Enum Metadata.Types.EventType

An event type. Choose event type not based on the product that generated the event but the one that logged the event itself. So, for example, an antivirus (AV) scanning email on a client would generate an SMTP_PROXY event, not an AV event. A DLP device scanning a web upload would generate an HTTP_PROXY event and not a DLP or process activity event. Note: In the case of a HTTP_PROXY event, you might also include process details if this occurred on an endpoint. That would be optional, but there are a certain set of required fields and banned fields due to its status as an HTTP_PROXY event.

Namespace: Google.Backstory

Assembly: Google.Backstory.dll

Syntax

public enum Metadata.Types.EventType

Fields

Name	Description
AnalystAddComment	Analyst addition of a comment for a finding.
AnalystUpdatePriority	Analyst update about the priority (such as low, medium, or high) for a finding.
AnalystUpdateReason	Analyst update about the reason (such as malicious or not malicious) for a finding.
AnalystUpdateReputation	Analyst update about the Reputation (such as useful or not useful) of a finding.
AnalystUpdateRiskScore	Analyst update about the risk score (0-100) of a finding.
AnalystUpdateRootCause	Analyst update about the root cause for a finding.
AnalystUpdateSeverityScore	Analyst update about the Severity score (0-100) of a finding.
AnalystUpdateStatus	Analyst update about the finding status.
AnalystUpdateVerdict	Analyst update about the Verdict (such as true positive, false positive, or disregard) of a finding.
DeviceConfigUpdate	Configuration update.
DeviceFirmwareUpdate	Firmware update.
DeviceProgramDownload	A program or application downloaded to a device.
DeviceProgramUpload	A program or application uploaded to a device.
EmailTransaction	An email transaction.
EmailUncategorized	Email messages
EmailUrlClick	Deprecated: use NETWORK_HTTP instead. An email URL click event.
EntityRiskChange	An update to an entity risk score. This event type is restricted to events published by Google Securit Operations Risk Analytics.
FileCopy	File copied. Used for file copies, for example, to a thumb drive.
FileCreation	File created.
FileDeletion	File deleted.
FileModification	File modified.
FileMove	File moved or renamed.
FileOpen	File opened.
FileRead	File read.
FileSync	File synced (for example, Google Drive, Dropbox, backup).
FileUncategorized	File event which does not match any of the other event types.
GenericEvent	Operating system events that are not described by any of the other event types. Might include uncategorized Microsoft Windows event logs.
GroupCreation	A group creation.
GroupDeletion	A group deletion.
GroupModification	A group modification.
GroupUncategorized	A group activity that does not fall into one of the other event types.
MutexCreation	Mutex creation.
MutexUncategorized	Any mutex event other than creation.
NetworkConnection	Network connection details like from a FW.
NetworkDhcp	DHCP payload.
NetworkDns	DNS payload.
NetworkFlow	Aggregated flow stats like netflow.
NetworkFtp	FTP telemetry.
NetworkHttp	HTTP telemetry.
NetworkSmtp	SMTP telemetry.
NetworkUncategorized	A network event that does not fit into one of the other event types.
ProcessInjection	Process injecting into another process.
ProcessLaunch	Process launch.
ProcessModuleLoad	Process loading a module.
ProcessOpen	Process being opened.
ProcessPrivilegeEscalation	Process privilege escalation.
ProcessTermination	Process termination.
ProcessUncategorized	Activity related to a process which does not match any other event types.
RegistryCreation	Registry creation.
RegistryDeletion	Registry deletion.
RegistryModification	Registry modification.
RegistryUncategorized	Registry event which does not match any of the other event types.
ResourceCreation	The resource was created/provisioned. This is equivalent to USER_RESOURCE_CREATION.
ResourceDeletion	The resource was deleted/deprovisioned. This is equivalent to USER_RESOURCE_DELETION.
ResourcePermissionsChange	The resource had it's permissions or ACLs updated. This is equivalent to USER_RESOURCE_UPDATE_PERMISSIONS.
ResourceRead	The resource was read. This is equivalent to USER_RESOURCE_ACCESS.
ResourceWritten	The resource was written to. This is equivalent to USER_RESOURCE_UPDATE_CONTENT.
ScanFile	A file scan.
ScanHost	Scan results from scanning an entire host device for threats/sensitive documents.
ScanNetwork	Scan network for suspicious activity
ScanProcess	Scan process.
ScanProcessBehaviors	Scan process behaviors. Please use SCAN_PROCESS instead.
ScanUncategorized	Scan item that does not fit into one of the other event types.
ScanVulnHost	Vulnerability scan logs about host vulnerabilities (e.g., out of date software) and network vulnerabilities (e.g., unprotected service detected via a network scan).
ScanVulnNetwork	Vulnerability scan logs about network vulnerabilities.
ScheduledTaskCreation	Scheduled task creation.
ScheduledTaskDeletion	Scheduled task deletion.
ScheduledTaskDisable	Scheduled task being disabled.
ScheduledTaskEnable	Scheduled task being enabled.
ScheduledTaskModification	Scheduled task being modified.
ScheduledTaskUncategorized	Scheduled task event that does not fall into one of the other event types.
ServiceCreation	A service creation.
ServiceDeletion	A service deletion.
ServiceModification	A service modification.
ServiceStart	A service start.
ServiceStop	A service stop.
ServiceUnspecified	Service event that does not fit into one of the other event types.
SettingCreation	Setting creation.
SettingDeletion	Setting deletion.
SettingModification	Setting modification.
SettingUncategorized	Settings-related event which does not match any of the other event types.
StatusHeartbeat	Heartbeat indicating product is alive.
StatusShutdown	An agent shutdown.
StatusStartup	An agent startup.
StatusUncategorized	A status message that does not fit into one of the other event types.
StatusUpdate	A software or fingerprint update.
SystemAuditLogUncategorized	A system audit log event that is not a wipe.
SystemAuditLogWipe	A system audit log wipe.
TriageAgentUpdateInvestigation	Triage Agent has investigated the finding.
Unspecified	Default event type
UserBadgeIn	User physically badging into a location.
UserChangePassword	User password change event.
UserChangePermissions	Change in user permissions.
UserCommunication	User initiating communication through a medium (for example, video).
UserCreation	User creation.
UserDeletion	User deletion.
UserLogin	User login.
UserLogout	User logout.
UserResourceAccess	User accessing a virtual resource. This is equivalent to RESOURCE_READ.
UserResourceCreation	User creating a virtual resource. This is equivalent to RESOURCE_CREATION.
UserResourceDeletion	User deleting a virtual resource. This is equivalent to RESOURCE_DELETION.
UserResourceUpdateContent	User updating content of a virtual resource. This is equivalent to RESOURCE_WRITTEN.
UserResourceUpdatePermissions	User updating permissions of a virtual resource. This is equivalent to RESOURCE_PERMISSIONS_CHANGE.
UserStats	Deprecated. Used to update user info for an LDAP dump.
UserUncategorized	User activity which does not match any of the other event types.