Class Metadata

General information associated with a UDM event.

Inheritance

object

Metadata

Implements

IMessage<Metadata>

IEquatable<Metadata>

IDeepCloneable<Metadata>

IBufferMessage

IMessage

Inherited Members

object.GetHashCode()

object.GetType()

object.ToString()

Namespace: Google.Backstory

Assembly: Google.Backstory.dll

Syntax

public sealed class Metadata : IMessage<Metadata>, IEquatable<Metadata>, IDeepCloneable<Metadata>, IBufferMessage, IMessage

Constructors

Metadata()

Declaration

public Metadata()

Metadata(Metadata)

Declaration

public Metadata(Metadata other)

Parameters

Type	Name	Description
Metadata	other

Properties

BaseLabels

Data access labels on the base event.

Declaration

public DataAccessLabels BaseLabels { get; set; }

Property Value

Type	Description
DataAccessLabels

CollectedTimestamp

The GMT timestamp when the event was collected by the vendor's local collection infrastructure.

Declaration

public Timestamp CollectedTimestamp { get; set; }

Property Value

Type	Description
Timestamp

Description

A human-readable unparsable description of the event.

Declaration

public string Description { get; set; }

Property Value

Type	Description
string

EnrichmentLabels

Data access labels from all the contextual events used to enrich the base event.

Declaration

public DataAccessLabels EnrichmentLabels { get; set; }

Property Value

Type	Description
DataAccessLabels

EnrichmentState

The enrichment state.

Declaration

public Metadata.Types.EnrichmentState EnrichmentState { get; set; }

Property Value

Type	Description
Metadata.Types.EnrichmentState

EventTimestamp

The GMT timestamp when the event was generated.

Declaration

public Timestamp EventTimestamp { get; set; }

Property Value

Type	Description
Timestamp

EventTimestampAttributes

Attributes associated with event_timestamp. This field is used to distinguish between different types of timestamps that can be used to represent the event_timestamp.

Declaration

public RepeatedField<Metadata.Types.EventTimestampAttribute> EventTimestampAttributes { get; }

Property Value

Type	Description
RepeatedField<Metadata.Types.EventTimestampAttribute>

EventType

The event type. If an event has multiple possible types, this specifies the most specific type.

Declaration

public Metadata.Types.EventType EventType { get; set; }

Property Value

Type	Description
Metadata.Types.EventType

Id

ID of the UDM event. Can be used for raw and normalized event retrieval.

Declaration

public ByteString Id { get; set; }

Property Value

Type	Description
ByteString

IngestedTimestamp

The GMT timestamp when the event was ingested (received) by Chronicle.

Declaration

public Timestamp IngestedTimestamp { get; set; }

Property Value

Type	Description
Timestamp

IngestionLabels

User-configured ingestion metadata labels.

Declaration

public RepeatedField<Label> IngestionLabels { get; }

Property Value

Type	Description
RepeatedField<Label>

LogType

The string value of log type.

Declaration

public string LogType { get; set; }

Property Value

Type	Description
string

ParserVersion

The version of the parser that generated this UDM event.

Declaration

public string ParserVersion { get; set; }

Property Value

Type	Description
string

ProductDeploymentId

The deployment identifier assigned by the vendor for a product deployment.

Declaration

public string ProductDeploymentId { get; set; }

Property Value

Type	Description
string

ProductEventType

A short, descriptive, human-readable, product-specific event name or type (e.g. "Scanned X", "User account created", "process_start").

Declaration

public string ProductEventType { get; set; }

Property Value

Type	Description
string

ProductLogId

A vendor-specific event identifier to uniquely identify the event (e.g. a GUID).

Declaration

public string ProductLogId { get; set; }

Property Value

Type	Description
string

ProductName

The name of the product.

Declaration

public string ProductName { get; set; }

Property Value

Type	Description
string

ProductVersion

The version of the product.

Declaration

public string ProductVersion { get; set; }

Property Value

Type	Description
string

StructuredFields

Flattened fields extracted from the log.

Declaration

[Obsolete]
public Struct StructuredFields { get; set; }

Property Value

Type	Description
Struct

Tags

Tags added by Chronicle after an event is parsed. It is an error to populate this field from within a parser.

Declaration

public Tags Tags { get; set; }

Property Value

Type	Description
Tags

UrlBackToProduct

A URL that takes the user to the source product console for this event.

Declaration

public string UrlBackToProduct { get; set; }

Property Value

Type	Description
string

VendorName

The name of the product vendor.

Declaration

public string VendorName { get; set; }

Property Value

Type	Description
string