Class Collection

Collection represents a container of objects (such as events, entity context metadata, detection finding metadata) and state (such as investigation details).

An example use case for Collection is to model a detection and investigation from detection finding metadata to investigative state collected in the course of the investigation. For more complex investigation and response workflows a Collection could represent an incident consisting of multiple child findings or incidents. This can be expanded on to model remediation elements of a full detection and response workflow.

Inheritance
object
Collection
Implements
Inherited Members
Namespace: Google.Backstory
Assembly: Google.Backstory.dll
Syntax
public sealed class Collection : IMessage<Collection>, IEquatable<Collection>, IDeepCloneable<Collection>, IBufferMessage, IMessage

Constructors

Collection()

Declaration
public Collection()

Collection(Collection)

Declaration
public Collection(Collection other)
Parameters
Type Name Description
Collection other

Properties

CaseName

The resource name of the Case that this collection belongs to. Example: projects/{project id}/locations/{region}/chronicle/cases/{internal_case_id}

Declaration
public string CaseName { get; set; }
Property Value
Type Description
string

CollectionElements

Constituent elements of the collection. Each element shares an association that groups it together and is a component of the overall collection. For example, a detection collection may have several constituent elements that each share a correlation association that together represent a particular pattern or behavior.

Declaration
public RepeatedField<Element> CollectionElements { get; }
Property Value
Type Description
RepeatedField<Element>

CreatedTime

Time the collection was created.

Declaration
public Timestamp CreatedTime { get; set; }
Property Value
Type Description
Timestamp

DataAccessScope

The resource name of the DataAccessScope of this collection.

Declaration
public string DataAccessScope { get; set; }
Property Value
Type Description
string

Detection

Detection metadata for findings that represent detections, can include rule details, machine learning model metadata, and indicators implicated in the detection (using the .about field).

Declaration
public RepeatedField<SecurityResult> Detection { get; }
Property Value
Type Description
RepeatedField<SecurityResult>

DetectionTime

Timestamp within the time_window related to the time of the collection_elements. For Rule Detections, this timestamp is the end of the the time_window for multi-event rules or the time of the event for single event rules. For late-arriving events that trigger new alerts, the detection_time will be the event time of the event.

Declaration
public Timestamp DetectionTime { get; set; }
Property Value
Type Description
Timestamp

DetectionTimingDetails

Detection timing details for the collection. These details are used to determine prossible causes of latency for the detection. This field is only set for detections that are generated by rules.

Declaration
public RepeatedField<Collection.Types.DetectionTimingDetails> DetectionTimingDetails { get; }
Property Value
Type Description
RepeatedField<Collection.Types.DetectionTimingDetails>

Id

Unique ID for the collection. The ID is specific to the type of collection. For example, with rule detections this is the detection ID.

Declaration
public string Id { get; set; }
Property Value
Type Description
string

IdNamespace

The ID namespace used for the Collection.

Declaration
public Id.Types.Namespace IdNamespace { get; set; }
Property Value
Type Description
Id.Types.Namespace

Investigation

Consolidated investigation details (categorization, status, etc) typically for collections that begin as detection findings and then evolve with analyst action and feedback into investigations around the detection output.

Declaration
public Investigation Investigation { get; set; }
Property Value
Type Description
Investigation

LastUpdatedTime

Time the collection was last updated.

Declaration
public Timestamp LastUpdatedTime { get; set; }
Property Value
Type Description
Timestamp

LatencyMetrics

The latency metrics for the specific detection. These metrics are calculated from ALL of the events that contribute to the detection, not just the sampled ones.

Declaration
public LatencyMetrics LatencyMetrics { get; set; }
Property Value
Type Description
LatencyMetrics

ResponsePlatformInfo

Alert related info of this same alert in customer's SOAR platform.

Declaration
public ResponsePlatformInfo ResponsePlatformInfo { get; set; }
Property Value
Type Description
ResponsePlatformInfo

RuleRunFrequency

The run frequency of the rule when it generated the detection.

Declaration
public Collection.Types.RunFrequency RuleRunFrequency { get; set; }
Property Value
Type Description
Collection.Types.RunFrequency

SimulatedEventCount

The total number of simulated events that contributed to this detection. Simulated events are realistic threat sequences (Raw Logs or UDM) programmatically delivered into the production ingestion pipeline to verify the entire detection lifecycle—from identification to action.

Declaration
public long SimulatedEventCount { get; set; }
Property Value
Type Description
long

SimulatedEventNames

The set of all values from event ingestion_labels where SIMULATED is set as the key, for all simulated events that participated in this detection.

Declaration
public RepeatedField<string> SimulatedEventNames { get; }
Property Value
Type Description
RepeatedField<string>

SoarAlert

A boolean field indicating that the alert is present in SOAR.

Declaration
public bool SoarAlert { get; set; }
Property Value
Type Description
bool

SoarAlertMetadata

Metadata fields of alerts coming from other SIEM systems via SOAR.

Declaration
public SoarAlertMetadata SoarAlertMetadata { get; set; }
Property Value
Type Description
SoarAlertMetadata

Tags

Tags set by UC/DSML/RE for the Finding during creation.

Declaration
public RepeatedField<string> Tags { get; }
Property Value
Type Description
RepeatedField<string>

TimeWindow

Time interval that the collection represents.

Declaration
public Interval TimeWindow { get; set; }
Property Value
Type Description
Interval

Type

What the collection represents.

Declaration
public Collection.Types.CollectionType Type { get; set; }
Property Value
Type Description
Collection.Types.CollectionType