_labels. E.g.: A customer with scope with denied labels A and B and allow_all will be able to see all data except data labeled with A and data labeled with B and data with labels A and B.
typeboolean
allowedDataAccessLabels
descriptionOptional. The allowed labels for the scope. Either allow_all or allowed_data_access_labels needs to be provided. When provided, there has to be at least one label allowed for the scope to be valid. The logical operator for evaluation of the allowed labels is OR. E.g.: A customer with scope with allowed labels A and B will be able to see data with labeled with A or B or (A and B).
items
$refDataAccessLabelReference
typearray
author
descriptionOutput only. The user who created the data access scope.
readOnlyTrue
typestring
createTime
descriptionOutput only. The time at which the data access scope was created.
formatgoogle-datetime
readOnlyTrue
typestring
deniedDataAccessLabels
descriptionOptional. The denied labels for the scope. The logical operator for evaluation of the denied labels is AND. E.g.: A customer with scope with denied labels A and B won't be able to see data labeled with A and data labeled with B and data with labels A and B.
items
$refDataAccessLabelReference
typearray
description
descriptionOptional. A description of the data access scope for a human reader.
typestring
displayName
descriptionOutput only. The name to be used for display to customers of the data access scope.
readOnlyTrue
typestring
lastEditor
descriptionOutput only. The user who last updated the data access scope.
readOnlyTrue
typestring
name
descriptionRequired. The unique full name of the data access scope. The name should comply with https://google.aip.dev/122 standards.
typestring
updateTime
descriptionOutput only. The time at which the data access scope was last updated.
formatgoogle-datetime
readOnlyTrue
typestring
typeobject
Empty
descriptionA generic empty message that you can re-use to avoid defining duplicated empty messages in your APIs. A typical example is to use it as the request or the response type of an API method. For instance: service Foo { rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty); }
idEmpty
properties
typeobject
EntityCount
descriptionCount of different types of entities in the watchlist.
idEntityCount
properties
asset
descriptionOutput only. Count of asset type entities in the watchlist.
formatint32
readOnlyTrue
typeinteger
user
descriptionOutput only. Count of user type entities in the watchlist.
formatint32
readOnlyTrue
typeinteger
typeobject
EntityPopulationMechanism
descriptionMechanism to populate entities in the watchlist.
idEntityPopulationMechanism
properties
manual
$refManual
descriptionOptional. Entities are added manually.
typeobject
IngestionLabel
descriptionRepresentation of an ingestion label type.
idIngestionLabel
properties
ingestionLabelKey
descriptionRequired. The key of the ingestion label. Always required.
typestring
ingestionLabelValue
descriptionOptional. The value of the ingestion label. Optional. An object with no provided value and some key provided would match against the given key and ANY value.
typestring
typeobject
InputsUsed
descriptionInputsUsed is a convenience field that tells us which sources of events (if any) were used in the rule. NEXT TAG: 4
idInputsUsed
properties
usesDetection
descriptionOptional. Whether the rule queries detections.
typeboolean
usesEntity
descriptionOptional. Whether the rule queries entity events.
typeboolean
usesUdm
descriptionOptional. Whether the rule queries UDM events.
typeboolean
typeobject
Instance
descriptionA Instance represents an instantiation of the Instance product.
idInstance
properties
name
descriptionOutput only. The resource name of this instance. Format: projects/{project}/locations/{region}/instances/{instance}
readOnlyTrue
typestring
typeobject
Interval
descriptionRepresents a time interval, encoded as a Timestamp start (inclusive) and a Timestamp end (exclusive). The start must be less than or equal to the end. When the start equals the end, the interval is empty (matches no time). When both start and end are unspecified, the interval matches any time.
idInterval
properties
endTime
descriptionOptional. Exclusive end of the interval. If specified, a Timestamp matching this interval will have to be before the end.
formatgoogle-datetime
typestring
startTime
descriptionOptional. Inclusive start of the interval. If specified, a Timestamp matching this interval will have to be the same or after the start.
formatgoogle-datetime
typestring
typeobject
ListDataAccessLabelsResponse
descriptionResponse message for ListDataAccessLabels.
idListDataAccessLabelsResponse
properties
dataAccessLabels
descriptionList of data access labels.
items
$refDataAccessLabel
typearray
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
typeobject
ListDataAccessScopesResponse
descriptionResponse message for ListDataAccessScopes.
idListDataAccessScopesResponse
properties
dataAccessScopes
descriptionList of data access scopes.
items
$refDataAccessScope
typearray
globalDataAccessScopeGranted
descriptionWhether or not global scope is granted to the user.
typeboolean
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
typeobject
ListOperationsResponse
descriptionThe response message for Operations.ListOperations.
idListOperationsResponse
properties
nextPageToken
descriptionThe standard List next-page token.
typestring
operations
descriptionA list of operations that matches the specified filter in the request.
items
$refOperation
typearray
typeobject
ListReferenceListsResponse
descriptionA response to a request for a list of reference lists.
idListReferenceListsResponse
properties
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
referenceLists
descriptionThe reference lists. Ordered in ascending alphabetical order by name.
items
$refReferenceList
typearray
typeobject
ListRetrohuntsResponse
descriptionResponse message for ListRetrohunts method.
idListRetrohuntsResponse
properties
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
retrohunts
descriptionThe retrohunts from the specified rule.
items
$refRetrohunt
typearray
typeobject
ListRuleDeploymentsResponse
descriptionResponse message for ListRuleDeployments.
idListRuleDeploymentsResponse
properties
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
ruleDeployments
descriptionThe rule deployments from all rules.
items
$refRuleDeployment
typearray
typeobject
ListRuleRevisionsResponse
descriptionResponse message for ListRuleRevisions method.
idListRuleRevisionsResponse
properties
nextPageToken
descriptionA token that can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
rules
descriptionThe revisions of the rule.
items
$refRule
typearray
typeobject
ListRulesResponse
descriptionResponse message for ListRules method.
idListRulesResponse
properties
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
rules
descriptionThe rules from the specified instance.
items
$refRule
typearray
typeobject
ListWatchlistsResponse
descriptionResponse message for listing watchlists.
idListWatchlistsResponse
properties
nextPageToken
descriptionOptional. A token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
watchlists
descriptionOptional. The watchlists from the specified instance.
items
$refWatchlist
typearray
typeobject
Manual
descriptionEntities are added manually.
idManual
properties
typeobject
Operation
descriptionThis resource represents a long-running operation that is the result of a network API call.
idOperation
properties
done
descriptionIf the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available.
typeboolean
error
$refStatus
descriptionThe error result of the operation in case of failure or cancellation.
metadata
additionalProperties
descriptionProperties of the object. Contains field @type with type URL.
typeany
descriptionService-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any.
typeobject
name
descriptionThe server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`.
typestring
response
additionalProperties
descriptionProperties of the object. Contains field @type with type URL.
typeany
descriptionThe normal, successful response of the operation. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`.
typeobject
typeobject
ReferenceList
descriptionA reference list. Reference lists are user-defined lists of values which users can use in multiple Rules.
idReferenceList
properties
description
descriptionRequired. A user-provided description of the reference list.
typestring
displayName
descriptionOutput only. The unique display name of the reference list.
readOnlyTrue
typestring
entries
descriptionRequired. The entries of the reference list. When listed, they are returned in the order that was specified at creation or update. The combined size of the values of the reference list may not exceed 6MB. This is returned only when the view is REFERENCE_LIST_VIEW_FULL.
items
$refReferenceListEntry
typearray
name
descriptionOutput only. The resource name of the reference list. Format: projects/{project}/locations/{location}/instances/{instance}/referenceLists/{reference_list}
readOnlyTrue
typestring
revisionCreateTime
descriptionOutput only. The timestamp when the reference list was last updated.
formatgoogle-datetime
readOnlyTrue
typestring
ruleAssociationsCount
descriptionOutput only. The count of self-authored rules using the reference list.
formatint32
readOnlyTrue
typeinteger
rules
descriptionOutput only. The resource names for the associated self-authored Rules that use this reference list. This is returned only when the view is REFERENCE_LIST_VIEW_FULL.
items
typestring
readOnlyTrue
typearray
scopeInfo
$refScopeInfo
descriptionOutput only. The scope info of the reference list. During reference list creation, if this field is not set, the reference list without scopes (an unscoped list) will be created for an unscoped user. For a scoped user, this field must be set. During reference list update, if scope_info is requested to be updated, this field must be set.
readOnlyTrue
syntaxType
descriptionRequired. The syntax type indicating how list entries should be validated.
enum
  • REFERENCE_LIST_SYNTAX_TYPE_UNSPECIFIED
  • REFERENCE_LIST_SYNTAX_TYPE_PLAIN_TEXT_STRING
  • REFERENCE_LIST_SYNTAX_TYPE_REGEX
  • REFERENCE_LIST_SYNTAX_TYPE_CIDR
enumDescriptions
  • Defaults to REFERENCE_LIST_SYNTAX_TYPE_PLAIN_TEXT_STRING.
  • List contains plain text patterns.
  • List contains only Regular Expression patterns.
  • List contains only CIDR patterns.
typestring
typeobject
ReferenceListEntry
descriptionAn entry in a reference list.
idReferenceListEntry
properties
value
descriptionRequired. The value of the entry. Maximum length is 512 characters.
typestring
typeobject
ReferenceListScope
descriptionReferenceListScope specifies the list of scope names of the reference list.
idReferenceListScope
properties
scopeNames
descriptionOptional. The list of scope names of the reference list. The scope names should be full resource names and should be of the format: "projects/{project}/locations/{location}/instances/{instance}/dataAccessScopes/{scope_name}".
items
typestring
typearray
typeobject
Retrohunt
descriptionRetrohunt is an execution of a Rule over a time range in the past.
idRetrohunt
properties
executionInterval
$refInterval
descriptionOutput only. The start and end time of the retrohunt execution. If the retrohunt is not yet finished, the end time of the interval will not be populated.
readOnlyTrue
name
descriptionThe resource name of the retrohunt. Retrohunt is the child of a rule revision. {rule} in the format below is structured as {rule_id@revision_id}. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}/retrohunts/{retrohunt}
typestring
processInterval
$refInterval
descriptionRequired. The start and end time of the event time range this retrohunt processes.
progressPercentage
descriptionOutput only. Percent progress of the retrohunt towards completion, from 0.00 to 100.00.
formatfloat
readOnlyTrue
typenumber
state
descriptionOutput only. The state of the retrohunt.
enum
  • STATE_UNSPECIFIED
  • RUNNING
  • DONE
  • CANCELLED
  • FAILED
enumDescriptions
  • Unspecified or unknown retrohunt state.
  • Running state.
  • Done state.
  • Cancelled state.
  • Failed state.
readOnlyTrue
typestring
typeobject
RetrohuntMetadata
descriptionOperation Metadata for Retrohunts.
idRetrohuntMetadata
properties
executionInterval
$refInterval
descriptionThe start and end time of the retrohunt execution. If the retrohunt is not yet finished, the end time of the interval will not be filled.
progressPercentage
descriptionPercent progress of the retrohunt towards completion, from 0.00 to 100.00.
formatfloat
typenumber
retrohunt
descriptionThe name of the retrohunt. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}/retrohunts/{retrohunt}
typestring
typeobject
Rule
descriptionThe Rule resource represents a user-created rule. NEXT TAG: 21
idRule
properties
allowedRunFrequencies
descriptionOutput only. The run frequencies that are allowed for the rule. Populated in BASIC view and FULL view.
items
enum
  • RUN_FREQUENCY_UNSPECIFIED
  • LIVE
  • HOURLY
  • DAILY
enumDescriptions
  • The run frequency is unspecified/unknown.
  • Executes in real time.
  • Executes once per hour.
  • Executes once per day.
typestring
readOnlyTrue
typearray
author
descriptionOutput only. The author of the rule. Extracted from the meta section of text. Populated in BASIC view and FULL view.
readOnlyTrue
typestring
compilationDiagnostics
descriptionOutput only. A list of a rule's corresponding compilation diagnostic messages such as compilation errors and compilation warnings. Populated in FULL view.
items
$refCompilationDiagnostic
readOnlyTrue
typearray
compilationState
descriptionOutput only. The current compilation state of the rule. Populated in FULL view.
enum
  • COMPILATION_STATE_UNSPECIFIED
  • SUCCEEDED
  • FAILED
enumDescriptions
  • The compilation state is unspecified/unknown.
  • The Rule can successfully compile.
  • The Rule cannot successfully compile. This is possible if a backwards-incompatible change was made to the compiler.
readOnlyTrue
typestring
createTime
descriptionOutput only. The timestamp of when the rule was created. Populated in FULL view.
formatgoogle-datetime
readOnlyTrue
typestring
dataTables
descriptionOutput only. Resource names of the data tables used in this rule.
items
typestring
readOnlyTrue
typearray
displayName
descriptionOutput only. Display name of the rule. Populated in BASIC view and FULL view.
readOnlyTrue
typestring
etag
descriptionThe etag for this rule. If this is provided on update, the request will succeed if and only if it matches the server-computed value, and will fail with an ABORTED error otherwise. Populated in BASIC view and FULL view.
typestring
inputsUsed
$refInputsUsed
descriptionOutput only. The set of inputs used in the rule. For example, if the rule uses $e.principal.hostname, then the uses_udm field will be true.
readOnlyTrue
metadata
additionalProperties
typestring
descriptionOutput only. Additional metadata specified in the meta section of text. Populated in FULL view.
readOnlyTrue
typeobject
name
descriptionFull resource name for the rule. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}
typestring
nearRealTimeLiveRuleEligible
descriptionOutput only. Indicate the rule can run in near real time live rule. If this is true, the rule uses the near real time live rule when the run frequency is set to LIVE.
readOnlyTrue
typeboolean
referenceLists
descriptionOutput only. Resource names of the reference lists used in this rule. Populated in FULL view.
items
typestring
readOnlyTrue
typearray
revisionCreateTime
descriptionOutput only. The timestamp of when the rule revision was created. Populated in FULL, REVISION_METADATA_ONLY views.
formatgoogle-datetime
readOnlyTrue
typestring
revisionId
descriptionOutput only. The revision ID of the rule. A new revision is created whenever the rule text is changed in any way. Format: v_{10 digits}_{9 digits} Populated in REVISION_METADATA_ONLY view and FULL view.
readOnlyTrue
typestring
scope
descriptionResource name of the DataAccessScope bound to this rule. Populated in BASIC view and FULL view. If reference lists are used in the rule, validations will be performed against this scope to ensure that the reference lists are compatible with both the user's and the rule's scopes. The scope should be in the format: "projects/{project}/locations/{location}/instances/{instance}/dataAccessScopes/{scope}".
typestring
severity
$refSeverity
descriptionOutput only. The severity of the rule as specified in the meta section of text. Populated in BASIC view and FULL view.
readOnlyTrue
text
descriptionThe YARA-L content of the rule. Populated in FULL view.
typestring
type
descriptionOutput only. User-facing type of the rule. Extracted from the events section of rule text. Populated in BASIC view and FULL view.
enum
  • RULE_TYPE_UNSPECIFIED
  • SINGLE_EVENT
  • MULTI_EVENT
enumDescriptions
  • The rule type is unspecified/unknown.
  • Rule checks for the existence of a single event.
  • Rule checks for correlation between multiple events
readOnlyTrue
typestring
typeobject
RuleDeployment
descriptionThe RuleDeployment resource represents the deployment state of a Rule.
idRuleDeployment
properties
alerting
descriptionWhether detections resulting from this deployment should be considered alerts.
typeboolean
archiveTime
descriptionOutput only. The timestamp when the rule deployment archive state was last set to true. If the rule deployment's current archive state is not set to true, the field will be empty.
formatgoogle-datetime
readOnlyTrue
typestring
archived
descriptionThe archive state of the rule deployment. Cannot be set to true unless enabled is set to false. If set to true, alerting will automatically be set to false. If currently set to true, enabled, alerting, and run_frequency cannot be updated.
typeboolean
consumerRules
descriptionOutput only. The names of the associated/chained consumer rules. Rules are considered consumers of this rule if their rule text explicitly filters on this rule's ruleid. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}
items
typestring
readOnlyTrue
typearray
enabled
descriptionWhether the rule is currently deployed continuously against incoming data.
typeboolean
executionState
descriptionOutput only. The execution state of the rule deployment.
enum
  • EXECUTION_STATE_UNSPECIFIED
  • DEFAULT
  • LIMITED
  • PAUSED
enumDescriptions
  • Unspecified or unknown execution state.
  • Default execution state.
  • Rules in limited state may not have their executions guaranteed.
  • Paused rules are not executed at all.
readOnlyTrue
typestring
lastAlertStatusChangeTime
descriptionOutput only. The timestamp when the rule deployment alert state was lastly changed. This is filled regardless of the current alert state. E.g. if the current alert status is false, this timestamp will be the timestamp when the alert status was changed to false.
formatgoogle-datetime
readOnlyTrue
typestring
name
descriptionRequired. The resource name of the rule deployment. Note that RuleDeployment is a child of the overall Rule, not any individual revision, so the resource ID segment for the Rule resource must not reference a specific revision. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}/deployment
typestring
producerRules
descriptionOutput only. The names of the associated/chained producer rules. Rules are considered producers for this rule if this rule explicitly filters on their ruleid. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}
items
typestring
readOnlyTrue
typearray
runFrequency
descriptionThe run frequency of the rule deployment.
enum
  • RUN_FREQUENCY_UNSPECIFIED
  • LIVE
  • HOURLY
  • DAILY
enumDescriptions
  • The run frequency is unspecified/unknown.
  • Executes in real time.
  • Executes once per hour.
  • Executes once per day.
typestring
typeobject
ScopeInfo
descriptionScopeInfo specifies the scope info of the reference list.
idScopeInfo
properties
referenceListScope
$refReferenceListScope
descriptionRequired. The list of scope names of the reference list, if the list is empty the reference list is treated as unscoped.
typeobject
Severity
descriptionSeverity represents the severity level of the rule.
idSeverity
properties
displayName
descriptionThe display name of the severity level. Extracted from the meta section of the rule text.
typestring
typeobject
Status
descriptionThe `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors).
idStatus
properties
code
descriptionThe status code, which should be an enum value of google.rpc.Code.
formatint32
typeinteger
details
descriptionA list of messages that carry the error details. There is a common set of message types for APIs to use.
items
additionalProperties
descriptionProperties of the object. Contains field @type with type URL.
typeany
typeobject
typearray
message
descriptionA developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
typestring
typeobject
UdmSearchOperationMetadata
descriptionInformation about a UDM Search operation. This message is used to populate the `metadata` field of `Operation` resources created by UDM Search.
idUdmSearchOperationMetadata
properties
baselineEventsCount
descriptionThe number of events matching the baseline query so far.
formatint32
typeinteger
baselineQuery
descriptionQuery used to search for events.
typestring
baselineTimeRange
$refInterval
descriptionThe time range used for the baseline query [inclusive start time, exclusive end time).
caseInsensitive
descriptionIf true, the search was performed in a case-insensitive manner.
typeboolean
endTime
descriptionThe end time of the operation, if done.
formatgoogle-datetime
typestring
expireTime
descriptionThe time when the operation results expire. This time may change while the operation is in progress. If unset, the results never expire.
formatgoogle-datetime
typestring
filteredEventsCount
descriptionThe number of events matching the snapshot query so far. This is <= `baseline_events_count`. If the snapshot query is empty, this will be equal to `baseline_events_count`.
formatint32
typeinteger
progress
descriptionA value from 0 to 1 representing the progress of the operation.
formatdouble
typenumber
snapshotQuery
descriptionQuery used to filter the baseline query's events.
typestring
snapshotTimeRange
$refInterval
descriptionTime range used to filter the baseline query's events [inclusive start time, exclusive end time). This time range is completely within `baseline_time_range`. If not set, it is assumed to match `baseline_time_range`.
startTime
descriptionThe start time of the operation.
formatgoogle-datetime
typestring
statsRowsCount
descriptionThe total number of rows returned for a stats query.
formatint32
typeinteger
typeobject
UserError
descriptionThis message exists solely to get the `UserErrorReason` enum to appear in the service discovery document.
idUserError
properties
reason
descriptionThe reason for a specific error that should be shown to the app user.
enum
  • USER_ERROR_REASON_UNSPECIFIED
  • RULE_REFERENCES_OUT_OF_SCOPE
  • RULE_ARCHIVED
  • RULE_STALE_VERSION
  • RULE_ACTIVE
  • RULE_RETROHUNT_RUNNING
  • RULE_LIVE
  • RULE_ALREADY_DISABLED
  • EXPENSIVE_RULE_LARGE_WINDOW
  • RULE_LIMITED_PAUSED
  • REFERENCE_LIST_NOT_FOUND
  • UEBA_RULES_NO_SCOPE
  • RULE_TESTING_INTERVAL_TOO_SHORT
  • SEARCH_CSV_FIELDS_NOT_SUPPORTED
  • INVALID_ARGUMENT_FOR_DASHBOARD_FILTER
  • INVALID_CONFIG_FOR_DASHBOARD_IMPORT
  • RETROHUNT_LIMIT_REACHED
enumDescriptions
  • Do not use this default value.
  • The rule text references resources, such as reference lists, that are out of scope for the rule. Example of an ErrorInfo for this reason: { "reason": "RULE_REFERENCES_OUT_OF_SCOPE", "domain": "chronicle.googleapis.com", "metadata": { "reference_lists": "list_name1,list_name2,list_name3,", } }
  • The rule being operated on (saving or setting run frequency) is archived, and so the operation can't be done.
  • The rule version being operated on is not the latest, and so the operation can't be done.
  • The rule can't be archived because it is live (detecting) and a retrohunt is running.
  • The rule can't be archived because a retrohunt is running against it.
  • The rule can't be archived because it is live (detecting).
  • The rule can't be disabled because is is already disabled.
  • The rule's match time window is too large for its current run frequency.
  • The rule can't be enabled because it has been limited or paused because of high resource use.
  • The list being referred to doesn't exist.
  • UEBA rules may not be assigned a data access scope.
  • The rule's match window is longer than the time range it's being tested over. Returns the match window duration and testing interval duration as metadata labeled `match_window_duration` and `testing_interval_duration`, formatted as Go durations. Example ErrorInfo: { "reason": "RULE_TESTING_INTERVAL_TOO_SHORT", "domain": "chronicle.googleapis.com", "metadata": { "match_window_duration": "24h", "testing_interval_duration": "12h", } }
  • The CSV fields are not supported for download. Returns the unsupported fields as metadata labeled `unsupported_fields`. Example ErrorInfo: { "reason": "SEARCH_CSV_FIELDS_NOT_SUPPORTED", "domain": "chronicle.googleapis.com", "metadata": { "unsupported_fields": "udm.about.security_result.variables,udm.network.http.parsed_user_agent.family", } }
  • Invalid argument for dashboard chart filters. Returns the filter name, filter value, operator, and expected type as metadata labeled `filter_name`, `filter_value`, `operator`, and `expected_type`, respectively. Example ErrorInfo: { "reason": "INVALID_ARGUMENT_FOR_DASHBOARD_FILTER", "domain": "chronicle.googleapis.com", "metadata": { "filter_name": "filter_name", "filter_value": "filter_value", "operater": "operator", "expected_type": "expected_type", } }
  • Invalid config for dashboard import. Example ErrorInfo: { "reason": "INVALID_CONFIG_FOR_DASHBOARD_IMPORT", "domain": "chronicle.googleapis.com", }
  • The user has reached the limit of retrohunts that can be run. Returns the retrohunt limit as metadata labeled `retrohunt_limit`. Example ErrorInfo: { "reason": "RETROHUNT_LIMIT_REACHED", "domain": "chronicle.googleapis.com", "metadata": { "retrohunt_limit": "10", } }
typestring
typeobject
Watchlist
descriptionA watchlist is a list of entities that allows for bulk operations over the included entities.
idWatchlist
properties
createTime
descriptionOutput only. Time the watchlist was created.
formatgoogle-datetime
readOnlyTrue
typestring
description
descriptionOptional. Description of the watchlist.
typestring
displayName
descriptionRequired. Display name of the watchlist. Note that it must be at least one character and less than 63 characters (https://google.aip.dev/148).
typestring
entityCount
$refEntityCount
descriptionOutput only. Entity count in the watchlist.
readOnlyTrue
entityPopulationMechanism
$refEntityPopulationMechanism
descriptionRequired. Mechanism to populate entities in the watchlist.
multiplyingFactor
descriptionOptional. Weight applied to the risk score for entities in this watchlist. The default is 1.0 if it is not specified.
formatfloat
typenumber
name
descriptionIdentifier. Resource name of the watchlist. Format: projects/{project}/locations/{location}/instances/{instance}/watchlists/{watchlist}
typestring
updateTime
descriptionOutput only. Time the watchlist was last updated.
formatgoogle-datetime
readOnlyTrue
typestring
watchlistUserPreferences
$refWatchlistUserPreferences
descriptionOptional. User preferences for watchlist configuration.
typeobject
WatchlistUserPreferences
descriptionA collection of user preferences for watchlist UI configuration.
idWatchlistUserPreferences
properties
pinned
descriptionOptional. Whether the watchlist is pinned on the dashboard.
typeboolean
typeobject
prod/us-chronicle-v1alpha
dictionary_item_added
  • root['resources']['projects']['resources']['locations']['resources']['instances']['methods']['delete']
  • root['resources']['projects']['resources']['locations']['resources']['instances']['methods']['undelete']
  • root['resources']['projects']['resources']['locations']['resources']['instances']['resources']['legacy']['methods']['legacyCreateOrUpdateCase']
  • root['resources']['projects']['resources']['locations']['resources']['instances']['resources']['legacy']['methods']['legacyCreateSoarAlert']
  • root['schemas']['GoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStats']
  • root['schemas']['GoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnData']
  • root['schemas']['GoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnSort']
  • root['schemas']['GoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnType']
  • root['schemas']['GoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnTypeList']
  • root['schemas']['GoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnValue']
  • root['schemas']['GoogleCloudStorageEventDrivenSettings']
  • root['schemas']['InstanceUdmSearchResponse']
  • root['schemas']['LegacyCreateOrUpdateCaseRequest']
  • root['schemas']['LegacyCreateSoarAlertRequest']
  • root['schemas']['LegacyFederatedUdmSearchViewResponse']
  • root['schemas']['LegacySoarAlert']
  • root['schemas']['SQSV2AccessKeySecretAuth']
  • root['schemas']['SoarEvent']
  • root['schemas']['UndeleteInstanceRequest']
  • root['schemas']['BackstoryFile']['properties']['symhash']
  • root['schemas']['ColumnMetadata']['properties']['latitude']
  • root['schemas']['ColumnMetadata']['properties']['longitude']
  • root['schemas']['EntityRisk']['properties']['riskWindowHasNewDetections']
  • root['schemas']['Extensions']['properties']['entityRisk']
  • root['schemas']['FeedDetails']['properties']['googleCloudStorageEventDrivenSettings']
  • root['schemas']['Instance']['properties']['customerCode']
  • root['schemas']['Instance']['properties']['deleteTime']
  • root['schemas']['Instance']['properties']['purgeTime']
  • root['schemas']['Instance']['properties']['wipeoutStatus']
  • root['schemas']['SQSAuthV2']['properties']['sqsV2AccessKeySecretAuth']
dictionary_item_removed
  • root['resources']['projects']['resources']['locations']['resources']['instances']['resources']['findings']
  • root['schemas']['FetchSimilarFindingsResponse']
  • root['schemas']['OmniflowAmazonS3Settings']
  • root['schemas']['OmniflowAmazonSQSSettings']
  • root['schemas']['OmniflowGoogleCloudStorageSettings']
  • root['schemas']['OmniflowS3Auth']
  • root['schemas']['FeedDetails']['properties']['omniflowAmazonS3Settings']
  • root['schemas']['FeedDetails']['properties']['omniflowAmazonSqsSettings']
  • root['schemas']['FeedDetails']['properties']['omniflowGcsSettings']
  • root['schemas']['FeedDetails']['properties']['feedSourceType']['enumDeprecated']
  • root['schemas']['FeedSourceTypeSchema']['properties']['feedSourceType']['enumDeprecated']
  • root['schemas']['PackLogType']['properties']['recommendedSourceType']['enumDeprecated']
values_changed
root['resources']['projects']['resources']['locations']['resources']['instances']['methods']['generateCollectionAgentAuth']['parameters']['name']['description']
new_valueRequired. The name of the chronicle instance to generate a collection agent auth json file for. Format: projects/{project_id}/locations/{location}/instances/{instance}
old_valueRequired. The name of the chronicle instance to generate a collection agent auth json file for. Format: projects/{project_id}/locations/{region}/instances/{instance}
root['resources']['projects']['resources']['locations']['resources']['instances']['methods']['generateSoarAuthJwt']['parameters']['name']['description']
new_valueRequired. The name of the chronicle instance to retrieve a report for. Format: projects/{project_id}/locations/{location}/instances/{instance}
old_valueRequired. The name of the chronicle instance to retrieve a report for. Format: projects/{project_id}/locations/{region}/instances/{instance}
root['resources']['projects']['resources']['locations']['resources']['instances']['methods']['generateWorkspaceConnectionToken']['parameters']['name']['description']
new_valueRequired. The name of the chronicle instance to create workspace token for. Format: projects/{project_id}/locations/{location}/instances/{instance}
old_valueRequired. The name of the chronicle instance to create workspace token for. Format: projects/{project_id}/locations/{region}/instances/{instance}
root['resources']['projects']['resources']['locations']['resources']['instances']['methods']['get']['parameters']['name']['description']
new_valueRequired. The name of the instance to retrieve. Format: projects/{project_id}/locations/{location}/instances/{instance}
old_valueRequired. The name of the instance to retrieve. Format: projects/{project_id}/locations/{region}/instances/{instance}
root['resources']['projects']['resources']['locations']['resources']['instances']['methods']['report']['parameters']['name']['description']
new_valueRequired. The name of the chronicle instance to retrieve a report for. Format: projects/{project_id}/locations/{location}/instances/{instance}
old_valueRequired. The name of the chronicle instance to retrieve a report for. Format: projects/{project_id}/locations/{region}/instances/{instance}
root['resources']['projects']['resources']['locations']['resources']['instances']['resources']['legacy']['methods']['legacyBatchGetCases']['parameters']['instance']['description']
new_valueRequired. Chronicle instance this request is sent to. Format: projects/{project}/locations/{location}/instances/{instance}/legacy
old_valueChronicle instance this request is sent to. Format: projects/{project}/locations/{location}/instances/{instance}/legacy
root['revision']
new_value20250310
old_value20250227
root['schemas']['EntityRisk']['description']
new_valueStores information related to the risk score of an entity. Next ID: 15
old_valueStores information related to the risk score of an entity. Next ID: 14
root['schemas']['EntityRisk']['properties']['riskWindowSize']['description']
new_valueRisk window duration for the entity.
old_valueRisk window duration for the Entity.
root['schemas']['Instance']['properties']['name']['description']
new_valueOutput only. The resource name of this instance. Format: projects/{project}/locations/{location}/instances/{instance}
old_valueOutput only. The resource name of this instance. Format: projects/{project}/locations/{region}/instances/{instance}
root['schemas']['SQSAuthV2']['properties']['additionalS3AccessKeySecretAuth']['description']
new_valueRequired. Deprecated. If the S3 objects referred to by the SQS queue require different auth info other than the SQS auth, that can be specified here. Additional S3AccessKeySecret. Required.
old_valueRequired. If the S3 objects referred to by the SQS queue require different auth info other than the SQS auth, that can be specified here. Additional S3AccessKeySecret. Required.
root['schemas']['StatusProto']['properties']['canonicalCode']['description']
new_valuecopybara:strip_begin(b/383363683) copybara:strip_end_and_replace optional int32 canonical_code = 6;
old_valueThe canonical error code (see codes.proto) that most closely corresponds to this status. This may be missing, and in the common case of the generic space, it definitely will be. copybara:strip_begin(b/383363683) copybara:strip_end_and_replace optional int32 canonical_code = 6;
root['schemas']['StatusProto']['properties']['space']['description']
new_valuecopybara:strip_begin(b/383363683) Space to which this status belongs copybara:strip_end_and_replace optional string space = 2; // Space to which this status belongs
old_valueThe following are usually only present when code != 0 Space to which this status belongs copybara:strip_begin(b/383363683) copybara:strip_end_and_replace optional string space = 2;
iterable_item_added
root['schemas']['AnalyticValue']['properties']['eventType']['enum'][103]ENTITY_RISK_CHANGE
root['schemas']['AnalyticValue']['properties']['eventType']['enumDescriptions'][103]An update to an entity risk score. This event type is restricted to events published by Google Securit Operations Risk Analytics.
root['schemas']['EnrichmentDisablementTarget']['properties']['eventType']['enum'][103]ENTITY_RISK_CHANGE
root['schemas']['EnrichmentDisablementTarget']['properties']['eventType']['enumDescriptions'][103]An update to an entity risk score. This event type is restricted to events published by Google Securit Operations Risk Analytics.
root['schemas']['EventTypesSuggestion']['properties']['eventType']['enum'][103]ENTITY_RISK_CHANGE
root['schemas']['EventTypesSuggestion']['properties']['eventType']['enumDescriptions'][103]An update to an entity risk score. This event type is restricted to events published by Google Securit Operations Risk Analytics.
root['schemas']['FeedDetails']['properties']['feedSourceType']['enum'][19]GOOGLE_CLOUD_STORAGE_EVENT_DRIVEN
root['schemas']['FeedDetails']['properties']['feedSourceType']['enumDescriptions'][19]Google Cloud Storage Feed backed by Omniflow STS driven by pubsub events.
root['schemas']['FeedSourceTypeSchema']['properties']['feedSourceType']['enum'][19]GOOGLE_CLOUD_STORAGE_EVENT_DRIVEN
root['schemas']['FeedSourceTypeSchema']['properties']['feedSourceType']['enumDescriptions'][19]Google Cloud Storage Feed backed by Omniflow STS driven by pubsub events.
root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][1412]BLOCKDAEMON_METOMIC
root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][2124]JIT
root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][2125]PROCORE
root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][2126]HP_INC_MFP
root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][2127]MERU_CONTENTKEEPER_PROXY
root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][2128]KPMG_JAPAN_HR
root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][2129]FORD_ADFS_IDP
root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][2130]FORD_BLUE_DNS
root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][2131]TSA_VMS
root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][2132]ALLIANZ_CPAM
root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][2133]HKBK_ASE1_DIGITALGUARDIAN_NDLP
root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][2134]PANORAYS
root['schemas']['IoCDiscoveryInfo']['properties']['logType']['enum'][2135]BBVA_BAEMPRE
root['schemas']['Metadata']['properties']['eventType']['enum'][103]ENTITY_RISK_CHANGE
root['schemas']['Metadata']['properties']['eventType']['enumDescriptions'][103]An update to an entity risk score. This event type is restricted to events published by Google Securit Operations Risk Analytics.
root['schemas']['PackLogType']['properties']['recommendedSourceType']['enum'][19]GOOGLE_CLOUD_STORAGE_EVENT_DRIVEN
root['schemas']['PackLogType']['properties']['recommendedSourceType']['enumDescriptions'][19]Google Cloud Storage Feed backed by Omniflow STS driven by pubsub events.
root['schemas']['RawLog']['properties']['type']['enum'][1412]BLOCKDAEMON_METOMIC
root['schemas']['RawLog']['properties']['type']['enum'][2124]JIT
root['schemas']['RawLog']['properties']['type']['enum'][2125]PROCORE
root['schemas']['RawLog']['properties']['type']['enum'][2126]HP_INC_MFP
root['schemas']['RawLog']['properties']['type']['enum'][2127]MERU_CONTENTKEEPER_PROXY
root['schemas']['RawLog']['properties']['type']['enum'][2128]KPMG_JAPAN_HR
root['schemas']['RawLog']['properties']['type']['enum'][2129]FORD_ADFS_IDP
root['schemas']['RawLog']['properties']['type']['enum'][2130]FORD_BLUE_DNS
root['schemas']['RawLog']['properties']['type']['enum'][2131]TSA_VMS
root['schemas']['RawLog']['properties']['type']['enum'][2132]ALLIANZ_CPAM
root['schemas']['RawLog']['properties']['type']['enum'][2133]HKBK_ASE1_DIGITALGUARDIAN_NDLP
root['schemas']['RawLog']['properties']['type']['enum'][2134]PANORAYS
root['schemas']['RawLog']['properties']['type']['enum'][2135]BBVA_BAEMPRE
root['schemas']['RawLogEventInformation']['properties']['eventType']['enum'][103]ENTITY_RISK_CHANGE
root['schemas']['RawLogEventInformation']['properties']['eventType']['enumDescriptions'][103]An update to an entity risk score. This event type is restricted to events published by Google Securit Operations Risk Analytics.
root['schemas']['SIEventData']['properties']['rawLogType']['enum'][1412]BLOCKDAEMON_METOMIC
root['schemas']['SIEventData']['properties']['rawLogType']['enum'][2124]JIT
root['schemas']['SIEventData']['properties']['rawLogType']['enum'][2125]PROCORE
root['schemas']['SIEventData']['properties']['rawLogType']['enum'][2126]HP_INC_MFP
root['schemas']['SIEventData']['properties']['rawLogType']['enum'][2127]MERU_CONTENTKEEPER_PROXY
root['schemas']['SIEventData']['properties']['rawLogType']['enum'][2128]KPMG_JAPAN_HR
root['schemas']['SIEventData']['properties']['rawLogType']['enum'][2129]FORD_ADFS_IDP
root['schemas']['SIEventData']['properties']['rawLogType']['enum'][2130]FORD_BLUE_DNS
root['schemas']['SIEventData']['properties']['rawLogType']['enum'][2131]TSA_VMS
root['schemas']['SIEventData']['properties']['rawLogType']['enum'][2132]ALLIANZ_CPAM
root['schemas']['SIEventData']['properties']['rawLogType']['enum'][2133]HKBK_ASE1_DIGITALGUARDIAN_NDLP
root['schemas']['SIEventData']['properties']['rawLogType']['enum'][2134]PANORAYS
root['schemas']['SIEventData']['properties']['rawLogType']['enum'][2135]BBVA_BAEMPRE
iterable_item_removed
root['schemas']['FeedDetails']['properties']['feedSourceType']['enum'][14]OMNIFLOW_GOOGLE_CLOUD_STORAGE
root['schemas']['FeedDetails']['properties']['feedSourceType']['enum'][15]OMNIFLOW_AMAZON_S3
root['schemas']['FeedDetails']['properties']['feedSourceType']['enum'][16]OMNIFLOW_AMAZON_SQS
root['schemas']['FeedDetails']['properties']['feedSourceType']['enumDescriptions'][14]
root['schemas']['FeedSourceTypeSchema']['properties']['feedSourceType']['enum'][14]OMNIFLOW_GOOGLE_CLOUD_STORAGE
root['schemas']['FeedSourceTypeSchema']['properties']['feedSourceType']['enum'][15]OMNIFLOW_AMAZON_S3
root['schemas']['FeedSourceTypeSchema']['properties']['feedSourceType']['enum'][16]OMNIFLOW_AMAZON_SQS
root['schemas']['FeedSourceTypeSchema']['properties']['feedSourceType']['enumDescriptions'][14]
root['schemas']['PackLogType']['properties']['recommendedSourceType']['enum'][14]OMNIFLOW_GOOGLE_CLOUD_STORAGE
root['schemas']['PackLogType']['properties']['recommendedSourceType']['enum'][15]OMNIFLOW_AMAZON_S3
root['schemas']['PackLogType']['properties']['recommendedSourceType']['enum'][16]OMNIFLOW_AMAZON_SQS
root['schemas']['PackLogType']['properties']['recommendedSourceType']['enumDescriptions'][14]
prod/us-chronicle-v1beta
values_changed
root['resources']['projects']['resources']['locations']['resources']['instances']['methods']['get']['parameters']['name']['description']
new_valueRequired. The name of the instance to retrieve. Format: projects/{project_id}/locations/{location}/instances/{instance}
old_valueRequired. The name of the instance to retrieve. Format: projects/{project_id}/locations/{region}/instances/{instance}
root['revision']
new_value20250310
old_value20250227
root['schemas']
new_value
AIOverview
descriptionAI generated overview for the search results.
idAIOverview
properties
aiSummary
descriptionAI summary for the search results. Markdown formatted.
typestring
complete
descriptionWhether AI overview generation is complete.
typeboolean
suggestions
descriptionSuggested actions to continue the investigation in chat.
items
$refAction
typearray
typeobject
Action
descriptionAction represents an action that can be performed in the host UI.
idAction
properties
actionType
descriptionOutput only. Type of action.
enum
  • ACTION_TYPE_UNSPECIFIED
  • FOLLOW_UP
  • NAVIGATION
  • EXECUTION
enumDescriptions
  • The action type is unspecified.
  • The action is a follow up action.
  • The action is a navigation action.
  • The action is an execution action.
readOnlyTrue
typestring
displayText
descriptionOutput only. The text that'll be displayed to the user if this is rendered in the UI as a suggested action.
readOnlyTrue
typestring
execution
$refExecution
descriptionMetadata for execution action.
followUp
$refFollowUp
descriptionMetadata for follow up action.
navigation
$refNavigation
descriptionMetadata for navigation action.
useCaseId
descriptionOutput only. The use case ID of the action. It's used internally to identify in which context the action is used.
readOnlyTrue
typestring
typeobject
AlertFieldAggregation
idAlertFieldAggregation
properties
alertCount
formatint32
typeinteger
allValues
items
$refAlertFieldValueCount
typearray
baselineAlertCount
formatint32
typeinteger
bottomValues
items
$refAlertFieldValueCount
typearray
fieldName
typestring
tooManyValues
typeboolean
topValues
items
$refAlertFieldValueCount
typearray
valueCount
formatint32
typeinteger
typeobject
AlertFieldAggregations
idAlertFieldAggregations
properties
fields
items
$refAlertFieldAggregation
typearray
typeobject
AlertFieldValue
idAlertFieldValue
properties
boolValue
typeboolean
bytesValue
formatbyte
typestring
doubleValue
formatdouble
typenumber
enumValue
typestring
floatValue
formatfloat
typenumber
int32Value
formatint32
typeinteger
int64Value
formatint64
typestring
stringValue
typestring
uint32Value
formatuint32
typeinteger
uint64Value
formatuint64
typestring
typeobject
AlertFieldValueCount
idAlertFieldValueCount
properties
alertCount
formatint32
typeinteger
baselineAlertCount
formatint32
typeinteger
value
$refAlertFieldValue
typeobject
AnalystVerdict
descriptionVerdict provided by the human analyst. These fields are used to model Mandiant sources.
idAnalystVerdict
properties
confidenceScore
descriptionConfidence score of the verdict.
formatint32
typeinteger
verdictResponse
descriptionDetails of the verdict.
enum
  • VERDICT_RESPONSE_UNSPECIFIED
  • MALICIOUS
  • BENIGN
enumDescriptions
  • The default verdict response type.
  • VerdictResponse resulted a threat as malicious.
  • VerdictResponse resulted a threat as benign.
typestring
verdictTime
descriptionTimestamp at which the verdict was generated.
formatgoogle-datetime
typestring
typeobject
AnalyticsMetadata
descriptionStores information about an analytics metric used in a rule.
idAnalyticsMetadata
properties
analytic
descriptionName of the analytic.
typestring
typeobject
Annotation
descriptionExtra parameters that don't fit anywhere else, captured as key/value. For example "VendorID/42" in BlackBerry user agents. The following keys are modified with reduced User-Agent and no client hints (go/ua-reduction-ua-string-reference): * "Chrome" (see `browser_version`) * "ChromiumBrowser" (unavailable) * "ChromeWebview" (unavailable) * "OS_VERSION" (see `os`) * "Rest" (unavailable) * "misc" (see `device`)
idAnnotation
properties
key
typestring
value
typestring
typeobject
Artifact
descriptionInformation about an artifact. The artifact can only be an IP.
idArtifact
properties
anonymous
descriptionWhether the VPN tunnels are configured for anonymous browsing or not.
typeboolean
artifactClient
$refArtifactClient
descriptionEntity or software accessing or utilizing network resources.
asOwner
descriptionOwner of the Autonomous System to which the IP address belongs.
typestring
asn
descriptionAutonomous System Number to which the IP address belongs.
formatint64
typestring
firstSeenTime
descriptionFirst seen timestamp of the IP in the customer's environment.
formatgoogle-datetime
typestring
ip
descriptionIP address of the artifact. This field can be used as an entity indicator for an external destination IP entity.
typestring
jarm
descriptionThe JARM hash for the IP address. (https://engineering.salesforce.com/easily-identify-malicious-servers-on-the-internet-with-jarm-e095edac525a).
typestring
lastHttpsCertificate
$refSSLCertificate
descriptionSSL certificate information about the IP address.
lastHttpsCertificateDate
descriptionMost recent date for the certificate in VirusTotal.
formatgoogle-datetime
typestring
lastSeenTime
descriptionLast seen timestamp of the IP address in the customer's environment.
formatgoogle-datetime
typestring
location
$refLocation
descriptionLocation of the Artifact's IP address.
network
$refNetwork
descriptionNetwork information related to the Artifact's IP address.
prevalence
$refPrevalence
descriptionThe prevalence of the artifact within the customer's environment.
regionalInternetRegistry
descriptionRIR (one of the current RIRs: AFRINIC, ARIN, APNIC, LACNIC or RIPE NCC).
typestring
risks
descriptionThis field lists potential risks associated with the network activity.
items
typestring
typearray
tags
descriptionIdentification attributes
items
typestring
typearray
tunnels
descriptionVPN tunnels.
items
$refTunnels
typearray
whois
descriptionWHOIS information as returned from the pertinent WHOIS server.
typestring
whoisDate
descriptionDate of the last update of the WHOIS record in VirusTotal.
formatgoogle-datetime
typestring
typeobject
ArtifactClient
descriptionEntity or software accessing or utilizing network resources.
idArtifactClient
properties
behaviors
descriptionThe behaviors of the client accessing the network.
items
typestring
typearray
proxies
descriptionThe type of proxies used by the client.
items
typestring
typearray
typeobject
Asset
descriptionInformation about a compute asset such as a workstation, laptop, phone, virtual desktop, or VM.
idAsset
properties
assetId
descriptionThe asset ID. Value must contain the ':' character. For example, cs:abcdd23434. This field can be used as an entity indicator for asset entities.
typestring
attribute
$refAttribute
descriptionGeneric entity metadata attributes of the asset.
category
descriptionThe category of the asset (e.g. "End User Asset", "Workstation", "Server").
typestring
creationTime
deprecatedTrue
descriptionTime the asset was created or provisioned. Deprecate: creation_time should be populated in Attribute as generic metadata.
formatgoogle-datetime
typestring
deploymentStatus
descriptionThe deployment status of the asset for device lifecycle purposes.
enum
  • DEPLOYMENT_STATUS_UNSPECIFIED
  • ACTIVE
  • PENDING_DECOMISSION
  • DECOMISSIONED
enumDescriptions
  • Unspecified deployment status.
  • Asset is active, functional and deployed.
  • Asset is pending decommission and no longer deployed.
  • Asset is decommissioned.
typestring
firstDiscoverTime
descriptionTime the asset was first discovered (by asset management/discoverability software).
formatgoogle-datetime
typestring
firstSeenTime
descriptionThe first observed time for an asset. The value is calculated on the basis of the first time the identifier was observed.
formatgoogle-datetime
typestring
hardware
descriptionThe asset hardware specifications.
items
$refHardware
typearray
hostname
descriptionAsset hostname or domain name field. This field can be used as an entity indicator for asset entities.
typestring
ip
descriptionA list of IP addresses associated with an asset. This field can be used as an entity indicator for asset entities.
items
typestring
typearray
labels
deprecatedTrue
descriptionMetadata labels for the asset. Deprecated: labels should be populated in Attribute as generic metadata.
items
$refLabel
typearray
lastBootTime
descriptionTime the asset was last boot started.
formatgoogle-datetime
typestring
lastDiscoverTime
descriptionTime the asset was last discovered (by asset management/discoverability software).
formatgoogle-datetime
typestring
location
$refLocation
descriptionLocation of the asset.
mac
descriptionList of MAC addresses associated with an asset. This field can be used as an entity indicator for asset entities.
items
typestring
typearray
natIp
descriptionList of NAT IP addresses associated with an asset.
items
typestring
typearray
networkDomain
descriptionThe network domain of the asset (e.g. "corp.acme.com")
typestring
platformSoftware
$refPlatformSoftware
descriptionThe asset operating system platform software.
productObjectId
descriptionA vendor-specific identifier to uniquely identify the entity (a GUID or similar). This field can be used as an entity indicator for asset entities.
typestring
software
descriptionThe asset software details.
items
$refSoftware
typearray
systemLastUpdateTime
descriptionTime the asset system or OS was last updated. For all other operations that are not system updates (such as resizing a VM), use Attribute.last_update_time.
formatgoogle-datetime
typestring
type
descriptionThe type of the asset (e.g. workstation or laptop or server).
enum
  • ROLE_UNSPECIFIED
  • WORKSTATION
  • LAPTOP
  • IOT
  • NETWORK_ATTACHED_STORAGE
  • PRINTER
  • SCANNER
  • SERVER
  • TAPE_LIBRARY
  • MOBILE
enumDescriptions
  • Unspecified asset role.
  • A workstation or desktop.
  • A laptop computer.
  • An IOT asset.
  • A network attached storage device.
  • A printer.
  • A scanner.
  • A server.
  • A tape library device.
  • A mobile device such as a mobile phone or PDA.
typestring
vulnerabilities
descriptionVulnerabilities discovered on asset.
items
$refVulnerability
typearray
typeobject
Association
descriptionAssociations represents different metadata about malware and threat actors involved with an IoC.
idAssociation
properties
alias
descriptionDifferent aliases of the threat actor given by different sources.
items
$refAssociationAlias
typearray
associatedActors
descriptionList of associated threat actors for a malware. Not applicable for threat actors.
items
$refAssociation
typearray
countryCode
descriptionCountry from which the threat actor/ malware is originated.
items
typestring
typearray
description
descriptionHuman readable description about the association.
typestring
firstReferenceTime
descriptionFirst time the threat actor was referenced or seen.
formatgoogle-datetime
typestring
id
descriptionUnique association id generated by mandiant.
typestring
industriesAffected
descriptionList of industries the threat actor affects.
items
typestring
typearray
lastReferenceTime
descriptionLast time the threat actor was referenced or seen.
formatgoogle-datetime
typestring
name
descriptionName of the threat actor/malware.
typestring
regionCode
$refLocation
descriptionName of the country, the threat is originating from.
role
descriptionRole of the malware. Not applicable for threat actor.
typestring
sourceCountry
deprecatedTrue
descriptionName of the country the threat originated from.
typestring
sponsorRegion
$refLocation
descriptionSponsor region of the threat actor.
tags
descriptionTags.
items
typestring
typearray
targetedRegions
descriptionTargeted regions.
items
$refLocation
typearray
type
descriptionSignifies the type of association.
enum
  • ASSOCIATION_TYPE_UNSPECIFIED
  • THREAT_ACTOR
  • MALWARE
enumDescriptions
  • The default Association Type.
  • Association type Threat actor.
  • Association type Malware.
typestring
typeobject
AssociationAlias
descriptionAssociation Alias used to represent Mandiant Threat Intelligence.
idAssociationAlias
properties
company
descriptionName of the provider who gave the association's name.
typestring
name
descriptionName of the alias.
typestring
typeobject
AttackDetails
descriptionMITRE ATT&CK details.
idAttackDetails
properties
tactics
descriptionTactics employed.
items
$refTactic
typearray
techniques
descriptionTechniques employed.
items
$refTechnique
typearray
version
descriptionATT&CK version (e.g. 12.1).
typestring
typeobject
Attribute
descriptionAttribute is a container for generic entity attributes including common attributes across core entities (such as, user or asset). For example, Cloud is a generic entity attribute since it can apply to an asset (for example, a VM) or a user (for example, an identity service account).
idAttribute
properties
cloud
$refCloud
descriptionCloud metadata attributes such as project ID, account ID, or organizational hierarchy.
creationTime
descriptionTime the resource or entity was created or provisioned.
formatgoogle-datetime
typestring
labels
descriptionSet of labels for the entity. Should only be used for product labels (for example, Google Cloud resource labels or Azure AD sensitivity labels. Should not be used for arbitrary key-value mappings.
items
$refLabel
typearray
lastUpdateTime
descriptionTime the resource or entity was last updated.
formatgoogle-datetime
typestring
permissions
descriptionSystem permissions for IAM entity (human principal, service account, group).
items
$refPermission
typearray
roles
descriptionSystem IAM roles to be assumed by resources to use the role's permissions for access control.
items
$refRole
typearray
typeobject
Authentication
descriptionThe Authentication extension captures details specific to authentication events. General guidelines for authentication events: * Details about the source of the authentication event (for example, client IP or hostname), should be captured in principal. The principal may be empty if we have no details about the source of the login. * Details about the target of the authentication event (for example, details about the machine that is being logged into or logged out of) should be captured in target. * Some authentication events may involve a third-party. For example, a user logs into a cloud service (for example, Chronicle) via their company's SSO (the event is logged by their SSO solution). In this case, the principal captures information about the user's device, the target captures details about the cloud service they logged into, and the intermediary captures details about the SSO solution.
idAuthentication
properties
authDetails
descriptionThe vendor defined details of the authentication.
typestring
mechanism
descriptionThe authentication mechanism.
items
enum
  • MECHANISM_UNSPECIFIED
  • USERNAME_PASSWORD
  • OTP
  • HARDWARE_KEY
  • LOCAL
  • REMOTE
  • REMOTE_INTERACTIVE
  • MECHANISM_OTHER
  • BADGE_READER
  • NETWORK
  • BATCH
  • SERVICE
  • UNLOCK
  • NETWORK_CLEAR_TEXT
  • NEW_CREDENTIALS
  • INTERACTIVE
  • CACHED_INTERACTIVE
  • CACHED_REMOTE_INTERACTIVE
  • CACHED_UNLOCK
  • BIOMETRIC
  • WEARABLE
enumDescriptions
  • The default mechanism.
  • Username + password authentication.
  • OTP authentication.
  • Hardware key authentication.
  • Local authentication.
  • Remote authentication.
  • RDP, Terminal Services, or VNC.
  • Some other mechanism that is not defined here.
  • Badge reader authentication
  • Network authentication.
  • Batch authentication.
  • Service authentication
  • Direct human-interactive unlock authentication.
  • Network clear text authentication.
  • Authentication with new credentials.
  • Interactive authentication.
  • Interactive authentication using cached credentials.
  • Cached Remote Interactive authentication using cached credentials.
  • Cached Remote Interactive authentication using cached credentials.
  • Biometric device such as a fingerprint reader.
  • Wearable such as an Apple Watch.
typestring
typearray
type
descriptionThe type of authentication.
enum
  • AUTHTYPE_UNSPECIFIED
  • MACHINE
  • SSO
  • VPN
  • PHYSICAL
  • TACACS
enumDescriptions
  • The default type.
  • A machine authentication.
  • An SSO authentication.
  • A VPN authentication.
  • A Physical authentication (e.g. "Badge reader").
  • A TACACS family protocol for networked systems authentication (e.g. TACACS, TACACS+).
typestring
typeobject
AuthorityKeyId
descriptionIdentifies the public key to be used to verify the signature on this certificate or CRL.
idAuthorityKeyId
properties
keyid
descriptionKey hexdump.
typestring
serialNumber
descriptionSerial number hexdump.
typestring
typeobject
BackstoryEntity
descriptionAn Entity provides additional context about an item in a UDM event. For example, a PROCESS_LAUNCH event describes that user 'abc@example.corp' launched process 'shady.exe'. The event does not include information that user 'abc@example.com' is a recently terminated employee who administers a server storing finance data. Information stored in one or more Entities can add this additional context.
idBackstoryEntity
properties
additional
additionalProperties
descriptionProperties of the object.
typeany
descriptionImportant entity data that cannot be adequately represented within the formal sections of the Entity.
typeobject
entity
$refNoun
descriptionNoun in the UDM event that this entity represents.
metadata
$refEntityMetadata
descriptionEntity metadata such as timestamp, product, etc.
metric
$refMetric
descriptionStores statistical metrics about the entity. Used if metadata.entity_type is METRIC.
relations
descriptionOne or more relationships between the entity (a) and other entities, including the relationship type and related entity.
items
$refRelation
typearray
riskScore
$refEntityRisk
descriptionStores information related to the entity's risk score.
typeobject
BackstoryFile
descriptionInformation about a file.
idBackstoryFile
properties
ahash
deprecatedTrue
descriptionDeprecated. Use authentihash instead.
typestring
authentihash
descriptionAuthentihash of the file.
typestring
capabilitiesTags
descriptionCapabilities tags.
items
typestring
typearray
createTime
descriptionTimestamp when the file was created.
formatgoogle-datetime
typestring
embeddedDomains
descriptionEmbedded domains found in the file.
items
typestring
typearray
embeddedIps
descriptionEmbedded IP addresses found in the file.
items
typestring
typearray
embeddedUrls
descriptionEmbedded urls found in the file.
items
typestring
typearray
exifInfo
$refExifInfo
descriptionExif metadata from different file formats extracted by exiftool.
fileMetadata
$refFileMetadata
deprecatedTrue
descriptionMetadata associated with the file. Deprecate FileMetadata in favor of using fields in File.
fileType
descriptionFileType field.
enum
  • FILE_TYPE_UNSPECIFIED
  • FILE_TYPE_PE_EXE
  • FILE_TYPE_PE_DLL
  • FILE_TYPE_MSI
  • FILE_TYPE_NE_EXE
  • FILE_TYPE_NE_DLL
  • FILE_TYPE_DOS_EXE
  • FILE_TYPE_DOS_COM
  • FILE_TYPE_COFF
  • FILE_TYPE_ELF
  • FILE_TYPE_LINUX_KERNEL
  • FILE_TYPE_RPM
  • FILE_TYPE_LINUX
  • FILE_TYPE_MACH_O
  • FILE_TYPE_JAVA_BYTECODE
  • FILE_TYPE_DMG
  • FILE_TYPE_DEB
  • FILE_TYPE_PKG
  • FILE_TYPE_PYC
  • FILE_TYPE_LNK
  • FILE_TYPE_DESKTOP_ENTRY
  • FILE_TYPE_JPEG
  • FILE_TYPE_TIFF
  • FILE_TYPE_GIF
  • FILE_TYPE_PNG
  • FILE_TYPE_BMP
  • FILE_TYPE_GIMP
  • FILE_TYPE_IN_DESIGN
  • FILE_TYPE_PSD
  • FILE_TYPE_TARGA
  • FILE_TYPE_XWD
  • FILE_TYPE_DIB
  • FILE_TYPE_JNG
  • FILE_TYPE_ICO
  • FILE_TYPE_FPX
  • FILE_TYPE_EPS
  • FILE_TYPE_SVG
  • FILE_TYPE_EMF
  • FILE_TYPE_WEBP
  • FILE_TYPE_DWG
  • FILE_TYPE_DXF
  • FILE_TYPE_THREEDS
  • FILE_TYPE_OGG
  • FILE_TYPE_FLC
  • FILE_TYPE_FLI
  • FILE_TYPE_MP3
  • FILE_TYPE_FLAC
  • FILE_TYPE_WAV
  • FILE_TYPE_MIDI
  • FILE_TYPE_AVI
  • FILE_TYPE_MPEG
  • FILE_TYPE_QUICKTIME
  • FILE_TYPE_ASF
  • FILE_TYPE_DIVX
  • FILE_TYPE_FLV
  • FILE_TYPE_WMA
  • FILE_TYPE_WMV
  • FILE_TYPE_RM
  • FILE_TYPE_MOV
  • FILE_TYPE_MP4
  • FILE_TYPE_T3GP
  • FILE_TYPE_WEBM
  • FILE_TYPE_MKV
  • FILE_TYPE_PDF
  • FILE_TYPE_PS
  • FILE_TYPE_DOC
  • FILE_TYPE_DOCX
  • FILE_TYPE_PPT
  • FILE_TYPE_PPTX
  • FILE_TYPE_XLS
  • FILE_TYPE_XLSX
  • FILE_TYPE_RTF
  • FILE_TYPE_PPSX
  • FILE_TYPE_ODP
  • FILE_TYPE_ODS
  • FILE_TYPE_ODT
  • FILE_TYPE_HWP
  • FILE_TYPE_GUL
  • FILE_TYPE_ODF
  • FILE_TYPE_ODG
  • FILE_TYPE_ONE_NOTE
  • FILE_TYPE_OOXML
  • FILE_TYPE_SLK
  • FILE_TYPE_EBOOK
  • FILE_TYPE_LATEX
  • FILE_TYPE_TTF
  • FILE_TYPE_EOT
  • FILE_TYPE_WOFF
  • FILE_TYPE_CHM
  • FILE_TYPE_ZIP
  • FILE_TYPE_GZIP
  • FILE_TYPE_BZIP
  • FILE_TYPE_RZIP
  • FILE_TYPE_DZIP
  • FILE_TYPE_SEVENZIP
  • FILE_TYPE_CAB
  • FILE_TYPE_JAR
  • FILE_TYPE_RAR
  • FILE_TYPE_MSCOMPRESS
  • FILE_TYPE_ACE
  • FILE_TYPE_ARC
  • FILE_TYPE_ARJ
  • FILE_TYPE_ASD
  • FILE_TYPE_BLACKHOLE
  • FILE_TYPE_KGB
  • FILE_TYPE_ZLIB
  • FILE_TYPE_TAR
  • FILE_TYPE_ZST
  • FILE_TYPE_LZFSE
  • FILE_TYPE_PYTHON_WHL
  • FILE_TYPE_PYTHON_PKG
  • FILE_TYPE_MSIX
  • FILE_TYPE_TEXT
  • FILE_TYPE_SCRIPT
  • FILE_TYPE_PHP
  • FILE_TYPE_PYTHON
  • FILE_TYPE_PERL
  • FILE_TYPE_RUBY
  • FILE_TYPE_C
  • FILE_TYPE_CPP
  • FILE_TYPE_JAVA
  • FILE_TYPE_SHELLSCRIPT
  • FILE_TYPE_PASCAL
  • FILE_TYPE_AWK
  • FILE_TYPE_DYALOG
  • FILE_TYPE_FORTRAN
  • FILE_TYPE_JAVASCRIPT
  • FILE_TYPE_POWERSHELL
  • FILE_TYPE_VBA
  • FILE_TYPE_M4
  • FILE_TYPE_OBJETIVEC
  • FILE_TYPE_JMOD
  • FILE_TYPE_MAKEFILE
  • FILE_TYPE_INI
  • FILE_TYPE_CLJ
  • FILE_TYPE_PDB
  • FILE_TYPE_SQL
  • FILE_TYPE_NEKO
  • FILE_TYPE_WER
  • FILE_TYPE_GOLANG
  • FILE_TYPE_M3U
  • FILE_TYPE_BAT
  • FILE_TYPE_MSC
  • FILE_TYPE_RDP
  • FILE_TYPE_SYMBIAN
  • FILE_TYPE_PALMOS
  • FILE_TYPE_WINCE
  • FILE_TYPE_ANDROID
  • FILE_TYPE_IPHONE
  • FILE_TYPE_HTML
  • FILE_TYPE_XML
  • FILE_TYPE_SWF
  • FILE_TYPE_FLA
  • FILE_TYPE_COOKIE
  • FILE_TYPE_TORRENT
  • FILE_TYPE_EMAIL_TYPE
  • FILE_TYPE_OUTLOOK
  • FILE_TYPE_SGML
  • FILE_TYPE_JSON
  • FILE_TYPE_CSV
  • FILE_TYPE_HTA
  • FILE_TYPE_INTERNET_SHORTCUT
  • FILE_TYPE_CAP
  • FILE_TYPE_ISOIMAGE
  • FILE_TYPE_SQUASHFS
  • FILE_TYPE_VHD
  • FILE_TYPE_APPLE
  • FILE_TYPE_MACINTOSH
  • FILE_TYPE_APPLESINGLE
  • FILE_TYPE_APPLEDOUBLE
  • FILE_TYPE_MACINTOSH_HFS
  • FILE_TYPE_APPLE_PLIST
  • FILE_TYPE_MACINTOSH_LIB
  • FILE_TYPE_APPLESCRIPT
  • FILE_TYPE_APPLESCRIPT_COMPILED
  • FILE_TYPE_CRX
  • FILE_TYPE_XPI
  • FILE_TYPE_ROM
  • FILE_TYPE_IPS
  • FILE_TYPE_PEM
  • FILE_TYPE_PGP
  • FILE_TYPE_CRT
enumDescriptions
  • File type is UNSPECIFIED.
  • File type is PE_EXE.
  • Although DLLs are actually portable executables, this value enables the file type to be identified separately. File type is PE_DLL.
  • File type is MSI.
  • File type is NE_EXE.
  • File type is NE_DLL.
  • File type is DOS_EXE.
  • File type is DOS_COM.
  • File type is COFF.
  • File type is ELF.
  • File type is LINUX_KERNEL.
  • File type is RPM.
  • File type is LINUX.
  • File type is MACH_O.
  • File type is JAVA_BYTECODE.
  • File type is DMG.
  • File type is DEB.
  • File type is PKG.
  • File type is PYC.
  • File type is LNK.
  • File type is DESKTOP_ENTRY.
  • File type is JPEG.
  • File type is TIFF.
  • File type is GIF.
  • File type is PNG.
  • File type is BMP.
  • File type is GIMP.
  • File type is Adobe InDesign.
  • File type is PSD. Adobe Photoshop.
  • File type is TARGA.
  • File type is XWD.
  • File type is DIB.
  • File type is JNG.
  • File type is ICO.
  • File type is FPX.
  • File type is EPS.
  • File type is SVG.
  • File type is EMF.
  • File type is WEBP.
  • File type is DWG.
  • File type is DXF.
  • File type is 3DS.
  • File type is OGG.
  • File type is FLC.
  • File type is FLI.
  • File type is MP3.
  • File type is FLAC.
  • File type is WAV.
  • File type is MIDI.
  • File type is AVI.
  • File type is MPEG.
  • File type is QUICKTIME.
  • File type is ASF.
  • File type is DIVX.
  • File type is FLV.
  • File type is WMA.
  • File type is WMV.
  • File type is RM. RealMedia type.
  • File type is MOV.
  • File type is MP4.
  • File type is T3GP.
  • File type is WEBM.
  • File type is MKV.
  • File type is PDF.
  • File type is PS.
  • File type is DOC.
  • File type is DOCX.
  • File type is PPT.
  • File type is PPTX.
  • File type is XLS.
  • File type is XLSX.
  • File type is RTF.
  • File type is PPSX.
  • File type is ODP.
  • File type is ODS.
  • File type is ODT.
  • File type is HWP.
  • File type is GUL.
  • File type is ODF.
  • File type is ODG.
  • File type is ONE_NOTE.
  • File type is OOXML.
  • File type is SLK.
  • File type is EBOOK.
  • File type is LATEX.
  • File type is TTF.
  • File type is EOT.
  • File type is WOFF.
  • File type is CHM.
  • File type is ZIP.
  • File type is GZIP.
  • File type is BZIP.
  • File type is RZIP.
  • File type is DZIP.
  • File type is SEVENZIP.
  • File type is CAB.
  • File type is JAR.
  • File type is RAR.
  • File type is MSCOMPRESS.
  • File type is ACE.
  • File type is ARC.
  • File type is ARJ.
  • File type is ASD.
  • File type is BLACKHOLE.
  • File type is KGB.
  • File type is ZLIB.
  • File type is TAR.
  • File type is ZST.
  • File type is LZFSE.
  • File type is PYTHON_WHL.
  • File type is PYTHON_PKG.
  • File type is MSIX, new Windows app package format.
  • File type is TEXT.
  • File type is SCRIPT.
  • File type is PHP.
  • File type is PYTHON.
  • File type is PERL.
  • File type is RUBY.
  • File type is C.
  • File type is CPP.
  • File type is JAVA.
  • File type is SHELLSCRIPT.
  • File type is PASCAL.
  • File type is AWK.
  • File type is DYALOG.
  • File type is FORTRAN.
  • File type is JAVASCRIPT.
  • File type is POWERSHELL.
  • File type is VBA.
  • File type is M4.
  • File type is OBJETIVEC.
  • File type is JMOD.
  • File type is MAKEFILE.
  • File type is INI.
  • File type is CLJ.
  • File type is PDB.
  • File type is SQL.
  • File type is NEKO.
  • File type is WER.
  • File type is GOLANG.
  • File type is M3U.
  • File type is BAT, Windows .bat/.cmd (old files are tagged as SHELLSCRIPT).
  • File type is MSC, Microsoft Management Console (MMC).
  • File type is RDP, Microsoft Remote Desktop Protocol (RDP) file.
  • File type is SYMBIAN.
  • File type is PALMOS.
  • File type is WINCE.
  • File type is ANDROID.
  • File type is IPHONE.
  • File type is HTML.
  • File type is XML.
  • File type is SWF.
  • File type is FLA.
  • File type is COOKIE.
  • File type is TORRENT.
  • File type is EMAIL_TYPE.
  • File type is OUTLOOK.
  • File type is SGML.
  • File type is JSON.
  • File type is CSV.
  • File type is HTA (HTML Application).
  • File type is MSHTML .url.
  • File type is CAP.
  • File type is ISOIMAGE.
  • File type is SQUASHFS.
  • File type is VHD.
  • File type is APPLE.
  • File type is MACINTOSH.
  • File type is APPLESINGLE.
  • File type is APPLEDOUBLE.
  • File type is MACINTOSH_HFS.
  • File type is APPLE_PLIST.
  • File type is MACINTOSH_LIB.
  • File type is APPLESCRIPT.
  • File type is APPLESCRIPT_COMPILED .
  • File type is CRX.
  • File type is XPI.
  • File type is ROM.
  • File type is IPS.
  • File type is PEM.
  • File type is PGP.
  • File type is CRT.
typestring
firstSeenTime
descriptionTimestamp the file was first seen in the customer's environment.
formatgoogle-datetime
typestring
firstSubmissionTime
descriptionFirst submission time of the file.
formatgoogle-datetime
typestring
fullPath
descriptionThe full path identifying the location of the file on the system. This field can be used as an entity indicator for file entities.
typestring
lastAccessTime
descriptionTimestamp when the file was accessed.
formatgoogle-datetime
typestring
lastAnalysisTime
descriptionTimestamp the file was last analysed.
formatgoogle-datetime
typestring
lastModificationTime
descriptionTimestamp when the file was last updated.
formatgoogle-datetime
typestring
lastSeenTime
descriptionTimestamp the file was last seen in the customer's environment.
formatgoogle-datetime
typestring
lastSubmissionTime
descriptionLast submission time of the file.
formatgoogle-datetime
typestring
mainIcon
$refFavicon
descriptionIcon's relevant hashes.
md5
descriptionThe MD5 hash of the file, as a hex-encoded string. This field can be used as an entity indicator for file entities.
typestring
mimeType
descriptionThe MIME (Multipurpose Internet Mail Extensions) type of the file, for example "PE", "PDF", or "powershell script".
typestring
names
descriptionNames fields.
items
typestring
typearray
ntfs
$refNtfsFileMetadata
descriptionNTFS metadata.
pdfInfo
$refPDFInfo
descriptionInformation about the PDF file structure.
peFile
$refFileMetadataPE
descriptionMetadata about the Portable Executable (PE) file.
prevalence
$refPrevalence
descriptionPrevalence of the file hash in the customer's environment.
securityResult
$refSecurityResult
descriptionGoogle Cloud Threat Intelligence (GCTI) security result for the file including threat context and detection metadata.
sha1
descriptionThe SHA1 hash of the file, as a hex-encoded string. This field can be used as an entity indicator for file entities.
typestring
sha256
descriptionThe SHA256 hash of the file, as a hex-encoded string. This field can be used as an entity indicator for file entities.
typestring
signatureInfo
$refSignatureInfo
descriptionFile signature information extracted from different tools.
size
descriptionThe size of the file in bytes.
formatuint64
typestring
ssdeep
descriptionSsdeep of the file
typestring
statDev
descriptionThe file system identifier to which the object belongs.
formatuint64
typestring
statFlags
descriptionUser defined flags for file.
formatuint32
typeinteger
statInode
descriptionThe file identifier. Unique identifier of object within a file system.
formatuint64
typestring
statMode
descriptionThe mode of the file. A bit string indicating the permissions and privileges of the file.
formatuint64
typestring
statNlink
descriptionNumber of links to file.
formatuint64
typestring
symhash
descriptionSymHash of the file. Used for Mach-O (e.g. MacOS) binaries, to identify similar files based on their symbol table.
typestring
tags
descriptionTags for the file.
items
typestring
typearray
vhash
descriptionVhash of the file.
typestring
typeobject
BoolSequence
descriptionBoolSequence represents a sequence of bools.
idBoolSequence
properties
boolVals
descriptionbool sequence.
items
typeboolean
typearray
typeobject
BytesSequence
descriptionBytesSequence represents a sequence of bytes.
idBytesSequence
properties
bytesVals
descriptionbytes sequence.
items
formatbyte
typestring
typearray
typeobject
CancelOperationRequest
descriptionThe request message for Operations.CancelOperation.
idCancelOperationRequest
properties
typeobject
CertSignature
descriptionCertificate's signature and algorithm.
idCertSignature
properties
signature
descriptionSignature.
typestring
signatureAlgorithm
descriptionAlgorithm.
typestring
typeobject
Certificate
descriptionCertificate information
idCertificate
properties
issuer
descriptionIssuer of the certificate.
typestring
md5
descriptionThe MD5 hash of the certificate, as a hex-encoded string.
typestring
notAfter
descriptionIndicates when the certificate is no longer valid.
formatgoogle-datetime
typestring
notBefore
descriptionIndicates when the certificate is first valid.
formatgoogle-datetime
typestring
serial
descriptionCertificate serial number.
typestring
sha1
descriptionThe SHA1 hash of the certificate, as a hex-encoded string.
typestring
sha256
descriptionThe SHA256 hash of the certificate, as a hex-encoded string.
typestring
subject
descriptionSubject of the certificate.
typestring
version
descriptionCertificate version.
typestring
typeobject
Chip
idChip
properties
text
typestring
type
enum
  • UNSPECIFIED
  • ALERT
  • NETWORK_CONNECTION
  • EDR
  • UNPARSED_RAW_LOG
  • LOGIN_EVENT
  • EMAIL_EVENT
  • GENERIC
  • TELEMETRY
enumDescriptions
typestring
typeobject
Client
descriptionTransport Layer Security (TLS) information associated with the client (for example, Certificate or JA3 hash).
idClient
properties
certificate
$refCertificate
descriptionClient certificate.
ja3
descriptionJA3 hash from the TLS ClientHello, as a hex-encoded string.
typestring
serverName
descriptionHost name of the server, that the client is connecting to.
typestring
supportedCiphers
descriptionCiphers supported by the client during client hello.
items
typestring
typearray
typeobject
Cloud
descriptionMetadata related to the cloud environment.
idCloud
properties
availabilityZone
descriptionThe cloud environment availability zone (different from region which is location.name).
typestring
environment
descriptionThe Cloud environment.
enum
  • UNSPECIFIED_CLOUD_ENVIRONMENT
  • GOOGLE_CLOUD_PLATFORM
  • AMAZON_WEB_SERVICES
  • MICROSOFT_AZURE
enumDescriptions
  • Default.
  • Google Cloud Platform.
  • Amazon Web Services.
  • Microsoft Azure.
typestring
project
$refResource
deprecatedTrue
descriptionThe cloud environment project information. Deprecated: Use Resource.resource_ancestors
vpc
$refResource
deprecatedTrue
descriptionThe cloud environment VPC. Deprecated.
typeobject
Collection
descriptionCollection represents a container of objects (such as events, entity context metadata, detection finding metadata) and state (such as investigation details). BEGIN GOOGLE-INTERNAL See go/udm:collections for additional details. END GOOGLE-INTERNAL An example use case for Collection is to model a detection and investigation from detection finding metadata to investigative state collected in the course of the investigation. For more complex investigation and response workflows a Collection could represent an incident consisting of multiple child findings or incidents. This can be expanded on to model remediation elements of a full detection and response workflow. NEXT TAG: 20
idCollection
properties
caseName
descriptionThe resource name of the Case that this collection belongs to. Example: projects/{project id}/locations/{region}/chronicle/cases/{internal_case_id}
typestring
collectionElements
descriptionConstituent elements of the collection. Each element shares an association that groups it together and is a component of the overall collection. For example, a detection collection may have several constituent elements that each share a correlation association that together represent a particular pattern or behavior.
items
$refElement
typearray
createdTime
descriptionTime the collection was created.
formatgoogle-datetime
typestring
dataAccessScope
descriptionThe resource name of the DataAccessScope of this collection. BEGIN GOOGLE-INTERNAL We may change this name based on the final resource design of the scope. END GOOGLE-INTERNAL
typestring
detection
descriptionDetection metadata for findings that represent detections, can include rule details, machine learning model metadata, and indicators implicated in the detection (using the .about field).
items
$refSecurityResult
typearray
detectionTime
descriptionTimestamp within the time_window related to the time of the collection_elements. For Rule Detections, this timestamp is the end of the the time_window for multi-event rules or the time of the event for single event rules. For late-arriving events that trigger new alerts, the detection_time will be the event time of the event.
formatgoogle-datetime
typestring
feedbackHistory
descriptionThe history of feedback submitted by analysts for this finding, in descending order by timestamp. This field is limited to the most recent 1000 feedback events. The primary feedback will also be included in this list.
items
$refFeedback
typearray
feedbackSummary
$refFeedback
descriptionThe current primary analyst feedback. This does not include the history of feedback given, which may be supplied in `feedback`.
id
descriptionUnique ID for the collection. The ID is specific to the type of collection. For example, with rule detections this is the detection ID.
typestring
idNamespace
descriptionThe ID namespace used for the Collection.
enum
  • NORMALIZED_TELEMETRY
  • RAW_TELEMETRY
  • RULE_DETECTIONS
  • UPPERCASE
  • MACHINE_INTELLIGENCE
  • SECURITY_COMMAND_CENTER
  • UNSPECIFIED
  • SOAR_ALERT
  • VIRUS_TOTAL
enumDescriptions
  • Ingested and Normalized telemetry events
  • Ingested Raw telemetry
  • Chronicle Rules engine
  • Uppercase
  • DSML - Machine Intelligence
  • A normalized telemetry event from Google Security Command Center.
  • Unspecified Namespace
  • An alert coming from other SIEMs via Chronicle SOAR.
  • VirusTotal.
typestring
investigation
$refInvestigation
descriptionConsolidated investigation details (categorization, status, etc) typically for collections that begin as detection findings and then evolve with analyst action and feedback into investigations around the detection output.
lastUpdatedTime
descriptionTime the collection was last updated.
formatgoogle-datetime
typestring
responsePlatformInfo
$refResponsePlatformInfo
descriptionAlert related info of this same alert in customer's SOAR platform.
soarAlert
descriptionA boolean field indicating that the alert is present in SOAR.
typeboolean
soarAlertMetadata
$refSoarAlertMetadata
descriptionMetadata fields of alerts coming from other SIEM systems via SOAR.
tags
descriptionTags set by UC/DSML/RE for the Finding during creation.
items
typestring
typearray
timeWindow
$refInterval
descriptionTime interval that the collection represents.
type
descriptionWhat the collection represents.
enum
  • COLLECTION_TYPE_UNSPECIFIED
  • TELEMETRY_ALERT
  • GCTI_FINDING
  • UPPERCASE_ALERT
  • RULE_DETECTION
  • MACHINE_INTELLIGENCE_ALERT
  • SOAR_ALERT
enumDescriptions
  • An unspecified collection type.
  • An alert reported in customer telemetry.
  • A finding from the Uppercase team.
  • A detection found by applying a rule.
  • An alert generated by Chronicle machine learning models.
  • An alert coming from other SIEMs via Chronicle SOAR.
typestring
typeobject
ColumnNames
idColumnNames
properties
names
items
typestring
typearray
typeobject
CompilationDiagnostic
descriptionCompilationDiagnostic represents a compilation diagnostic generated during a rule's compilation, such as a compilation error or a compilation warning.
idCompilationDiagnostic
properties
message
descriptionOutput only. The diagnostic message.
readOnlyTrue
typestring
position
$refCompilationPosition
descriptionOutput only. The approximate position in the rule text associated with the compilation diagnostic. Compilation Position may be empty.
readOnlyTrue
severity
descriptionOutput only. The severity of a rule's compilation diagnostic.
enum
  • SEVERITY_UNSPECIFIED
  • WARNING
  • ERROR
enumDescriptions
  • An unspecified severity level.
  • A compilation warning.
  • A compilation error.
readOnlyTrue
typestring
uri
descriptionOutput only. Link to documentation that describes a diagnostic in more detail.
readOnlyTrue
typestring
typeobject
CompilationPosition
descriptionCompilationPosition represents the location of a compilation diagnostic in rule text.
idCompilationPosition
properties
endColumn
descriptionOutput only. End column number, beginning at 1.
formatint32
readOnlyTrue
typeinteger
endLine
descriptionOutput only. End line number, beginning at 1.
formatint32
readOnlyTrue
typeinteger
startColumn
descriptionOutput only. Start column number, beginning at 1.
formatint32
readOnlyTrue
typeinteger
startLine
descriptionOutput only. Start line number, beginning at 1.
formatint32
readOnlyTrue
typeinteger
typeobject
CreateParserExtensionMetadata
descriptionOperation metadata for creating a parser extension.
idCreateParserExtensionMetadata
properties
state
descriptionThe state of the parser extension creation process.
enum
  • STATE_UNSPECIFIED
  • NEW
  • VALIDATING
  • LIVE
  • REJECTED
  • INTERNAL_ERROR
  • VALIDATED
  • ARCHIVED
enumDescriptions
  • The state for this parser extension was not specified.
  • The parser extension has been newly submitted and is waiting to be validated.
  • The parser extension is currently going through the validation pipeline.
  • The parser extension is live in production. Only configs that have successfully passed the validation stage will be set to LIVE.
  • Validation completed, but the parser extension was rejected with errors.
  • An error occurred when processing this parser extension.
  • Extension is validated.
  • Extension is archived and is no more being used.
typestring
stateLastChangedTime
descriptionThe time the config state was last changed.
formatgoogle-datetime
typestring
validationErrors
descriptionAny validation error while validating the extension, this have cap of size 10
items
typestring
typearray
validationReport
descriptionThe validation report generated during validation of the parser extension.
typestring
typeobject
CreateParserMetadata
descriptionOperation metadata for creating a parser.
idCreateParserMetadata
properties
stage
descriptionThe validation stage of the parser creation process.
enum
  • VALIDATION_STAGE_UNSPECIFIED
  • NEW
  • VALIDATING
  • PASSED
  • FAILED
  • DELETE_CANDIDATE
enumDescriptions
  • The validation stage is not specified.
  • The custom parser is submitted for validation.
  • The custom parser is currently going through the validation pipeline
  • The custom parser has successfully passed the validation.
  • The custom parser has failed validation.
  • The parser is no good, It is available for auto deletion.
typestring
validationReport
descriptionThe validation report generated during validation of the parser.
typestring
typeobject
DNSRecord
descriptionDNS record.
idDNSRecord
properties
expire
descriptionExpire.
formatgoogle-duration
typestring
minimum
descriptionMinimum.
formatgoogle-duration
typestring
priority
descriptionPriority.
formatint64
typestring
refresh
descriptionRefresh.
formatgoogle-duration
typestring
retry
descriptionRetry.
formatint64
typestring
rname
descriptionRname.
typestring
serial
descriptionSerial.
formatint64
typestring
ttl
descriptionTime to live.
formatgoogle-duration
typestring
type
descriptionType.
typestring
value
descriptionValue.
typestring
typeobject
DataAccessIngestionLabel
idDataAccessIngestionLabel
properties
key
descriptionThe key.
typestring
value
descriptionThe value.
typestring
typeobject
DataAccessLabel
descriptionA DataAccessLabel is a label on events to define user access to data.
idDataAccessLabel
properties
author
descriptionOutput only. The user who created the data access label.
readOnlyTrue
typestring
createTime
descriptionOutput only. The time at which the data access label was created.
formatgoogle-datetime
readOnlyTrue
typestring
description
descriptionOptional. A description of the data access label for a human reader.
typestring
displayName
descriptionOutput only. The short name displayed for the label as it appears on event data.
readOnlyTrue
typestring
lastEditor
descriptionOutput only. The user who last updated the data access label.
readOnlyTrue
typestring
name
descriptionRequired. The unique resource name of the data access label.
typestring
udmQuery
descriptionA UDM query over event data.
typestring
updateTime
descriptionOutput only. The time at which the data access label was last updated.
formatgoogle-datetime
readOnlyTrue
typestring
typeobject
DataAccessLabelReference
descriptionReference object to a data access label.
idDataAccessLabelReference
properties
assetNamespace
descriptionThe asset namespace configured in the forwarder of the customer's events.
typestring
dataAccessLabel
descriptionThe name of the data access label.
typestring
displayName
descriptionOutput only. The display name of the label. Data access label and log types's name will match the display name of the resource. The asset namespace will match the namespace itself. The ingestion key value pair will match the key of the tuple.
readOnlyTrue
typestring
ingestionLabel
$refIngestionLabel
descriptionThe ingestion label configured in the forwarder of the customer's events.
logType
descriptionThe name of the log type.
typestring
typeobject
DataAccessLabels
idDataAccessLabels
properties
allowScopedAccess
descriptionAre the labels ready for scoped access
typeboolean
customLabels
descriptionAll the complex labels (UDM search syntax based).
items
typestring
typearray
ingestionKvLabels
descriptionAll the ingestion labels (key/value pairs).
items
$refDataAccessIngestionLabel
typearray
ingestionLabels
deprecatedTrue
descriptionAll the ingestion labels.
items
typestring
typearray
logTypes
descriptionAll the LogType labels.
items
typestring
typearray
namespaces
descriptionAll the namespaces.
items
typestring
typearray
typeobject
DataAccessScope
descriptionA DataAccessScope is a boolean expression of data access labels used to restrict access to data for users.
idDataAccessScope
properties
allowAll
descriptionOptional. Whether or not the scope allows all labels, allow_all and allowed_data_access_labels are mutually exclusive and one of them must be present. denied_data_access_labels can still be used along with allow_all. When combined with denied_data_access_labels, access will be granted to all data that doesn't have labels mentioned in denied_data_access_labels. E.g.: A customer with scope with denied labels A and B and allow_all will be able to see all data except data labeled with A and data labeled with B and data with labels A and B.
typeboolean
allowedDataAccessLabels
descriptionOptional. The allowed labels for the scope. Either allow_all or allowed_data_access_labels needs to be provided. When provided, there has to be at least one label allowed for the scope to be valid. The logical operator for evaluation of the allowed labels is OR. E.g.: A customer with scope with allowed labels A and B will be able to see data with labeled with A or B or (A and B).
items
$refDataAccessLabelReference
typearray
author
descriptionOutput only. The user who created the data access scope.
readOnlyTrue
typestring
createTime
descriptionOutput only. The time at which the data access scope was created.
formatgoogle-datetime
readOnlyTrue
typestring
deniedDataAccessLabels
descriptionOptional. The denied labels for the scope. The logical operator for evaluation of the denied labels is AND. E.g.: A customer with scope with denied labels A and B won't be able to see data labeled with A and data labeled with B and data with labels A and B.
items
$refDataAccessLabelReference
typearray
description
descriptionOptional. A description of the data access scope for a human reader.
typestring
displayName
descriptionOutput only. The name to be used for display to customers of the data access scope.
readOnlyTrue
typestring
lastEditor
descriptionOutput only. The user who last updated the data access scope.
readOnlyTrue
typestring
name
descriptionRequired. The unique full name of the data access scope. The name should comply with https://google.aip.dev/122 standards.
typestring
updateTime
descriptionOutput only. The time at which the data access scope was last updated.
formatgoogle-datetime
readOnlyTrue
typestring
typeobject
Date
descriptionRepresents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values. * A month and day, with a zero year (for example, an anniversary). * A year on its own, with a zero month and a zero day. * A year and month, with a zero day (for example, a credit card expiration date). Related types: * google.type.TimeOfDay * google.type.DateTime * google.protobuf.Timestamp
idDate
properties
day
descriptionDay of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.
formatint32
typeinteger
month
descriptionMonth of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.
formatint32
typeinteger
year
descriptionYear of the date. Must be from 1 to 9999, or 0 to specify a date without a year.
formatint32
typeinteger
typeobject
Detections
idDetections
properties
baselineAlertsCount
formatint32
typeinteger
complete
typeboolean
detectionFieldAggregations
$refAlertFieldAggregations
detections
items
$refCollection
typearray
filteredAlertsCount
formatint32
typeinteger
tooManyDetections
typeboolean
validSnapshotQuery
typeboolean
typeobject
Dhcp
descriptionDHCP information.
idDhcp
properties
chaddr
descriptionClient hardware address (chaddr).
typestring
ciaddr
descriptionClient IP address (ciaddr).
typestring
clientHostname
descriptionClient hostname. See RFC2132, section 3.14.
typestring
clientIdentifier
descriptionClient identifier. See RFC2132, section 9.14. Note: Make sure to update the client_identifier_string field as well if you update this field.
formatbyte
typestring
clientIdentifierString
descriptionClient identifier as string. See RFC2132, section 9.14. This field holds the string value of the client_identifier.
typestring
file
descriptionBoot image filename.
typestring
flags
descriptionFlags.
formatuint32
typeinteger
giaddr
descriptionRelay agent IP address (giaddr).
typestring
hlen
descriptionHardware address length.
formatuint32
typeinteger
hops
descriptionHardware ops.
formatuint32
typeinteger
htype
descriptionHardware address type.
formatuint32
typeinteger
leaseTimeSeconds
descriptionLease time in seconds. See RFC2132, section 9.2.
formatuint32
typeinteger
opcode
descriptionThe BOOTP op code.
enum
  • UNKNOWN_OPCODE
  • BOOTREQUEST
  • BOOTREPLY
enumDescriptions
  • Default opcode.
  • Request.
  • Reply.
typestring
options
descriptionList of DHCP options.
items
$refOption
typearray
requestedAddress
descriptionRequested IP address. See RFC2132, section 9.1.
typestring
seconds
descriptionSeconds elapsed since client began address acquisition/renewal process.
formatuint32
typeinteger
siaddr
descriptionIP address of the next bootstrap server.
typestring
sname
descriptionServer name that the client wishes to boot from.
typestring
transactionId
descriptionTransaction ID.
formatuint32
typeinteger
type
descriptionDHCP message type.
enum
  • UNKNOWN_MESSAGE_TYPE
  • DISCOVER
  • OFFER
  • REQUEST
  • DECLINE
  • ACK
  • NAK
  • RELEASE
  • INFORM
  • WIN_DELETED
  • WIN_EXPIRED
enumDescriptions
  • Default message type.
  • DHCPDISCOVER.
  • DHCPOFFER.
  • DHCPREQUEST.
  • DHCPDECLINE.
  • DHCPACK.
  • DHCPNAK.
  • DHCPRELEASE.
  • DHCPINFORM.
  • Microsoft Windows DHCP "lease deleted".
  • Microsoft Windows DHCP "lease expired".
typestring
yiaddr
descriptionYour IP address (yiaddr).
typestring
typeobject
Dns
descriptionDNS information.
idDns
properties
additional
descriptionA list of additional domain name servers that can be used to verify the answer to the domain.
items
$refResourceRecord
typearray
answers
descriptionA list of answers to the domain name query.
items
$refResourceRecord
typearray
authoritative
descriptionOther DNS header flags. See RFC1035, section 4.1.1.
typeboolean
authority
descriptionA list of domain name servers which verified the answers to the domain name queries.
items
$refResourceRecord
typearray
id
descriptionDNS query id.
formatuint32
typeinteger
opcode
descriptionThe DNS OpCode used to specify the type of DNS query (for example, QUERY, IQUERY, or STATUS).
formatuint32
typeinteger
questions
descriptionA list of domain protocol message questions.
items
$refQuestion
typearray
recursionAvailable
descriptionWhether a recursive DNS lookup is available.
typeboolean
recursionDesired
descriptionWhether a recursive DNS lookup is desired.
typeboolean
response
descriptionSet to true if the event is a DNS response. See QR field from RFC1035.
typeboolean
responseCode
descriptionResponse code. See RCODE from RFC1035.
formatuint32
typeinteger
truncated
descriptionWhether the DNS response was truncated.
typeboolean
typeobject
Domain
descriptionInformation about a domain.
idDomain
properties
admin
$refUser
descriptionParsed contact information for the administrative contact for the domain.
auditUpdateTime
descriptionAudit updated time.
formatgoogle-datetime
typestring
billing
$refUser
descriptionParsed contact information for the billing contact of the domain.
categories
descriptionCategories assign to the domain as retrieved from VirusTotal.
items
typestring
typearray
contactEmail
descriptionContact email address.
typestring
creationTime
descriptionDomain creation time.
formatgoogle-datetime
typestring
expirationTime
descriptionExpiration time.
formatgoogle-datetime
typestring
favicon
$refFavicon
descriptionIncludes difference hash and MD5 hash of the domain's favicon.
firstSeenTime
descriptionFirst seen timestamp of the domain in the customer's environment.
formatgoogle-datetime
typestring
ianaRegistrarId
descriptionIANA Registrar ID. See https://www.iana.org/assignments/registrar-ids/registrar-ids.xhtml
formatint32
typeinteger
jarm
descriptionDomain's JARM hash.
typestring
lastDnsRecords
descriptionDomain's DNS records from the last scan.
items
$refDNSRecord
typearray
lastDnsRecordsTime
descriptionDate when the DNS records list was retrieved by VirusTotal.
formatgoogle-datetime
typestring
lastHttpsCertificate
$refSSLCertificate
descriptionSSL certificate object retrieved last time the domain was analyzed.
lastHttpsCertificateTime
descriptionWhen the certificate was retrieved by VirusTotal.
formatgoogle-datetime
typestring
lastSeenTime
descriptionLast seen timestamp of the domain in the customer's environment.
formatgoogle-datetime
typestring
name
descriptionThe domain name. This field can be used as an entity indicator for Domain entities.
typestring
nameServer
descriptionRepeated list of name servers.
items
typestring
typearray
popularityRanks
descriptionDomain's position in popularity ranks such as Alexa, Quantcast, Statvoo, etc
items
$refPopularityRank
typearray
prevalence
$refPrevalence
descriptionThe prevalence of the domain within the customer's environment.
privateRegistration
descriptionIndicates whether the domain appears to be using a private registration service to mask the owner's contact information.
typeboolean
registrant
$refUser
descriptionParsed contact information for the registrant of the domain.
registrar
descriptionRegistrar name . FOr example, "Wild West Domains, Inc. (R120-LROR)", "GoDaddy.com, LLC", or "PDR LTD. D/B/A PUBLICDOMAINREGISTRY.COM".
typestring
registryDataRawText
descriptionRegistry Data raw text.
formatbyte
typestring
status
descriptionDomain status. See https://www.icann.org/resources/pages/epp-status-codes-2014-06-16-en for meanings of possible values
typestring
tags
descriptionList of representative attributes.
items
typestring
typearray
tech
$refUser
descriptionParsed contact information for the technical contact for the domain
updateTime
descriptionLast updated time.
formatgoogle-datetime
typestring
whoisRecordRawText
descriptionWHOIS raw text.
formatbyte
typestring
whoisServer
descriptionWhois server name.
typestring
whoisTime
descriptionDate of the last update of the WHOIS record.
formatgoogle-datetime
typestring
zone
$refUser
descriptionParsed contact information for the zone.
typeobject
DoubleSequence
descriptionDoubleSequence represents a sequence of doubles.
idDoubleSequence
properties
doubleVals
descriptiondouble sequence.
items
formatdouble
typenumber
typearray
typeobject
EC
descriptionEC public key information.
idEC
properties
oid
descriptionCurve name.
typestring
pub
descriptionPublic key hexdump.
typestring
typeobject
Element
descriptionNEXT TAG: 5
idElement
properties
association
$refSecurityResult
descriptionMetadata that provides the relevant association for the references in the element. For a detection, this can be the correlated aspect of the references that contributed to the overall detection. For example, may include sub-rule condition, machine learning model metadata, and/or indicators implicated in this component of the detection (using the .about field).
label
descriptionA name that labels the entire references group.
typestring
references
descriptionReferences to model primatives including events and entities that share a common association. Even though a reference can have both UDM and entity, a collection of references (of a single element) will only have one type of message in it (either UDM / Entity).
items
$refReference
typearray
referencesSampled
descriptionCopied from the detection event_sample.too_many_event_samples field. If true, the number of references will be capped at the sample limit (set at rule service). This is applicable to both UDM references and Entity references.
typeboolean
typeobject
Email
descriptionEmail info.
idEmail
properties
bcc
descriptionA list of 'bcc' addresses.
items
typestring
typearray
bounceAddress
descriptionThe envelope from address. https://en.wikipedia.org/wiki/Bounce_address
typestring
cc
descriptionA list of 'cc' addresses.
items
typestring
typearray
from
descriptionThe 'from' address.
typestring
mailId
descriptionThe mail (or message) ID.
typestring
replyTo
descriptionThe 'reply to' address.
typestring
subject
descriptionThe subject line(s) of the email.
items
typestring
typearray
to
descriptionA list of 'to' addresses.
items
typestring
typearray
typeobject
Empty
descriptionA generic empty message that you can re-use to avoid defining duplicated empty messages in your APIs. A typical example is to use it as the request or the response type of an API method. For instance: service Foo { rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty); }
idEmpty
properties
typeobject
EntityChangedCountTimelineBucket
idEntityChangedCountTimelineBucket
properties
entityChangedInfo
items
$refEntityChangedInfo
typearray
totalChangedEntitiesCount
formatint32
typeinteger
typeobject
EntityChangedInfo
idEntityChangedInfo
properties
artifacts
$refFieldAndValue
entityCount
formatint32
typeinteger
typeobject
EntityCount
descriptionCount of different types of entities in the watchlist.
idEntityCount
properties
asset
descriptionOutput only. Count of asset type entities in the watchlist.
formatint32
readOnlyTrue
typeinteger
user
descriptionOutput only. Count of user type entities in the watchlist.
formatint32
readOnlyTrue
typeinteger
typeobject
EntityMetadata
descriptionInformation about the Entity and the product where the entity was created. Next Tag: 17
idEntityMetadata
properties
collectedTimestamp
descriptionGMT timestamp when the entity information was collected by the vendor's local collection infrastructure.
formatgoogle-datetime
typestring
creationTimestamp
descriptionGMT timestamp when the entity described by the product_entity_id was created on the system where data was collected.
formatgoogle-datetime
typestring
description
descriptionHuman-readable description of the entity.
typestring
entityType
descriptionEntity type. If an entity has multiple possible types, this specifies the most specific type.
enum
  • UNKNOWN_ENTITYTYPE
  • ASSET
  • USER
  • GROUP
  • RESOURCE
  • IP_ADDRESS
  • FILE
  • DOMAIN_NAME
  • URL
  • MUTEX
  • METRIC
enumDescriptions
  • @hide_from_doc
  • An asset, such as workstation, laptop, phone, virtual machine, etc.
  • User.
  • Group.
  • Resource.
  • An external IP address.
  • A file.
  • A domain.
  • A url.
  • A mutex.
  • A metric.
typestring
eventMetadata
$refMetadata
descriptionMetadata field from the event.
extracted
additionalProperties
descriptionProperties of the object.
typeany
descriptionFlattened fields extracted from the log.
typeobject
feed
descriptionVendor feed name for a threat indicator feed.
typestring
interval
$refInterval
descriptionValid existence time range for the version of the entity represented by this entity data.
productEntityId
descriptionA vendor-specific identifier that uniquely identifies the entity (e.g. a GUID, LDAP, OID, or similar).
typestring
productName
descriptionProduct name that produced the entity information.
typestring
productVersion
descriptionVersion of the product that produced the entity information.
typestring
sourceLabels
descriptionEntity source metadata labels.
items
$refLabel
typearray
sourceType
descriptionThe source of the entity.
enum
  • SOURCE_TYPE_UNSPECIFIED
  • ENTITY_CONTEXT
  • DERIVED_CONTEXT
  • GLOBAL_CONTEXT
enumDescriptions
  • Default source type
  • Entities ingested from customers (e.g. AD_CONTEXT, DLP_CONTEXT)
  • Entities derived from customer data such as prevalence, artifact first/last seen, or asset/user first seen stats.
  • Global contextual entities such as WHOIS or Safe Browsing.
typestring
structuredFields
additionalProperties
descriptionProperties of the object.
typeany
deprecatedTrue
descriptionStructured fields extracted from the log.
typeobject
threat
descriptionMetadata provided by a threat intelligence feed that identified the entity as malicious.
items
$refSecurityResult
typearray
vendorName
descriptionVendor name of the product that produced the entity information.
typestring
typeobject
EntityPopulationMechanism
descriptionMechanism to populate entities in the watchlist.
idEntityPopulationMechanism
properties
manual
$refManual
descriptionOptional. Entities are added manually.
typeobject
EntityRisk
descriptionStores information related to the risk score of an entity. Next ID: 15
idEntityRisk
properties
DEPRECATEDRiskScore
deprecatedTrue
descriptionDeprecated risk score.
formatint32
typeinteger
detailUri
descriptionLink to the Google Security Operations UI with information about the entity risk score. If the SecOps instance has multiple frontend paths configured, this will be a relative path that can be used to construct the full URL.
typestring
detectionsCount
descriptionNumber of detections that make up the risk score within the time window.
formatint32
typeinteger
firstDetectionTime
descriptionTimestamp of the first detection within the specified time window. This field is empty when there are no detections.
formatgoogle-datetime
typestring
lastDetectionTime
descriptionTimestamp of the last detection within the specified time window. This field is empty when there are no detections.
formatgoogle-datetime
typestring
lastResetTime
descriptionTimestamp for UEBA risk score reset based deduplication. Used specifically for risk based meta rules.
formatgoogle-datetime
typestring
normalizedRiskScore
descriptionNormalized risk score for the entity. This value is between 0-1000.
formatint32
typeinteger
rawRiskDelta
$refRiskDelta
descriptionRepresents the change in raw risk score for an entity between the end of the previous time window and the end of the current time window.
riskDelta
$refRiskDelta
descriptionRepresents the change in risk score for an entity between the end of the previous time window and the end of the current time window.
riskScore
descriptionRaw risk score for the entity.
formatfloat
typenumber
riskVersion
descriptionVersion of the risk score calculation algorithm.
typestring
riskWindow
$refInterval
descriptionTime window used when computing the risk score for an entity, for example 24 hours or 7 days.
riskWindowHasNewDetections
descriptionWhether there are new detections for the risk window.
typeboolean
riskWindowSize
descriptionRisk window duration for the entity.
formatgoogle-duration
typestring
typeobject
ErrorMessage
idErrorMessage
properties
errorText
typestring
type
enum
  • UNDEFINED_ERROR_TYPE
  • INVALID_QUERY_TYPE
  • INVALID_FIELD_PATH_TYPE
  • UNCLOSED_BRACKET_TYPE
  • BACKEND_ERROR_TYPE
  • UNCLOSED_QUOTES_TYPE
  • QUERY_TOO_LARGE_TYPE
enumDescriptions
typestring
typeobject
EventCountTimeline
idEventCountTimeline
properties
buckets
items
$refEventCountTimelineBucket
typearray
sizeOfBucketMs
formatint64
typestring
typeobject
EventCountTimelineBucket
idEventCountTimelineBucket
properties
alertCount
formatint32
typeinteger
baselineAlertCount
formatint32
typeinteger
baselineEventCount
formatint32
typeinteger
baselineTimedEntityCount
formatint32
typeinteger
entityChangedCount
$refEntityChangedCountTimelineBucket
eventCount
formatint32
typeinteger
filteredTimedEntityCount
formatint32
typeinteger
typeobject
Execution
descriptionExecution can be used to store metadata required for what action the UI should execute.
idExecution
properties
metadata
additionalProperties
typestring
descriptionOutput only. The payload to use when executing the action.
readOnlyTrue
typeobject
typeobject
ExifInfo
descriptionExif information.
idExifInfo
properties
company
descriptioncompany name.
typestring
compilationTime
descriptionCompilation time.
formatgoogle-datetime
typestring
entryPoint
descriptionentry point.
formatint64
typestring
fileDescription
descriptiondescription of a file.
typestring
originalFile
descriptionoriginal file name.
typestring
product
descriptionproduct name.
typestring
typeobject
Extension
descriptionCertificate's extensions.
idExtension
properties
authorityKeyId
$refAuthorityKeyId
descriptionIdentifies the public key to be used to verify the signature on this certificate or CRL.
ca
descriptionWhether the subject acts as a certificate authority (CA) or not.
typeboolean
caInfoAccess
descriptionAuthority information access locations are URLs that are added to a certificate in its authority information access extension.
typestring
certTemplateNameDc
descriptionBMP data value "DomainController". See MS Q291010.
typestring
certificatePolicies
descriptionDifferent certificate policies will relate to different applications which may use the certified key.
typestring
crlDistributionPoints
descriptionCRL distribution points to which a certificate user should refer to ascertain if the certificate has been revoked.
typestring
extendedKeyUsage
descriptionOne or more purposes for which the certified public key may be used, in addition to or in place of the basic purposes indicated in the key usage extension field.
typestring
keyUsage
descriptionThe purpose for which the certified public key is used.
typestring
netscapeCertComment
descriptionUsed to include free-form text comments inside certificates.
typestring
netscapeCertificate
descriptionIdentify whether the certificate subject is an SSL client, an SSL server, or a CA.
typeboolean
oldAuthorityKeyId
descriptionWhether the certificate has an old authority key identifier extension.
typeboolean
peLogotype
descriptionWhether the certificate includes a logotype.
typeboolean
subjectAlternativeName
descriptionContains one or more alternative names, using any of a variety of name forms, for the entity that is bound by the CA to the certified public key.
typestring
subjectKeyId
descriptionIdentifies the public key being certified.
typestring
typeobject
Extensions
descriptionExtensions to a UDM event.
idExtensions
properties
auth
$refAuthentication
descriptionAn authentication extension.
entityRisk
$refEntityRisk
descriptionAn entity risk change extension.
vulns
$refVulnerabilities
descriptionA vulnerability extension.
typeobject
Favicon
descriptionDifference hash and MD5 hash of the domain's favicon.
idFavicon
properties
dhash
descriptionDifference hash.
typestring
rawMd5
descriptionFavicon's MD5 hash.
typestring
typeobject
Feedback
idFeedback
properties
comment
descriptionOptional.
typestring
confidenceScore
formatint32
typeinteger
createdTime
formatgoogle-datetime
typestring
disregarded
typeboolean
idpUserId
typestring
priority
descriptionOptional.
enum
  • PRIORITY_UNSPECIFIED
  • PRIORITY_INFO
  • PRIORITY_LOW
  • PRIORITY_MEDIUM
  • PRIORITY_HIGH
  • PRIORITY_CRITICAL
enumDescriptions
  • Default priority level.
  • Informational priority.
  • Low priority.
  • Medium priority.
  • High priority.
  • Critical priority.
typestring
priorityDisplay
descriptionOptional.
typestring
reason
descriptionOptional.
enum
  • REASON_UNSPECIFIED
  • REASON_NOT_MALICIOUS
  • REASON_MALICIOUS
  • REASON_MAINTENANCE
enumDescriptions
  • Default reason.
  • Case or Alert not malicious.
  • Case or Alert is malicious.
  • Case or Alert is under maintenance.
typestring
reputation
enum
  • REPUTATION_UNSPECIFIED
  • USEFUL
  • NOT_USEFUL
enumDescriptions
  • An unspecified reputation.
  • A categorization of the finding as useful.
  • A categorization of the finding as not useful.
typestring
riskScore
formatint32
typeinteger
rootCause
descriptionOptional.
typestring
severity
formatint32
typeinteger
severityDisplay
descriptionOptional.
typestring
status
descriptionOptional.
enum
  • STATUS_UNSPECIFIED
  • NEW
  • REVIEWED
  • CLOSED
  • OPEN
enumDescriptions
  • Unspecified finding status.
  • New finding.
  • When a finding has feedback.
  • When an analyst closes an finding.
  • Open. Used to indicate that a Case / Alert is open.
typestring
verdict
enum
  • VERDICT_UNSPECIFIED
  • TRUE_POSITIVE
  • FALSE_POSITIVE
enumDescriptions
  • An unspecified verdict.
  • A categorization of the finding as a "true positive".
  • A categorization of the finding as a "false positive".
typestring
typeobject
FieldAndValue
idFieldAndValue
properties
entityNamespace
typestring
fieldPath
typestring
kvalueType
enum
  • UNKNOWN
  • COLLECTOR_ID
  • EVENT_SHARD
  • ASSET_IP_ADDRESS
  • MAC
  • HOSTNAME
  • PRODUCT_SPECIFIC_ID
  • NAMESPACE
  • DOMAIN_NAME
  • RESOLVED_IP_ADDRESS
  • STEMMED_DOMAIN_NAME
  • PROCESS_ID
  • FULL_COMMAND_LINE
  • FILE_NAME
  • FILE_PATH
  • HASH_MD5
  • HASH_SHA256
  • HASH_SHA1
  • RAW_PID
  • PARENT_PROCESS_ID
  • EMAIL
  • USERNAME
  • WINDOWS_SID
  • EMPLOYEE_ID
  • PRODUCT_OBJECT_ID
  • USER_DISPLAY_NAME
  • CLOUD_RESOURCE_NAME
  • REGISTRY_KEY
  • REGISTRY_VALUE_DATA
  • REGISTRY_VALUE_NAME
enumDescriptions
typestring
value
typestring
typeobject
FileMetadata
descriptionMetadata about a file. Place metadata about different file types here, for example data from the Microsoft Windows VersionInfo block or digital signer details. Use a different sub-message per file type.
idFileMetadata
properties
pe
$refPeFileMetadata
deprecatedTrue
descriptionMetadata for Microsoft Windows PE files. Deprecate PeFileMetadata in favor of single File proto.
typeobject
FileMetadataCodesign
descriptionFile metadata from the codesign utility.
idFileMetadataCodesign
properties
compilationTime
descriptionCode sign timestamp
formatgoogle-datetime
typestring
format
descriptionCode sign format.
typestring
id
descriptionCode sign identifier.
typestring
teamId
descriptionThe assigned team identifier of the developer who signed the application.
typestring
typeobject
FileMetadataImports
descriptionFile metadata imports.
idFileMetadataImports
properties
functions
descriptionFunction field.
items
typestring
typearray
library
descriptionLibrary field.
typestring
typeobject
FileMetadataPE
descriptionMetadata about the Portable Executable (PE) file.
idFileMetadataPE
properties
compilationExiftoolTime
descriptioninfo.exiftool.TimeStamp.
formatgoogle-datetime
typestring
compilationTime
descriptioninfo.pe-timestamp.
formatgoogle-datetime
typestring
entryPoint
descriptioninfo.pe-entry-point.
formatint64
typestring
entryPointExiftool
descriptioninfo.exiftool.EntryPoint.
formatint64
typestring
imphash
descriptionImphash of the file.
typestring
imports
descriptionFilemetadataImports fields.
items
$refFileMetadataImports
typearray
resource
descriptionFilemetadataPeResourceInfo fields.
items
$refFileMetadataPeResourceInfo
typearray
resourcesLanguageCount
deprecatedTrue
descriptionDeprecated: use resources_language_count_str.
items
$refStringToInt64MapEntry
typearray
resourcesLanguageCountStr
descriptionNumber of resources by language. Example: NEUTRAL: 20, ENGLISH US: 10
items
$refLabel
typearray
resourcesTypeCount
deprecatedTrue
descriptionDeprecated: use resources_type_count_str.
items
$refStringToInt64MapEntry
typearray
resourcesTypeCountStr
descriptionNumber of resources by resource type. Example: RT_ICON: 10, RT_DIALOG: 5
items
$refLabel
typearray
section
descriptionFilemetadataSection fields.
items
$refFileMetadataSection
typearray
signatureInfo
$refFileMetadataSignatureInfo
deprecatedTrue
descriptionFilemetadataSignatureInfo field. deprecated, user File.signature_info instead.
typeobject
FileMetadataPeResourceInfo
descriptionFile metadata for PE resource.
idFileMetadataPeResourceInfo
properties
entropy
descriptionEntropy of the resource.
formatdouble
typenumber
fileType
descriptionFile type. Note that this value may not match any of the well-known type identifiers defined in the ResourceType enum.
typestring
filetypeMagic
descriptionType of resource content, as identified by the magic Python module.
typestring
languageCode
descriptionHuman-readable version of the language and sublanguage identifiers, as defined in the Microsoft Windows PE specification. Examples: | Language | Sublanguage | Field value | | LANG_NEUTRAL | SUBLANG_NEUTRAL | NEUTRAL | | LANG_FRENCH | - | FRENCH | | LANG_ENGLISH | SUBLANG_ENGLISH US | ENGLISH US |
typestring
sha256Hex
descriptionSHA256_hex field..
typestring
typeobject
FileMetadataSection
descriptionFile metadata section.
idFileMetadataSection
properties
entropy
descriptionEntropy of the section.
formatdouble
typenumber
md5Hex
descriptionMD5 hex of the file.
typestring
name
descriptionName of the section.
typestring
rawSizeBytes
descriptionRaw file size in bytes.
formatint64
typestring
virtualSizeBytes
descriptionVirtual file size in bytes.
formatint64
typestring
typeobject
FileMetadataSignatureInfo
descriptionSignature information.
idFileMetadataSignatureInfo
properties
signer
deprecatedTrue
descriptionDeprecated: use signers field.
items
typestring
typearray
signers
descriptionFile metadata signer information. The order of the signers matters. Each element is a higher level authority, being the last the root authority.
items
$refSignerInfo
typearray
verificationMessage
descriptionStatus of the certificate. Valid values are "Signed", "Unsigned" or a description of the certificate anomaly, if found.
typestring
verified
descriptionTrue if verification_message == "Signed"
typeboolean
x509
descriptionList of certificates.
items
$refX509
typearray
typeobject
FilterProperties
idFilterProperties
properties
hidden
typeboolean
stringProperties
additionalProperties
$refStringValues
typeobject
typeobject
FindingVariable
descriptionA structure that holds the value and associated metadata for values extracted while producing a Finding.
idFindingVariable
properties
boolSeq
$refBoolSequence
descriptionThe value in boolsequence format.
boolVal
descriptionThe value in boolean format.
typeboolean
bytesSeq
$refBytesSequence
descriptionThe value in bytessequence format.
bytesVal
descriptionThe value in bytes format.
formatbyte
typestring
doubleSeq
$refDoubleSequence
descriptionThe value in doublesequence format.
doubleVal
descriptionThe value in double format.
formatdouble
typenumber
int64Seq
$refInt64Sequence
descriptionThe value in int64sequence format.
int64Val
descriptionThe value in int64 format.
formatint64
typestring
nullVal
descriptionWhether the value is null.
typeboolean
sourcePath
descriptionThe UDM field path for the field which this value was derived from. Example: `principal.user.username`
typestring
stringSeq
$refStringSequence
descriptionThe value in stringsequence format.
stringVal
descriptionThe value in string format. Enum values are returned as strings.
typestring
type
descriptionThe type of the variable.
enum
  • TYPE_UNSPECIFIED
  • MATCH
  • OUTCOME
enumDescriptions
  • An unspecified variable type.
  • A variable coming from the match conditions.
  • A variable representing significant data that was found in the detection logic.
typestring
uint64Seq
$refUint64Sequence
descriptionThe value in uint64sequence format.
uint64Val
descriptionThe value in uint64 format.
formatuint64
typestring
value
descriptionThe value in string form.
typestring
typeobject
FollowUp
descriptionFollowUp can be used to store metadata required to send a follow up message by the UI.
idFollowUp
properties
followUp
descriptionOutput only. The text to use as input when generating the follow up message.
readOnlyTrue
typestring
typeobject
Ftp
descriptionFTP info.
idFtp
properties
command
descriptionThe FTP command.
typestring
typeobject
FunctionResponse
idFunctionResponse
properties
rows
items
$refFunctionResponseRow
typearray
tooManyRows
typeboolean
typeobject
FunctionResponseRow
idFunctionResponseRow
properties
values
items
$refUdmFieldValue
typearray
typeobject
GoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStats
descriptionLINT.IfChange(stats_data) Stats results when the query is for statistics NEXT TAG = 6;
idGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStats
properties
dataQueryExpression
descriptionExpression that represent the subset of the requested query used to filter data. The expression will be used to enable features such as drill-down from stats results to UDM events. In that case, the new query will be composed by this expression and the expression related to a stats result.
typestring
results
descriptionResult rows that are queried.
items
$refGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnData
typearray
sortOrder
descriptionIndicates the columns used for sorting and the order in which they are sorted. If no ORDER section is specified in the query, this will be empty.
items
$refGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnSort
typearray
tooManyResults
descriptionIf true, there are too many results to return and some have been omitted.
typeboolean
totalResults
descriptionThe total number of results returned.
formatint32
typeinteger
typeobject
GoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnData
descriptionRepresents a single column in the set of columns returned as the stats query result.
idGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnData
properties
column
descriptionUsed to store column names.
typestring
filterExpression
descriptionExpression used to compose a query for filtering/drill-downs related to the data in this column.
typestring
filterable
descriptionTo identify if the column can be used for filtering/drill-downs.
typeboolean
values
descriptionTo store store column data.
items
$refGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnType
typearray
typeobject
GoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnSort
descriptionContains the column name and which direction the column is sorted (ascending or descenging).
idGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnSort
properties
descending
descriptionWhether the column is sorted in descending order (ascending by default);
typeboolean
name
descriptionName of the column.
typestring
typeobject
GoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnType
descriptionSingular vs list of values in a column.
idGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnType
properties
list
$refGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnTypeList
descriptionList of values in a column e.g. IPs
value
$refGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnValue
descriptionSingle value in a column.
typeobject
GoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnTypeList
descriptionStore list of values in a column.
idGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnTypeList
properties
values
descriptionList of values in one cell of the column.
items
$refGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnValue
typearray
typeobject
GoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnValue
descriptionValue of the column based on data type
idGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStatsColumnValue
properties
boolVal
descriptionBoolean value.
typeboolean
bytesVal
descriptionBytes value.
formatbyte
typestring
dateVal
$refDate
descriptionDate values.
doubleVal
descriptionDouble value.
formatdouble
typenumber
int64Val
descriptionInteger value (signed).
formatint64
typestring
nullVal
descriptionTrue if the value is NULL.
typeboolean
protoVal
additionalProperties
descriptionProperties of the object. Contains field @type with type URL.
typeany
descriptionFor any proto values that are not any of the above.
typeobject
stringVal
descriptionString value. Enum values are returned as strings.
typestring
timestampVal
descriptionTimestamp values.
formatgoogle-datetime
typestring
uint64Val
descriptionUn-signed integer value.
formatuint64
typestring
typeobject
Group
descriptionInformation about an organizational group.
idGroup
properties
attribute
$refAttribute
descriptionGeneric entity metadata attributes of the group.
creationTime
deprecatedTrue
descriptionGroup creation time. Deprecated: creation_time should be populated in Attribute as generic metadata.
formatgoogle-datetime
typestring
emailAddresses
descriptionEmail addresses of the group.
items
typestring
typearray
groupDisplayName
descriptionGroup display name. e.g. "Finance".
typestring
productObjectId
descriptionProduct globally unique user object identifier, such as an LDAP Object Identifier.
typestring
windowsSid
descriptionMicrosoft Windows SID of the group.
typestring
typeobject
GroupAggregationByField
idGroupAggregationByField
properties
baselineEventCount
formatint32
typeinteger
eventCount
formatint32
typeinteger
fieldName
typestring
fieldValue
$refUdmFieldValue
fields
items
$refUdmFieldAggregation
typearray
valueCount
formatint32
typeinteger
typeobject
Hardware
descriptionHardware specification details for a resource, including both physical and virtual hardware.
idHardware
properties
cpuClockSpeed
descriptionClock speed of the hardware CPU in MHz.
formatuint64
typestring
cpuMaxClockSpeed
descriptionMaximum possible clock speed of the hardware CPU in MHz.
formatuint64
typestring
cpuModel
descriptionModel description of the hardware CPU (e.g. "2.8 GHz Quad-Core Intel Core i5").
typestring
cpuNumberCores
descriptionNumber of CPU cores.
formatuint64
typestring
cpuPlatform
descriptionPlatform of the hardware CPU (e.g. "Intel Broadwell").
typestring
manufacturer
descriptionHardware manufacturer.
typestring
model
descriptionHardware model.
typestring
ram
descriptionAmount of the hardware ramdom access memory (RAM) in Mb.
formatuint64
typestring
serialNumber
descriptionHardware serial number.
typestring
typeobject
Http
descriptionSpecify the full URL of the HTTP request within "target". Also specify any uploaded or downloaded file information within "source" or "target".
idHttp
properties
method
descriptionThe HTTP request method (e.g. "GET", "POST", "PATCH", "DELETE").
typestring
parsedUserAgent
$refUserAgentProto
descriptionThe parsed user_agent string.
referralUrl
descriptionThe URL for the HTTP referer.
typestring
responseCode
descriptionThe response status code, for example 200, 302, 404, or 500.
formatint32
typeinteger
userAgent
descriptionThe User-Agent request header which includes the application type, operating system, software vendor or software version of the requesting software user agent.
typestring
typeobject
Id
descriptionIdentifier to identify a UDM object like a UDM event, Entity, Collection. The full identifier for persistence is created by setting the 32 most significant bits as the Id.Namespace enum and the rest according to go/udm:ids. This is a convenience wrapper to define the id space enum values and provide an easy interface for RPCs, most persistence use cases should use a denormalized form. See go/udm:ids for background and details.
idId
properties
id
descriptionFull raw ID.
formatbyte
typestring
namespace
descriptionNamespace the id belongs to.
enum
  • NORMALIZED_TELEMETRY
  • RAW_TELEMETRY
  • RULE_DETECTIONS
  • UPPERCASE
  • MACHINE_INTELLIGENCE
  • SECURITY_COMMAND_CENTER
  • UNSPECIFIED
  • SOAR_ALERT
  • VIRUS_TOTAL
enumDescriptions
  • Ingested and Normalized telemetry events
  • Ingested Raw telemetry
  • Chronicle Rules engine
  • Uppercase
  • DSML - Machine Intelligence
  • A normalized telemetry event from Google Security Command Center.
  • Unspecified Namespace
  • An alert coming from other SIEMs via Chronicle SOAR.
  • VirusTotal.
typestring
stringId
descriptionSome ids are stored as strings that are not able to be translated to bytes, so store these separately. Ex. detection id of the form de_aaaaaaaa-aaaa...
typestring
typeobject
IngestionLabel
descriptionRepresentation of an ingestion label type.
idIngestionLabel
properties
ingestionLabelKey
descriptionRequired. The key of the ingestion label. Always required.
typestring
ingestionLabelValue
descriptionOptional. The value of the ingestion label. Optional. An object with no provided value and some key provided would match against the given key and ANY value.
typestring
typeobject
InputsUsed
descriptionInputsUsed is a convenience field that tells us which sources of events (if any) were used in the rule. NEXT TAG: 4
idInputsUsed
properties
usesDetection
descriptionOptional. Whether the rule queries detections.
typeboolean
usesEntity
descriptionOptional. Whether the rule queries entity events.
typeboolean
usesUdm
descriptionOptional. Whether the rule queries UDM events.
typeboolean
typeobject
Instance
descriptionA Instance represents an instantiation of the Instance product.
idInstance
properties
name
descriptionOutput only. The resource name of this instance. Format: projects/{project}/locations/{location}/instances/{instance}
readOnlyTrue
typestring
typeobject
InstanceUdmSearchResponse
idInstanceUdmSearchResponse
properties
baselineEventsCount
formatint32
typeinteger
complete
typeboolean
detections
$refDetections
filteredEventsCount
formatint32
typeinteger
instanceId
typestring
prevalence
$refUdmPrevalenceResponse
progress
formatdouble
typenumber
runtimeErrors
$refRuntimeError
timeline
$refEventCountTimeline
tooManyEvents
typeboolean
typeobject
Int64Sequence
descriptionInt64Sequence represents a sequence of int64s.
idInt64Sequence
properties
int64Vals
descriptionint64 sequence.
items
formatint64
typestring
typearray
typeobject
Interval
descriptionRepresents a time interval, encoded as a Timestamp start (inclusive) and a Timestamp end (exclusive). The start must be less than or equal to the end. When the start equals the end, the interval is empty (matches no time). When both start and end are unspecified, the interval matches any time.
idInterval
properties
endTime
descriptionOptional. Exclusive end of the interval. If specified, a Timestamp matching this interval will have to be before the end.
formatgoogle-datetime
typestring
startTime
descriptionOptional. Inclusive start of the interval. If specified, a Timestamp matching this interval will have to be the same or after the start.
formatgoogle-datetime
typestring
typeobject
Investigation
descriptionRepresents the aggregated state of an investigation such as categorization, severity, and status. Can be expanded to include analyst assignment details and more.
idInvestigation
properties
comments
descriptionComment added by the Analyst.
items
typestring
typearray
priority
descriptionPriority of the Alert or Finding set by analyst.
enum
  • PRIORITY_UNSPECIFIED
  • PRIORITY_INFO
  • PRIORITY_LOW
  • PRIORITY_MEDIUM
  • PRIORITY_HIGH
  • PRIORITY_CRITICAL
enumDescriptions
  • Default priority level.
  • Informational priority.
  • Low priority.
  • Medium priority.
  • High priority.
  • Critical priority.
typestring
reason
descriptionReason for closing the Case or Alert.
enum
  • REASON_UNSPECIFIED
  • REASON_NOT_MALICIOUS
  • REASON_MALICIOUS
  • REASON_MAINTENANCE
enumDescriptions
  • Default reason.
  • Case or Alert not malicious.
  • Case or Alert is malicious.
  • Case or Alert is under maintenance.
typestring
reputation
descriptionDescribes whether a finding was useful or not-useful.
enum
  • REPUTATION_UNSPECIFIED
  • USEFUL
  • NOT_USEFUL
enumDescriptions
  • An unspecified reputation.
  • A categorization of the finding as useful.
  • A categorization of the finding as not useful.
typestring
riskScore
descriptionRisk score for a finding set by an analyst.
formatuint32
typeinteger
rootCause
descriptionRoot cause of the Alert or Finding set by analyst.
typestring
severityScore
descriptionSeverity score for a finding set by an analyst.
formatuint32
typeinteger
status
descriptionDescribes the workflow status of a finding.
enum
  • STATUS_UNSPECIFIED
  • NEW
  • REVIEWED
  • CLOSED
  • OPEN
enumDescriptions
  • Unspecified finding status.
  • New finding.
  • When a finding has feedback.
  • When an analyst closes an finding.
  • Open. Used to indicate that a Case / Alert is open.
typestring
verdict
descriptionDescribes reason a finding investigation was resolved.
enum
  • VERDICT_UNSPECIFIED
  • TRUE_POSITIVE
  • FALSE_POSITIVE
enumDescriptions
  • An unspecified verdict.
  • A categorization of the finding as a "true positive".
  • A categorization of the finding as a "false positive".
typestring
typeobject
IoCStats
descriptionInformation about the threat intelligence source. These fields are used to model Mandiant sources.
idIoCStats
properties
benignCount
descriptionCount of responses where the IoC was identified as benign.
formatint32
typeinteger
firstLevelSource
descriptionName of first level IoC source, for example Mandiant or a third-party.
typestring
iocStatsType
descriptionDescribes the source of the IoCStat.
enum
  • UNSPECIFIED_IOC_STATS_TYPE
  • MANDIANT_SOURCES
  • THIRD_PARTY_SOURCES
  • THREAT_INTELLIGENCE_IOC_STATS
enumDescriptions
  • IoCStat source is unidentified.
  • IoCStat is from a Mandiant Source.
  • IoCStat is from a third-party source.
  • IoCStat is from a threat intelligence feed.
typestring
maliciousCount
descriptionCount of responses where the IoC was identified as malicious.
formatint32
typeinteger
quality
descriptionLevel of confidence in the IoC mapping extracted from the source.
enum
  • UNKNOWN_CONFIDENCE
  • LOW_CONFIDENCE
  • MEDIUM_CONFIDENCE
  • HIGH_CONFIDENCE
enumDescriptions
  • The default confidence level.
  • Low confidence.
  • Medium confidence.
  • High confidence.
typestring
responseCount
descriptionTotal number of response from the source.
formatint32
typeinteger
secondLevelSource
descriptionName of the second-level IoC source, for example Crowdsourced Threat Analysis or Knowledge Graph.
typestring
sourceCount
descriptionNumber of sources from which information was extracted.
formatint32
typeinteger
typeobject
Label
descriptionKey value labels.
idLabel
properties
key
descriptionThe key.
typestring
rbacEnabled
descriptionIndicates whether this label can be used for Data RBAC
typeboolean
source
descriptionWhere the label is derived from.
typestring
value
descriptionThe value.
typestring
typeobject
LatLng
descriptionAn object that represents a latitude/longitude pair. This is expressed as a pair of doubles to represent degrees latitude and degrees longitude. Unless specified otherwise, this object must conform to the WGS84 standard. Values must be within normalized ranges.
idLatLng
properties
latitude
descriptionThe latitude in degrees. It must be in the range [-90.0, +90.0].
formatdouble
typenumber
longitude
descriptionThe longitude in degrees. It must be in the range [-180.0, +180.0].
formatdouble
typenumber
typeobject
LegacyFederatedUdmSearchViewResponse
descriptionResponse to a Federated UDM Search query. This will be used by StreamSearchOperation RPC to return the results of a federated search operation.
idLegacyFederatedUdmSearchViewResponse
properties
activityTimeline
$refEventCountTimeline
descriptionTimeline of event counts broken into hourly/daily buckets to identify activity.
aiOverview
$refAIOverview
descriptionLINT.ThenChange( //depot/google3/google/cloud/chronicle/v1main/dashboard_query.proto:data_sources, //depot/google3/googlex/security/malachite/proto/udm_search.proto:data_sources ) AI generated overview for the search results. Only populated if the AI features are enabled for the customer and generate_ai_overview is set to true in the request.
baselineEventsCount
descriptionThe number of events in the baseline query.
formatint32
typeinteger
complete
descriptionStreaming for this response is done. There will be no additional updates.
typeboolean
dataSources
descriptionDatasource of the query and results in case of a statistics query
items
enum
  • SEARCH_DATA_SOURCE_UNSPECIFIED
  • SEARCH_UDM
  • SEARCH_ENTITY
  • SEARCH_RULE_DETECTIONS
  • SEARCH_RULESETS
enumDescriptions
  • Unspecified data source.
  • Events
  • Entities
  • To be used for detections data source.
  • To be used for ruleset with detections datasource.
typestring
typearray
detectionFieldAggregations
$refAlertFieldAggregations
descriptionList of detection fields with aggregated values. This enabled filtering in the Alerts panel for federated search.
events
$refUdmEventList
descriptionList of UDM events. NOTE: After complete is set to true, the `UdmEventList` message will be omitted from the response. The latest message should be used as reference. If the `UdmEventList` message is returned again, then it should replace the previous value.
fieldAggregations
$refUdmFieldAggregations
descriptionList of UDM fields with aggregated values.
filteredEventsCount
descriptionThe number of events in the snapshot that match the snapshot_query. This is <= `baseline_events_count`. If the snapshot query is empty this will be equivalent to `baseline_events_count`.
formatint32
typeinteger
groupedFieldAggregations
$refUdmFieldAggregations
descriptionList of grouped fields with aggregated values.
instanceAggregations
$refUdmFieldAggregations
descriptionInstance aggregations for the search results. Provides information on the number of events per instance for the aggregations panel in the UI. This allows users to easily drill-down into the individual instances.
instanceUdmSearchResponses
descriptionAll the instance specific UDM search responses.
items
$refInstanceUdmSearchResponse
typearray
operation
descriptionThe name of the operation resource representing the UDM Search operation. This can be passed to `StreamSearchOperation` to fetch stored results or stream the results of an in-progress operation. The metadata type of the operation is `UdmSearchMetadata`. The response type is `LegacyFetchUdmSearchViewResponse`. Format: projects/{project}/locations/{location}/instances/{instance}/operations/{operation}
typestring
progress
descriptionProgress of the query represented as a double between 0 and 1.
formatdouble
typenumber
queryValidationErrors
descriptionParse error for the baseline_query and/or the snapshot_query.
items
$refErrorMessage
typearray
runtimeErrors
descriptionRuntime errors.
items
$refRuntimeError
typearray
stats
$refGoogleCloudChronicleV1alphaLegacyFederatedUdmSearchViewResponseStats
descriptionStats results when the query is for statistics
statsFunctionParameterValidationErrorMessage
descriptionIf the request's stats_function_parameter` is invalid, this field will contain the detailed error message.
typestring
statsFunctionResponse
$refFunctionResponse
descriptionResult for statistical function.
timeline
$refEventCountTimeline
descriptionTimeline of event counts broken into buckets. This populates the trend-over-time chart in the UI.
tooLargeResponse
descriptionIf true, the response to be returned to the UI is too large and some events have been omitted.
typeboolean
tooManyEvents
descriptionIf true, there are too many events to return and some have been omitted.
typeboolean
validBaselineQuery
descriptionIndicates whether the request baseline_query is a valid structured query or not. If not, `query_validation_errors` will include the parse error.
typeboolean
validSnapshotQuery
descriptionIndicates whether the request baseline and snapshot queries are valid. If not, `query_validation_errors` will include the parse error.
typeboolean
typeobject
ListDataAccessLabelsResponse
descriptionResponse message for ListDataAccessLabels.
idListDataAccessLabelsResponse
properties
dataAccessLabels
descriptionList of data access labels.
items
$refDataAccessLabel
typearray
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
typeobject
ListDataAccessScopesResponse
descriptionResponse message for ListDataAccessScopes.
idListDataAccessScopesResponse
properties
dataAccessScopes
descriptionList of data access scopes.
items
$refDataAccessScope
typearray
globalDataAccessScopeGranted
descriptionWhether or not global scope is granted to the user.
typeboolean
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
typeobject
ListOperationsResponse
descriptionThe response message for Operations.ListOperations.
idListOperationsResponse
properties
nextPageToken
descriptionThe standard List next-page token.
typestring
operations
descriptionA list of operations that matches the specified filter in the request.
items
$refOperation
typearray
typeobject
ListReferenceListsResponse
descriptionA response to a request for a list of reference lists.
idListReferenceListsResponse
properties
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
referenceLists
descriptionThe reference lists. Ordered in ascending alphabetical order by name.
items
$refReferenceList
typearray
typeobject
ListRetrohuntsResponse
descriptionResponse message for ListRetrohunts method.
idListRetrohuntsResponse
properties
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
retrohunts
descriptionThe retrohunts from the specified rule.
items
$refRetrohunt
typearray
typeobject
ListRuleDeploymentsResponse
descriptionResponse message for ListRuleDeployments.
idListRuleDeploymentsResponse
properties
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
ruleDeployments
descriptionThe rule deployments from all rules.
items
$refRuleDeployment
typearray
typeobject
ListRuleRevisionsResponse
descriptionResponse message for ListRuleRevisions method.
idListRuleRevisionsResponse
properties
nextPageToken
descriptionA token that can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
rules
descriptionThe revisions of the rule.
items
$refRule
typearray
typeobject
ListRulesResponse
descriptionResponse message for ListRules method.
idListRulesResponse
properties
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
rules
descriptionThe rules from the specified instance.
items
$refRule
typearray
typeobject
ListWatchlistsResponse
descriptionResponse message for listing watchlists.
idListWatchlistsResponse
properties
nextPageToken
descriptionOptional. A token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
watchlists
descriptionOptional. The watchlists from the specified instance.
items
$refWatchlist
typearray
typeobject
Location
descriptionInformation about a location.
idLocation
properties
city
descriptionThe city.
typestring
countryOrRegion
descriptionThe country or region.
typestring
deskName
descriptionDesk name or individual location, typically for an employee in an office. (e.g. "IN-BLR-BCPC-11-1121D").
typestring
floorName
descriptionFloor name, number or a combination of the two for a building. (e.g. "1-A").
typestring
name
descriptionCustom location name (e.g. building or site name like "London Office"). For cloud environments, this is the region (e.g. "us-west2").
typestring
regionCoordinates
$refLatLng
descriptionCoordinates for the associated region. See https://cloud.google.com/vision/docs/reference/rest/v1/LatLng for a description of the fields.
regionLatitude
deprecatedTrue
descriptionDeprecated: use region_coordinates.
formatfloat
typenumber
regionLongitude
deprecatedTrue
descriptionDeprecated: use region_coordinates.
formatfloat
typenumber
state
descriptionThe state.
typestring
typeobject
Manual
descriptionEntities are added manually.
idManual
properties
typeobject
Measure
descriptionDescribes the precomputed measure.
idMeasure
properties
aggregateFunction
descriptionFunction used to calculate the aggregated measure.
enum
  • AGGREGATE_FUNCTION_UNSPECIFIED
  • MIN
  • MAX
  • COUNT
  • SUM
  • AVG
  • STDDEV
enumDescriptions
  • Default value.
  • Minimum.
  • Maximum.
  • Count.
  • Sum.
  • Average.
  • Standard Deviation.
typestring
value
descriptionValue of the aggregated measure.
formatdouble
typenumber
typeobject
Metadata
descriptionGeneral information associated with a UDM event.
idMetadata
properties
baseLabels
$refDataAccessLabels
descriptionData access labels on the base event.
collectedTimestamp
descriptionThe GMT timestamp when the event was collected by the vendor's local collection infrastructure.
formatgoogle-datetime
typestring
description
descriptionA human-readable unparsable description of the event.
typestring
enrichmentLabels
$refDataAccessLabels
descriptionData access labels from all the contextual events used to enrich the base event.
enrichmentState
descriptionThe enrichment state.
enum
  • ENRICHMENT_STATE_UNSPECIFIED
  • ENRICHED
  • UNENRICHED
enumDescriptions
  • Unspecified.
  • The event has been enriched by Chronicle.
  • The event has not been enriched by Chronicle.
typestring
eventTimestamp
descriptionThe GMT timestamp when the event was generated.
formatgoogle-datetime
typestring
eventType
descriptionThe event type. If an event has multiple possible types, this specifies the most specific type.
enum
  • EVENTTYPE_UNSPECIFIED
  • PROCESS_UNCATEGORIZED
  • PROCESS_LAUNCH
  • PROCESS_INJECTION
  • PROCESS_PRIVILEGE_ESCALATION
  • PROCESS_TERMINATION
  • PROCESS_OPEN
  • PROCESS_MODULE_LOAD
  • REGISTRY_UNCATEGORIZED
  • REGISTRY_CREATION
  • REGISTRY_MODIFICATION
  • REGISTRY_DELETION
  • SETTING_UNCATEGORIZED
  • SETTING_CREATION
  • SETTING_MODIFICATION
  • SETTING_DELETION
  • MUTEX_UNCATEGORIZED
  • MUTEX_CREATION
  • FILE_UNCATEGORIZED
  • FILE_CREATION
  • FILE_DELETION
  • FILE_MODIFICATION
  • FILE_READ
  • FILE_COPY
  • FILE_OPEN
  • FILE_MOVE
  • FILE_SYNC
  • USER_UNCATEGORIZED
  • USER_LOGIN
  • USER_LOGOUT
  • USER_CREATION
  • USER_CHANGE_PASSWORD
  • USER_CHANGE_PERMISSIONS
  • USER_STATS
  • USER_BADGE_IN
  • USER_DELETION
  • USER_RESOURCE_CREATION
  • USER_RESOURCE_UPDATE_CONTENT
  • USER_RESOURCE_UPDATE_PERMISSIONS
  • USER_COMMUNICATION
  • USER_RESOURCE_ACCESS
  • USER_RESOURCE_DELETION
  • GROUP_UNCATEGORIZED
  • GROUP_CREATION
  • GROUP_DELETION
  • GROUP_MODIFICATION
  • EMAIL_UNCATEGORIZED
  • EMAIL_TRANSACTION
  • EMAIL_URL_CLICK
  • NETWORK_UNCATEGORIZED
  • NETWORK_FLOW
  • NETWORK_CONNECTION
  • NETWORK_FTP
  • NETWORK_DHCP
  • NETWORK_DNS
  • NETWORK_HTTP
  • NETWORK_SMTP
  • STATUS_UNCATEGORIZED
  • STATUS_HEARTBEAT
  • STATUS_STARTUP
  • STATUS_SHUTDOWN
  • STATUS_UPDATE
  • SCAN_UNCATEGORIZED
  • SCAN_FILE
  • SCAN_PROCESS_BEHAVIORS
  • SCAN_PROCESS
  • SCAN_HOST
  • SCAN_VULN_HOST
  • SCAN_VULN_NETWORK
  • SCAN_NETWORK
  • SCHEDULED_TASK_UNCATEGORIZED
  • SCHEDULED_TASK_CREATION
  • SCHEDULED_TASK_DELETION
  • SCHEDULED_TASK_ENABLE
  • SCHEDULED_TASK_DISABLE
  • SCHEDULED_TASK_MODIFICATION
  • SYSTEM_AUDIT_LOG_UNCATEGORIZED
  • SYSTEM_AUDIT_LOG_WIPE
  • SERVICE_UNSPECIFIED
  • SERVICE_CREATION
  • SERVICE_DELETION
  • SERVICE_START
  • SERVICE_STOP
  • SERVICE_MODIFICATION
  • GENERIC_EVENT
  • RESOURCE_CREATION
  • RESOURCE_DELETION
  • RESOURCE_PERMISSIONS_CHANGE
  • RESOURCE_READ
  • RESOURCE_WRITTEN
  • DEVICE_FIRMWARE_UPDATE
  • DEVICE_CONFIG_UPDATE
  • DEVICE_PROGRAM_UPLOAD
  • DEVICE_PROGRAM_DOWNLOAD
  • ANALYST_UPDATE_VERDICT
  • ANALYST_UPDATE_REPUTATION
  • ANALYST_UPDATE_SEVERITY_SCORE
  • ANALYST_UPDATE_STATUS
  • ANALYST_ADD_COMMENT
  • ANALYST_UPDATE_PRIORITY
  • ANALYST_UPDATE_ROOT_CAUSE
  • ANALYST_UPDATE_REASON
  • ANALYST_UPDATE_RISK_SCORE
  • ENTITY_RISK_CHANGE
enumDeprecated
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • True
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • True
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • True
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
  • False
enumDescriptions
  • Default event type
  • Activity related to a process which does not match any other event types.
  • Process launch.
  • Process injecting into another process.
  • Process privilege escalation.
  • Process termination.
  • Process being opened.
  • Process loading a module.
  • Registry event which does not match any of the other event types.
  • Registry creation.
  • Registry modification.
  • Registry deletion.
  • Settings-related event which does not match any of the other event types.
  • Setting creation.
  • Setting modification.
  • Setting deletion.
  • Any mutex event other than creation.
  • Mutex creation.
  • File event which does not match any of the other event types.
  • File created.
  • File deleted.
  • File modified.
  • File read.
  • File copied. Used for file copies, for example, to a thumb drive.
  • File opened.
  • File moved or renamed.
  • File synced (for example, Google Drive, Dropbox, backup).
  • User activity which does not match any of the other event types.
  • User login.
  • User logout.
  • User creation.
  • User password change event.
  • Change in user permissions.
  • Deprecated. Used to update user info for an LDAP dump.
  • User physically badging into a location.
  • User deletion.
  • User creating a virtual resource. This is equivalent to RESOURCE_CREATION.
  • User updating content of a virtual resource. This is equivalent to RESOURCE_WRITTEN.
  • User updating permissions of a virtual resource. This is equivalent to RESOURCE_PERMISSIONS_CHANGE.
  • User initiating communication through a medium (for example, video).
  • User accessing a virtual resource. This is equivalent to RESOURCE_READ.
  • User deleting a virtual resource. This is equivalent to RESOURCE_DELETION.
  • A group activity that does not fall into one of the other event types.
  • A group creation.
  • A group deletion.
  • A group modification.
  • Email messages
  • An email transaction.
  • Deprecated: use NETWORK_HTTP instead. An email URL click event.
  • A network event that does not fit into one of the other event types.
  • Aggregated flow stats like netflow.
  • Network connection details like from a FW.
  • FTP telemetry.
  • DHCP payload.
  • DNS payload.
  • HTTP telemetry.
  • SMTP telemetry.
  • A status message that does not fit into one of the other event types.
  • Heartbeat indicating product is alive.
  • An agent startup.
  • An agent shutdown.
  • A software or fingerprint update.
  • Scan item that does not fit into one of the other event types.
  • A file scan.
  • Scan process behaviors. Please use SCAN_PROCESS instead.
  • Scan process.
  • Scan results from scanning an entire host device for threats/sensitive documents.
  • Vulnerability scan logs about host vulnerabilities (e.g., out of date software) and network vulnerabilities (e.g., unprotected service detected via a network scan).
  • Vulnerability scan logs about network vulnerabilities.
  • Scan network for suspicious activity
  • Scheduled task event that does not fall into one of the other event types.
  • Scheduled task creation.
  • Scheduled task deletion.
  • Scheduled task being enabled.
  • Scheduled task being disabled.
  • Scheduled task being modified.
  • A system audit log event that is not a wipe.
  • A system audit log wipe.
  • Service event that does not fit into one of the other event types.
  • A service creation.
  • A service deletion.
  • A service start.
  • A service stop.
  • A service modification.
  • Operating system events that are not described by any of the other event types. Might include uncategorized Microsoft Windows event logs.
  • The resource was created/provisioned. This is equivalent to USER_RESOURCE_CREATION.
  • The resource was deleted/deprovisioned. This is equivalent to USER_RESOURCE_DELETION.
  • The resource had it's permissions or ACLs updated. This is equivalent to USER_RESOURCE_UPDATE_PERMISSIONS.
  • The resource was read. This is equivalent to USER_RESOURCE_ACCESS.
  • The resource was written to. This is equivalent to USER_RESOURCE_UPDATE_CONTENT.
  • Firmware update.
  • Configuration update.
  • A program or application uploaded to a device.
  • A program or application downloaded to a device.
  • Analyst update about the Verdict (such as true positive, false positive, or disregard) of a finding.
  • Analyst update about the Reputation (such as useful or not useful) of a finding.
  • Analyst update about the Severity score (0-100) of a finding.
  • Analyst update about the finding status.
  • Analyst addition of a comment for a finding.
  • Analyst update about the priority (such as low, medium, or high) for a finding.
  • Analyst update about the root cause for a finding.
  • Analyst update about the reason (such as malicious or not malicious) for a finding.
  • Analyst update about the risk score (0-100) of a finding.
  • An update to an entity risk score. This event type is restricted to events published by Google Securit Operations Risk Analytics.
typestring
id
descriptionID of the UDM event. Can be used for raw and normalized event retrieval.
formatbyte
typestring
ingestedTimestamp
descriptionThe GMT timestamp when the event was ingested (received) by Chronicle.
formatgoogle-datetime
typestring
ingestionLabels
descriptionUser-configured ingestion metadata labels.
items
$refLabel
typearray
logType
descriptionThe string value of log type.
typestring
productDeploymentId
descriptionThe deployment identifier assigned by the vendor for a product deployment.
typestring
productEventType
descriptionA short, descriptive, human-readable, product-specific event name or type (e.g. "Scanned X", "User account created", "process_start").
typestring
productLogId
descriptionA vendor-specific event identifier to uniquely identify the event (e.g. a GUID).
typestring
productName
descriptionThe name of the product.
typestring
productVersion
descriptionThe version of the product.
typestring
structuredFields
additionalProperties
descriptionProperties of the object.
typeany
deprecatedTrue
descriptionFlattened fields extracted from the log.
typeobject
tags
$refTags
descriptionTags added by Chronicle after an event is parsed. It is an error to populate this field from within a parser.
urlBackToProduct
descriptionA URL that takes the user to the source product console for this event.
typestring
vendorName
descriptionThe name of the product vendor.
typestring
typeobject
Metric
descriptionStores precomputed aggregated analytic data for an entity.
idMetric
properties
dimensions
descriptionAll group by clauses used to calculate the metric.
items
enum
  • DIMENSION_UNSPECIFIED
  • PRINCIPAL_DEVICE
  • TARGET_USER
  • TARGET_DEVICE
  • PRINCIPAL_USER
  • TARGET_IP
  • PRINCIPAL_FILE_HASH
  • PRINCIPAL_COUNTRY
  • SECURITY_CATEGORY
  • NETWORK_ASN
  • CLIENT_CERTIFICATE_HASH
  • DNS_QUERY_TYPE
  • DNS_DOMAIN
  • HTTP_USER_AGENT
  • EVENT_TYPE
  • PRODUCT_NAME
  • PRODUCT_EVENT_TYPE
  • PARENT_FOLDER_PATH
  • TARGET_RESOURCE_NAME
  • PRINCIPAL_APPLICATION
  • TARGET_APPLICATION
  • EMAIL_TO_ADDRESS
  • EMAIL_FROM_ADDRESS
  • MAIL_ID
  • PRINCIPAL_IP
  • SECURITY_ACTION
  • SECURITY_RULE_ID
  • TARGET_NETWORK_ORGANIZATION_NAME
  • PRINCIPAL_NETWORK_ORGANIZATION_NAME
  • PRINCIPAL_PROCESS_FILE_PATH
  • PRINCIPAL_PROCESS_FILE_HASH
  • SECURITY_RESULT_RULE_NAME
  • TARGET_RESOURCE_LABEL_KEY
  • VENDOR_NAME
  • TARGET_RESOURCE_TYPE
  • TARGET_LOCATION_NAME
enumDescriptions
  • Default
  • Principal Device
  • Target User
  • Target Device
  • Principal User
  • Target IP
  • Principal File Hash
  • Principal Country
  • Security Category
  • Network ASN
  • Client Certificate Hash
  • DNS Query Type
  • DNS Domain
  • HTTP User Agent
  • Event Type
  • Product Name
  • Product Event Type
  • Parent Folder Path
  • Target resource Name
  • Principal Application.
  • Target Application.
  • Email To Address.
  • Email From Address.
  • Mail Id.
  • Principal IP.
  • Security Action.
  • Security Rule Id.
  • Target Network Organization name.
  • Principal Network Organization name.
  • Principal Process File Path.
  • Principal Process File SHA256 Hash.
  • Security Result rule name.
  • Target Resource label key.
  • Vendor name.
  • Target Resource type.
  • Target Location name.
typestring
typearray
exportWindow
descriptionExport window for which the metric was exported.
formatint64
typestring
firstSeen
descriptionTimestamp of the first time the entity was seen in the environment.
formatgoogle-datetime
typestring
lastSeen
descriptionTime stamp of the last time last time the entity was seen in the environment.
formatgoogle-datetime
typestring
metricName
descriptionName of the analytic.
enum
  • METRIC_NAME_UNSPECIFIED
  • NETWORK_BYTES_INBOUND
  • NETWORK_BYTES_OUTBOUND
  • NETWORK_BYTES_TOTAL
  • AUTH_ATTEMPTS_SUCCESS
  • AUTH_ATTEMPTS_FAIL
  • AUTH_ATTEMPTS_TOTAL
  • DNS_BYTES_OUTBOUND
  • NETWORK_FLOWS_INBOUND
  • NETWORK_FLOWS_OUTBOUND
  • NETWORK_FLOWS_TOTAL
  • DNS_QUERIES_SUCCESS
  • DNS_QUERIES_FAIL
  • DNS_QUERIES_TOTAL
  • FILE_EXECUTIONS_SUCCESS
  • FILE_EXECUTIONS_FAIL
  • FILE_EXECUTIONS_TOTAL
  • HTTP_QUERIES_SUCCESS
  • HTTP_QUERIES_FAIL
  • HTTP_QUERIES_TOTAL
  • WORKSPACE_EMAILS_SENT_TOTAL
  • WORKSPACE_TOTAL_DOWNLOAD_ACTIONS
  • WORKSPACE_TOTAL_CHANGE_ACTIONS
  • WORKSPACE_AUTH_ATTEMPTS_TOTAL
  • WORKSPACE_NETWORK_BYTES_OUTBOUND
  • WORKSPACE_NETWORK_BYTES_TOTAL
  • ALERT_EVENT_NAME_COUNT
  • RESOURCE_CREATION_TOTAL
  • RESOURCE_CREATION_SUCCESS
  • RESOURCE_READ_SUCCESS
  • RESOURCE_READ_FAIL
  • RESOURCE_DELETION_SUCCESS
enumDescriptions
  • Default
  • Total received network bytes.
  • Total network sent bytes.
  • Total network sent bytes and received bytes.
  • Successful authentication attempts.
  • Failed authentication attempts.
  • Total authentication attempts.
  • Total number of sent bytes for DNS events.
  • Total number of events having non-null received bytes.
  • Total number of events having non-null sent bytes.
  • Total events having non-null sent or received bytes.
  • DNS query success count - Number of events with response_code = 0.
  • Number of events with response_code != 0.
  • Total number of DNS queries made.
  • Number of successfule file executions.
  • Number of failed file executions.
  • Total number file executions.
  • Number of successful HTTP queries.
  • Number of failed HTTP queries.
  • Total number of HTTP queries.
  • Total number of emails sent in Google Workspace.
  • Total number of download actions in Google Workspace.
  • Total number of change actions in Google Workspace.
  • Total number of authentication attempts in Google Workspace.
  • Number of outbound network bytes (total sent) in Google Workspace.
  • Total number of network bytes (both sent and received) in Google Workspace.
  • Track number of alerts fired by EDR/SENTINEL/MICROSOFT_GRAPH.
  • First-time analytic tracking successful resource creations.
  • Volume-based analytic tracking successful resource creations.
  • Volume-based analytic tracking successful resource reads.
  • Volume-based analytic tracking failed resource reads.
  • Volume-based analytic tracking successful resource deletions.
typestring
sumMeasure
$refMeasure
descriptionSum of all precomputed measures for the given metric.
totalEvents
descriptionTotal number of events used to calculate the given precomputed metric.
formatint64
typestring
typeobject
Navigation
descriptionNavigation can be used to store the metadata required to navigate the user to a new URL.
idNavigation
properties
targetUri
descriptionOutput only. The URI to redirect the user to.
readOnlyTrue
typestring
typeobject
Network
descriptionA network event.
idNetwork
properties
applicationProtocol
descriptionThe application protocol.
enum
  • UNKNOWN_APPLICATION_PROTOCOL
  • AFP
  • APPC
  • AMQP
  • ATOM
  • BEEP
  • BITCOIN
  • BIT_TORRENT
  • CFDP
  • CIP
  • COAP
  • COTP
  • DCERPC
  • DDS
  • DEVICE_NET
  • DHCP
  • DICOM
  • DNP3
  • DNS
  • E_DONKEY
  • ENRP
  • FAST_TRACK
  • FINGER
  • FREENET
  • FTAM
  • GOOSE
  • GOPHER
  • GRPC
  • HL7
  • H323
  • HTTP
  • HTTPS
  • IEC104
  • IRCP
  • KADEMLIA
  • KRB5
  • LDAP
  • LPD
  • MIME
  • MMS
  • MODBUS
  • MQTT
  • NETCONF
  • NFS
  • NIS
  • NNTP
  • NTCIP
  • NTP
  • OSCAR
  • PNRP
  • PTP
  • QUIC
  • RDP
  • RELP
  • RIP
  • RLOGIN
  • RPC
  • RTMP
  • RTP
  • RTPS
  • RTSP
  • SAP
  • SDP
  • SIP
  • SLP
  • SMB
  • SMTP
  • SNMP
  • SNTP
  • SSH
  • SSMS
  • STYX
  • SV
  • TCAP
  • TDS
  • TOR
  • TSP
  • VTP
  • WHOIS
  • WEB_DAV
  • X400
  • X500
  • XMPP
enumDescriptions
  • The default application protocol.
  • Apple Filing Protocol.
  • Advanced Program-to-Program Communication.
  • Advanced Message Queuing Protocol.
  • Publishing Protocol.
  • Block Extensible Exchange Protocol.
  • Crypto currency protocol.
  • Peer-to-peer file sharing.
  • Coherent File Distribution Protocol.
  • Common Industrial Protocol.
  • Constrained Application Protocol.
  • Connection Oriented Transport Protocol.
  • DCE/RPC.
  • Data Distribution Service.
  • Automation industry protocol.
  • DHCP.
  • Digital Imaging and Communications in Medicine Protocol.
  • Distributed Network Protocol 3 (DNP3)
  • DNS.
  • Classic file sharing protocol.
  • Endpoint Handlespace Redundancy Protocol.
  • Filesharing peer-to-peer protocol.
  • User Information Protocol.
  • Censorship resistant peer-to-peer network.
  • File Transfer Access and Management.
  • GOOSE Protocol.
  • Gopher protocol.
  • gRPC Remote Procedure Call.
  • Health Level Seven.
  • Packet-based multimedia communications system.
  • HTTP.
  • HTTPS.
  • IEC 60870-5-104 (IEC 104) Protocol.
  • Internet Relay Chat Protocol.
  • Peer-to-peer hashtables.
  • Kerberos 5.
  • Lightweight Directory Access Protocol.
  • Line Printer Daemon Protocol.
  • Multipurpose Internet Mail Extensions and Secure MIME.
  • Multimedia Messaging Service.
  • Serial communications protocol.
  • Message Queuing Telemetry Transport.
  • Network Configuration.
  • Network File System.
  • Network Information Service.
  • Network News Transfer Protocol.
  • National Transportation Communications for Intelligent Transportation System.
  • Network Time Protocol.
  • AOL Instant Messenger Protocol.
  • Peer Name Resolution Protocol.
  • Precision Time Protocol.
  • QUIC.
  • Remote Desktop Protocol.
  • Reliable Event Logging Protocol.
  • Routing Information Protocol.
  • Remote Login in UNIX Systems.
  • Remote Procedure Call.
  • Real Time Messaging Protocol.
  • Real-time Transport Protocol.
  • Real Time Publish Subscribe.
  • Real Time Streaming Protocol.
  • Session Announcement Protocol.
  • Session Description Protocol.
  • Session Initiation Protocol.
  • Service Location Protocol.
  • Server Message Block.
  • Simple Mail Transfer Protocol.
  • Simple Network Management Protocol.
  • Simple Network Time Protocol.
  • Secure Shell.
  • Secure SMS Messaging Protocol.
  • Styx/9P - Plan 9 from Bell Labs distributed file system protocol.
  • Sampled Values Protocol.
  • Transaction Capabilities Application Part.
  • Tabular Data Stream.
  • Anonymity network.
  • Time Stamp Protocol.
  • Virtual Terminal Protocol.
  • Remote Directory Access Protocol.
  • Web Distributed Authoring and Versioning.
  • Message Handling Service Protocol.
  • Directory Access Protocol (DAP).
  • Extensible Messaging and Presence Protocol.
typestring
applicationProtocolVersion
descriptionThe version of the application protocol. e.g. "1.1, 2.0"
typestring
asn
descriptionAutonomous system number.
typestring
carrierName
descriptionCarrier identification.
typestring
communityId
descriptionCommunity ID network flow value.
typestring
dhcp
$refDhcp
descriptionDHCP info.
direction
descriptionThe direction of network traffic.
enum
  • UNKNOWN_DIRECTION
  • INBOUND
  • OUTBOUND
  • BROADCAST
enumDescriptions
  • The default direction.
  • An inbound request.
  • An outbound request.
  • A broadcast.
typestring
dns
$refDns
descriptionDNS info.
dnsDomain
descriptionDNS domain name.
typestring
email
$refEmail
descriptionEmail info for the sender/recipient.
ftp
$refFtp
descriptionFTP info.
http
$refHttp
descriptionHTTP info.
ipProtocol
descriptionThe IP protocol.
enum
  • UNKNOWN_IP_PROTOCOL
  • ICMP
  • IGMP
  • TCP
  • UDP
  • IP6IN4
  • GRE
  • ESP
  • ICMP6
  • EIGRP
  • ETHERIP
  • PIM
  • VRRP
  • SCTP
enumDescriptions
  • The default protocol.
  • ICMP.
  • IGMP
  • TCP.
  • UDP.
  • IPv6 Encapsulation
  • Generic Routing Encapsulation
  • Encapsulating Security Payload
  • ICMPv6
  • Enhanced Interior Gateway Routing
  • Ethernet-within-IP Encapsulation
  • Protocol Independent Multicast
  • Virtual Router Redundancy Protocol
  • Stream Control Transmission Protocol
typestring
ipSubnetRange
descriptionAssociated human-readable IP subnet range (e.g. 10.1.2.0/24).
typestring
organizationName
descriptionOrganization name (e.g Google).
typestring
parentSessionId
descriptionThe ID of the parent network session.
typestring
receivedBytes
descriptionThe number of bytes received.
formatuint64
typestring
receivedPackets
descriptionThe number of packets received.
formatint64
typestring
sentBytes
descriptionThe number of bytes sent.
formatuint64
typestring
sentPackets
descriptionThe number of packets sent.
formatint64
typestring
sessionDuration
descriptionThe duration of the session as the number of seconds and nanoseconds. For seconds, network.session_duration.seconds, the type is a 64-bit integer. For nanoseconds, network.session_duration.nanos, the type is a 32-bit integer.
formatgoogle-duration
typestring
sessionId
descriptionThe ID of the network session.
typestring
smtp
$refSmtp
descriptionSMTP info. Store fields specific to SMTP not covered by Email.
tls
$refTls
descriptionTLS info.
typeobject
Noun
descriptionThe Noun type is used to represent the different entities in an event: principal, src, target, observer, intermediary, and about. It stores attributes known about the entity. For example, if the entity is a device with multiple IP or MAC addresses, it stores the IP and MAC addresses that are relevant to the event.
idNoun
properties
administrativeDomain
descriptionDomain which the device belongs to (for example, the Microsoft Windows domain).
typestring
application
descriptionThe name of an application or service. Some SSO solutions only capture the name of a target application such as "Atlassian" or "Chronicle".
typestring
artifact
$refArtifact
descriptionInformation about an artifact.
asset
$refAsset
descriptionInformation about the asset.
assetId
descriptionThe asset ID. This field can be used as an entity indicator for asset entities.
typestring
cloud
$refCloud
deprecatedTrue
descriptionCloud metadata. Deprecated: cloud should be populated in entity Attribute as generic metadata (e.g. asset.attribute.cloud).
domain
$refDomain
descriptionInformation about the domain.
email
descriptionEmail address. Only filled in for security_result.about
typestring
file
$refBackstoryFile
descriptionInformation about the file.
group
$refGroup
descriptionInformation about the group.
hostname
descriptionClient hostname or domain name field. Hostname also doubles as the domain for remote entities. This field can be used as an entity indicator for asset entities.
typestring
investigation
$refInvestigation
descriptionAnalyst feedback/investigation for alerts.
ip
descriptionA list of IP addresses associated with a network connection. This field can be used as an entity indicator for asset entities.
items
typestring
typearray
ipGeoArtifact
descriptionEnriched geographic information corresponding to an IP address. Specifically, location and network data.
items
$refArtifact
typearray
ipLocation
deprecatedTrue
descriptionDeprecated: use ip_geo_artifact.location instead.
items
$refLocation
typearray
labels
deprecatedTrue
descriptionLabels are key-value pairs. For example: key = "env", value = "prod". Deprecated: labels should be populated in entity Attribute as generic metadata (e.g. user.attribute.labels).
items
$refLabel
typearray
location
$refLocation
descriptionPhysical location. For cloud environments, set the region in location.name.
mac
descriptionList of MAC addresses associated with a device. This field can be used as an entity indicator for asset entities.
items
typestring
typearray
namespace
descriptionNamespace which the device belongs to, such as "AD forest". Uses for this field include Microsoft Windows AD forest, the name of subsidiary, or the name of acquisition. This field can be used along with an asset indicator to identify an asset.
typestring
natIp
descriptionA list of NAT translated IP addresses associated with a network connection.
items
typestring
typearray
natPort
descriptionNAT external network port number when a specific network connection is described within an event.
formatint32
typeinteger
network
$refNetwork
descriptionNetwork details, including sub-messages with details on each protocol (for example, DHCP, DNS, or HTTP).
objectReference
$refId
descriptionFinding to which the Analyst updated the feedback.
platform
descriptionPlatform.
enum
  • UNKNOWN_PLATFORM
  • WINDOWS
  • MAC
  • LINUX
  • GCP
  • AWS
  • AZURE
  • IOS
  • ANDROID
  • CHROME_OS
enumDeprecated
  • False
  • False
  • False
  • False
  • True
  • True
  • True
  • False
  • False
  • False
enumDescriptions
  • Default value.
  • Microsoft Windows.
  • macOS.
  • Linux.
  • Deprecated: see cloud.environment.
  • Deprecated: see cloud.environment.
  • Deprecated: see cloud.environment.
  • IOS
  • Android
  • Chrome OS
typestring
platformPatchLevel
descriptionPlatform patch level. For example, "Build 17134.48"
typestring
platformVersion
descriptionPlatform version. For example, "Microsoft Windows 1803".
typestring
port
descriptionSource or destination network port number when a specific network connection is described within an event.
formatint32
typeinteger
process
$refProcess
descriptionInformation about the process.
processAncestors
descriptionInformation about the process's ancestors ordered from immediate ancestor (parent process) to root. Note: process_ancestors is only populated when data is exported to BigQuery since recursive fields (e.g. process.parent_process) are not supported by BigQuery.
items
$refProcess
typearray
registry
$refRegistry
descriptionRegistry information.
resource
$refResource
descriptionInformation about the resource (e.g. scheduled task, calendar entry). This field should not be used for files, registry, or processes because these objects are already part of Noun.
resourceAncestors
descriptionInformation about the resource's ancestors ordered from immediate ancestor (starting with parent resource).
items
$refResource
typearray
securityResult
descriptionA list of security results.
items
$refSecurityResult
typearray
url
descriptionThe URL.
typestring
urlMetadata
$refUrl
descriptionInformation about the URL.
user
$refUser
descriptionInformation about the user.
userManagementChain
descriptionInformation about the user's management chain (reporting hierarchy). Note: user_management_chain is only populated when data is exported to BigQuery since recursive fields (e.g. user.managers) are not supported by BigQuery.
items
$refUser
typearray
typeobject
NtfsFileMetadata
descriptionNTFS-specific file metadata.
idNtfsFileMetadata
properties
changeTime
descriptionNTFS MFT entry changed timestamp.
formatgoogle-datetime
typestring
filenameAccessTime
descriptionNTFS $FILE_NAME attribute accessed timestamp.
formatgoogle-datetime
typestring
filenameChangeTime
descriptionNTFS $FILE_NAME attribute changed timestamp.
formatgoogle-datetime
typestring
filenameCreateTime
descriptionNTFS $FILE_NAME attribute created timestamp.
formatgoogle-datetime
typestring
filenameModifyTime
descriptionNTFS $FILE_NAME attribute modified timestamp.
formatgoogle-datetime
typestring
typeobject
Operation
descriptionThis resource represents a long-running operation that is the result of a network API call.
idOperation
properties
done
descriptionIf the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available.
typeboolean
error
$refStatus
descriptionThe error result of the operation in case of failure or cancellation.
metadata
additionalProperties
descriptionProperties of the object. Contains field @type with type URL.
typeany
descriptionService-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any.
typeobject
name
descriptionThe server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`.
typestring
response
additionalProperties
descriptionProperties of the object. Contains field @type with type URL.
typeany
descriptionThe normal, successful response of the operation. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`.
typeobject
typeobject
Option
descriptionDHCP options.
idOption
properties
code
descriptionCode. See RFC1533.
formatuint32
typeinteger
data
descriptionData.
formatbyte
typestring
typeobject
PDFInfo
descriptionInformation about the PDF file structure. See https://developers.virustotal.com/reference/pdf_info
idPDFInfo
properties
acroform
descriptionNumber of /AcroForm tags found in the PDF.
formatint64
typestring
autoaction
descriptionNumber of /AA tags found in the PDF.
formatint64
typestring
embeddedFile
descriptionNumber of /EmbeddedFile tags found in the PDF.
formatint64
typestring
encrypted
descriptionWhether the document is encrypted or not. This is defined by the /Encrypt tag.
formatint64
typestring
endobjCount
descriptionNumber of object definitions (endobj keyword).
formatint64
typestring
endstreamCount
descriptionNumber of defined stream objects (stream keyword).
formatint64
typestring
flash
descriptionNumber of /RichMedia tags found in the PDF.
formatint64
typestring
header
descriptionPDF version.
typestring
javascript
descriptionNumber of /JavaScript tags found in the PDF file. Should be the same as the js field in normal scenarios.
formatint64
typestring
jbig2Compression
descriptionNumber of /JBIG2Decode tags found in the PDF.
formatint64
typestring
js
descriptionNumber of /JS tags found in the PDF file. Should be the same as javascript field in normal scenarios.
formatint64
typestring
launchActionCount
descriptionNumber of /Launch tags found in the PDF file.
formatint64
typestring
objCount
descriptionNumber of objects definitions (obj keyword).
formatint64
typestring
objectStreamCount
descriptionNumber of object streams.
formatint64
typestring
openaction
descriptionNumber of /OpenAction tags found in the PDF.
formatint64
typestring
pageCount
descriptionNumber of pages in the PDF.
formatint64
typestring
startxref
descriptionNumber of startxref keywords in the PDF.
formatint64
typestring
streamCount
descriptionNumber of defined stream objects (stream keyword).
formatint64
typestring
suspiciousColors
descriptionNumber of colors expressed with more than 3 bytes (CVE-2009-3459).
formatint64
typestring
trailer
descriptionNumber of trailer keywords in the PDF.
formatint64
typestring
xfa
descriptionNumber of \XFA tags found in the PDF.
formatint64
typestring
xref
descriptionNumber of xref keywords in the PDF.
formatint64
typestring
typeobject
PeFileMetadata
descriptionMetadata about a Microsoft Windows Portable Executable.
idPeFileMetadata
properties
importHash
descriptionHash of PE imports.
typestring
typeobject
Permission
descriptionSystem permission for resource access and modification.
idPermission
properties
description
descriptionDescription of the permission (e.g. 'Ability to update detect rules').
typestring
name
descriptionName of the permission (e.g. chronicle.analyst.updateRule).
typestring
type
descriptionType of the permission.
enum
  • UNKNOWN_PERMISSION_TYPE
  • ADMIN_WRITE
  • ADMIN_READ
  • DATA_WRITE
  • DATA_READ
enumDescriptions
  • Default permission type.
  • Administrator write permission.
  • Administrator read permission.
  • Data resource access write permission.
  • Data resource access read permission.
typestring
typeobject
PlatformSoftware
descriptionPlatform software information about an operating system.
idPlatformSoftware
properties
platform
descriptionThe platform operating system.
enum
  • UNKNOWN_PLATFORM
  • WINDOWS
  • MAC
  • LINUX
  • GCP
  • AWS
  • AZURE
  • IOS
  • ANDROID
  • CHROME_OS
enumDeprecated
  • False
  • False
  • False
  • False
  • True
  • True
  • True
  • False
  • False
  • False
enumDescriptions
  • Default value.
  • Microsoft Windows.
  • macOS.
  • Linux.
  • Deprecated: see cloud.environment.
  • Deprecated: see cloud.environment.
  • Deprecated: see cloud.environment.
  • IOS
  • Android
  • Chrome OS
typestring
platformPatchLevel
descriptionThe platform software patch level ( e.g. "Build 17134.48", "SP1").
typestring
platformVersion
descriptionThe platform software version ( e.g. "Microsoft Windows 1803").
typestring
typeobject
PopularityRank
descriptionDomain's position in popularity ranks for sources such as Alexa, Quantcast, or Statvoo.
idPopularityRank
properties
giver
descriptionName of the rank serial number hexdump.
typestring
ingestionTime
descriptionTimestamp when the rank was ingested.
formatgoogle-datetime
typestring
rank
descriptionRank position.
formatint64
typestring
typeobject
Prevalence
descriptionThe prevalence of a resource within the customer's environment. This measures how common it is for assets to access the resource.
idPrevalence
properties
dayCount
descriptionThe number of days over which rolling_max is calculated.
formatint32
typeinteger
dayMax
descriptionThe max prevalence score in a day interval window.
formatint32
typeinteger
dayMaxSubDomains
descriptionThe max prevalence score in a day interval window across sub-domains. This field is only valid for domains.
formatint32
typeinteger
rollingMax
descriptionThe maximum number of assets per day accessing the resource over the trailing day_count days.
formatint32
typeinteger
rollingMaxSubDomains
descriptionThe maximum number of assets per day accessing the domain along with sub-domains over the trailing day_count days. This field is only valid for domains.
formatint32
typeinteger
typeobject
Process
descriptionInformation about a process.
idProcess
properties
accessMask
descriptionA bit mask representing the level of access.
formatuint64
typestring
commandLine
descriptionThe command line command that created the process. This field can be used as an entity indicator for process entities.
typestring
commandLineHistory
descriptionThe command line history of the process.
items
typestring
typearray
egid
descriptionThe effective group ID of the process.
typestring
euid
descriptionThe effective user ID of the process.
typestring
file
$refBackstoryFile
descriptionInformation about the file in use by the process.
integrityLevelRid
descriptionThe Microsoft Windows integrity level relative ID (RID) of the process.
formatuint64
typestring
parentPid
deprecatedTrue
descriptionThe ID of the parent process. Deprecated: use parent_process.pid instead.
typestring
parentProcess
$refProcess
descriptionInformation about the parent process.
pgid
descriptionThe identifier that points to the process group ID leader.
typestring
pid
descriptionThe process ID. This field can be used as an entity indicator for process entities.
typestring
productSpecificParentProcessId
deprecatedTrue
descriptionA product specific id for the parent process. Please use parent_process.product_specific_process_id instead.
typestring
productSpecificProcessId
descriptionA product specific process id.
typestring
rgid
descriptionThe real group ID of the process.
typestring
ruid
descriptionThe real user ID of the process.
typestring
sessionLeaderPid
descriptionThe process ID of the session leader process.
typestring
tokenElevationType
descriptionThe elevation type of the process on Microsoft Windows. This determines if any privileges are removed when UAC is enabled.
enum
  • UNKNOWN
  • TYPE_1
  • TYPE_2
  • TYPE_3
enumDescriptions
  • An undetermined token type.
  • A full token with no privileges removed or groups disabled.
  • An elevated token with no privileges removed or groups disabled. Used when running as administrator.
  • A limited token with administrative privileges removed and administrative groups disabled.
typestring
tty
descriptionThe teletype terminal which the command was executed within.
typestring
typeobject
ProviderMLVerdict
descriptionDeprecated. MLVerdict result provided from threat providers, like Mandiant. These fields are used to model Mandiant sources.
idProviderMLVerdict
properties
benignCount
descriptionCount of responses where this IoC was marked benign.
formatint32
typeinteger
confidenceScore
descriptionConfidence score of the verdict.
formatint32
typeinteger
maliciousCount
descriptionCount of responses where this IoC was marked malicious.
formatint32
typeinteger
mandiantSources
descriptionList of mandiant sources from which the verdict was generated.
items
$refSource
typearray
sourceProvider
descriptionSource provider giving the ML verdict.
typestring
thirdPartySources
descriptionList of third-party sources from which the verdict was generated.
items
$refSource
typearray
typeobject
PublicKey
descriptionSubject public key info.
idPublicKey
properties
algorithm
descriptionAny of "RSA", "DSA" or "EC". Indicates the algorithm used to generate the certificate.
typestring
rsa
$refRSA
descriptionRSA public key information.
typeobject
Question
descriptionDNS Questions. See RFC1035, section 4.1.2.
idQuestion
properties
class
descriptionThe code specifying the class of the query.
formatuint32
typeinteger
name
descriptionThe domain name.
typestring
prevalence
$refPrevalence
descriptionThe prevalence of the domain within the customer's environment.
type
descriptionThe code specifying the type of the query.
formatuint32
typeinteger
typeobject
RSA
descriptionRSA public key information.
idRSA
properties
exponent
descriptionKey exponent hexdump.
typestring
keySize
descriptionKey size.
formatint64
typestring
modulus
descriptionKey modulus hexdump.
typestring
typeobject
Reference
descriptionReference to model primatives including event and entity. As support is added for fast retrieval of objects by identifiers, this will be expanded to include ID references rather than full object copies. BEGIN GOOGLE-INTERNAL See go/udm:ids for additional details. END GOOGLE-INTERNAL
idReference
properties
entity
$refBackstoryEntity
descriptionEntity being referenced. End one-of
event
$refUDM
descriptionOnly one of event or entity will be populated for a single reference. Start one-of Event being referenced.
id
$refId
descriptionId being referenced. This field will also be populated for both event and entity with the event id. For detections, only this field will be populated.
typeobject
ReferenceList
descriptionA reference list. Reference lists are user-defined lists of values which users can use in multiple Rules.
idReferenceList
properties
description
descriptionRequired. A user-provided description of the reference list.
typestring
displayName
descriptionOutput only. The unique display name of the reference list.
readOnlyTrue
typestring
entries
descriptionRequired. The entries of the reference list. When listed, they are returned in the order that was specified at creation or update. The combined size of the values of the reference list may not exceed 6MB. This is returned only when the view is REFERENCE_LIST_VIEW_FULL.
items
$refReferenceListEntry
typearray
name
descriptionOutput only. The resource name of the reference list. Format: projects/{project}/locations/{location}/instances/{instance}/referenceLists/{reference_list}
readOnlyTrue
typestring
revisionCreateTime
descriptionOutput only. The timestamp when the reference list was last updated.
formatgoogle-datetime
readOnlyTrue
typestring
ruleAssociationsCount
descriptionOutput only. The count of self-authored rules using the reference list.
formatint32
readOnlyTrue
typeinteger
rules
descriptionOutput only. The resource names for the associated self-authored Rules that use this reference list. This is returned only when the view is REFERENCE_LIST_VIEW_FULL.
items
typestring
readOnlyTrue
typearray
scopeInfo
$refScopeInfo
descriptionOutput only. The scope info of the reference list. During reference list creation, if this field is not set, the reference list without scopes (an unscoped list) will be created for an unscoped user. For a scoped user, this field must be set. During reference list update, if scope_info is requested to be updated, this field must be set.
readOnlyTrue
syntaxType
descriptionRequired. The syntax type indicating how list entries should be validated.
enum
  • REFERENCE_LIST_SYNTAX_TYPE_UNSPECIFIED
  • REFERENCE_LIST_SYNTAX_TYPE_PLAIN_TEXT_STRING
  • REFERENCE_LIST_SYNTAX_TYPE_REGEX
  • REFERENCE_LIST_SYNTAX_TYPE_CIDR
enumDescriptions
  • Defaults to REFERENCE_LIST_SYNTAX_TYPE_PLAIN_TEXT_STRING.
  • List contains plain text patterns.
  • List contains only Regular Expression patterns.
  • List contains only CIDR patterns.
typestring
typeobject
ReferenceListEntry
descriptionAn entry in a reference list.
idReferenceListEntry
properties
value
descriptionRequired. The value of the entry. Maximum length is 512 characters.
typestring
typeobject
ReferenceListScope
descriptionReferenceListScope specifies the list of scope names of the reference list.
idReferenceListScope
properties
scopeNames
descriptionOptional. The list of scope names of the reference list. The scope names should be full resource names and should be of the format: "projects/{project}/locations/{location}/instances/{instance}/dataAccessScopes/{scope_name}".
items
typestring
typearray
typeobject
Registry
descriptionInformation about a registry key or value.
idRegistry
properties
registryKey
descriptionRegistry key associated with an application or system component (e.g., HKEY_, HKCU\Environment...).
typestring
registryValueData
descriptionData associated with a registry value (e.g. %USERPROFILE%\Local Settings\Temp).
typestring
registryValueName
descriptionName of the registry value associated with an application or system component (e.g. TEMP).
typestring
registryValueType
descriptionType of the registry value.
enum
  • TYPE_UNSPECIFIED
  • NONE
  • SZ
  • EXPAND_SZ
  • BINARY
  • DWORD
  • DWORD_LITTLE_ENDIAN
  • DWORD_BIG_ENDIAN
  • LINK
  • MULTI_SZ
  • RESOURCE_LIST
  • QWORD
  • QWORD_LITTLE_ENDIAN
enumDescriptions
  • Default registry value type used when the type is unknown.
  • The registry value is not set and only the key exists.
  • A null-terminated string.
  • A null-terminated string that contains unexpanded references to environment variables
  • Binary data in any form.
  • A 32-bit number.
  • A 32-bit number in little-endian format.
  • A 32-bit number in big-endian format.
  • A null-terminated Unicode string that contains the target path of a symbolic link.
  • A sequence of null-terminated strings, terminated by an empty string
  • A device driver resource list.
  • A 64-bit number.
  • A 64-bit number in little-endian format.
typestring
typeobject
Relation
descriptionDefines the relationship between the entity (a) and another entity (b).
idRelation
properties
direction
descriptionDirectionality of relationship between primary entity (a) and the related entity (b).
enum
  • DIRECTIONALITY_UNSPECIFIED
  • BIDIRECTIONAL
  • UNIDIRECTIONAL
enumDescriptions
  • Default value.
  • Modeled in both directions. Primary entity (a) to related entity (b) and related entity (b) to primary entity (a).
  • Modeled in a single direction. Primary entity (a) to related entity (b).
typestring
entity
$refNoun
descriptionEntity (b) that the primary entity (a) is related to.
entityLabel
descriptionLabel to identify the Noun of the relation.
enum
  • ENTITY_LABEL_UNSPECIFIED
  • PRINCIPAL
  • TARGET
  • OBSERVER
  • SRC
  • NETWORK
  • SECURITY_RESULT
  • INTERMEDIARY
enumDescriptions
  • Default value.
  • The Noun represents a principal type object.
  • The Noun represents a target type object.
  • The Noun represents an observer type object.
  • The Noun represents src type object.
  • The Noun represents a network type object.
  • The Noun represents a SecurityResult object.
  • The Noun represents an intermediary type object.
typestring
entityType
descriptionType of the related entity (b) in this relationship.
enum
  • UNKNOWN_ENTITYTYPE
  • ASSET
  • USER
  • GROUP
  • RESOURCE
  • IP_ADDRESS
  • FILE
  • DOMAIN_NAME
  • URL
  • MUTEX
  • METRIC
enumDescriptions
  • @hide_from_doc
  • An asset, such as workstation, laptop, phone, virtual machine, etc.
  • User.
  • Group.
  • Resource.
  • An external IP address.
  • A file.
  • A domain.
  • A url.
  • A mutex.
  • A metric.
typestring
relationship
descriptionType of relationship.
enum
  • RELATIONSHIP_UNSPECIFIED
  • OWNS
  • ADMINISTERS
  • MEMBER
  • EXECUTES
  • DOWNLOADED_FROM
  • CONTACTS
enumDescriptions
  • Default value
  • Related entity is owned by the primary entity (e.g. user owns device asset).
  • Related entity is administered by the primary entity (e.g. user administers a group).
  • Primary entity is a member of the related entity (e.g. user is a member of a group).
  • Primary entity may have executed the related entity.
  • Primary entity may have been downloaded from the related entity.
  • Primary entity contacts the related entity.
typestring
uid
descriptionUID of the relationship.
formatbyte
typestring
typeobject
Resource
descriptionInformation about a resource such as a task, Cloud Storage bucket, database, disk, logical policy, or something similar.
idResource
properties
attribute
$refAttribute
descriptionGeneric entity metadata attributes of the resource.
id
deprecatedTrue
descriptionDeprecated: Use resource.name or resource.product_object_id.
typestring
name
descriptionThe full name of the resource. For example, Google Cloud: //cloudresourcemanager.googleapis.com/projects/wombat-123, and AWS: arn:aws:iam::123456789012:user/johndoe.
typestring
parent
deprecatedTrue
descriptionThe parent of the resource. For a database table, the parent is the database. For a storage object, the bucket name. Deprecated: use resource_ancestors.name.
typestring
productObjectId
descriptionA vendor-specific identifier to uniquely identify the entity (a GUID, OID, or similar) This field can be used as an entity indicator for a Resource entity.
typestring
resourceSubtype
descriptionResource sub-type (e.g. "BigQuery", "Bigtable").
typestring
resourceType
descriptionResource type.
enum
  • UNSPECIFIED
  • MUTEX
  • TASK
  • PIPE
  • DEVICE
  • FIREWALL_RULE
  • MAILBOX_FOLDER
  • VPC_NETWORK
  • VIRTUAL_MACHINE
  • STORAGE_BUCKET
  • STORAGE_OBJECT
  • DATABASE
  • TABLE
  • CLOUD_PROJECT
  • CLOUD_ORGANIZATION
  • SERVICE_ACCOUNT
  • ACCESS_POLICY
  • CLUSTER
  • SETTING
  • DATASET
  • BACKEND_SERVICE
  • POD
  • CONTAINER
  • FUNCTION
  • RUNTIME
  • IP_ADDRESS
  • DISK
  • VOLUME
  • IMAGE
  • SNAPSHOT
  • REPOSITORY
  • CREDENTIAL
  • LOAD_BALANCER
  • GATEWAY
  • SUBNET
  • USER
enumDescriptions
  • Default type.
  • Mutex.
  • Task.
  • Named pipe.
  • Device.
  • Firewall rule.
  • Mailbox folder.
  • VPC Network.
  • Virtual machine.
  • Storage bucket.
  • Storage object.
  • Database.
  • Data table.
  • Cloud project.
  • Cloud organization.
  • Service account.
  • Access policy.
  • Cluster.
  • Settings.
  • Dataset.
  • Endpoint that receive traffic from a load balancer or proxy.
  • Pod, which is a collection of containers. Often used in Kubernetes.
  • Container.
  • Cloud function.
  • Runtime.
  • IP address.
  • Disk.
  • Volume.
  • Machine image.
  • Snapshot.
  • Repository.
  • Credential, e.g. access keys, ssh keys, tokens, certificates.
  • Load balancer.
  • Gateway.
  • Subnet.
  • User.
typestring
type
deprecatedTrue
descriptionDeprecated: use resource_type instead.
typestring
typeobject
ResourceRecord
descriptionDNS Resource Records. See RFC1035, section 4.1.3.
idResourceRecord
properties
binaryData
descriptionThe raw bytes of any non-UTF8 strings that might be included as part of a DNS response.
formatbyte
typestring
class
descriptionThe code specifying the class of the resource record.
formatuint32
typeinteger
data
descriptionThe payload or response to the DNS question for all responses encoded in UTF-8 format
typestring
name
descriptionThe name of the owner of the resource record.
typestring
ttl
descriptionThe time interval for which the resource record can be cached before the source of the information should again be queried.
formatuint32
typeinteger
type
descriptionThe code specifying the type of the resource record.
formatuint32
typeinteger
typeobject
ResponsePlatformInfo
descriptionRelated info of an Alert in customer's SOAR platform.
idResponsePlatformInfo
properties
alertId
descriptionId of the alert in SOAR product.
typestring
responsePlatformType
descriptionType of SOAR product.
enum
  • RESPONSE_PLATFORM_TYPE_UNSPECIFIED
  • RESPONSE_PLATFORM_TYPE_SIEMPLIFY
enumDescriptions
  • Response platform not specified.
  • Siemplify
typestring
typeobject
Retrohunt
descriptionRetrohunt is an execution of a Rule over a time range in the past.
idRetrohunt
properties
executionInterval
$refInterval
descriptionOutput only. The start and end time of the retrohunt execution. If the retrohunt is not yet finished, the end time of the interval will not be populated.
readOnlyTrue
name
descriptionThe resource name of the retrohunt. Retrohunt is the child of a rule revision. {rule} in the format below is structured as {rule_id@revision_id}. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}/retrohunts/{retrohunt}
typestring
processInterval
$refInterval
descriptionRequired. The start and end time of the event time range this retrohunt processes.
progressPercentage
descriptionOutput only. Percent progress of the retrohunt towards completion, from 0.00 to 100.00.
formatfloat
readOnlyTrue
typenumber
state
descriptionOutput only. The state of the retrohunt.
enum
  • STATE_UNSPECIFIED
  • RUNNING
  • DONE
  • CANCELLED
  • FAILED
enumDescriptions
  • Unspecified or unknown retrohunt state.
  • Running state.
  • Done state.
  • Cancelled state.
  • Failed state.
readOnlyTrue
typestring
typeobject
RetrohuntMetadata
descriptionOperation Metadata for Retrohunts.
idRetrohuntMetadata
properties
executionInterval
$refInterval
descriptionThe start and end time of the retrohunt execution. If the retrohunt is not yet finished, the end time of the interval will not be filled.
progressPercentage
descriptionPercent progress of the retrohunt towards completion, from 0.00 to 100.00.
formatfloat
typenumber
retrohunt
descriptionThe name of the retrohunt. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}/retrohunts/{retrohunt}
typestring
typeobject
RiskDelta
descriptionDescribes the difference in risk score between two points in time.
idRiskDelta
properties
previousRangeEndTime
descriptionEnd time of the previous time window.
formatgoogle-datetime
typestring
previousRiskScore
descriptionRisk score from previous risk window
formatint32
typeinteger
riskScoreDelta
descriptionDifference in the normalized risk score from the previous recorded value.
formatint32
typeinteger
riskScoreNumericDelta
descriptionNumeric change between current and previous risk score
formatint32
typeinteger
typeobject
Role
descriptionSystem role for resource access and modification.
idRole
properties
description
descriptionSystem role description for user.
typestring
name
descriptionSystem role name for user.
typestring
type
descriptionSystem role type for well known roles.
enum
  • TYPE_UNSPECIFIED
  • ADMINISTRATOR
  • SERVICE_ACCOUNT
enumDescriptions
  • Default user role.
  • Product administrator with elevated privileges.
  • System service account for automated privilege access.
typestring
typeobject
Rule
descriptionThe Rule resource represents a user-created rule. NEXT TAG: 21
idRule
properties
allowedRunFrequencies
descriptionOutput only. The run frequencies that are allowed for the rule. Populated in BASIC view and FULL view.
items
enum
  • RUN_FREQUENCY_UNSPECIFIED
  • LIVE
  • HOURLY
  • DAILY
enumDescriptions
  • The run frequency is unspecified/unknown.
  • Executes in real time.
  • Executes once per hour.
  • Executes once per day.
typestring
readOnlyTrue
typearray
author
descriptionOutput only. The author of the rule. Extracted from the meta section of text. Populated in BASIC view and FULL view.
readOnlyTrue
typestring
compilationDiagnostics
descriptionOutput only. A list of a rule's corresponding compilation diagnostic messages such as compilation errors and compilation warnings. Populated in FULL view.
items
$refCompilationDiagnostic
readOnlyTrue
typearray
compilationState
descriptionOutput only. The current compilation state of the rule. Populated in FULL view.
enum
  • COMPILATION_STATE_UNSPECIFIED
  • SUCCEEDED
  • FAILED
enumDescriptions
  • The compilation state is unspecified/unknown.
  • The Rule can successfully compile.
  • The Rule cannot successfully compile. This is possible if a backwards-incompatible change was made to the compiler.
readOnlyTrue
typestring
createTime
descriptionOutput only. The timestamp of when the rule was created. Populated in FULL view.
formatgoogle-datetime
readOnlyTrue
typestring
dataTables
descriptionOutput only. Resource names of the data tables used in this rule.
items
typestring
readOnlyTrue
typearray
displayName
descriptionOutput only. Display name of the rule. Populated in BASIC view and FULL view.
readOnlyTrue
typestring
etag
descriptionThe etag for this rule. If this is provided on update, the request will succeed if and only if it matches the server-computed value, and will fail with an ABORTED error otherwise. Populated in BASIC view and FULL view.
typestring
inputsUsed
$refInputsUsed
descriptionOutput only. The set of inputs used in the rule. For example, if the rule uses $e.principal.hostname, then the uses_udm field will be true.
readOnlyTrue
metadata
additionalProperties
typestring
descriptionOutput only. Additional metadata specified in the meta section of text. Populated in FULL view.
readOnlyTrue
typeobject
name
descriptionFull resource name for the rule. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}
typestring
nearRealTimeLiveRuleEligible
descriptionOutput only. Indicate the rule can run in near real time live rule. If this is true, the rule uses the near real time live rule when the run frequency is set to LIVE.
readOnlyTrue
typeboolean
referenceLists
descriptionOutput only. Resource names of the reference lists used in this rule. Populated in FULL view.
items
typestring
readOnlyTrue
typearray
revisionCreateTime
descriptionOutput only. The timestamp of when the rule revision was created. Populated in FULL, REVISION_METADATA_ONLY views.
formatgoogle-datetime
readOnlyTrue
typestring
revisionId
descriptionOutput only. The revision ID of the rule. A new revision is created whenever the rule text is changed in any way. Format: v_{10 digits}_{9 digits} Populated in REVISION_METADATA_ONLY view and FULL view.
readOnlyTrue
typestring
scope
descriptionResource name of the DataAccessScope bound to this rule. Populated in BASIC view and FULL view. If reference lists are used in the rule, validations will be performed against this scope to ensure that the reference lists are compatible with both the user's and the rule's scopes. The scope should be in the format: "projects/{project}/locations/{location}/instances/{instance}/dataAccessScopes/{scope}".
typestring
severity
$refSeverity
descriptionOutput only. The severity of the rule as specified in the meta section of text. Populated in BASIC view and FULL view.
readOnlyTrue
text
descriptionThe YARA-L content of the rule. Populated in FULL view.
typestring
type
descriptionOutput only. User-facing type of the rule. Extracted from the events section of rule text. Populated in BASIC view and FULL view.
enum
  • RULE_TYPE_UNSPECIFIED
  • SINGLE_EVENT
  • MULTI_EVENT
enumDescriptions
  • The rule type is unspecified/unknown.
  • Rule checks for the existence of a single event.
  • Rule checks for correlation between multiple events
readOnlyTrue
typestring
typeobject
RuleDeployment
descriptionThe RuleDeployment resource represents the deployment state of a Rule.
idRuleDeployment
properties
alerting
descriptionWhether detections resulting from this deployment should be considered alerts.
typeboolean
archiveTime
descriptionOutput only. The timestamp when the rule deployment archive state was last set to true. If the rule deployment's current archive state is not set to true, the field will be empty.
formatgoogle-datetime
readOnlyTrue
typestring
archived
descriptionThe archive state of the rule deployment. Cannot be set to true unless enabled is set to false. If set to true, alerting will automatically be set to false. If currently set to true, enabled, alerting, and run_frequency cannot be updated.
typeboolean
consumerRules
descriptionOutput only. The names of the associated/chained consumer rules. Rules are considered consumers of this rule if their rule text explicitly filters on this rule's ruleid. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}
items
typestring
readOnlyTrue
typearray
enabled
descriptionWhether the rule is currently deployed continuously against incoming data.
typeboolean
executionState
descriptionOutput only. The execution state of the rule deployment.
enum
  • EXECUTION_STATE_UNSPECIFIED
  • DEFAULT
  • LIMITED
  • PAUSED
enumDescriptions
  • Unspecified or unknown execution state.
  • Default execution state.
  • Rules in limited state may not have their executions guaranteed.
  • Paused rules are not executed at all.
readOnlyTrue
typestring
lastAlertStatusChangeTime
descriptionOutput only. The timestamp when the rule deployment alert state was lastly changed. This is filled regardless of the current alert state. E.g. if the current alert status is false, this timestamp will be the timestamp when the alert status was changed to false.
formatgoogle-datetime
readOnlyTrue
typestring
name
descriptionRequired. The resource name of the rule deployment. Note that RuleDeployment is a child of the overall Rule, not any individual revision, so the resource ID segment for the Rule resource must not reference a specific revision. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}/deployment
typestring
producerRules
descriptionOutput only. The names of the associated/chained producer rules. Rules are considered producers for this rule if this rule explicitly filters on their ruleid. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}
items
typestring
readOnlyTrue
typearray
runFrequency
descriptionThe run frequency of the rule deployment.
enum
  • RUN_FREQUENCY_UNSPECIFIED
  • LIVE
  • HOURLY
  • DAILY
enumDescriptions
  • The run frequency is unspecified/unknown.
  • Executes in real time.
  • Executes once per hour.
  • Executes once per day.
typestring
typeobject
RuntimeError
idRuntimeError
properties
errorText
typestring
timeRange
$refInterval
typeobject
SSLCertificate
descriptionSSL certificate.
idSSLCertificate
properties
certExtensions
additionalProperties
descriptionProperties of the object.
typeany
descriptionCertificate's extensions.
typeobject
certSignature
$refCertSignature
descriptionCertificate's signature and algorithm.
ec
$refEC
descriptionEC public key information.
extension
$refExtension
deprecatedTrue
description(DEPRECATED) certificate's extension.
firstSeenTime
descriptionDate the certificate was first retrieved by VirusTotal.
formatgoogle-datetime
typestring
issuer
$refSubject
descriptionCertificate's issuer data.
publicKey
$refPublicKey
descriptionPublic key information.
serialNumber
descriptionCertificate's serial number hexdump.
typestring
signatureAlgorithm
descriptionAlgorithm used for the signature (for example, "sha1RSA").
typestring
size
descriptionCertificate content length.
formatint64
typestring
subject
$refSubject
descriptionCertificate's subject data.
thumbprint
descriptionCertificate's content SHA1 hash.
typestring
thumbprintSha256
descriptionCertificate's content SHA256 hash.
typestring
validity
$refValidity
descriptionCertificate's validity period.
version
descriptionCertificate version (typically "V1", "V2" or "V3").
typestring
typeobject
ScopeInfo
descriptionScopeInfo specifies the scope info of the reference list.
idScopeInfo
properties
referenceListScope
$refReferenceListScope
descriptionRequired. The list of scope names of the reference list, if the list is empty the reference list is treated as unscoped.
typeobject
SearchDataTableColumnInfo
idSearchDataTableColumnInfo
properties
isDefault
typeboolean
originalColumn
typestring
typeobject
SearchDataTableInfo
idSearchDataTableInfo
properties
columnInfo
items
$refSearchDataTableColumnInfo
typearray
dataTable
typestring
typeobject
SearchDataTableRow
idSearchDataTableRow
properties
column
typestring
value
typestring
typeobject
SearchDataTableRowInfo
idSearchDataTableRowInfo
properties
dataTable
typestring
rows
items
$refSearchDataTableRow
typearray
typeobject
SecurityResult
descriptionSecurity related metadata for the event. A security result might be something like "virus detected and quarantined," "malicious connection blocked," or "sensitive data included in document foo.doc." Each security result, of which there may be more than one, may either pertain to the whole event, or to a specific object or device referenced in the event (e.g. a malicious file that was detected, or a sensitive document sent as an email attachment). For security results that apply to a particular object referenced in the event, the security_results message MUST contain details about the implicated object (such as process, user, IP, domain, URL, IP, or email address) in the about field. For security results that apply to the entire event (e.g. SPAM found in this email), the about field must remain empty.
idSecurityResult
properties
about
$refNoun
descriptionIf the security result is about a specific entity (Noun), add it here. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
action
descriptionActions taken for this event. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
items
enum
  • UNKNOWN_ACTION
  • ALLOW
  • BLOCK
  • ALLOW_WITH_MODIFICATION
  • QUARANTINE
  • FAIL
  • CHALLENGE
enumDescriptions
  • The default action.
  • Allowed.
  • Blocked.
  • Strip, modify something (e.g. File or email was disinfected or rewritten and still forwarded).
  • Put somewhere for later analysis (does NOT imply block).
  • Failed (e.g. the event was allowed but failed).
  • Challenged (e.g. the user was challenged by a Captcha, 2FA).
typestring
typearray
actionDetails
descriptionThe detail of the action taken as provided by the vendor. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
typestring
alertState
descriptionThe alerting types of this security result. This is primarily set for rule-generated detections and alerts.
enum
  • UNSPECIFIED
  • NOT_ALERTING
  • ALERTING
enumDescriptions
  • The security result type is not known.
  • The security result is not an alert.
  • The security result is an alert.
typestring
analyticsMetadata
descriptionStores metadata about each risk analytic metric the rule uses. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
items
$refAnalyticsMetadata
typearray
associations
descriptionAssociations related to the threat. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
items
$refAssociation
typearray
attackDetails
$refAttackDetails
descriptionMITRE ATT&CK details. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
campaigns
descriptionCampaigns using this IOC threat. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
items
typestring
typearray
category
descriptionThe security category. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
items
enum
  • UNKNOWN_CATEGORY
  • SOFTWARE_MALICIOUS
  • SOFTWARE_SUSPICIOUS
  • SOFTWARE_PUA
  • NETWORK_MALICIOUS
  • NETWORK_SUSPICIOUS
  • NETWORK_CATEGORIZED_CONTENT
  • NETWORK_DENIAL_OF_SERVICE
  • NETWORK_RECON
  • NETWORK_COMMAND_AND_CONTROL
  • ACL_VIOLATION
  • AUTH_VIOLATION
  • EXPLOIT
  • DATA_EXFILTRATION
  • DATA_AT_REST
  • DATA_DESTRUCTION
  • TOR_EXIT_NODE
  • MAIL_SPAM
  • MAIL_PHISHING
  • MAIL_SPOOFING
  • POLICY_VIOLATION
  • SOCIAL_ENGINEERING
  • PHISHING
enumDescriptions
  • The default category.
  • Malware, spyware, rootkit.
  • Below the conviction threshold; probably bad.
  • Potentially Unwanted App (such as adware).
  • Includes C&C or network exploit.
  • Suspicious activity, such as potential reverse tunnel.
  • Non-security related: URL has category like gambling or porn.
  • DoS, DDoS.
  • Port scan detected by an IDS, probing of web app.
  • If we know this is a C&C channel.
  • Unauthorized access attempted, including attempted access to files, web services, processes, web objects, etc.
  • Authentication failed (e.g. bad password or bad 2-factor authentication).
  • Exploit: For all manner of exploits including attempted overflows, bad protocol encodings, ROP, SQL injection, etc. For both network and host- based exploits.
  • DLP: Sensitive data transmission, copy to thumb drive.
  • DLP: Sensitive data found at rest in a scan.
  • Attempt to destroy/delete data.
  • TOR Exit Nodes.
  • Spam email, message, etc.
  • Phishing email, chat messages, etc.
  • Spoofed source email address, etc.
  • Security-related policy violation (e.g. firewall/proxy/HIPS rule violated, NAC block action).
  • Threats which manipulate to break normal security procedures.
  • Phishing pages, pops, https phishing etc.
typestring
typearray
categoryDetails
descriptionFor vendor-specific categories. For web categorization, put type in here such as "gambling" or "porn". This field is not populated when the SecurityResult appears in a finding (a detection or alert).
items
typestring
typearray
confidence
descriptionThe confidence level of the result as estimated by the product. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
enum
  • UNKNOWN_CONFIDENCE
  • LOW_CONFIDENCE
  • MEDIUM_CONFIDENCE
  • HIGH_CONFIDENCE
enumDescriptions
  • The default confidence level.
  • Low confidence.
  • Medium confidence.
  • High confidence.
typestring
confidenceDetails
descriptionAdditional detail with regards to the confidence of a security event as estimated by the product vendor. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
typestring
confidenceScore
descriptionThe confidence score of the security result. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
formatfloat
typenumber
description
descriptionA human-readable description (e.g. "user password was wrong"). This can be more detailed than the summary.
typestring
detectionDepth
descriptionThe depth of the detection chain. Applies only to composite detections.
formatint64
typestring
detectionFields
descriptionAn ordered list of values, that represent fields in detections for a security finding. This list represents mapping of names of requested entities to their values (the security result matched variables). This is only populated when the SecurityResult appears in a finding (a detection or alert).
items
$refLabel
typearray
firstDiscoveredTime
descriptionFirst time the IoC threat was discovered in the provider. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
formatgoogle-datetime
typestring
lastDiscoveredTime
descriptionLast time the IoC was seen in the provider data. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
formatgoogle-datetime
typestring
lastUpdatedTime
descriptionLast time the IoC threat was updated in the provider. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
formatgoogle-datetime
typestring
outcomes
descriptionA list of outcomes that represent the results of this security finding. This list represents a mapping of names of the requested outcomes, to a stringified version of their values. This is only populated when the SecurityResult appears in a finding (a detection or alert).
items
$refLabel
typearray
priority
descriptionThe priority of the result. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
enum
  • UNKNOWN_PRIORITY
  • LOW_PRIORITY
  • MEDIUM_PRIORITY
  • HIGH_PRIORITY
enumDescriptions
  • Default priority level.
  • Low priority.
  • Medium priority.
  • High priority.
typestring
priorityDetails
descriptionVendor-specific information about the security result priority. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
typestring
reports
descriptionReports that reference this IOC threat. These are the report IDs. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
items
typestring
typearray
riskScore
descriptionThe risk score of the security result.
formatfloat
typenumber
ruleAuthor
descriptionAuthor of the security rule. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
typestring
ruleId
descriptionA vendor-specific ID for a rule, varying by observer type (e.g. "08123", "5d2b44d0-5ef6-40f5-a704-47d61d3babbe").
typestring
ruleLabels
descriptionA list of rule labels that can't be captured by the other fields in security result (e.g. "reference : AnotherRule", "contributor : John"). This is primarily set in rule-generated detections and alerts.
items
$refLabel
typearray
ruleName
descriptionName of the security rule (e.g. "BlockInboundToOracle").
typestring
ruleSet
descriptionThe curated detection's rule set identifier. (for example, "windows-threats") This is primarily set in rule-generated detections and alerts.
typestring
ruleSetDisplayName
descriptionThe curated detections rule set display name. This is primarily set in rule-generated detections and alerts.
typestring
ruleType
descriptionThe type of security rule.
typestring
ruleVersion
descriptionVersion of the security rule. (e.g. "v1.1", "00001", "1604709794", "2020-11-16T23:04:19+00:00"). Note that rule versions are source-dependant and lexical ordering should not be assumed.
typestring
rulesetCategoryDisplayName
descriptionThe curated detection rule set category display name. (for example, if rule_set_display_name is "CDIR SCC Enhanced Exfiltration", the rule_set_category is "Cloud Threats"). This is primarily set in rule-generated detections and alerts.
typestring
severity
descriptionThe severity of the result.
enum
  • UNKNOWN_SEVERITY
  • INFORMATIONAL
  • ERROR
  • NONE
  • LOW
  • MEDIUM
  • HIGH
  • CRITICAL
enumDescriptions
  • The default severity level.
  • Info severity.
  • An error.
  • No malicious result.
  • Low-severity malicious result.
  • Medium-severity malicious result.
  • High-severity malicious result.
  • Critical-severity malicious result.
typestring
severityDetails
descriptionVendor-specific severity. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
typestring
summary
descriptionA short human-readable summary (e.g. "failed login occurred")
typestring
threatFeedName
descriptionVendor feed name for a threat indicator feed. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
typestring
threatId
descriptionVendor-specific ID for a threat. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
typestring
threatIdNamespace
descriptionThe attribute threat_id_namespace qualifies threat_id with an id namespace to get an unique id. The attribute threat_id by itself is not unique across Chronicle as it is a vendor specific id. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
enum
  • NORMALIZED_TELEMETRY
  • RAW_TELEMETRY
  • RULE_DETECTIONS
  • UPPERCASE
  • MACHINE_INTELLIGENCE
  • SECURITY_COMMAND_CENTER
  • UNSPECIFIED
  • SOAR_ALERT
  • VIRUS_TOTAL
enumDescriptions
  • Ingested and Normalized telemetry events
  • Ingested Raw telemetry
  • Chronicle Rules engine
  • Uppercase
  • DSML - Machine Intelligence
  • A normalized telemetry event from Google Security Command Center.
  • Unspecified Namespace
  • An alert coming from other SIEMs via Chronicle SOAR.
  • VirusTotal.
typestring
threatName
descriptionA vendor-assigned classification common across multiple customers (for example, "W32/File-A", "Slammer"). This field is not populated when the SecurityResult appears in a finding (a detection or alert).
typestring
threatStatus
descriptionCurrent status of the threat This field is not populated when the SecurityResult appears in a finding (a detection or alert).
enum
  • THREAT_STATUS_UNSPECIFIED
  • ACTIVE
  • CLEARED
  • FALSE_POSITIVE
enumDescriptions
  • Default threat status
  • Active threat.
  • Cleared threat.
  • False positive.
typestring
threatVerdict
descriptionGCTI threat verdict on the security result entity. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
enum
  • THREAT_VERDICT_UNSPECIFIED
  • UNDETECTED
  • SUSPICIOUS
  • MALICIOUS
enumDescriptions
  • Unspecified threat verdict level.
  • Undetected threat verdict level.
  • Suspicious threat verdict level.
  • Malicious threat verdict level.
typestring
urlBackToProduct
descriptionURL that takes the user to the source product console for this event. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
typestring
variables
additionalProperties
$refFindingVariable
descriptionA list of outcomes and match variables that represent the results of this security finding. This list represents a mapping of names of the requested outcomes or match variables, to their values. This is only populated when the SecurityResult appears in a finding (a detection or alert).
typeobject
verdict
$refVerdict
deprecatedTrue
descriptionVerdict about the IoC from the provider. This field is now deprecated. Use VerdictInfo instead.
verdictInfo
descriptionVerdict information about the IoC from the provider. This field is not populated when the SecurityResult appears in a finding (a detection or alert).
items
$refVerdictInfo
typearray
typeobject
Server
descriptionTransport Layer Security (TLS) information associated with the server (for example, Certificate or JA3 hash).
idServer
properties
certificate
$refCertificate
descriptionServer certificate.
ja3s
descriptionJA3 hash from the TLS ServerHello, as a hex-encoded string.
typestring
typeobject
Severity
descriptionSeverity represents the severity level of the rule.
idSeverity
properties
displayName
descriptionThe display name of the severity level. Extracted from the meta section of the rule text.
typestring
typeobject
SignatureInfo
descriptionFile signature information extracted from different tools.
idSignatureInfo
properties
codesign
$refFileMetadataCodesign
descriptionSignature information extracted from the codesign utility.
sigcheck
$refFileMetadataSignatureInfo
descriptionSignature information extracted from the sigcheck tool.
typeobject
SignerInfo
descriptionFile metadata related to the signer information.
idSignerInfo
properties
certIssuer
descriptionCompany that issued the certificate.
typestring
name
descriptionCommon name of the signers/certificate. The order of the signers matters. Each element is a higher level authority, the last being the root authority.
typestring
status
descriptionIt can say "Valid" or state the problem with the certificate if any (e.g. "This certificate or one of the certificates in the certificate chain is not time valid.").
typestring
validUsage
descriptionIndicates which situations the certificate is valid for (e.g. "Code Signing").
typestring
typeobject
Smtp
descriptionSMTP info. See RFC 2821.
idSmtp
properties
helo
descriptionThe client's 'HELO'/'EHLO' string.
typestring
isTls
descriptionIf the connection switched to TLS.
typeboolean
isWebmail
descriptionIf the message was sent via a webmail client.
typeboolean
mailFrom
descriptionThe client's 'MAIL FROM' string.
typestring
messagePath
descriptionThe message's path (extracted from the headers).
typestring
rcptTo
descriptionThe client's 'RCPT TO' string(s).
items
typestring
typearray
serverResponse
descriptionThe server's response(s) to the client.
items
typestring
typearray
typeobject
SoarAlertMetadata
descriptionMetadata fields of alerts coming from other SIEM systems.
idSoarAlertMetadata
properties
alertId
descriptionAlert ID in the source SIEM system.
typestring
product
descriptionName of the product the alert is coming from.
typestring
sourceRule
descriptionName of the rule triggering the alert in the source SIEM.
typestring
sourceSystem
descriptionName of the Source SIEM system.
typestring
sourceSystemTicketId
descriptionTicket id for the alert in the source system.
typestring
sourceSystemUri
descriptionUrl to the source SIEM system.
typestring
vendor
descriptionName of the vendor.
typestring
typeobject
Software
descriptionInformation about a software package or application.
idSoftware
properties
description
descriptionThe description of the software.
typestring
name
descriptionThe name of the software.
typestring
permissions
descriptionSystem permissions granted to the software. For example, "android.permission.WRITE_EXTERNAL_STORAGE"
items
$refPermission
typearray
vendorName
descriptionThe name of the software vendor.
typestring
version
descriptionThe version of the software.
typestring
typeobject
Source
descriptionDeprecated. Information about the threat intelligence source. These fields are used to model Mandiant sources.
idSource
properties
benignCount
descriptionCount of responses where this IoC was marked benign.
formatint32
typeinteger
maliciousCount
descriptionCount of responses where this IoC was marked malicious.
formatint32
typeinteger
name
descriptionName of the IoC source.
typestring
quality
descriptionQuality of the IoC mapping extracted from the source.
enum
  • UNKNOWN_CONFIDENCE
  • LOW_CONFIDENCE
  • MEDIUM_CONFIDENCE
  • HIGH_CONFIDENCE
enumDescriptions
  • The default confidence level.
  • Low confidence.
  • Medium confidence.
  • High confidence.
typestring
responseCount
descriptionTotal response count from this source.
formatint32
typeinteger
sourceCount
descriptionNumber of sources from which intelligence was extracted.
formatint32
typeinteger
threatIntelligenceSources
descriptionDifferent threat intelligence sources from which IoC info was extracted.
items
$refSource
typearray
typeobject
Status
descriptionThe `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors).
idStatus
properties
code
descriptionThe status code, which should be an enum value of google.rpc.Code.
formatint32
typeinteger
details
descriptionA list of messages that carry the error details. There is a common set of message types for APIs to use.
items
additionalProperties
descriptionProperties of the object. Contains field @type with type URL.
typeany
typeobject
typearray
message
descriptionA developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
typestring
typeobject
StringSequence
descriptionStringSequence represents a sequence of string.
idStringSequence
properties
stringVals
descriptionstring sequence.
items
typestring
typearray
typeobject
StringToInt64MapEntry
idStringToInt64MapEntry
properties
key
descriptionKey field.
typestring
value
descriptionValue field.
formatint64
typestring
typeobject
StringValue
idStringValue
properties
displayValue
typestring
rawValue
typestring
typeobject
StringValues
idStringValues
properties
values
items
$refStringValue
typearray
typeobject
Subject
descriptionSubject data.
idSubject
properties
commonName
descriptionCN: CommonName.
typestring
countryName
descriptionC: Country name.
typestring
locality
descriptionL: Locality.
typestring
organization
descriptionO: Organization.
typestring
organizationalUnit
descriptionOU: OrganizationalUnit.
typestring
stateOrProvinceName
descriptionST: StateOrProvinceName.
typestring
typeobject
Tactic
descriptionTactic information related to an attack or threat.
idTactic
properties
id
descriptionTactic ID (e.g. "TA0043").
typestring
name
descriptionTactic Name (e.g. "Reconnaissance")
typestring
typeobject
Tags
descriptionTags are event metadata which is set by examining event contents post-parsing. For example, a UDM event may be assigned a tenant_id based on certain customer-defined parameters.
idTags
properties
dataTapConfigName
descriptionA list of sink name values defined in DataTap configurations.
items
typestring
typearray
tenantId
descriptionA list of subtenant ids that this event belongs to.
items
formatbyte
typestring
typearray
typeobject
Technique
descriptionTechnique information related to an attack or threat.
idTechnique
properties
id
descriptionTechnique ID (e.g. "T1595").
typestring
name
descriptionTechnique Name (e.g. "Active Scanning").
typestring
subtechniqueId
descriptionSubtechnique ID (e.g. "T1595.001").
typestring
subtechniqueName
descriptionSubtechnique Name (e.g. "Scanning IP Blocks").
typestring
typeobject
TimeOff
descriptionSystem record for leave/time-off from a Human Capital Management (HCM) system.
idTimeOff
properties
description
descriptionDescription of the leave if available (e.g. 'Vacation').
typestring
interval
$refInterval
descriptionInterval duration of the leave.
typeobject
Tls
descriptionTransport Layer Security (TLS) information.
idTls
properties
cipher
descriptionCipher used during the connection.
typestring
client
$refClient
descriptionCertificate information for the client certificate.
curve
descriptionElliptical curve used for a given cipher.
typestring
established
descriptionIndicates whether the TLS negotiation was successful.
typeboolean
nextProtocol
descriptionProtocol to be used for tunnel.
typestring
resumed
descriptionIndicates whether the TLS connection was resumed from a previous TLS negotiation.
typeboolean
server
$refServer
descriptionCertificate information for the server certificate.
version
descriptionTLS version.
typestring
versionProtocol
descriptionProtocol.
typestring
typeobject
Tracker
descriptionURL Tracker.
idTracker
properties
id
descriptionTracker ID, if available.
typestring
timestamp
descriptionTracker ingestion date.
formatgoogle-datetime
typestring
tracker
descriptionTracker name.
typestring
url
descriptionTracker script URL.
typestring
typeobject
Tunnels
descriptionVPN tunnels.
idTunnels
properties
provider
descriptionThe provider of the VPN tunnels being used.
typestring
type
descriptionThe type of the VPN tunnels.
typestring
typeobject
UDM
descriptionA Unified Data Model event.
idUDM
properties
about
descriptionRepresents entities referenced by the event that are not otherwise described in principal, src, target, intermediary or observer. For example, it could be used to track email file attachments, domains/URLs/IPs embedded within an email body, and DLLs that are loaded during a PROCESS_LAUNCH event.
items
$refNoun
typearray
additional
additionalProperties
descriptionProperties of the object.
typeany
descriptionAny important vendor-specific event data that cannot be adequately represented within the formal sections of the UDM model.
typeobject
extensions
$refExtensions
descriptionAll other first-class, event-specific metadata goes in this message. Do not place protocol metadata in Extensions; put it in Network.
extracted
additionalProperties
descriptionProperties of the object.
typeany
descriptionFlattened fields extracted from the log.
typeobject
intermediary
descriptionRepresents details on one or more intermediate entities processing activity described in the event. This includes device details about a proxy server or SMTP relay server. If an active event (that has a principal and possibly target) passes through any intermediaries, they're added here. Intermediaries can impact the overall action, for example blocking or modifying an ongoing request. A rule of thumb here is that 'principal', 'target', and description of the initial action should be the same regardless of the intermediary or its action. A successful network connection from A->B should look the same in principal/target/intermediary as one blocked by firewall C: principal: A, target: B (intermediary: C).
items
$refNoun
typearray
metadata
$refMetadata
descriptionEvent metadata such as timestamp, source product, etc.
network
$refNetwork
descriptionAll network details go here, including sub-messages with details on each protocol (for example, DHCP, DNS, or HTTP).
observer
$refNoun
descriptionRepresents an observer entity (for example, a packet sniffer or network-based vulnerability scanner), which is not a direct intermediary, but which observes and reports on the event in question.
principal
$refNoun
descriptionRepresents the acting entity that originates the activity described in the event. The principal must include at least one machine detail (hostname, MACs, IPs, port, product-specific identifiers like an EDR asset ID) or user detail (for example, username), and optionally include process details. It must NOT include any of the following fields: email, files, registry keys or values.
securityResult
descriptionA list of security results.
items
$refSecurityResult
typearray
src
$refNoun
descriptionRepresents a source entity being acted upon by the participant along with the device or process context for the source object (the machine where the source object resides). For example, if user U copies file A on machine X to file B on machine Y, both file A and machine X would be specified in the src portion of the UDM event.
target
$refNoun
descriptionRepresents a target entity being referenced by the event or an object on the target entity. For example, in a firewall connection from device A to device B, A is described as the principal and B is described as the target. For a process injection by process C into target process D, process C is described as the principal and process D is described as the target.
typeobject
UdmColumnList
idUdmColumnList
properties
values
items
$refUdmColumnValue
typearray
typeobject
UdmColumnType
idUdmColumnType
properties
list
$refUdmColumnList
value
$refUdmColumnValue
typeobject
UdmColumnValue
idUdmColumnValue
properties
boolVal
typeboolean
bytesVal
formatbyte
typestring
dateVal
$refDate
doubleVal
formatdouble
typenumber
int64Val
formatint64
typestring
nullVal
typeboolean
protoVal
additionalProperties
descriptionProperties of the object. Contains field @type with type URL.
typeany
typeobject
stringVal
typestring
timestampVal
formatgoogle-datetime
typestring
uint64Val
formatuint64
typestring
typeobject
UdmEventInfo
idUdmEventInfo
properties
alertNumber
formatint32
typeinteger
annotations
items
enum
  • ANNOTATION_UNSPECIFIED
  • ANNOTATION_ALERT
enumDescriptions
typestring
typearray
chip
$refChip
deprecatedTrue
connectedComponentLabel
descriptionOptional.
formatbyte
typestring
datatableRowInfo
items
$refSearchDataTableRowInfo
typearray
detections
items
$refCollection
typearray
displayName
deprecatedTrue
typestring
entity
$refBackstoryEntity
event
$refUDM
eventLogToken
typestring
filterProperties
$refFilterProperties
deprecatedTrue
outcomes
items
$refUdmColumnType
typearray
tenantId
descriptionOptional.
typestring
uid
formatbyte
typestring
typeobject
UdmEventList
idUdmEventList
properties
columnNames
$refColumnNames
complete
typeboolean
datatableInfo
items
$refSearchDataTableInfo
typearray
events
items
$refUdmEventInfo
typearray
progress
formatdouble
typenumber
tooManyEvents
typeboolean
typeobject
UdmFieldAggregation
idUdmFieldAggregation
properties
aggregationType
enum
  • UNSPECIFIED_FIELD_AGGREGATION_TYPE
  • UDM_FIELD_AGGREGATION_TYPE
  • ENTITY_FIELD_AGGREGATION_TYPE
enumDescriptions
typestring
allValues
items
$refUdmValueCount
typearray
baselineEventCount
formatint32
typeinteger
bottomValues
items
$refUdmValueCount
typearray
eventCount
formatint32
typeinteger
fieldName
typestring
tooManyValues
typeboolean
topValues
items
$refUdmValueCount
typearray
valueCount
formatint32
typeinteger
typeobject
UdmFieldAggregations
idUdmFieldAggregations
properties
complete
typeboolean
fields
items
$refUdmFieldAggregation
typearray
groupByFields
items
$refGroupAggregationByField
typearray
typeobject
UdmFieldValue
idUdmFieldValue
properties
boolValue
typeboolean
bytesValue
formatbyte
typestring
doubleValue
formatdouble
typenumber
enumValue
typestring
floatValue
formatfloat
typenumber
int32Value
formatint32
typeinteger
int64Value
formatint64
typestring
isNull
typeboolean
stringValue
typestring
timestampValue
formatgoogle-datetime
typestring
uint32Value
formatuint32
typeinteger
uint64Value
formatuint64
typestring
typeobject
UdmPrevalence
idUdmPrevalence
properties
artifacts
items
$refFieldAndValue
typearray
prevalence
formatint32
typeinteger
typeobject
UdmPrevalenceBucket
idUdmPrevalenceBucket
properties
prevalence
items
$refUdmPrevalence
typearray
typeobject
UdmPrevalenceResponse
idUdmPrevalenceResponse
properties
buckets
items
$refUdmPrevalenceBucket
typearray
partialPrevalence
typeboolean
typeobject
UdmSearchOperationMetadata
descriptionInformation about a UDM Search operation. This message is used to populate the `metadata` field of `Operation` resources created by UDM Search.
idUdmSearchOperationMetadata
properties
baselineEventsCount
descriptionThe number of events matching the baseline query so far.
formatint32
typeinteger
baselineQuery
descriptionQuery used to search for events.
typestring
baselineTimeRange
$refInterval
descriptionThe time range used for the baseline query [inclusive start time, exclusive end time).
caseInsensitive
descriptionIf true, the search was performed in a case-insensitive manner.
typeboolean
endTime
descriptionThe end time of the operation, if done.
formatgoogle-datetime
typestring
expireTime
descriptionThe time when the operation results expire. This time may change while the operation is in progress. If unset, the results never expire.
formatgoogle-datetime
typestring
filteredEventsCount
descriptionThe number of events matching the snapshot query so far. This is <= `baseline_events_count`. If the snapshot query is empty, this will be equal to `baseline_events_count`.
formatint32
typeinteger
progress
descriptionA value from 0 to 1 representing the progress of the operation.
formatdouble
typenumber
snapshotQuery
descriptionQuery used to filter the baseline query's events.
typestring
snapshotTimeRange
$refInterval
descriptionTime range used to filter the baseline query's events [inclusive start time, exclusive end time). This time range is completely within `baseline_time_range`. If not set, it is assumed to match `baseline_time_range`.
startTime
descriptionThe start time of the operation.
formatgoogle-datetime
typestring
statsRowsCount
descriptionThe total number of rows returned for a stats query.
formatint32
typeinteger
typeobject
UdmValueCount
idUdmValueCount
properties
baselineEventCount
formatint32
typeinteger
eventCount
formatint32
typeinteger
value
$refUdmFieldValue
typeobject
Uint64Sequence
descriptionUint64Sequence represents a sequence of uint64s.
idUint64Sequence
properties
uint64Vals
descriptionuint64 sequence.
items
formatuint64
typestring
typearray
typeobject
Url
descriptionUrl.
idUrl
properties
categories
descriptionCategorisation done by VirusTotal partners.
items
typestring
typearray
favicon
$refFavicon
descriptionDifference hash and MD5 hash of the URL's.
htmlMeta
additionalProperties
descriptionProperties of the object.
typeany
descriptionMeta tags (only for URLs downloading HTML).
typeobject
lastFinalUrl
descriptionIf the original URL redirects, where does it end.
typestring
lastHttpResponseCode
descriptionHTTP response code of the last response.
formatint32
typeinteger
lastHttpResponseContentLength
descriptionLength in bytes of the content received.
formatint64
typestring
lastHttpResponseContentSha256
descriptionURL response body's SHA256 hash.
typestring
lastHttpResponseCookies
additionalProperties
descriptionProperties of the object.
typeany
descriptionWebsite's cookies.
typeobject
lastHttpResponseHeaders
additionalProperties
descriptionProperties of the object.
typeany
descriptionHeaders and values of the last HTTP response.
typeobject
tags
descriptionTags.
items
typestring
typearray
title
descriptionWebpage title.
typestring
trackers
descriptionTrackers found in the URL in a historical manner.
items
$refTracker
typearray
url
descriptionURL.
typestring
typeobject
User
descriptionInformation about a user.
idUser
properties
accountExpirationTime
descriptionUser account expiration timestamp.
formatgoogle-datetime
typestring
accountLockoutTime
descriptionUser account lockout timestamp.
formatgoogle-datetime
typestring
accountType
descriptionType of user account (for example, service, domain, or cloud). This is somewhat aligned to: https://attack.mitre.org/techniques/T1078/
enum
  • ACCOUNT_TYPE_UNSPECIFIED
  • DOMAIN_ACCOUNT_TYPE
  • LOCAL_ACCOUNT_TYPE
  • CLOUD_ACCOUNT_TYPE
  • SERVICE_ACCOUNT_TYPE
  • DEFAULT_ACCOUNT_TYPE
enumDescriptions
  • Default user account type.
  • A human account part of some domain in directory services.
  • A local machine account.
  • A SaaS service account type (such as Slack or GitHub).
  • A non-human account for data access.
  • A system built in default account.
typestring
attribute
$refAttribute
descriptionGeneric entity metadata attributes of the user.
companyName
descriptionUser job company name.
typestring
department
descriptionUser job department
items
typestring
typearray
emailAddresses
descriptionEmail addresses of the user. This field can be used as an entity indicator for user entities.
items
typestring
typearray
employeeId
descriptionHuman capital management identifier. This field can be used as an entity indicator for user entities.
typestring
firstName
descriptionFirst name of the user (e.g. "John").
typestring
firstSeenTime
descriptionThe first observed time for a user. The value is calculated on the basis of the first time the identifier was observed.
formatgoogle-datetime
typestring
groupIdentifiers
descriptionProduct object identifiers of the group(s) the user belongs to A vendor-specific identifier to uniquely identify the group(s) the user belongs to (a GUID, LDAP OID, or similar).
items
typestring
typearray
groupid
deprecatedTrue
descriptionThe ID of the group that the user belongs to. Deprecated in favor of the repeated group_identifiers field.
typestring
hireDate
descriptionUser job employment hire date.
formatgoogle-datetime
typestring
lastBadPasswordAttemptTime
descriptionUser last bad password attempt timestamp.
formatgoogle-datetime
typestring
lastLoginTime
descriptionUser last login timestamp.
formatgoogle-datetime
typestring
lastName
descriptionLast name of the user (e.g. "Locke").
typestring
lastPasswordChangeTime
descriptionUser last password change timestamp.
formatgoogle-datetime
typestring
managers
descriptionUser job manager(s).
items
$refUser
typearray
middleName
descriptionMiddle name of the user.
typestring
officeAddress
$refLocation
descriptionUser job office location.
passwordExpirationTime
descriptionUser password expiration timestamp.
formatgoogle-datetime
typestring
personalAddress
$refLocation
descriptionPersonal address of the user.
phoneNumbers
descriptionPhone numbers for the user.
items
typestring
typearray
productObjectId
descriptionA vendor-specific identifier to uniquely identify the entity (e.g. a GUID, LDAP, OID, or similar). This field can be used as an entity indicator for user entities.
typestring
roleDescription
deprecatedTrue
descriptionSystem role description for user. Deprecated: use attribute.roles.
typestring
roleName
deprecatedTrue
descriptionSystem role name for user. Deprecated: use attribute.roles.
typestring
terminationDate
descriptionUser job employment termination date.
formatgoogle-datetime
typestring
timeOff
descriptionUser time off leaves from active work.
items
$refTimeOff
typearray
title
descriptionUser job title.
typestring
userAuthenticationStatus
descriptionSystem authentication status for user.
enum
  • UNKNOWN_AUTHENTICATION_STATUS
  • ACTIVE
  • SUSPENDED
  • NO_ACTIVE_CREDENTIALS
  • DELETED
enumDescriptions
  • The default authentication status.
  • The authentication method is in active state.
  • The authentication method is in suspended/disabled state.
  • The authentication method has no active credentials.
  • The authentication method has been deleted.
typestring
userDisplayName
descriptionThe display name of the user (e.g. "John Locke").
typestring
userRole
deprecatedTrue
descriptionSystem role for user. Deprecated: use attribute.roles.
enum
  • UNKNOWN_ROLE
  • ADMINISTRATOR
  • SERVICE_ACCOUNT
enumDeprecated
  • False
  • False
  • True
enumDescriptions
  • Default user role.
  • Product administrator with elevated privileges.
  • System service account for automated privilege access. Deprecated: not a role, instead set User.account_type.
typestring
userid
descriptionThe ID of the user. This field can be used as an entity indicator for user entities.
typestring
windowsSid
descriptionThe Microsoft Windows SID of the user. This field can be used as an entity indicator for user entities.
typestring
typeobject
UserAgentProto
idUserAgentProto
properties
annotation
items
$refAnnotation
typearray
browser
descriptionProduct brand within the family: Firefox, Netscape, Camino etc.. Or Earth, Windows-Media-Player etc.. for non-browser user agents.
typestring
browserEngineVersion
descriptionVersion of the rendering engine e.g. "8.01" for "Opera/8.01"
typestring
browserVersion
descriptionMinor and lower versions unavailable with reduced User-Agent and no client hints (go/ua-reduction-ua-string-reference).
typestring
carrier
descriptionMobile specific: name of mobile carrier
typestring
device
description(Usually) Mobile specific: name of hardware device, may or may not contain the full model name. e.g. iPhone, Palm750, SPH-M800. Reduced to "K" for Android devices with reduced User-Agent and no client hints (go/ua-reduction-ua-string-reference).
typestring
deviceVersion
description(Usually) Mobile specific: version of hardware device Unavailable with reduced User-Agent and no client hints (go/ua-reduction-ua-string-reference).
typestring
family
descriptionUser agent family captures the type of browser/app at a high-level e.g. MSIE, Gecko, Safari etc..
enum
  • USER_DEFINED
  • MSIE
  • GECKO
  • APPLEWEBKIT
  • OPERA
  • KHTML
  • OTHER
  • APPLE
  • BLACKBERRY
  • DOCOMO
  • GOOGLE
  • OPENWAVE
  • POLARIS
  • OBIGO
  • TELECA
  • MICROSOFT
  • NOKIA
  • NETFRONT
  • SEMC
  • SMIT
  • KOREAN
  • CLIENT_HINTS
enumDescriptions
  • Used to represent new families supported by user-defined parsers
  • Desktop user agent families
  • WebKit based browsers e.g. Safari
  • e.g. Konqueror
  • Mobile and non-browser user agent families UA's w/o enough data to fit into a family
  • Apple apps e.g. YouTube on iPhone
  • Google Earth, Sketchup, UpdateChecker etc...
  • UP.Browser
  • Windows Media Player, RSS platform etc...
  • Sony Ericsson Mobile Communications
  • SKT, LGT
  • Constructed from UA-CH instead of UserAgent string.
typestring
googleToolbarVersion
descriptionVersion number of GoogleToolbar, if installed. Applies only to MSIE and Firefox at this time.
typestring
javaConfiguration
descriptionMobile specific: e.g. Configuration/CLDC-1.1
typestring
javaConfigurationVersion
typestring
javaProfile
descriptionMobile specific: e.g. Profile/MIDP-2.0
typestring
javaProfileVersion
typestring
locale
descriptionLocale in which the browser is running as country code and optionally language pair. Unavailable with reduced User-Agent and no client hints (go/ua-reduction-ua-string-reference).
typestring
messaging
descriptionMobile specific: e.g. MMP/2.0
typestring
messagingVersion
typestring
os
descriptionFull name of the operating system e.g. "Darwin/9.7.0", "Android 1.5", "Windows 98" Version is reduced, and other data might also be missing, for reduced User-Agent and no client hints (go/ua-reduction-ua-string-reference).
typestring
osVariant
descriptionExtra qualifier for the OS e.g. "(i386)", "Build/CUPCAKE", "PalmSource/Palm-D061" Unavailable with reduced User-Agent and no client hints (go/ua-reduction-ua-string-reference).
typestring
platform
descriptionThe platform describes the environment in which the browser or app runs. For desktop user agents, Platform is a string describing the OS family e.g. Windows, Macintosh, Linux. For mobile user agents, Platform either describes the OS family (if available) or the hardware maker. e.g. Linux, or HTC, LG, Palm.
typestring
security
descriptionSecurity level reported by user agent, either U, I or N. Unavailable with reduced User-Agent and no client hints (go/ua-reduction-ua-string-reference).
typestring
subFamily
descriptionSub-family identifies individual regexps when a family has more than 1. This is used to generate the right UA string from a protobuf. Examples in the AppleWebKit family: Chrome and Safari. Can also be an arbitrary identifier.
typestring
typeobject
UserError
descriptionThis message exists solely to get the `UserErrorReason` enum to appear in the service discovery document.
idUserError
properties
reason
descriptionThe reason for a specific error that should be shown to the app user.
enum
  • USER_ERROR_REASON_UNSPECIFIED
  • RULE_REFERENCES_OUT_OF_SCOPE
  • RULE_ARCHIVED
  • RULE_STALE_VERSION
  • RULE_ACTIVE
  • RULE_RETROHUNT_RUNNING
  • RULE_LIVE
  • RULE_ALREADY_DISABLED
  • EXPENSIVE_RULE_LARGE_WINDOW
  • RULE_LIMITED_PAUSED
  • REFERENCE_LIST_NOT_FOUND
  • UEBA_RULES_NO_SCOPE
  • RULE_TESTING_INTERVAL_TOO_SHORT
  • SEARCH_CSV_FIELDS_NOT_SUPPORTED
  • INVALID_ARGUMENT_FOR_DASHBOARD_FILTER
  • INVALID_CONFIG_FOR_DASHBOARD_IMPORT
  • RETROHUNT_LIMIT_REACHED
enumDescriptions
  • Do not use this default value.
  • The rule text references resources, such as reference lists, that are out of scope for the rule. Example of an ErrorInfo for this reason: { "reason": "RULE_REFERENCES_OUT_OF_SCOPE", "domain": "chronicle.googleapis.com", "metadata": { "reference_lists": "list_name1,list_name2,list_name3,", } }
  • The rule being operated on (saving or setting run frequency) is archived, and so the operation can't be done.
  • The rule version being operated on is not the latest, and so the operation can't be done.
  • The rule can't be archived because it is live (detecting) and a retrohunt is running.
  • The rule can't be archived because a retrohunt is running against it.
  • The rule can't be archived because it is live (detecting).
  • The rule can't be disabled because is is already disabled.
  • The rule's match time window is too large for its current run frequency.
  • The rule can't be enabled because it has been limited or paused because of high resource use.
  • The list being referred to doesn't exist.
  • UEBA rules may not be assigned a data access scope.
  • The rule's match window is longer than the time range it's being tested over. Returns the match window duration and testing interval duration as metadata labeled `match_window_duration` and `testing_interval_duration`, formatted as Go durations. Example ErrorInfo: { "reason": "RULE_TESTING_INTERVAL_TOO_SHORT", "domain": "chronicle.googleapis.com", "metadata": { "match_window_duration": "24h", "testing_interval_duration": "12h", } }
  • The CSV fields are not supported for download. Returns the unsupported fields as metadata labeled `unsupported_fields`. Example ErrorInfo: { "reason": "SEARCH_CSV_FIELDS_NOT_SUPPORTED", "domain": "chronicle.googleapis.com", "metadata": { "unsupported_fields": "udm.about.security_result.variables,udm.network.http.parsed_user_agent.family", } }
  • Invalid argument for dashboard chart filters. Returns the filter name, filter value, operator, and expected type as metadata labeled `filter_name`, `filter_value`, `operator`, and `expected_type`, respectively. Example ErrorInfo: { "reason": "INVALID_ARGUMENT_FOR_DASHBOARD_FILTER", "domain": "chronicle.googleapis.com", "metadata": { "filter_name": "filter_name", "filter_value": "filter_value", "operater": "operator", "expected_type": "expected_type", } }
  • Invalid config for dashboard import. Example ErrorInfo: { "reason": "INVALID_CONFIG_FOR_DASHBOARD_IMPORT", "domain": "chronicle.googleapis.com", }
  • The user has reached the limit of retrohunts that can be run. Returns the retrohunt limit as metadata labeled `retrohunt_limit`. Example ErrorInfo: { "reason": "RETROHUNT_LIMIT_REACHED", "domain": "chronicle.googleapis.com", "metadata": { "retrohunt_limit": "10", } }
typestring
typeobject
Validity
descriptionDefines certificate's validity period.
idValidity
properties
expiryTime
descriptionExpiry date.
formatgoogle-datetime
typestring
issueTime
descriptionIssue date.
formatgoogle-datetime
typestring
typeobject
Verdict
descriptionDeprecated. Encapsulates the threat verdict provided by human analysts and ML models. These fields are used to model Mandiant sources.
idVerdict
properties
analystVerdict
$refAnalystVerdict
descriptionHuman analyst verdict provided by sources like Mandiant.
neighbourInfluence
descriptionDescribes the neighbour influence of the verdict.
typestring
responseCount
descriptionTotal response count across all sources.
formatint32
typeinteger
sourceCount
descriptionNumber of sources from which intelligence was extracted.
formatint32
typeinteger
verdict
$refProviderMLVerdict
descriptionML Verdict provided by sources like Mandiant.
typeobject
VerdictInfo
descriptionDescribes the threat verdict provided by human analysts and machine learning models. These fields are used to model Mandiant sources.
idVerdictInfo
properties
benignCount
descriptionCount of responses where this IoC was marked as benign.
formatint32
typeinteger
categoryDetails
descriptionTags related to the verdict.
typestring
confidenceScore
descriptionConfidence score of the verdict.
formatint32
typeinteger
globalCustomerCount
descriptionGlobal customer count over the last 30 days
formatint32
typeinteger
globalHitsCount
descriptionGlobal hit count over the last 30 days.
formatint32
typeinteger
iocStats
descriptionList of IoCStats from which the verdict was generated.
items
$refIoCStats
typearray
maliciousCount
descriptionCount of responses where this IoC was marked as malicious.
formatint32
typeinteger
neighbourInfluence
descriptionDescribes the near neighbor influence of the verdict.
typestring
pwn
descriptionWhether one or more Mandiant incident response customers had this indicator in their environment.
typeboolean
pwnFirstTaggedTime
descriptionThe timestamp of the first time a pwn was associated to this entity.
formatgoogle-datetime
typestring
responseCount
descriptionTotal response count across all sources.
formatint32
typeinteger
sourceCount
descriptionNumber of sources from which intelligence was extracted.
formatint32
typeinteger
sourceProvider
descriptionSource provider giving the machine learning verdict.
typestring
verdictResponse
descriptionDetails about the verdict.
enum
  • VERDICT_RESPONSE_UNSPECIFIED
  • MALICIOUS
  • BENIGN
enumDescriptions
  • The default verdict response type.
  • VerdictResponse resulted a threat as malicious.
  • VerdictResponse resulted a threat as benign.
typestring
verdictTime
descriptionTimestamp when the verdict was generated.
formatgoogle-datetime
typestring
verdictType
descriptionType of verdict.
enum
  • VERDICT_TYPE_UNSPECIFIED
  • PROVIDER_ML_VERDICT
  • ANALYST_VERDICT
enumDescriptions
  • Verdict category not specified.
  • MLVerdict result provided from threat providers, like Mandiant. These fields are used to model Mandiant sources.
  • Verdict provided by the human analyst. These fields are used to model Mandiant sources.
typestring
typeobject
Vulnerabilities
descriptionThe Vulnerabilities extension captures details on observed/detected vulnerabilities.
idVulnerabilities
properties
vulnerabilities
descriptionA list of vulnerabilities.
items
$refVulnerability
typearray
typeobject
Vulnerability
descriptionA vulnerability.
idVulnerability
properties
about
$refNoun
descriptionIf the vulnerability is about a specific noun (e.g. executable), then add it here.
cveDescription
descriptionCommon Vulnerabilities and Exposures Description. https://cve.mitre.org/about/faqs.html#what_is_cve_record
typestring
cveId
descriptionCommon Vulnerabilities and Exposures Id. https://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures https://cve.mitre.org/about/faqs.html#what_is_cve_id
typestring
cvssBaseScore
descriptionCVSS Base Score in the range of 0.0 to 10.0. Useful for sorting.
formatfloat
typenumber
cvssVector
descriptionVector of CVSS properties (e.g. "AV:L/AC:H/Au:N/C:N/I:P/A:C") Can be linked to via: https://nvd.nist.gov/vuln-metrics/cvss/v2-calculator
typestring
cvssVersion
descriptionVersion of CVSS Vector/Score.
typestring
description
descriptionDescription of the vulnerability.
typestring
firstFound
descriptionProducts that maintain a history of vuln scans should populate first_found with the time that a scan first detected the vulnerability on this asset.
formatgoogle-datetime
typestring
lastFound
descriptionProducts that maintain a history of vuln scans should populate last_found with the time that a scan last detected the vulnerability on this asset.
formatgoogle-datetime
typestring
name
descriptionName of the vulnerability (e.g. "Unsupported OS Version detected").
typestring
scanEndTime
descriptionIf the vulnerability was discovered during an asset scan, then this field should be populated with the time the scan ended. This field can be left unset if the end time is not available or not applicable.
formatgoogle-datetime
typestring
scanStartTime
descriptionIf the vulnerability was discovered during an asset scan, then this field should be populated with the time the scan started. This field can be left unset if the start time is not available or not applicable.
formatgoogle-datetime
typestring
severity
descriptionThe severity of the vulnerability.
enum
  • UNKNOWN_SEVERITY
  • LOW
  • MEDIUM
  • HIGH
  • CRITICAL
enumDescriptions
  • The default severity level.
  • Low severity.
  • Medium severity.
  • High severity.
  • Critical severity.
typestring
severityDetails
descriptionVendor-specific severity
typestring
vendor
descriptionVendor of scan that discovered vulnerability.
typestring
vendorKnowledgeBaseArticleId
descriptionVendor specific knowledge base article (e.g. "KBXXXXXX" from Microsoft). https://en.wikipedia.org/wiki/Microsoft_Knowledge_Base https://access.redhat.com/knowledgebase
typestring
vendorVulnerabilityId
descriptionVendor specific vulnerability id (e.g. Microsoft security bulletin id).
typestring
typeobject
Watchlist
descriptionA watchlist is a list of entities that allows for bulk operations over the included entities.
idWatchlist
properties
createTime
descriptionOutput only. Time the watchlist was created.
formatgoogle-datetime
readOnlyTrue
typestring
description
descriptionOptional. Description of the watchlist.
typestring
displayName
descriptionRequired. Display name of the watchlist. Note that it must be at least one character and less than 63 characters (https://google.aip.dev/148).
typestring
entityCount
$refEntityCount
descriptionOutput only. Entity count in the watchlist.
readOnlyTrue
entityPopulationMechanism
$refEntityPopulationMechanism
descriptionRequired. Mechanism to populate entities in the watchlist.
multiplyingFactor
descriptionOptional. Weight applied to the risk score for entities in this watchlist. The default is 1.0 if it is not specified.
formatfloat
typenumber
name
descriptionIdentifier. Resource name of the watchlist. Format: projects/{project}/locations/{location}/instances/{instance}/watchlists/{watchlist}
typestring
updateTime
descriptionOutput only. Time the watchlist was last updated.
formatgoogle-datetime
readOnlyTrue
typestring
watchlistUserPreferences
$refWatchlistUserPreferences
descriptionOptional. User preferences for watchlist configuration.
typeobject
WatchlistUserPreferences
descriptionA collection of user preferences for watchlist UI configuration.
idWatchlistUserPreferences
properties
pinned
descriptionOptional. Whether the watchlist is pinned on the dashboard.
typeboolean
typeobject
X509
descriptionFile certificate.
idX509
properties
algorithm
descriptionCertificate algorithm.
typestring
certIssuer
descriptionIssuer of the certificate.
typestring
name
descriptionCertificate name.
typestring
serialNumber
descriptionCertificate serial number.
typestring
thumbprint
descriptionCertificate thumbprint.
typestring
typeobject
old_value
CancelOperationRequest
descriptionThe request message for Operations.CancelOperation.
idCancelOperationRequest
properties
typeobject
CompilationDiagnostic
descriptionCompilationDiagnostic represents a compilation diagnostic generated during a rule's compilation, such as a compilation error or a compilation warning.
idCompilationDiagnostic
properties
message
descriptionOutput only. The diagnostic message.
readOnlyTrue
typestring
position
$refCompilationPosition
descriptionOutput only. The approximate position in the rule text associated with the compilation diagnostic. Compilation Position may be empty.
readOnlyTrue
severity
descriptionOutput only. The severity of a rule's compilation diagnostic.
enum
  • SEVERITY_UNSPECIFIED
  • WARNING
  • ERROR
enumDescriptions
  • An unspecified severity level.
  • A compilation warning.
  • A compilation error.
readOnlyTrue
typestring
uri
descriptionOutput only. Link to documentation that describes a diagnostic in more detail.
readOnlyTrue
typestring
typeobject
CompilationPosition
descriptionCompilationPosition represents the location of a compilation diagnostic in rule text.
idCompilationPosition
properties
endColumn
descriptionOutput only. End column number, beginning at 1.
formatint32
readOnlyTrue
typeinteger
endLine
descriptionOutput only. End line number, beginning at 1.
formatint32
readOnlyTrue
typeinteger
startColumn
descriptionOutput only. Start column number, beginning at 1.
formatint32
readOnlyTrue
typeinteger
startLine
descriptionOutput only. Start line number, beginning at 1.
formatint32
readOnlyTrue
typeinteger
typeobject
CreateParserExtensionMetadata
descriptionOperation metadata for creating a parser extension.
idCreateParserExtensionMetadata
properties
state
descriptionThe state of the parser extension creation process.
enum
  • STATE_UNSPECIFIED
  • NEW
  • VALIDATING
  • LIVE
  • REJECTED
  • INTERNAL_ERROR
  • VALIDATED
  • ARCHIVED
enumDescriptions
  • The state for this parser extension was not specified.
  • The parser extension has been newly submitted and is waiting to be validated.
  • The parser extension is currently going through the validation pipeline.
  • The parser extension is live in production. Only configs that have successfully passed the validation stage will be set to LIVE.
  • Validation completed, but the parser extension was rejected with errors.
  • An error occurred when processing this parser extension.
  • Extension is validated.
  • Extension is archived and is no more being used.
typestring
stateLastChangedTime
descriptionThe time the config state was last changed.
formatgoogle-datetime
typestring
validationErrors
descriptionAny validation error while validating the extension, this have cap of size 10
items
typestring
typearray
validationReport
descriptionThe validation report generated during validation of the parser extension.
typestring
typeobject
CreateParserMetadata
descriptionOperation metadata for creating a parser.
idCreateParserMetadata
properties
stage
descriptionThe validation stage of the parser creation process.
enum
  • VALIDATION_STAGE_UNSPECIFIED
  • NEW
  • VALIDATING
  • PASSED
  • FAILED
  • DELETE_CANDIDATE
enumDescriptions
  • The validation stage is not specified.
  • The custom parser is submitted for validation.
  • The custom parser is currently going through the validation pipeline
  • The custom parser has successfully passed the validation.
  • The custom parser has failed validation.
  • The parser is no good, It is available for auto deletion.
typestring
validationReport
descriptionThe validation report generated during validation of the parser.
typestring
typeobject
DataAccessLabel
descriptionA DataAccessLabel is a label on events to define user access to data.
idDataAccessLabel
properties
author
descriptionOutput only. The user who created the data access label.
readOnlyTrue
typestring
createTime
descriptionOutput only. The time at which the data access label was created.
formatgoogle-datetime
readOnlyTrue
typestring
description
descriptionOptional. A description of the data access label for a human reader.
typestring
displayName
descriptionOutput only. The short name displayed for the label as it appears on event data.
readOnlyTrue
typestring
lastEditor
descriptionOutput only. The user who last updated the data access label.
readOnlyTrue
typestring
name
descriptionRequired. The unique resource name of the data access label.
typestring
udmQuery
descriptionA UDM query over event data.
typestring
updateTime
descriptionOutput only. The time at which the data access label was last updated.
formatgoogle-datetime
readOnlyTrue
typestring
typeobject
DataAccessLabelReference
descriptionReference object to a data access label.
idDataAccessLabelReference
properties
assetNamespace
descriptionThe asset namespace configured in the forwarder of the customer's events.
typestring
dataAccessLabel
descriptionThe name of the data access label.
typestring
displayName
descriptionOutput only. The display name of the label. Data access label and log types's name will match the display name of the resource. The asset namespace will match the namespace itself. The ingestion key value pair will match the key of the tuple.
readOnlyTrue
typestring
ingestionLabel
$refIngestionLabel
descriptionThe ingestion label configured in the forwarder of the customer's events.
logType
descriptionThe name of the log type.
typestring
typeobject
DataAccessScope
descriptionA DataAccessScope is a boolean expression of data access labels used to restrict access to data for users.
idDataAccessScope
properties
allowAll
descriptionOptional. Whether or not the scope allows all labels, allow_all and allowed_data_access_labels are mutually exclusive and one of them must be present. denied_data_access_labels can still be used along with allow_all. When combined with denied_data_access_labels, access will be granted to all data that doesn't have labels mentioned in denied_data_access_labels. E.g.: A customer with scope with denied labels A and B and allow_all will be able to see all data except data labeled with A and data labeled with B and data with labels A and B.
typeboolean
allowedDataAccessLabels
descriptionOptional. The allowed labels for the scope. Either allow_all or allowed_data_access_labels needs to be provided. When provided, there has to be at least one label allowed for the scope to be valid. The logical operator for evaluation of the allowed labels is OR. E.g.: A customer with scope with allowed labels A and B will be able to see data with labeled with A or B or (A and B).
items
$refDataAccessLabelReference
typearray
author
descriptionOutput only. The user who created the data access scope.
readOnlyTrue
typestring
createTime
descriptionOutput only. The time at which the data access scope was created.
formatgoogle-datetime
readOnlyTrue
typestring
deniedDataAccessLabels
descriptionOptional. The denied labels for the scope. The logical operator for evaluation of the denied labels is AND. E.g.: A customer with scope with denied labels A and B won't be able to see data labeled with A and data labeled with B and data with labels A and B.
items
$refDataAccessLabelReference
typearray
description
descriptionOptional. A description of the data access scope for a human reader.
typestring
displayName
descriptionOutput only. The name to be used for display to customers of the data access scope.
readOnlyTrue
typestring
lastEditor
descriptionOutput only. The user who last updated the data access scope.
readOnlyTrue
typestring
name
descriptionRequired. The unique full name of the data access scope. The name should comply with https://google.aip.dev/122 standards.
typestring
updateTime
descriptionOutput only. The time at which the data access scope was last updated.
formatgoogle-datetime
readOnlyTrue
typestring
typeobject
Empty
descriptionA generic empty message that you can re-use to avoid defining duplicated empty messages in your APIs. A typical example is to use it as the request or the response type of an API method. For instance: service Foo { rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty); }
idEmpty
properties
typeobject
EntityCount
descriptionCount of different types of entities in the watchlist.
idEntityCount
properties
asset
descriptionOutput only. Count of asset type entities in the watchlist.
formatint32
readOnlyTrue
typeinteger
user
descriptionOutput only. Count of user type entities in the watchlist.
formatint32
readOnlyTrue
typeinteger
typeobject
EntityPopulationMechanism
descriptionMechanism to populate entities in the watchlist.
idEntityPopulationMechanism
properties
manual
$refManual
descriptionOptional. Entities are added manually.
typeobject
IngestionLabel
descriptionRepresentation of an ingestion label type.
idIngestionLabel
properties
ingestionLabelKey
descriptionRequired. The key of the ingestion label. Always required.
typestring
ingestionLabelValue
descriptionOptional. The value of the ingestion label. Optional. An object with no provided value and some key provided would match against the given key and ANY value.
typestring
typeobject
InputsUsed
descriptionInputsUsed is a convenience field that tells us which sources of events (if any) were used in the rule. NEXT TAG: 4
idInputsUsed
properties
usesDetection
descriptionOptional. Whether the rule queries detections.
typeboolean
usesEntity
descriptionOptional. Whether the rule queries entity events.
typeboolean
usesUdm
descriptionOptional. Whether the rule queries UDM events.
typeboolean
typeobject
Instance
descriptionA Instance represents an instantiation of the Instance product.
idInstance
properties
name
descriptionOutput only. The resource name of this instance. Format: projects/{project}/locations/{region}/instances/{instance}
readOnlyTrue
typestring
typeobject
Interval
descriptionRepresents a time interval, encoded as a Timestamp start (inclusive) and a Timestamp end (exclusive). The start must be less than or equal to the end. When the start equals the end, the interval is empty (matches no time). When both start and end are unspecified, the interval matches any time.
idInterval
properties
endTime
descriptionOptional. Exclusive end of the interval. If specified, a Timestamp matching this interval will have to be before the end.
formatgoogle-datetime
typestring
startTime
descriptionOptional. Inclusive start of the interval. If specified, a Timestamp matching this interval will have to be the same or after the start.
formatgoogle-datetime
typestring
typeobject
ListDataAccessLabelsResponse
descriptionResponse message for ListDataAccessLabels.
idListDataAccessLabelsResponse
properties
dataAccessLabels
descriptionList of data access labels.
items
$refDataAccessLabel
typearray
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
typeobject
ListDataAccessScopesResponse
descriptionResponse message for ListDataAccessScopes.
idListDataAccessScopesResponse
properties
dataAccessScopes
descriptionList of data access scopes.
items
$refDataAccessScope
typearray
globalDataAccessScopeGranted
descriptionWhether or not global scope is granted to the user.
typeboolean
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
typeobject
ListOperationsResponse
descriptionThe response message for Operations.ListOperations.
idListOperationsResponse
properties
nextPageToken
descriptionThe standard List next-page token.
typestring
operations
descriptionA list of operations that matches the specified filter in the request.
items
$refOperation
typearray
typeobject
ListReferenceListsResponse
descriptionA response to a request for a list of reference lists.
idListReferenceListsResponse
properties
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
referenceLists
descriptionThe reference lists. Ordered in ascending alphabetical order by name.
items
$refReferenceList
typearray
typeobject
ListRetrohuntsResponse
descriptionResponse message for ListRetrohunts method.
idListRetrohuntsResponse
properties
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
retrohunts
descriptionThe retrohunts from the specified rule.
items
$refRetrohunt
typearray
typeobject
ListRuleDeploymentsResponse
descriptionResponse message for ListRuleDeployments.
idListRuleDeploymentsResponse
properties
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
ruleDeployments
descriptionThe rule deployments from all rules.
items
$refRuleDeployment
typearray
typeobject
ListRuleRevisionsResponse
descriptionResponse message for ListRuleRevisions method.
idListRuleRevisionsResponse
properties
nextPageToken
descriptionA token that can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
rules
descriptionThe revisions of the rule.
items
$refRule
typearray
typeobject
ListRulesResponse
descriptionResponse message for ListRules method.
idListRulesResponse
properties
nextPageToken
descriptionA token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
rules
descriptionThe rules from the specified instance.
items
$refRule
typearray
typeobject
ListWatchlistsResponse
descriptionResponse message for listing watchlists.
idListWatchlistsResponse
properties
nextPageToken
descriptionOptional. A token, which can be sent as `page_token` to retrieve the next page. If this field is omitted, there are no subsequent pages.
typestring
watchlists
descriptionOptional. The watchlists from the specified instance.
items
$refWatchlist
typearray
typeobject
Manual
descriptionEntities are added manually.
idManual
properties
typeobject
Operation
descriptionThis resource represents a long-running operation that is the result of a network API call.
idOperation
properties
done
descriptionIf the value is `false`, it means the operation is still in progress. If `true`, the operation is completed, and either `error` or `response` is available.
typeboolean
error
$refStatus
descriptionThe error result of the operation in case of failure or cancellation.
metadata
additionalProperties
descriptionProperties of the object. Contains field @type with type URL.
typeany
descriptionService-specific metadata associated with the operation. It typically contains progress information and common metadata such as create time. Some services might not provide such metadata. Any method that returns a long-running operation should document the metadata type, if any.
typeobject
name
descriptionThe server-assigned name, which is only unique within the same service that originally returns it. If you use the default HTTP mapping, the `name` should be a resource name ending with `operations/{unique_id}`.
typestring
response
additionalProperties
descriptionProperties of the object. Contains field @type with type URL.
typeany
descriptionThe normal, successful response of the operation. If the original method returns no data on success, such as `Delete`, the response is `google.protobuf.Empty`. If the original method is standard `Get`/`Create`/`Update`, the response should be the resource. For other methods, the response should have the type `XxxResponse`, where `Xxx` is the original method name. For example, if the original method name is `TakeSnapshot()`, the inferred response type is `TakeSnapshotResponse`.
typeobject
typeobject
ReferenceList
descriptionA reference list. Reference lists are user-defined lists of values which users can use in multiple Rules.
idReferenceList
properties
description
descriptionRequired. A user-provided description of the reference list.
typestring
displayName
descriptionOutput only. The unique display name of the reference list.
readOnlyTrue
typestring
entries
descriptionRequired. The entries of the reference list. When listed, they are returned in the order that was specified at creation or update. The combined size of the values of the reference list may not exceed 6MB. This is returned only when the view is REFERENCE_LIST_VIEW_FULL.
items
$refReferenceListEntry
typearray
name
descriptionOutput only. The resource name of the reference list. Format: projects/{project}/locations/{location}/instances/{instance}/referenceLists/{reference_list}
readOnlyTrue
typestring
revisionCreateTime
descriptionOutput only. The timestamp when the reference list was last updated.
formatgoogle-datetime
readOnlyTrue
typestring
ruleAssociationsCount
descriptionOutput only. The count of self-authored rules using the reference list.
formatint32
readOnlyTrue
typeinteger
rules
descriptionOutput only. The resource names for the associated self-authored Rules that use this reference list. This is returned only when the view is REFERENCE_LIST_VIEW_FULL.
items
typestring
readOnlyTrue
typearray
scopeInfo
$refScopeInfo
descriptionOutput only. The scope info of the reference list. During reference list creation, if this field is not set, the reference list without scopes (an unscoped list) will be created for an unscoped user. For a scoped user, this field must be set. During reference list update, if scope_info is requested to be updated, this field must be set.
readOnlyTrue
syntaxType
descriptionRequired. The syntax type indicating how list entries should be validated.
enum
  • REFERENCE_LIST_SYNTAX_TYPE_UNSPECIFIED
  • REFERENCE_LIST_SYNTAX_TYPE_PLAIN_TEXT_STRING
  • REFERENCE_LIST_SYNTAX_TYPE_REGEX
  • REFERENCE_LIST_SYNTAX_TYPE_CIDR
enumDescriptions
  • Defaults to REFERENCE_LIST_SYNTAX_TYPE_PLAIN_TEXT_STRING.
  • List contains plain text patterns.
  • List contains only Regular Expression patterns.
  • List contains only CIDR patterns.
typestring
typeobject
ReferenceListEntry
descriptionAn entry in a reference list.
idReferenceListEntry
properties
value
descriptionRequired. The value of the entry. Maximum length is 512 characters.
typestring
typeobject
ReferenceListScope
descriptionReferenceListScope specifies the list of scope names of the reference list.
idReferenceListScope
properties
scopeNames
descriptionOptional. The list of scope names of the reference list. The scope names should be full resource names and should be of the format: "projects/{project}/locations/{location}/instances/{instance}/dataAccessScopes/{scope_name}".
items
typestring
typearray
typeobject
Retrohunt
descriptionRetrohunt is an execution of a Rule over a time range in the past.
idRetrohunt
properties
executionInterval
$refInterval
descriptionOutput only. The start and end time of the retrohunt execution. If the retrohunt is not yet finished, the end time of the interval will not be populated.
readOnlyTrue
name
descriptionThe resource name of the retrohunt. Retrohunt is the child of a rule revision. {rule} in the format below is structured as {rule_id@revision_id}. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}/retrohunts/{retrohunt}
typestring
processInterval
$refInterval
descriptionRequired. The start and end time of the event time range this retrohunt processes.
progressPercentage
descriptionOutput only. Percent progress of the retrohunt towards completion, from 0.00 to 100.00.
formatfloat
readOnlyTrue
typenumber
state
descriptionOutput only. The state of the retrohunt.
enum
  • STATE_UNSPECIFIED
  • RUNNING
  • DONE
  • CANCELLED
  • FAILED
enumDescriptions
  • Unspecified or unknown retrohunt state.
  • Running state.
  • Done state.
  • Cancelled state.
  • Failed state.
readOnlyTrue
typestring
typeobject
RetrohuntMetadata
descriptionOperation Metadata for Retrohunts.
idRetrohuntMetadata
properties
executionInterval
$refInterval
descriptionThe start and end time of the retrohunt execution. If the retrohunt is not yet finished, the end time of the interval will not be filled.
progressPercentage
descriptionPercent progress of the retrohunt towards completion, from 0.00 to 100.00.
formatfloat
typenumber
retrohunt
descriptionThe name of the retrohunt. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}/retrohunts/{retrohunt}
typestring
typeobject
Rule
descriptionThe Rule resource represents a user-created rule. NEXT TAG: 21
idRule
properties
allowedRunFrequencies
descriptionOutput only. The run frequencies that are allowed for the rule. Populated in BASIC view and FULL view.
items
enum
  • RUN_FREQUENCY_UNSPECIFIED
  • LIVE
  • HOURLY
  • DAILY
enumDescriptions
  • The run frequency is unspecified/unknown.
  • Executes in real time.
  • Executes once per hour.
  • Executes once per day.
typestring
readOnlyTrue
typearray
author
descriptionOutput only. The author of the rule. Extracted from the meta section of text. Populated in BASIC view and FULL view.
readOnlyTrue
typestring
compilationDiagnostics
descriptionOutput only. A list of a rule's corresponding compilation diagnostic messages such as compilation errors and compilation warnings. Populated in FULL view.
items
$refCompilationDiagnostic
readOnlyTrue
typearray
compilationState
descriptionOutput only. The current compilation state of the rule. Populated in FULL view.
enum
  • COMPILATION_STATE_UNSPECIFIED
  • SUCCEEDED
  • FAILED
enumDescriptions
  • The compilation state is unspecified/unknown.
  • The Rule can successfully compile.
  • The Rule cannot successfully compile. This is possible if a backwards-incompatible change was made to the compiler.
readOnlyTrue
typestring
createTime
descriptionOutput only. The timestamp of when the rule was created. Populated in FULL view.
formatgoogle-datetime
readOnlyTrue
typestring
dataTables
descriptionOutput only. Resource names of the data tables used in this rule.
items
typestring
readOnlyTrue
typearray
displayName
descriptionOutput only. Display name of the rule. Populated in BASIC view and FULL view.
readOnlyTrue
typestring
etag
descriptionThe etag for this rule. If this is provided on update, the request will succeed if and only if it matches the server-computed value, and will fail with an ABORTED error otherwise. Populated in BASIC view and FULL view.
typestring
inputsUsed
$refInputsUsed
descriptionOutput only. The set of inputs used in the rule. For example, if the rule uses $e.principal.hostname, then the uses_udm field will be true.
readOnlyTrue
metadata
additionalProperties
typestring
descriptionOutput only. Additional metadata specified in the meta section of text. Populated in FULL view.
readOnlyTrue
typeobject
name
descriptionFull resource name for the rule. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}
typestring
nearRealTimeLiveRuleEligible
descriptionOutput only. Indicate the rule can run in near real time live rule. If this is true, the rule uses the near real time live rule when the run frequency is set to LIVE.
readOnlyTrue
typeboolean
referenceLists
descriptionOutput only. Resource names of the reference lists used in this rule. Populated in FULL view.
items
typestring
readOnlyTrue
typearray
revisionCreateTime
descriptionOutput only. The timestamp of when the rule revision was created. Populated in FULL, REVISION_METADATA_ONLY views.
formatgoogle-datetime
readOnlyTrue
typestring
revisionId
descriptionOutput only. The revision ID of the rule. A new revision is created whenever the rule text is changed in any way. Format: v_{10 digits}_{9 digits} Populated in REVISION_METADATA_ONLY view and FULL view.
readOnlyTrue
typestring
scope
descriptionResource name of the DataAccessScope bound to this rule. Populated in BASIC view and FULL view. If reference lists are used in the rule, validations will be performed against this scope to ensure that the reference lists are compatible with both the user's and the rule's scopes. The scope should be in the format: "projects/{project}/locations/{location}/instances/{instance}/dataAccessScopes/{scope}".
typestring
severity
$refSeverity
descriptionOutput only. The severity of the rule as specified in the meta section of text. Populated in BASIC view and FULL view.
readOnlyTrue
text
descriptionThe YARA-L content of the rule. Populated in FULL view.
typestring
type
descriptionOutput only. User-facing type of the rule. Extracted from the events section of rule text. Populated in BASIC view and FULL view.
enum
  • RULE_TYPE_UNSPECIFIED
  • SINGLE_EVENT
  • MULTI_EVENT
enumDescriptions
  • The rule type is unspecified/unknown.
  • Rule checks for the existence of a single event.
  • Rule checks for correlation between multiple events
readOnlyTrue
typestring
typeobject
RuleDeployment
descriptionThe RuleDeployment resource represents the deployment state of a Rule.
idRuleDeployment
properties
alerting
descriptionWhether detections resulting from this deployment should be considered alerts.
typeboolean
archiveTime
descriptionOutput only. The timestamp when the rule deployment archive state was last set to true. If the rule deployment's current archive state is not set to true, the field will be empty.
formatgoogle-datetime
readOnlyTrue
typestring
archived
descriptionThe archive state of the rule deployment. Cannot be set to true unless enabled is set to false. If set to true, alerting will automatically be set to false. If currently set to true, enabled, alerting, and run_frequency cannot be updated.
typeboolean
consumerRules
descriptionOutput only. The names of the associated/chained consumer rules. Rules are considered consumers of this rule if their rule text explicitly filters on this rule's ruleid. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}
items
typestring
readOnlyTrue
typearray
enabled
descriptionWhether the rule is currently deployed continuously against incoming data.
typeboolean
executionState
descriptionOutput only. The execution state of the rule deployment.
enum
  • EXECUTION_STATE_UNSPECIFIED
  • DEFAULT
  • LIMITED
  • PAUSED
enumDescriptions
  • Unspecified or unknown execution state.
  • Default execution state.
  • Rules in limited state may not have their executions guaranteed.
  • Paused rules are not executed at all.
readOnlyTrue
typestring
lastAlertStatusChangeTime
descriptionOutput only. The timestamp when the rule deployment alert state was lastly changed. This is filled regardless of the current alert state. E.g. if the current alert status is false, this timestamp will be the timestamp when the alert status was changed to false.
formatgoogle-datetime
readOnlyTrue
typestring
name
descriptionRequired. The resource name of the rule deployment. Note that RuleDeployment is a child of the overall Rule, not any individual revision, so the resource ID segment for the Rule resource must not reference a specific revision. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}/deployment
typestring
producerRules
descriptionOutput only. The names of the associated/chained producer rules. Rules are considered producers for this rule if this rule explicitly filters on their ruleid. Format: projects/{project}/locations/{location}/instances/{instance}/rules/{rule}
items
typestring
readOnlyTrue
typearray
runFrequency
descriptionThe run frequency of the rule deployment.
enum
  • RUN_FREQUENCY_UNSPECIFIED
  • LIVE
  • HOURLY
  • DAILY
enumDescriptions
  • The run frequency is unspecified/unknown.
  • Executes in real time.
  • Executes once per hour.
  • Executes once per day.
typestring
typeobject
ScopeInfo
descriptionScopeInfo specifies the scope info of the reference list.
idScopeInfo
properties
referenceListScope
$refReferenceListScope
descriptionRequired. The list of scope names of the reference list, if the list is empty the reference list is treated as unscoped.
typeobject
Severity
descriptionSeverity represents the severity level of the rule.
idSeverity
properties
displayName
descriptionThe display name of the severity level. Extracted from the meta section of the rule text.
typestring
typeobject
Status
descriptionThe `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors).
idStatus
properties
code
descriptionThe status code, which should be an enum value of google.rpc.Code.
formatint32
typeinteger
details
descriptionA list of messages that carry the error details. There is a common set of message types for APIs to use.
items
additionalProperties
descriptionProperties of the object. Contains field @type with type URL.
typeany
typeobject
typearray
message
descriptionA developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
typestring
typeobject
UdmSearchOperationMetadata
descriptionInformation about a UDM Search operation. This message is used to populate the `metadata` field of `Operation` resources created by UDM Search.
idUdmSearchOperationMetadata
properties
baselineEventsCount
descriptionThe number of events matching the baseline query so far.
formatint32
typeinteger
baselineQuery
descriptionQuery used to search for events.
typestring
baselineTimeRange
$refInterval
descriptionThe time range used for the baseline query [inclusive start time, exclusive end time).
caseInsensitive
descriptionIf true, the search was performed in a case-insensitive manner.
typeboolean
endTime
descriptionThe end time of the operation, if done.
formatgoogle-datetime
typestring
expireTime
descriptionThe time when the operation results expire. This time may change while the operation is in progress. If unset, the results never expire.
formatgoogle-datetime
typestring
filteredEventsCount
descriptionThe number of events matching the snapshot query so far. This is <= `baseline_events_count`. If the snapshot query is empty, this will be equal to `baseline_events_count`.
formatint32
typeinteger
progress
descriptionA value from 0 to 1 representing the progress of the operation.
formatdouble
typenumber
snapshotQuery
descriptionQuery used to filter the baseline query's events.
typestring
snapshotTimeRange
$refInterval
descriptionTime range used to filter the baseline query's events [inclusive start time, exclusive end time). This time range is completely within `baseline_time_range`. If not set, it is assumed to match `baseline_time_range`.
startTime
descriptionThe start time of the operation.
formatgoogle-datetime
typestring
statsRowsCount
descriptionThe total number of rows returned for a stats query.
formatint32
typeinteger
typeobject
UserError
descriptionThis message exists solely to get the `UserErrorReason` enum to appear in the service discovery document.
idUserError
properties
reason
descriptionThe reason for a specific error that should be shown to the app user.
enum
  • USER_ERROR_REASON_UNSPECIFIED
  • RULE_REFERENCES_OUT_OF_SCOPE
  • RULE_ARCHIVED
  • RULE_STALE_VERSION
  • RULE_ACTIVE
  • RULE_RETROHUNT_RUNNING
  • RULE_LIVE
  • RULE_ALREADY_DISABLED
  • EXPENSIVE_RULE_LARGE_WINDOW
  • RULE_LIMITED_PAUSED
  • REFERENCE_LIST_NOT_FOUND
  • UEBA_RULES_NO_SCOPE
  • RULE_TESTING_INTERVAL_TOO_SHORT
  • SEARCH_CSV_FIELDS_NOT_SUPPORTED
  • INVALID_ARGUMENT_FOR_DASHBOARD_FILTER
  • INVALID_CONFIG_FOR_DASHBOARD_IMPORT
  • RETROHUNT_LIMIT_REACHED
enumDescriptions
  • Do not use this default value.
  • The rule text references resources, such as reference lists, that are out of scope for the rule. Example of an ErrorInfo for this reason: { "reason": "RULE_REFERENCES_OUT_OF_SCOPE", "domain": "chronicle.googleapis.com", "metadata": { "reference_lists": "list_name1,list_name2,list_name3,", } }
  • The rule being operated on (saving or setting run frequency) is archived, and so the operation can't be done.
  • The rule version being operated on is not the latest, and so the operation can't be done.
  • The rule can't be archived because it is live (detecting) and a retrohunt is running.
  • The rule can't be archived because a retrohunt is running against it.
  • The rule can't be archived because it is live (detecting).
  • The rule can't be disabled because is is already disabled.
  • The rule's match time window is too large for its current run frequency.
  • The rule can't be enabled because it has been limited or paused because of high resource use.
  • The list being referred to doesn't exist.
  • UEBA rules may not be assigned a data access scope.
  • The rule's match window is longer than the time range it's being tested over. Returns the match window duration and testing interval duration as metadata labeled `match_window_duration` and `testing_interval_duration`, formatted as Go durations. Example ErrorInfo: { "reason": "RULE_TESTING_INTERVAL_TOO_SHORT", "domain": "chronicle.googleapis.com", "metadata": { "match_window_duration": "24h", "testing_interval_duration": "12h", } }
  • The CSV fields are not supported for download. Returns the unsupported fields as metadata labeled `unsupported_fields`. Example ErrorInfo: { "reason": "SEARCH_CSV_FIELDS_NOT_SUPPORTED", "domain": "chronicle.googleapis.com", "metadata": { "unsupported_fields": "udm.about.security_result.variables,udm.network.http.parsed_user_agent.family", } }
  • Invalid argument for dashboard chart filters. Returns the filter name, filter value, operator, and expected type as metadata labeled `filter_name`, `filter_value`, `operator`, and `expected_type`, respectively. Example ErrorInfo: { "reason": "INVALID_ARGUMENT_FOR_DASHBOARD_FILTER", "domain": "chronicle.googleapis.com", "metadata": { "filter_name": "filter_name", "filter_value": "filter_value", "operater": "operator", "expected_type": "expected_type", } }
  • Invalid config for dashboard import. Example ErrorInfo: { "reason": "INVALID_CONFIG_FOR_DASHBOARD_IMPORT", "domain": "chronicle.googleapis.com", }
  • The user has reached the limit of retrohunts that can be run. Returns the retrohunt limit as metadata labeled `retrohunt_limit`. Example ErrorInfo: { "reason": "RETROHUNT_LIMIT_REACHED", "domain": "chronicle.googleapis.com", "metadata": { "retrohunt_limit": "10", } }
typestring
typeobject
Watchlist
descriptionA watchlist is a list of entities that allows for bulk operations over the included entities.
idWatchlist
properties
createTime
descriptionOutput only. Time the watchlist was created.
formatgoogle-datetime
readOnlyTrue
typestring
description
descriptionOptional. Description of the watchlist.
typestring
displayName
descriptionRequired. Display name of the watchlist. Note that it must be at least one character and less than 63 characters (https://google.aip.dev/148).
typestring
entityCount
$refEntityCount
descriptionOutput only. Entity count in the watchlist.
readOnlyTrue
entityPopulationMechanism
$refEntityPopulationMechanism
descriptionRequired. Mechanism to populate entities in the watchlist.
multiplyingFactor
descriptionOptional. Weight applied to the risk score for entities in this watchlist. The default is 1.0 if it is not specified.
formatfloat
typenumber
name
descriptionIdentifier. Resource name of the watchlist. Format: projects/{project}/locations/{location}/instances/{instance}/watchlists/{watchlist}
typestring
updateTime
descriptionOutput only. Time the watchlist was last updated.
formatgoogle-datetime
readOnlyTrue
typestring
watchlistUserPreferences
$refWatchlistUserPreferences
descriptionOptional. User preferences for watchlist configuration.
typeobject
WatchlistUserPreferences
descriptionA collection of user preferences for watchlist UI configuration.
idWatchlistUserPreferences
properties
pinned
descriptionOptional. Whether the watchlist is pinned on the dashboard.
typeboolean
typeobject
prod/us-east1-connectgateway-
values_changed
root['revision']
new_value20250310
old_value20250303
prod/us-east1-connectgateway-v1
values_changed
root['revision']
new_value20250310
old_value20250303
prod/us-east1-connectgateway-v1beta1
values_changed
root['revision']
new_value20250310
old_value20250303
prod/us-east1-containerfilesystem-
values_changed
root['revision']
new_value20250307
old_value20250221
prod/us-east1-containerfilesystem-v1
values_changed
root['revision']
new_value20250307
old_value20250221
prod/us-east4-connectgateway-
values_changed
root['revision']
new_value20250310
old_value20250303
prod/us-east4-connectgateway-v1
values_changed
root['revision']
new_value20250310
old_value20250303
prod/us-east4-connectgateway-v1beta1
values_changed
root['revision']
new_value20250310
old_value20250303
prod/us-east4-containerfilesystem-
values_changed
root['revision']
new_value20250307
old_value20250221
prod/us-east4-containerfilesystem-v1
values_changed
root['revision']
new_value20250307
old_value20250221
prod/us-enterpriseknowledgegraph-
values_changed
root['revision']
new_value20250228
old_value20250221
prod/us-enterpriseknowledgegraph-v1
values_changed
root['revision']
new_value20250228
old_value20250221
prod/us-rbmopenmaap-
values_changed
root['revision']
new_value20250313
old_value20250310
prod/us-rbmopenmaap-v1
values_changed
root['revision']
new_value20250313
old_value20250310
prod/us-taskassist-pa-
dictionary_item_added
  • root['schemas']['SourceId']['properties']['threadLocator']
values_changed
root['revision']
new_value20250310
old_value20250303
prod/us-taskassist-pa-v1
values_changed
root['revision']
new_value20250310
old_value20250303
prod/us-taskassist-pa-v2
dictionary_item_added
  • root['schemas']['SourceId']['properties']['threadLocator']
values_changed
root['revision']
new_value20250310
old_value20250303
prod/us-west1-connectgateway-
values_changed
root['revision']
new_value20250310
old_value20250303
prod/us-west1-connectgateway-v1
values_changed
root['revision']
new_value20250310
old_value20250303
prod/us-west1-connectgateway-v1beta1
values_changed
root['revision']
new_value20250310
old_value20250303
prod/us-west1-containerfilesystem-
values_changed
root['revision']
new_value20250307
old_value20250221
prod/us-west1-containerfilesystem-v1
values_changed
root['revision']
new_value20250307
old_value20250221
prod/us-west2-dataproccontrol-
values_changed
root['revision']
new_value20250311
old_value20250306
prod/us-west2-dataproccontrol-v1
values_changed
root['revision']
new_value20250311
old_value20250306
prod/us-west3-dataproccontrol-
values_changed
root['revision']
new_value20250311
old_value20250224
prod/us-west3-dataproccontrol-v1
values_changed
root['revision']
new_value20250311
old_value20250224
prod/us-west4-connectgateway-
values_changed
root['revision']
new_value20250310
old_value20250303
prod/us-west4-connectgateway-v1
values_changed
root['revision']
new_value20250310
old_value20250303
prod/us-west4-connectgateway-v1beta1
values_changed
root['revision']
new_value20250310
old_value20250303
prod/us-west4-containerfilesystem-
values_changed
root['revision']
new_value20250307
old_value20250221
prod/us-west4-containerfilesystem-v1
values_changed
root['revision']
new_value20250307
old_value20250221
prod/usercontext-
values_changed
root['revision']
new_value20250312
old_value20250226
prod/usercontext-v1
values_changed
root['revision']
new_value20250312
old_value20250226
prod/userlocation-
values_changed
root['revision']
new_value20250311
old_value20250304
prod/userlocation-v1
values_changed
root['revision']
new_value20250311
old_value20250304
prod/userpaneltv-pa-
values_changed
root['revision']
new_value20250310
old_value20250303
prod/userpaneltv-pa-v1
values_changed
root['revision']
new_value20250310
old_value20250303
prod/vectortile-
values_changed
root['revision']
new_value20250312
old_value20250309
prod/vectortile-v1
values_changed
root['revision']
new_value20250312
old_value20250309
prod/workloadcertificate-v1alpha1
values_changed
root['revision']
new_value20240117
old_value20240103
prod/workspaceui-pa-
values_changed
root['revision']
new_value20250310
old_value20250226
prod/workspaceui-pa-v1
values_changed
root['revision']
new_value20250310
old_value20250226
prod/workspacevideo-pa-
values_changed
root['revision']
new_value20250311
old_value20250309
prod/workspacevideo-pa-v1
values_changed
root['revision']
new_value20250312
old_value20250309
prod/youtubeembeddedplayer-
values_changed
root['revision']
new_value20250312
old_value20250305
prod/youtubeembeddedplayer-v1beta1
values_changed
root['revision']
new_value20250312
old_value20250305
prod/youtubeoembed-
values_changed
root['revision']
new_value20250312
old_value20250305
prod/youtubeoembed-v1
values_changed
root['revision']
new_value20250312
old_value20250305