Class SecurityResult

Security related metadata for the event. A security result might be something like "virus detected and quarantined," "malicious connection blocked," or "sensitive data included in document foo.doc." Each security result, of which there may be more than one, may either pertain to the whole event, or to a specific object or device referenced in the event (e.g. a malicious file that was detected, or a sensitive document sent as an email attachment). For security results that apply to a particular object referenced in the event, the security_results message MUST contain details about the implicated object (such as process, user, IP, domain, URL, IP, or email address) in the about field. For security results that apply to the entire event (e.g. SPAM found in this email), the about field must remain empty.

Inheritance

object

SecurityResult

Implements

IMessage<SecurityResult>

IEquatable<SecurityResult>

IDeepCloneable<SecurityResult>

IBufferMessage

IMessage

Inherited Members

object.GetHashCode()

object.GetType()

object.ToString()

Namespace: Google.Backstory

Assembly: Google.Backstory.dll

Syntax

public sealed class SecurityResult : IMessage<SecurityResult>, IEquatable<SecurityResult>, IDeepCloneable<SecurityResult>, IBufferMessage, IMessage

Constructors

SecurityResult()

Declaration

public SecurityResult()

SecurityResult(SecurityResult)

Declaration

public SecurityResult(SecurityResult other)

Parameters

Type	Name	Description
SecurityResult	other

Properties

About

If the security result is about a specific entity (Noun), add it here. This field is not populated when the SecurityResult appears in a detection.

Declaration

public Noun About { get; set; }

Property Value

Type	Description
Noun

Action

Actions taken for this event. This field is not populated when the SecurityResult appears in a detection.

Declaration

public RepeatedField<SecurityResult.Types.Action> Action { get; }

Property Value

Type	Description
RepeatedField<SecurityResult.Types.Action>

ActionDetails

The detail of the action taken as provided by the vendor. This field is not populated when the SecurityResult appears in a detection.

Declaration

public string ActionDetails { get; set; }

Property Value

Type	Description
string

AlertState

The alerting types of this security result. This is primarily set for rule-generated detections and alerts.

Declaration

public SecurityResult.Types.AlertState AlertState { get; set; }

Property Value

Type	Description
SecurityResult.Types.AlertState

AnalyticsMetadata

Stores metadata about each risk analytic metric the rule uses. This field is not populated when the SecurityResult appears in a detection.

Declaration

public RepeatedField<AnalyticsMetadata> AnalyticsMetadata { get; }

Property Value

Type	Description
RepeatedField<AnalyticsMetadata>

Associations

Associations related to the threat.

Declaration

public RepeatedField<SecurityResult.Types.Association> Associations { get; }

Property Value

Type	Description
RepeatedField<SecurityResult.Types.Association>

AttackDetails

MITRE ATT&CK details. This field is not populated when the SecurityResult appears in a detection.

Declaration

public AttackDetails AttackDetails { get; set; }

Property Value

Type	Description
AttackDetails

Campaigns

Campaigns using this IOC threat. This is deprecated. Use threat_collections instead.

Declaration

[Obsolete]
public RepeatedField<string> Campaigns { get; }

Property Value

Type	Description
RepeatedField<string>

Type	Description
RepeatedField<SecurityResult.Types.SecurityCategory>

CategoryDetails

For vendor-specific categories. For web categorization, put type in here such as "gambling" or "porn". This field is not populated when the SecurityResult appears in a detection.

Declaration

public RepeatedField<string> CategoryDetails { get; }

Property Value

Type	Description
RepeatedField<string>

Confidence

The confidence level of the result as estimated by the product. This field is not populated when the SecurityResult appears in a detection.

Declaration

public SecurityResult.Types.ProductConfidence Confidence { get; set; }

Property Value

Type	Description
SecurityResult.Types.ProductConfidence

ConfidenceDetails

Additional detail with regards to the confidence of a security event as estimated by the product vendor. This field is not populated when the SecurityResult appears in a detection.

Declaration

public string ConfidenceDetails { get; set; }

Property Value

Type	Description
string

ConfidenceScore

The confidence score of the security result. This field is not populated when the SecurityResult appears in a detection.

Declaration

public float ConfidenceScore { get; set; }

Property Value

Type	Description
float

Description

A human-readable description (e.g. "user password was wrong"). This can be more detailed than the summary.

Declaration

public string Description { get; set; }

Property Value

Type	Description
string

DetectionDepth

The depth of the detection chain. Applies only to composite detections.

Declaration

public long DetectionDepth { get; set; }

Property Value

Type	Description
long

DetectionFields

An ordered list of values, that represent fields in detections for a security finding. This list represents mapping of names of requested entities to their values (the security result matched variables).

For Collection SecurityResults, prefer variables instead.

Declaration

public RepeatedField<Label> DetectionFields { get; }

Property Value

Type	Description
RepeatedField<Label>

DisplayName

The display name of the security result. This is populated from 'name_override' Outcome Variable, if present. Otherwise, this field is not set.

Declaration

public string DisplayName { get; set; }

Property Value

Type	Description
string

FirstDiscoveredTime

First time the IoC threat was discovered in the provider. This field is not populated when the SecurityResult appears in a detection.

Declaration

public Timestamp FirstDiscoveredTime { get; set; }

Property Value

Type	Description
Timestamp

LastDiscoveredTime

Last time the IoC was seen in the provider data. This field is not populated when the SecurityResult appears in a detection.

Declaration

public Timestamp LastDiscoveredTime { get; set; }

Property Value

Type	Description
Timestamp

LastUpdatedTime

Last time the IoC threat was updated in the provider. This field is not populated when the SecurityResult appears in a detection.

Declaration

public Timestamp LastUpdatedTime { get; set; }

Property Value

Type	Description
Timestamp

Outcomes

A list of outcomes that represent the results of this security finding. This list represents a mapping of names of the requested outcomes, to a stringified version of their values.

This is only populated when the SecurityResult appears in a detection. This is deprecated. Use variables instead.

Declaration

[Obsolete]
public RepeatedField<Label> Outcomes { get; }

Property Value

Type	Description
RepeatedField<Label>

Priority

The priority of the result. This field is not populated when the SecurityResult appears in a detection.

Declaration

public SecurityResult.Types.ProductPriority Priority { get; set; }

Property Value

Type	Description
SecurityResult.Types.ProductPriority

PriorityDetails

Vendor-specific information about the security result priority. This field is not populated when the SecurityResult appears in a detection.

Declaration

public string PriorityDetails { get; set; }

Property Value

Type	Description
string

Reports

Reports that reference this IOC threat. These are the report IDs. This is deprecated. Use threat_collections instead.

Declaration

[Obsolete]
public RepeatedField<string> Reports { get; }

Property Value

Type	Description
RepeatedField<string>

RiskScore

The risk score of the security result.

Declaration

public float RiskScore { get; set; }

Property Value

Type	Description
float

RuleAuthor

Author of the security rule. This field is not populated when the SecurityResult appears in a detection.

Declaration

public string RuleAuthor { get; set; }

Property Value

Type	Description
string

RuleId

A vendor-specific ID for a rule, varying by observer type (e.g. "08123", "5d2b44d0-5ef6-40f5-a704-47d61d3babbe").

Declaration

public string RuleId { get; set; }

Property Value

Type	Description
string

RuleLabels

A list of rule labels that can't be captured by the other fields in security result (e.g. "reference : AnotherRule", "contributor : John"). This is primarily set in rule-generated detections and alerts.

Declaration

public RepeatedField<Label> RuleLabels { get; }

Property Value

Type	Description
RepeatedField<Label>

RuleName

Name of the security rule (e.g. "BlockInboundToOracle").

Declaration

public string RuleName { get; set; }

Property Value

Type	Description
string

RuleSet

The curated detection's rule set identifier. (for example, "windows-threats") This is primarily set in rule-generated detections and alerts.

Declaration

public string RuleSet { get; set; }

Property Value

Type	Description
string

RuleSetDisplayName

The curated detections rule set display name. This is primarily set in rule-generated detections and alerts.

Declaration

public string RuleSetDisplayName { get; set; }

Property Value

Type	Description
string

RuleType

The type of security rule.

Declaration

public string RuleType { get; set; }

Property Value

Type	Description
string

RuleVersion

Version of the security rule. (e.g. "v1.1", "00001", "1604709794", "2020-11-16T23:04:19+00:00"). Note that rule versions are source-dependant and lexical ordering should not be assumed.

Declaration

public string RuleVersion { get; set; }

Property Value

Type	Description
string

RulesetCategoryDisplayName

The curated detection rule set category display name. (for example, if rule_set_display_name is "CDIR SCC Enhanced Exfiltration", the rule_set_category is "Cloud Threats"). This is primarily set in rule-generated detections and alerts.

Declaration

public string RulesetCategoryDisplayName { get; set; }

Property Value

Type	Description
string

Severity

The severity of the result.

Declaration

public SecurityResult.Types.ProductSeverity Severity { get; set; }

Property Value

Type	Description
SecurityResult.Types.ProductSeverity

SeverityDetails

Vendor-specific severity. This field is not populated when the SecurityResult appears in a detection.

Declaration

public string SeverityDetails { get; set; }

Property Value

Type	Description
string

Summary

A short human-readable summary (e.g. "failed login occurred")

Declaration

public string Summary { get; set; }

Property Value

Type	Description
string

ThreatCollections

GTI collections associated with the security result.

Declaration

public RepeatedField<SecurityResult.Types.ThreatCollectionItem> ThreatCollections { get; }

Property Value

Type	Description
RepeatedField<SecurityResult.Types.ThreatCollectionItem>

ThreatFeedName

Vendor feed name for a threat indicator feed. This field is not populated when the SecurityResult appears in a detection.

Declaration

public string ThreatFeedName { get; set; }

Property Value

Type	Description
string

ThreatId

Vendor-specific ID for a threat. This field is not populated when the SecurityResult appears in a detection.

Declaration

public string ThreatId { get; set; }

Property Value

Type	Description
string

ThreatIdNamespace

The attribute threat_id_namespace qualifies threat_id with an id namespace to get an unique id. The attribute threat_id by itself is not unique across Chronicle as it is a vendor specific id. This field is not populated when the SecurityResult appears in a detection.

Declaration

public Id.Types.Namespace ThreatIdNamespace { get; set; }

Property Value

Type	Description
Id.Types.Namespace

ThreatName

A vendor-assigned classification common across multiple customers (for example, "W32/File-A", "Slammer"). This field is not populated when the SecurityResult appears in a detection.

Declaration

public string ThreatName { get; set; }

Property Value

Type	Description
string

ThreatStatus

Current status of the threat This field is not populated when the SecurityResult appears in a detection.

Declaration

public SecurityResult.Types.ThreatStatus ThreatStatus { get; set; }

Property Value

Type	Description
SecurityResult.Types.ThreatStatus

ThreatVerdict

GCTI threat verdict on the security result entity. This field is not populated when the SecurityResult appears in a detection.

Declaration

public ThreatVerdict ThreatVerdict { get; set; }

Property Value

Type	Description
ThreatVerdict

UrlBackToProduct

URL that takes the user to the source product console for this event. This field is not populated when the SecurityResult appears in a detection.

Declaration

public string UrlBackToProduct { get; set; }

Property Value

Type	Description
string

Variables

A list of outcomes and match variables that represent the results of this security finding. This list represents a mapping of names of the requested outcomes or match variables, to their values.

This is only populated when the SecurityResult appears in a detection.

Declaration

public MapField<string, FindingVariable> Variables { get; }

Property Value

Type	Description
MapField<string, FindingVariable>

Verdict

Verdict about the IoC from the provider. This field is now deprecated. Use VerdictInfo instead.

Declaration

[Obsolete]
public SecurityResult.Types.Verdict Verdict { get; set; }

Property Value

Type	Description
SecurityResult.Types.Verdict

VerdictInfo

Verdict information about the IoC from the provider. This field is not populated when the SecurityResult appears in a detection.

Declaration

public RepeatedField<SecurityResult.Types.VerdictInfo> VerdictInfo { get; }

Property Value

Type	Description
RepeatedField<SecurityResult.Types.VerdictInfo>