Class Noun

The Noun type is used to represent the different entities in an event: principal, src, target, observer, intermediary, and about. It stores attributes known about the entity. For example, if the entity is a device with multiple IP or MAC addresses, it stores the IP and MAC addresses that are relevant to the event.

Inheritance
object
Noun
Implements
Inherited Members
Namespace: Google.Backstory
Assembly: Google.Backstory.dll
Syntax
public sealed class Noun : IMessage<Noun>, IEquatable<Noun>, IDeepCloneable<Noun>, IBufferMessage, IMessage

Constructors

Noun()

Declaration
public Noun()

Noun(Noun)

Declaration
public Noun(Noun other)
Parameters
Type Name Description
Noun other

Properties

AdministrativeDomain

Domain which the device belongs to (for example, the Microsoft Windows domain).

Declaration
public string AdministrativeDomain { get; set; }
Property Value
Type Description
string

Application

The name of an application or service. Some SSO solutions only capture the name of a target application such as "Atlassian" or "Chronicle".

Declaration
public string Application { get; set; }
Property Value
Type Description
string

Artifact

Information about an artifact.

Declaration
public Artifact Artifact { get; set; }
Property Value
Type Description
Artifact

Asset

Information about the asset.

Declaration
public Asset Asset { get; set; }
Property Value
Type Description
Asset

AssetId

The asset ID. This field can be used as an entity indicator for asset entities.

Declaration
public string AssetId { get; set; }
Property Value
Type Description
string

Browser

Information about an entry in the web browser's local history database.

Declaration
public Browser Browser { get; set; }
Property Value
Type Description
Browser

Cloud

Cloud metadata. Deprecated: cloud should be populated in entity Attribute as generic metadata (e.g. asset.attribute.cloud).

Declaration
[Obsolete]
public Cloud Cloud { get; set; }
Property Value
Type Description
Cloud

Domain

Information about the domain.

Declaration
public Domain Domain { get; set; }
Property Value
Type Description
Domain

Email

Email address. Only filled in for security_result.about

Declaration
public string Email { get; set; }
Property Value
Type Description
string

File

Information about the file.

Declaration
public File File { get; set; }
Property Value
Type Description
File

Group

Information about the group.

Declaration
public Group Group { get; set; }
Property Value
Type Description
Group

Hostname

Client hostname or domain name field. Hostname also doubles as the domain for remote entities. This field can be used as an entity indicator for asset entities.

Declaration
public string Hostname { get; set; }
Property Value
Type Description
string

Investigation

Analyst feedback/investigation for alerts.

Declaration
public Investigation Investigation { get; set; }
Property Value
Type Description
Investigation

Ip

A list of IP addresses associated with a network connection. This field can be used as an entity indicator for asset entities.

Declaration
public RepeatedField<string> Ip { get; }
Property Value
Type Description
RepeatedField<string>

IpGeoArtifact

Enriched geographic information corresponding to an IP address. Specifically, location and network data.

Declaration
public RepeatedField<Artifact> IpGeoArtifact { get; }
Property Value
Type Description
RepeatedField<Artifact>

IpLocation

Deprecated: use ip_geo_artifact.location instead.

Declaration
[Obsolete]
public RepeatedField<Location> IpLocation { get; }
Property Value
Type Description
RepeatedField<Location>

Labels

Labels are key-value pairs. For example: key = "env", value = "prod". Deprecated: labels should be populated in entity Attribute as generic metadata (e.g. user.attribute.labels).

Declaration
[Obsolete]
public RepeatedField<Label> Labels { get; }
Property Value
Type Description
RepeatedField<Label>

Location

Physical location. For cloud environments, set the region in location.name.

Declaration
public Location Location { get; set; }
Property Value
Type Description
Location

Mac

List of MAC addresses associated with a device. This field can be used as an entity indicator for asset entities.

Declaration
public RepeatedField<string> Mac { get; }
Property Value
Type Description
RepeatedField<string>

Namespace

Namespace which the device belongs to, such as "AD forest". Uses for this field include Microsoft Windows AD forest, the name of subsidiary, or the name of acquisition. This field can be used along with an asset indicator to identify an asset.

Declaration
public string Namespace { get; set; }
Property Value
Type Description
string

NatIp

A list of NAT translated IP addresses associated with a network connection.

Declaration
public RepeatedField<string> NatIp { get; }
Property Value
Type Description
RepeatedField<string>

NatPort

NAT external network port number when a specific network connection is described within an event.

Declaration
public int NatPort { get; set; }
Property Value
Type Description
int

Network

Network details, including sub-messages with details on each protocol (for example, DHCP, DNS, or HTTP).

Declaration
public Network Network { get; set; }
Property Value
Type Description
Network

ObjectReference

Finding to which the Analyst updated the feedback.

Declaration
public Id ObjectReference { get; set; }
Property Value
Type Description
Id

Platform

Platform.

Declaration
public Noun.Types.Platform Platform { get; set; }
Property Value
Type Description
Noun.Types.Platform

PlatformPatchLevel

Platform patch level. For example, "Build 17134.48"

Declaration
public string PlatformPatchLevel { get; set; }
Property Value
Type Description
string

PlatformVersion

Platform version. For example, "Microsoft Windows 1803".

Declaration
public string PlatformVersion { get; set; }
Property Value
Type Description
string

Port

Source or destination network port number when a specific network connection is described within an event.

Declaration
public int Port { get; set; }
Property Value
Type Description
int

Process

Information about the process.

Declaration
public Process Process { get; set; }
Property Value
Type Description
Process

ProcessAncestors

Information about the process's ancestors ordered from immediate ancestor (parent process) to root. Note: process_ancestors is only populated when data is exported to BigQuery since recursive fields (e.g. process.parent_process) are not supported by BigQuery.

Declaration
public RepeatedField<Process> ProcessAncestors { get; }
Property Value
Type Description
RepeatedField<Process>

Registry

Registry information.

Declaration
public Registry Registry { get; set; }
Property Value
Type Description
Registry

Resource

Information about the resource (e.g. scheduled task, calendar entry). This field should not be used for files, registry, or processes because these objects are already part of Noun.

Declaration
public Resource Resource { get; set; }
Property Value
Type Description
Resource

ResourceAncestors

Information about the resource's ancestors ordered from immediate ancestor (starting with parent resource).

Declaration
public RepeatedField<Resource> ResourceAncestors { get; }
Property Value
Type Description
RepeatedField<Resource>

SecurityResult

A list of security results.

Declaration
public RepeatedField<SecurityResult> SecurityResult { get; }
Property Value
Type Description
RepeatedField<SecurityResult>

Url

The URL.

Declaration
public string Url { get; set; }
Property Value
Type Description
string

UrlMetadata

Information about the URL.

Declaration
public Url UrlMetadata { get; set; }
Property Value
Type Description
Url

User

Information about the user.

Declaration
public User User { get; set; }
Property Value
Type Description
User

UserManagementChain

Information about the user's management chain (reporting hierarchy). Note: user_management_chain is only populated when data is exported to BigQuery since recursive fields (e.g. user.managers) are not supported by BigQuery.

Declaration
public RepeatedField<User> UserManagementChain { get; }
Property Value
Type Description
RepeatedField<User>