Class EntityRisk
Stores information related to the risk score of an entity.
Implements
Namespace: Google.Backstory
Assembly: Google.Backstory.dll
Syntax
public sealed class EntityRisk : IMessage<EntityRisk>, IEquatable<EntityRisk>, IDeepCloneable<EntityRisk>, IBufferMessage, IMessageConstructors
EntityRisk()
Declaration
public EntityRisk()EntityRisk(EntityRisk)
Declaration
public EntityRisk(EntityRisk other)Parameters
| Type | Name | Description |
|---|---|---|
| EntityRisk | other |
Properties
DEPRECATEDRiskScore
Deprecated risk score.
Declaration
[Obsolete]
public int DEPRECATEDRiskScore { get; set; }Property Value
| Type | Description |
|---|---|
| int |
DetailUri
Link to the Google Security Operations UI with information about the entity risk score. If the SecOps instance has multiple frontend paths configured, this will be a relative path that can be used to construct the full URL.
Declaration
public string DetailUri { get; set; }Property Value
| Type | Description |
|---|---|
| string |
DetectionsCount
Number of detections that make up the risk score within the time window.
Declaration
public int DetectionsCount { get; set; }Property Value
| Type | Description |
|---|---|
| int |
FirstDetectionTime
Timestamp of the first detection within the specified time window. This field is empty when there are no detections.
Declaration
public Timestamp FirstDetectionTime { get; set; }Property Value
| Type | Description |
|---|---|
| Timestamp |
LastDetectionTime
Timestamp of the last detection within the specified time window. This field is empty when there are no detections.
Declaration
public Timestamp LastDetectionTime { get; set; }Property Value
| Type | Description |
|---|---|
| Timestamp |
LastResetTime
Timestamp for UEBA risk score reset based deduplication. Used specifically for risk based meta rules.
Declaration
public Timestamp LastResetTime { get; set; }Property Value
| Type | Description |
|---|---|
| Timestamp |
NormalizedRiskScore
Normalized risk score for the entity. This value is between 0-1000.
Declaration
public int NormalizedRiskScore { get; set; }Property Value
| Type | Description |
|---|---|
| int |
RawRiskDelta
Represents the change in raw risk score for an entity between the end of the previous time window and the end of the current time window.
Declaration
public RiskDelta RawRiskDelta { get; set; }Property Value
| Type | Description |
|---|---|
| RiskDelta |
RiskDelta
Represents the change in risk score for an entity between the end of the previous time window and the end of the current time window.
Declaration
public RiskDelta RiskDelta { get; set; }Property Value
| Type | Description |
|---|---|
| RiskDelta |
RiskScore
Raw risk score for the entity.
Declaration
public float RiskScore { get; set; }Property Value
| Type | Description |
|---|---|
| float |
RiskVersion
Version of the risk score calculation algorithm.
Declaration
public string RiskVersion { get; set; }Property Value
| Type | Description |
|---|---|
| string |
RiskWindow
Time window used when computing the risk score for an entity, for example 24 hours or 7 days.
Declaration
public Interval RiskWindow { get; set; }Property Value
| Type | Description |
|---|---|
| Interval |
RiskWindowHasNewDetections
Whether there are new detections for the risk window.
Declaration
public bool RiskWindowHasNewDetections { get; set; }Property Value
| Type | Description |
|---|---|
| bool |
RiskWindowSize
Risk window duration for the entity.
Declaration
public Duration RiskWindowSize { get; set; }Property Value
| Type | Description |
|---|---|
| Duration |