Class Element
Assembly: Google.Backstory.dll
Syntax
public sealed class Element : IMessage<Element>, IEquatable<Element>, IDeepCloneable<Element>, IBufferMessage, IMessage
Constructors
Element()
Declaration
Element(Element)
Declaration
public Element(Element other)
Parameters
| Type |
Name |
Description |
| Element |
other |
|
Properties
Association
Metadata that provides the relevant association for the references in the
element. For a detection, this can be the correlated aspect of the
references that contributed to the overall detection. For example, may
include sub-rule condition, machine learning model metadata, and/or
indicators implicated in this component of the detection
(using the .about field).
Declaration
public SecurityResult Association { get; set; }
Property Value
Label
A name that labels the entire references group.
Declaration
public string Label { get; set; }
Property Value
LatencyMetrics
Latency metrics for the specific element. These are
calculated from all the contributing events or entities for a single event
variable, not just the sampled ones included in references. This is
currently only populated for UDM events.
Declaration
public LatencyMetrics LatencyMetrics { get; set; }
Property Value
References
References to model primatives including events and entities that share a
common association.
Even though a reference can have both UDM and entity, a collection of
references (of a single element) will only have one type of message in it
(either UDM / Entity).
Declaration
public RepeatedField<Reference> References { get; }
Property Value
ReferencesSampled
Copied from the detection event_sample.too_many_event_samples field.
If true, the number of references will be capped at the sample limit
(set at rule service).
This is applicable to both UDM references and Entity references.
Declaration
public bool ReferencesSampled { get; set; }
Property Value