Namespace Google.Backstory

Attribute is a container for generic entity attributes including common attributes across core entities (such as, user or asset). For example, Cloud is a generic entity attribute since it can apply to an asset (for example, a VM) or a user (for example, an identity service account).

Authentication

The Authentication extension captures details specific to authentication events. General guidelines for authentication events:

Details about the source of the authentication event (for example, client IP or hostname), should be captured in principal. The principal may be empty if we have no details about the source of the login.
Details about the target of the authentication event (for example, details about the machine that is being logged into or logged out of) should be captured in target.
Some authentication events may involve a third-party. For example, a user logs into a cloud service (for example, Chronicle) via their company's SSO (the event is logged by their SSO solution). In this case, the principal captures information about the user's device, the target captures details about the cloud service they logged into, and the intermediary captures details about the SSO solution.

Authentication.Types

Container for nested types declared in the Authentication message type.

BoolSequence

BoolSequence represents a sequence of bools.

Browser

Information about an entry in the web browser's local history database.

Browser.Types

Container for nested types declared in the Browser message type.

Browser.Types.Cookie

Browser cookie.

Browser.Types.Cookie.Types

Container for nested types declared in the Cookie message type.

BytesSequence

BytesSequence represents a sequence of bytes.

Certificate

Certificate information

Cloud

Metadata related to the cloud environment.

Cloud.Types

Container for nested types declared in the Cloud message type.

Collection

Collection represents a container of objects (such as events, entity context metadata, detection finding metadata) and state (such as investigation details).

An example use case for Collection is to model a detection and investigation from detection finding metadata to investigative state collected in the course of the investigation. For more complex investigation and response workflows a Collection could represent an incident consisting of multiple child findings or incidents. This can be expanded on to model remediation elements of a full detection and response workflow.

Collection.Types

Container for nested types declared in the Collection message type.

DNSRecord

DNS record.

DataAccessIngestionLabel

Label used in data access for ingestion.

DataAccessLabels

Label used in data access.

DataTableRowInfo

DataTableRowInfo captures information about a data table row including the name of the data table.

Dhcp

DHCP information.

Dhcp.Types

Container for nested types declared in the Dhcp message type.

Dhcp.Types.Option

DHCP options.

Dns

DNS information.

Dns.Types

Container for nested types declared in the Dns message type.

Dns.Types.Question

DNS Questions. See RFC1035, section 4.1.2.

Dns.Types.ResourceRecord

DNS Resource Records. See RFC1035, section 4.1.3.

Domain

Information about a domain.

DoubleSequence

DoubleSequence represents a sequence of doubles.

Element

Email

Email info.

Entity

An Entity provides additional context about an item in a UDM event. For example, a PROCESS_LAUNCH event describes that user 'abc@example.corp' launched process 'shady.exe'. The event does not include information that user 'abc@example.com' is a recently terminated employee who administers a server storing finance data. Information stored in one or more Entities can add this additional context.

EntityGraphEnrichment

EntityGraphEnrichment contains the data table name and the enrichment applied to the entity.

EntityGraphEnrichment.Types

Container for nested types declared in the EntityGraphEnrichment message type.

EntityMetadata

Information about the Entity and the product where the entity was created.

EntityMetadata.Types

Container for nested types declared in the EntityMetadata message type.

EntityRisk

Stores information related to the risk score of an entity.

ExifInfo

Exif information.

Extensions

Extensions to a UDM event.

Favicon

Difference hash and MD5 hash of the domain's favicon.

File

Information about a file.

File.Types

Container for nested types declared in the File message type.

FileMetadata

Metadata about a file. Place metadata about different file types here, for example data from the Microsoft Windows VersionInfo block or digital signer details. Use a different sub-message per file type.

FileMetadataCodesign

File metadata from the codesign utility.

FileMetadataImports

File metadata imports.

FileMetadataPE

Metadata about the Portable Executable (PE) file.

FileMetadataPeResourceInfo

File metadata for PE resource.

FileMetadataSection

File metadata section.

FileMetadataSignatureInfo

Signature information.

FindingVariable

A structure that holds the value and associated metadata for values extracted while producing a Finding.

FindingVariable.Types

Container for nested types declared in the FindingVariable message type.

Ftp

FTP info.

Group

Information about an organizational group.

GroupedFields

Grouped fields are aliases for groups of related UDM fields. All fields grouped together are of type string.

Hardware

Hardware specification details for a resource, including both physical and virtual hardware.

Http

Specify the full URL of the HTTP request within "target". Also specify any uploaded or downloaded file information within "source" or "target".

Id

Identifier to identify a UDM object like a UDM event, Entity, Collection. The full identifier for persistence is created by setting the 32 most significant bits as the Id.Namespace enum This is a convenience wrapper to define the id space enum values and provide an easy interface for RPCs, most persistence use cases should use a denormalized form.

Id.Types

Container for nested types declared in the Id message type.

Int64Sequence

Int64Sequence represents a sequence of int64s.

Investigation

Represents the aggregated state of an investigation such as categorization, severity, and status. Can be expanded to include analyst assignment details and more.

Label

Key value labels.

LatencyMetrics

LatencyMetrics contains relevant timestamps for measuring latency per event variable. These metrics are calculated from ALL of the events that contribute to the detection, not just the sampled ones.

LinuxUtmp

The LinuxUtmp extension captures details specific to Linux Utmp events.

LinuxUtmp.Types

Container for nested types declared in the LinuxUtmp message type.

Location

Information about a location.

Metadata

General information associated with a UDM event.

Metadata.Types

Container for nested types declared in the Metadata message type.

Metric

Stores precomputed aggregated analytic data for an entity.

Metric.Types

Container for nested types declared in the Metric message type.

Metric.Types.Measure

Describes the precomputed measure.

Network

A network event.

Network.Types

Container for nested types declared in the Network message type.

Noun

The Noun type is used to represent the different entities in an event: principal, src, target, observer, intermediary, and about. It stores attributes known about the entity. For example, if the entity is a device with multiple IP or MAC addresses, it stores the IP and MAC addresses that are relevant to the event.

Noun.Types

Container for nested types declared in the Noun message type.

NtfsFileMetadata

NTFS-specific file metadata.

OutlookMetadata

Microsoft Outlook specific metadata.

PDFInfo

Information about the PDF file structure. See https://developers.virustotal.com/reference/pdf_info

PeFileMetadata

Metadata about a Microsoft Windows Portable Executable.

Permission

System permission for resource access and modification.

Permission.Types

Container for nested types declared in the Permission message type.

PlatformSoftware

Platform software information about an operating system.

PopularityRank

Domain's position in popularity ranks for sources such as Alexa, Quantcast, or Statvoo.

PrefetchFileMetadata

Windows Prefetch file metadata.

Prevalence

The prevalence of a resource within the customer's environment. This measures how common it is for assets to access the resource.

Process

Information about a process.

Process.Types

Container for nested types declared in the Process message type.

ProxyInfo

Proxy information.

Reference

Reference to model primatives including event and entity. As support is added for fast retrieval of objects by identifiers, this will be expanded to include ID references rather than full object copies.

Registry

Information about a registry key or value.

Registry.Types

Container for nested types declared in the Registry message type.

Relation

Defines the relationship between the entity (a) and another entity (b).

Relation.Types

Container for nested types declared in the Relation message type.

Resource

Information about a resource such as a task, Cloud Storage bucket, database, disk, logical policy, or something similar.

Resource.Types

Container for nested types declared in the Resource message type.

ResourceUsage

The ResourceUsage extension captures details about what is using a resource.

ResponsePlatformInfo

Related info of an Alert in customer's SOAR platform.

ResponsePlatformInfo.Types

Container for nested types declared in the ResponsePlatformInfo message type.

RiskDelta

Describes the difference in risk score between two points in time.

Role

System role for resource access and modification.

Role.Types

Container for nested types declared in the Role message type.

SSLCertificate

SSL certificate.

SSLCertificate.Types

Container for nested types declared in the SSLCertificate message type.

SSLCertificate.Types.AuthorityKeyId

Identifies the public key to be used to verify the signature on this certificate or CRL.

SSLCertificate.Types.CertSignature

Certificate's signature and algorithm.

SSLCertificate.Types.EC

EC public key information.

SSLCertificate.Types.Extension

Certificate's extensions.

SSLCertificate.Types.PublicKey

Subject public key info.

SSLCertificate.Types.RSA

RSA public key information.

SSLCertificate.Types.Subject

Subject data.

SSLCertificate.Types.Validity

Defines certificate's validity period.

ScheduledAnacronTask

Information about a scheduled anacron task.

ScheduledCronTask

Information about a scheduled cron task.

ScheduledTask

Deprecated: use WindowsScheduledTask for Windows scheduled tasks or ScheduledCronTask for cron jobs. Information about a scheduled task.

SecurityResult

Security related metadata for the event. A security result might be something like "virus detected and quarantined," "malicious connection blocked," or "sensitive data included in document foo.doc." Each security result, of which there may be more than one, may either pertain to the whole event, or to a specific object or device referenced in the event (e.g. a malicious file that was detected, or a sensitive document sent as an email attachment). For security results that apply to a particular object referenced in the event, the security_results message MUST contain details about the implicated object (such as process, user, IP, domain, URL, IP, or email address) in the about field. For security results that apply to the entire event (e.g. SPAM found in this email), the about field must remain empty.

SecurityResult.Types

Container for nested types declared in the SecurityResult message type.

SecurityResult.Types.AnalystVerdict

Verdict provided by the human analyst. These fields are used to model Mandiant sources.

SecurityResult.Types.Association

Associations represents different metadata about malware and threat actors involved with an IoC.

SecurityResult.Types.Association.Types

Container for nested types declared in the Association message type.

SecurityResult.Types.Association.Types.AssociationAlias

Association Alias used to represent Mandiant Threat Intelligence.

SecurityResult.Types.IoCStats

Information about the threat intelligence source. These fields are used to model Mandiant sources.

SecurityResult.Types.ProviderMLVerdict

Deprecated. MLVerdict result provided from threat providers, like Mandiant. These fields are used to model Mandiant sources.

SecurityResult.Types.Source

Deprecated. Information about the threat intelligence source. These fields are used to model Mandiant sources.

SecurityResult.Types.ThreatCollectionItem

Threat Collection that is either a threat campaign or a threat report.

SecurityResult.Types.Verdict

Deprecated. Encapsulates the threat verdict provided by human analysts and ML models. These fields are used to model Mandiant sources.

SecurityResult.Types.VerdictInfo

Describes the threat verdict provided by human analysts and machine learning models. These fields are used to model Mandiant sources.

Service

Information about a Windows service.

Service.Types

Container for nested types declared in the Service message type.

SignatureInfo

File signature information extracted from different tools.

SignerInfo

File metadata related to the signer information.

Smtp

SMTP info. See RFC 2821.

SoarAlertMetadata

Metadata fields of alerts coming from other SIEM systems.

Software

Information about a software package or application.

Srum

The Srum extension captures details specific to Windows System Resource Usage Monitor (SRUM) events.

StringSequence

StringSequence represents a sequence of string.

StringToInt64MapEntry

SystemEventDetails

Captures additional details for system-level events.

TimeOff

System record for leave/time-off from a Human Capital Management (HCM) system.

Tls

Transport Layer Security (TLS) information.

Tls.Types

Container for nested types declared in the Tls message type.

Tls.Types.Client

Transport Layer Security (TLS) information associated with the client (for example, Certificate or JA3 hash).

Tls.Types.Server

Transport Layer Security (TLS) information associated with the server (for example, Certificate or JA3 hash).

Tracker

URL Tracker.

Tunnels

VPN tunnels.

UDM

A Unified Data Model event.

Uint64Sequence

Uint64Sequence represents a sequence of uint64s.

Url

Url.

User

Information about a user.

User.Types

Container for nested types declared in the User message type.

UserAssist

The UserAssist extension captures details specific to Windows User Assist events.

UsnJournal

Information from the NTFS USN Journal.

UsnJournal.Types

Container for nested types declared in the UsnJournal message type.

Volume

Information about a storage volume.

Vulnerabilities

The Vulnerabilities extension captures details on observed/detected vulnerabilities.

Vulnerability

A vulnerability.

Vulnerability.Types

Container for nested types declared in the Vulnerability message type.

WindowsEventLog

The WindowsEventLog extension captures details specific to Windows Event Log events.

WindowsEventLog.Types

Container for nested types declared in the WindowsEventLog message type.

WindowsScheduledTask

Information about a Windows scheduled task.

WindowsScheduledTask.Types

Container for nested types declared in the WindowsScheduledTask message type.

WindowsScheduledTask.Types.TaskAction

The task action.

WindowsScheduledTask.Types.TaskAction.Types

Container for nested types declared in the TaskAction message type.

WindowsScheduledTask.Types.TaskTrigger

The trigger of the scheduled task.

WindowsScheduledTask.Types.TaskTrigger.Types

Container for nested types declared in the TaskTrigger message type.

WmiPersistenceItem

Information about a WMI persistence item.

X509

File certificate.

Enums

Asset.Types.AssetType

The role type of the asset.

Asset.Types.DeploymentStatus

Deployment status states.

Authentication.Types.AuthType

Type of system the authentication event is associated with.

Authentication.Types.AuthenticationStatus

Authentication status, can be used to describe the status of authentication for a user or particular credential.

Authentication.Types.Mechanism

Mechanism(s) used to authenticate.

Authentication.Types.Outcome

The outcome of the authentication event.

Browser.Types.BrowserType

The name of the browser.

Browser.Types.Cookie.Types.CookieSameSite

The SameSite attribute of a cookie.

Browser.Types.UrlVisitType

The type of visit to a URL.

Browser.Types.VisitSource

The source of the visit.

Cloud.Types.CloudEnvironment

The service provider environment.

Collection.Types.CollectionType

The type of the collection which will indicate which other fields are relevant. For example, detection finding collections will populate the detection field. Findings that evolve into investigations will populate the investigation field.

Collection.Types.DetectionTimingDetails

Detection timing details for the collection.

Collection.Types.RunFrequency

Run frequencies used by rule executions.

Dhcp.Types.MessageType

DHCP message type. See RFC2131, section 3.1.

Dhcp.Types.OpCode

BOOTP op code. See RFC951, section 3.

EntityGraphEnrichment.Types.EnrichmentType

Type of enrichment.

EntityMetadata.Types.EntityType

Describes the type of entity. An unknown event type.

EntityMetadata.Types.SourceType

Describes the source of an entity.

File.Types.FileType

The file type, for example Microsoft Windows executable.

FindingVariable.TypedValueOneofCase

Enum of possible cases for the "typed_value" oneof.

FindingVariable.Types.Type

Type options for Finding variables.

Id.Types.Namespace

Extracted Namespace Component

LinuxUtmp.Types.RecordType

The type of activity record from the Utmp file.

Metadata.Types.EnrichmentState

An enrichment state.

Metadata.Types.EventTimestampAttribute

Enum representing the type of timestamp that the event_timestamp field represents.

Metadata.Types.EventType

An event type. Choose event type not based on the product that generated the event but the one that logged the event itself. So, for example, an antivirus (AV) scanning email on a client would generate an SMTP_PROXY event, not an AV event. A DLP device scanning a web upload would generate an HTTP_PROXY event and not a DLP or process activity event. Note: In the case of a HTTP_PROXY event, you might also include process details if this occurred on an endpoint. That would be optional, but there are a certain set of required fields and banned fields due to its status as an HTTP_PROXY event.

Metric.Types.AggregateFunction

Mathematic function used to calculate the value.

Metric.Types.Dimension

Describes field used as the dimension when grouping data to calculate the aggregate metric.

Metric.Types.MetricName

The name of the precomputed analytic.

Network.Types.ApplicationProtocol

A network application protocol.

Network.Types.ConnectionState

The state of a network connection.

Network.Types.Direction

A network traffic direction.

Network.Types.IpProtocol

An IP protocol.

Noun.Types.Platform

Operating system platform.

Permission.Types.PermissionType

High level categorizations of permission type.

Priority

Priority that is assigned to a Case or Alert.

Process.Types.State

The state of the process. See https://psutil.readthedocs.io/en/stable/#process-status-constants.

Process.Types.TokenElevationType

The elevation type of the process's token. See https://learn.microsoft.com/en-us/windows/win32/api/winnt/ne-winnt-token_elevation_type

Reason

Reason for closing an Alert or Case in the SOAR product.

Registry.Types.Type

Type of the registry value. These values are based on the Windows Registry value types: https://learn.microsoft.com/en-us/windows/win32/sysinfo/registry-value-types

Relation.Types.Directionality

Describes the relationship model as directed or undirected.

Relation.Types.EntityLabel

Entity label of the relation.

Relation.Types.Relationship

Type of relationship between the primary entity (a) and related entity (b).

Reputation

Categorization options for the usefulness of a finding.

Resource.Types.ResourceType

The type of resource.

ResponsePlatformInfo.Types.ResponsePlatformType

Available response platforms.

Role.Types.Type

Well-known system roles.

SecurityResult.Types.Action

Enum representing different possible actions taken by the product that created the event. Google SecOps classifies:

ALLOW and ALLOW_WITH_MODIFICATION actions as "successful".
BLOCK, QUARANTINE, FAIL, and CHALLENGE actions as "failed". This includes all corresponding metrics (for example, AUTH_ATTEMPTS_FAIL, FILE_EXECUTIONS_FAIL, RESOURCE_READ_FAIL, and so on).
UNKNOWN_ACTION actions as neither "successful" nor "failed", because, for example, logs might not provide information whether a login event occurred but some kind of "unknown" error was issued nonetheless.