Class AtiPrioritization
AtiPrioritization contains various fields used to calculate a priority score for an entity identified as a threat.
Implements
Namespace: Google.Backstory
Assembly: Google.Backstory.dll
Syntax
public sealed class AtiPrioritization : IMessage<AtiPrioritization>, IEquatable<AtiPrioritization>, IDeepCloneable<AtiPrioritization>, IBufferMessage, IMessageConstructors
AtiPrioritization()
Declaration
public AtiPrioritization()AtiPrioritization(AtiPrioritization)
Declaration
public AtiPrioritization(AtiPrioritization other)Parameters
| Type | Name | Description |
|---|---|---|
| AtiPrioritization | other |
Properties
ActiveIr
Whether one or more Mandiant incident response customers had this indicator in their environment.
Declaration
public bool ActiveIr { get; set; }Property Value
| Type | Description |
|---|---|
| bool |
ActiveIrFirstTaggedTime
The timestamp of the first time an active IR was applied to this entity.
Declaration
public Timestamp ActiveIrFirstTaggedTime { get; set; }Property Value
| Type | Description |
|---|---|
| Timestamp |
AttributedMalware
Malware families associated with this indicator.
Declaration
public RepeatedField<SecurityResult.Types.Association> AttributedMalware { get; }Property Value
| Type | Description |
|---|---|
| RepeatedField<SecurityResult.Types.Association> |
AttributedThreatActors
Threat actors associated with this indicator.
Declaration
public RepeatedField<SecurityResult.Types.Association> AttributedThreatActors { get; }Property Value
| Type | Description |
|---|---|
| RepeatedField<SecurityResult.Types.Association> |
Exclusive
Whether the indicator is being used by a maximum of one threat actor.
Declaration
public bool Exclusive { get; set; }Property Value
| Type | Description |
|---|---|
| bool |
GlobalCustomerCount
Global customer count over the last 30 days
Declaration
public long GlobalCustomerCount { get; set; }Property Value
| Type | Description |
|---|---|
| long |
GlobalHitCount
Global hit count over the last 30 days
Declaration
public long GlobalHitCount { get; set; }Property Value
| Type | Description |
|---|---|
| long |
GtiSeverity
The confidence score from "GTI severity" source.
Declaration
public int GtiSeverity { get; set; }Property Value
| Type | Description |
|---|---|
| int |
GtiThreatScore
The confidence score from "GTI threat score" source.
Declaration
public int GtiThreatScore { get; set; }Property Value
| Type | Description |
|---|---|
| int |
GtiUpdateTime
Timestamp of the latest update for GTI verdict, severity, or threat score.
Declaration
public Timestamp GtiUpdateTime { get; set; }Property Value
| Type | Description |
|---|---|
| Timestamp |
GtiVerdict
The confidence score from "GTI verdict" source.
Declaration
public int GtiVerdict { get; set; }Property Value
| Type | Description |
|---|---|
| int |
MandiantAnalystConfidence
The confidence score from "Mandiant Analyst Intel" source.
Declaration
public int MandiantAnalystConfidence { get; set; }Property Value
| Type | Description |
|---|---|
| int |
Osint
Whether the indicator details are available in open source.
Declaration
public bool Osint { get; set; }Property Value
| Type | Description |
|---|---|
| bool |
Reviewed
Whether the indicator verdict has passed review.
Declaration
public bool Reviewed { get; set; }Property Value
| Type | Description |
|---|---|
| bool |
Scanner
Whether the indicator is a scanner.
Declaration
public bool Scanner { get; set; }Property Value
| Type | Description |
|---|---|
| bool |