Class Artifact

Information about an artifact. The artifact can only be an IP.

Inheritance
object
Artifact
Implements
Inherited Members
Namespace: Google.Backstory
Assembly: Google.Backstory.dll
Syntax
public sealed class Artifact : IMessage<Artifact>, IEquatable<Artifact>, IDeepCloneable<Artifact>, IBufferMessage, IMessage

Constructors

Artifact()

Declaration
public Artifact()

Artifact(Artifact)

Declaration
public Artifact(Artifact other)
Parameters
Type Name Description
Artifact other

Properties

Anonymous

Whether the VPN tunnels are configured for anonymous browsing or not.

Declaration
public bool Anonymous { get; set; }
Property Value
Type Description
bool

ArtifactClient

Entity or software accessing or utilizing network resources.

Declaration
public ArtifactClient ArtifactClient { get; set; }
Property Value
Type Description
ArtifactClient

AsOwner

Owner of the Autonomous System to which the IP address belongs.

Declaration
public string AsOwner { get; set; }
Property Value
Type Description
string

Asn

Autonomous System Number to which the IP address belongs.

Declaration
public long Asn { get; set; }
Property Value
Type Description
long

FirstSeenTime

First seen timestamp of the IP in the customer's environment.

Declaration
public Timestamp FirstSeenTime { get; set; }
Property Value
Type Description
Timestamp

Ip

IP address of the artifact. This field can be used as an entity indicator for an external destination IP entity.

Declaration
public string Ip { get; set; }
Property Value
Type Description
string

Jarm

The JARM hash for the IP address. (https://engineering.salesforce.com/easily-identify-malicious-servers-on-the-internet-with-jarm-e095edac525a).

Declaration
public string Jarm { get; set; }
Property Value
Type Description
string

LastHttpsCertificate

SSL certificate information about the IP address.

Declaration
public SSLCertificate LastHttpsCertificate { get; set; }
Property Value
Type Description
SSLCertificate

LastHttpsCertificateDate

Most recent date for the certificate in VirusTotal.

Declaration
public Timestamp LastHttpsCertificateDate { get; set; }
Property Value
Type Description
Timestamp

LastSeenTime

Last seen timestamp of the IP address in the customer's environment.

Declaration
public Timestamp LastSeenTime { get; set; }
Property Value
Type Description
Timestamp

Location

Location of the Artifact's IP address.

Declaration
public Location Location { get; set; }
Property Value
Type Description
Location

Network

Network information related to the Artifact's IP address.

Declaration
public Network Network { get; set; }
Property Value
Type Description
Network

Prevalence

The prevalence of the artifact within the customer's environment.

Declaration
public Prevalence Prevalence { get; set; }
Property Value
Type Description
Prevalence

RegionalInternetRegistry

RIR (one of the current RIRs: AFRINIC, ARIN, APNIC, LACNIC or RIPE NCC).

Declaration
public string RegionalInternetRegistry { get; set; }
Property Value
Type Description
string

Risks

This field lists potential risks associated with the network activity.

Declaration
public RepeatedField<string> Risks { get; }
Property Value
Type Description
RepeatedField<string>

Tags

Identification attributes

Declaration
public RepeatedField<string> Tags { get; }
Property Value
Type Description
RepeatedField<string>

Tunnels

VPN tunnels.

Declaration
public RepeatedField<Tunnels> Tunnels { get; }
Property Value
Type Description
RepeatedField<Tunnels>

Whois

WHOIS information as returned from the pertinent WHOIS server.

Declaration
public string Whois { get; set; }
Property Value
Type Description
string

WhoisDate

Date of the last update of the WHOIS record in VirusTotal.

Declaration
public Timestamp WhoisDate { get; set; }
Property Value
Type Description
Timestamp