ListDeviceEvents
List all of the events discovered within your enterprise on a particular device within 2 hours earlier than the current time.
python · Google SecOps
Details
| ID | ListDeviceEvents |
|---|---|
| Language | python |
| From Version | 5.0.0 |
| Docker Image | demisto/python3:3.12.8.3296088 |
| Tags | enhancement |
README
List all of the events discovered within your enterprise on a particular device within 2 hours earlier than the current time.
Script Data
| Name | Description |
|---|---|
| Script Type | python3 |
| Tags | enhancement |
| Cortex XSOAR Version | 5.0.0 |
Dependencies
This script uses the following commands and scripts.
- gcb-list-events
Inputs
| Argument Name | Description |
|---|---|
| asset_identifier | Host Name, IP Address or MAC Address of the asset. |
Outputs
| Path | Description | Type |
|---|---|---|
| GoogleChronicleBackstory.Events.eventType | Specifies the type of the event. | String |
| GoogleChronicleBackstory.Events.eventTimestamp | The GMT timestamp when the event was generated. | Date |
| GoogleChronicleBackstory.Events.collectedTimestamp | The GMT timestamp when the event was collected by the vendor’s local collection infrastructure. | Date |
| GoogleChronicleBackstory.Events.description | Human-readable description of the event. | String |
| GoogleChronicleBackstory.Events.productEventType | Short, descriptive, human-readable, and product-specific event name or type. | String |
| GoogleChronicleBackstory.Events.productLogId | A vendor-specific event identifier to uniquely identify the event (a GUID). Users might use this identifier to search the vendor’s proprietary console for the event in question. | String |
| GoogleChronicleBackstory.Events.productName | Specifies the name of the product. | String |
| GoogleChronicleBackstory.Events.productVersion | Specifies the version of the product. | String |
| GoogleChronicleBackstory.Events.urlBackToProduct | URL linking to a relevant website where you can view more information about this specific event or the general event category. | String |
| GoogleChronicleBackstory.Events.vendorName | Specifies the product vendor’s name. | String |
| GoogleChronicleBackstory.Events.principal.assetId | Vendor-specific unique device identifier. | String |
| GoogleChronicleBackstory.Events.principal.email | Email address. | String |
| GoogleChronicleBackstory.Events.principal.hostname | Client hostname or domain name field. | String |
| GoogleChronicleBackstory.Events.principal.platform | Platform operating system. | String |
| GoogleChronicleBackstory.Events.principal.platformPatchLevel | Platform operating system patch level. | String |
| GoogleChronicleBackstory.Events.principal.platformVersion | Platform operating system version. | String |
| GoogleChronicleBackstory.Events.principal.ip | IP address associated with a network connection. | String |
| GoogleChronicleBackstory.Events.principal.port | Source or destination network port number when a specific network connection is described within an event. | String |
| GoogleChronicleBackstory.Events.principal.mac | MAC addresses associated with a device. | String |
| GoogleChronicleBackstory.Events.principal.administrativeDomain | Domain which the device belongs to (for example, the Windows domain). | String |
| GoogleChronicleBackstory.Events.principal.url | Standard URL. | String |
| GoogleChronicleBackstory.Events.principal.file.fileMetadata | Metadata associated with the file. | String |
| GoogleChronicleBackstory.Events.principal.file.fullPath | Full path identifying the location of the file on the system. | String |
| GoogleChronicleBackstory.Events.principal.file.md5 | MD5 hash value of the file. | String |
| GoogleChronicleBackstory.Events.principal.file.mimeType | Multipurpose Internet Mail Extensions (MIME) type of the file. | String |
| GoogleChronicleBackstory.Events.principal.file.sha1 | SHA-1 hash value of the file. | String |
| GoogleChronicleBackstory.Events.principal.file.sha256 | SHA-256 hash value of the file. | String |
| GoogleChronicleBackstory.Events.principal.file.size | Size of the file. | String |
| GoogleChronicleBackstory.Events.principal.process.commandLine | Stores the command line string for the process. | String |
| GoogleChronicleBackstory.Events.principal.process.productSpecificProcessId | Stores the product specific process ID. | String |
| GoogleChronicleBackstory.Events.principal.process.productSpecificParentProcessId | Stores the product specific process ID for the parent process. | String |
| GoogleChronicleBackstory.Events.principal.process.file | Stores the file name of the file in use by the process. | String |
| GoogleChronicleBackstory.Events.principal.process.file.fileMetadata | Metadata associated with the file. | String |
| GoogleChronicleBackstory.Events.principal.process.file.fullPath | Full path identifying the location of the file on the system. | String |
| GoogleChronicleBackstory.Events.principal.process.file.md5 | MD5 hash value of the file. | String |
| GoogleChronicleBackstory.Events.principal.process.file.mimeType | Multipurpose Internet Mail Extensions (MIME) type of the file. | String |
| GoogleChronicleBackstory.Events.principal.process.file.sha1 | SHA-1 hash value of the file. | String |
| GoogleChronicleBackstory.Events.principal.process.file.sha256 | SHA-256 hash value of the file. | String |
| GoogleChronicleBackstory.Events.principal.process.file.size | Size of the file. | String |
| GoogleChronicleBackstory.Events.principal.process.parentPid | Stores the process ID for the parent process. | String |
| GoogleChronicleBackstory.Events.principal.process.pid | Stores the process ID. | String |
| GoogleChronicleBackstory.Events.principal.registry.registryKey | Stores the registry key associated with an application or system component. | String |
| GoogleChronicleBackstory.Events.principal.registry.registryValueName | Stores the name of the registry value associated with an application or system component. | String |
| GoogleChronicleBackstory.Events.principal.registry.registryValueData | Stores the data associated with a registry value. | String |
| GoogleChronicleBackstory.Events.principal.user.emailAddresses | Stores the email addresses for the user. | String |
| GoogleChronicleBackstory.Events.principal.user.employeeId | Stores the human resources employee ID for the user. | String |
| GoogleChronicleBackstory.Events.principal.user.firstName | Stores the first name for the user. | String |
| GoogleChronicleBackstory.Events.principal.user.middleName | Stores the middle name for the user. | String |
| GoogleChronicleBackstory.Events.principal.user.lastName | Stores the last name for the user. | String |
| GoogleChronicleBackstory.Events.principal.user.groupid | Stores the group ID associated with a user. | String |
| GoogleChronicleBackstory.Events.principal.user.phoneNumbers | Stores the phone numbers for the user. | String |
| GoogleChronicleBackstory.Events.principal.user.title | Stores the job title for the user. | String |
| GoogleChronicleBackstory.Events.principal.user.userDisplayName | Stores the display name for the user. | String |
| GoogleChronicleBackstory.Events.principal.user.userid | Stores the user ID. | String |
| GoogleChronicleBackstory.Events.principal.user.windowsSid | Stores the Microsoft Windows security identifier (SID) associated with a user. | String |
| GoogleChronicleBackstory.Events.target.assetId | Vendor-specific unique device identifier. | String |
| GoogleChronicleBackstory.Events.target.email | Email address. | String |
| GoogleChronicleBackstory.Events.target.hostname | Client hostname or domain name field. | String |
| GoogleChronicleBackstory.Events.target.platform | Platform operating system. | String |
| GoogleChronicleBackstory.Events.target.platformPatchLevel | Platform operating system patch level. | String |
| GoogleChronicleBackstory.Events.target.platformVersion | Platform operating system version. | String |
| GoogleChronicleBackstory.Events.target.ip | IP address associated with a network connection. | String |
| GoogleChronicleBackstory.Events.target.port | Source or destination network port number when a specific network connection is described within an event. | String |
| GoogleChronicleBackstory.Events.target.mac | One or more MAC addresses associated with a device. | String |
| GoogleChronicleBackstory.Events.target.administrativeDomain | Domain which the device belongs to (for example, the Windows domain). | String |
| GoogleChronicleBackstory.Events.target.url | Standard URL. | String |
| GoogleChronicleBackstory.Events.target.file.fileMetadata | Metadata associated with the file. | String |
| GoogleChronicleBackstory.Events.target.file.fullPath | Full path identifying the location of the file on the system. | String |
| GoogleChronicleBackstory.Events.target.file.md5 | MD5 hash value of the file. | String |
| GoogleChronicleBackstory.Events.target.file.mimeType | Multipurpose Internet Mail Extensions (MIME) type of the file. | String |
| GoogleChronicleBackstory.Events.target.file.sha1 | SHA-1 hash value of the file. | String |
| GoogleChronicleBackstory.Events.target.file.sha256 | SHA-256 hash value of the file. | String |
| GoogleChronicleBackstory.Events.target.file.size | Size of the file. | String |
| GoogleChronicleBackstory.Events.target.process.commandLine | Stores the command line string for the process. | String |
| GoogleChronicleBackstory.Events.target.process.productSpecificProcessId | Stores the product specific process ID. | String |
| GoogleChronicleBackstory.Events.target.process.productSpecificParentProcessId | Stores the product specific process ID for the parent process. | String |
| GoogleChronicleBackstory.Events.target.process.file | Stores the file name of the file in use by the process. | String |
| GoogleChronicleBackstory.Events.target.process.file.fileMetadata | Metadata associated with the file. | String |
| GoogleChronicleBackstory.Events.target.process.file.fullPath | Full path identifying the location of the file on the system. | String |
| GoogleChronicleBackstory.Events.target.process.file.md5 | MD5 hash value of the file. | String |
| GoogleChronicleBackstory.Events.target.process.file.mimeType | Multipurpose Internet Mail Extensions (MIME) type of the file. | String |
| GoogleChronicleBackstory.Events.target.process.file.sha1 | SHA-1 hash value of the file. | String |
| GoogleChronicleBackstory.Events.target.process.file.sha256 | SHA-256 hash value of the file. | String |
| GoogleChronicleBackstory.Events.target.process.file.size | Size of the file. | String |
| GoogleChronicleBackstory.Events.target.process.parentPid | Stores the process ID for the parent process. | String |
| GoogleChronicleBackstory.Events.target.process.pid | Stores the process ID. | String |
| GoogleChronicleBackstory.Events.target.registry.registryKey | Stores the registry key associated with an application or system component. | String |
| GoogleChronicleBackstory.Events.target.registry.registryValueName | Stores the name of the registry value associated with an application or system component. | String |
| GoogleChronicleBackstory.Events.target.registry.registryValueData | Stores the data associated with a registry value. | String |
| GoogleChronicleBackstory.Events.target.user.emailAddresses | Stores the email addresses for the user. | String |
| GoogleChronicleBackstory.Events.target.user.employeeId | Stores the human resources employee ID for the user. | String |
| GoogleChronicleBackstory.Events.target.user.firstName | Stores the first name for the user. | String |
| GoogleChronicleBackstory.Events.target.user.middleName | Stores the middle name for the user. | String |
| GoogleChronicleBackstory.Events.target.user.lastName | Stores the last name for the user. | String |
| GoogleChronicleBackstory.Events.target.user.groupid | Stores the group ID associated with a user. | String |
| GoogleChronicleBackstory.Events.target.user.phoneNumbers | Stores the phone numbers for the user. | String |
| GoogleChronicleBackstory.Events.target.user.title | Stores the job title for the user. | String |
| GoogleChronicleBackstory.Events.target.user.userDisplayName | Stores the display name for the user. | String |
| GoogleChronicleBackstory.Events.target.user.userid | Stores the user ID. | String |
| GoogleChronicleBackstory.Events.target.user.windowsSid | Stores the Microsoft Windows security identifier (SID) associated with a user. | String |
| GoogleChronicleBackstory.Events.intermediary.assetId | Vendor-specific unique device identifier. | String |
| GoogleChronicleBackstory.Events.intermediary.email | Email address. | String |
| GoogleChronicleBackstory.Events.intermediary.hostname | Client hostname or domain name field. | String |
| GoogleChronicleBackstory.Events.intermediary.platform | Platform operating system. | String |
| GoogleChronicleBackstory.Events.intermediary.platformPatchLevel | Platform operating system patch level. | String |
| GoogleChronicleBackstory.Events.intermediary.platformVersion | Platform operating system version. | String |
| GoogleChronicleBackstory.Events.intermediary.ip | IP address associated with a network connection. | String |
| GoogleChronicleBackstory.Events.intermediary.port | Source or destination network port number when a specific network connection is described within an event. | String |
| GoogleChronicleBackstory.Events.intermediary.mac | One or more MAC addresses associated with a device. | String |
| GoogleChronicleBackstory.Events.intermediary.administrativeDomain | Domain which the device belongs to (for example, the Windows domain). | String |
| GoogleChronicleBackstory.Events.intermediary.url | Standard URL. | String |
| GoogleChronicleBackstory.Events.intermediary.file.fileMetadata | Metadata associated with the file. | String |
| GoogleChronicleBackstory.Events.intermediary.file.fullPath | Full path identifying the location of the file on the system. | String |
| GoogleChronicleBackstory.Events.intermediary.file.md5 | MD5 hash value of the file. | String |
| GoogleChronicleBackstory.Events.intermediary.file.mimeType | Multipurpose Internet Mail Extensions (MIME) type of the file. | String |
| GoogleChronicleBackstory.Events.intermediary.file.sha1 | SHA-1 hash value of the file. | String |
| GoogleChronicleBackstory.Events.intermediary.file.sha256 | SHA-256 hash value of the file. | String |
| GoogleChronicleBackstory.Events.intermediary.file.size | Size of the file. | String |
| GoogleChronicleBackstory.Events.intermediary.process.commandLine | Stores the command line string for the process. | String |
| GoogleChronicleBackstory.Events.intermediary.process.productSpecificProcessId | Stores the product specific process ID. | String |
| GoogleChronicleBackstory.Events.intermediary.process.productSpecificParentProcessId | Stores the product specific process ID for the parent process. | String |
| GoogleChronicleBackstory.Events.intermediary.process.file | Stores the file name of the file in use by the process. | String |
| GoogleChronicleBackstory.Events.intermediary.process.file.fileMetadata | Metadata associated with the file. | String |
| GoogleChronicleBackstory.Events.intermediary.process.file.fullPath | Full path identifying the location of the file on the system. | String |
| GoogleChronicleBackstory.Events.intermediary.process.file.md5 | MD5 hash value of the file. | String |
| GoogleChronicleBackstory.Events.intermediary.process.file.mimeType | Multipurpose Internet Mail Extensions (MIME) type of the file. | String |
| GoogleChronicleBackstory.Events.intermediary.process.file.sha1 | SHA-1 hash value of the file. | String |
| GoogleChronicleBackstory.Events.intermediary.process.file.sha256 | SHA-256 hash value of the file. | String |
| GoogleChronicleBackstory.Events.intermediary.process.file.size | Size of the file. | String |
| GoogleChronicleBackstory.Events.intermediary.process.parentPid | Stores the process ID for the parent process. | String |
| GoogleChronicleBackstory.Events.intermediary.process.pid | Stores the process ID. | String |
| GoogleChronicleBackstory.Events.intermediary.registry.registryKey | Stores the registry key associated with an application or system component. | String |
| GoogleChronicleBackstory.Events.intermediary.registry.registryValueName | Stores the name of the registry value associated with an application or system component. | String |
| GoogleChronicleBackstory.Events.intermediary.registry.registryValueData | Stores the data associated with a registry value. | String |
| GoogleChronicleBackstory.Events.intermediary.user.emailAddresses | Stores the email addresses for the user. | String |
| GoogleChronicleBackstory.Events.intermediary.user.employeeId | Stores the human resources employee ID for the user. | String |
| GoogleChronicleBackstory.Events.intermediary.user.firstName | Stores the first name for the user. | String |
| GoogleChronicleBackstory.Events.intermediary.user.middleName | Stores the middle name for the user. | String |
| GoogleChronicleBackstory.Events.intermediary.user.lastName | Stores the last name for the user. | String |
| GoogleChronicleBackstory.Events.intermediary.user.groupid | Stores the group ID associated with a user. | String |
| GoogleChronicleBackstory.Events.intermediary.user.phoneNumbers | Stores the phone numbers for the user. | String |
| GoogleChronicleBackstory.Events.intermediary.user.title | Stores the job title for the user. | String |
| GoogleChronicleBackstory.Events.intermediary.user.userDisplayName | Stores the display name for the user. | String |
| GoogleChronicleBackstory.Events.intermediary.user.userid | Stores the user ID. | String |
| GoogleChronicleBackstory.Events.intermediary.user.windowsSid | Stores the Microsoft Windows security identifier (SID) associated with a user. | String |
| GoogleChronicleBackstory.Events.src.assetId | Vendor-specific unique device identifier. | String |
| GoogleChronicleBackstory.Events.src.email | Email address. | String |
| GoogleChronicleBackstory.Events.src.hostname | Client hostname or domain name field. | String |
| GoogleChronicleBackstory.Events.src.platform | Platform operating system. | String |
| GoogleChronicleBackstory.Events.src.platformPatchLevel | Platform operating system patch level. | String |
| GoogleChronicleBackstory.Events.src.platformVersion | Platform operating system version. | String |
| GoogleChronicleBackstory.Events.src.ip | IP address associated with a network connection. | String |
| GoogleChronicleBackstory.Events.src.port | Source or destination network port number when a specific network connection is described within an event. | String |
| GoogleChronicleBackstory.Events.src.mac | One or more MAC addresses associated with a device. | String |
| GoogleChronicleBackstory.Events.src.administrativeDomain | Domain which the device belongs to (for example, the Windows domain). | String |
| GoogleChronicleBackstory.Events.src.url | Standard URL. | String |
| GoogleChronicleBackstory.Events.src.file.fileMetadata | Metadata associated with the file. | String |
| GoogleChronicleBackstory.Events.src.file.fullPath | Full path identifying the location of the file on the system. | String |
| GoogleChronicleBackstory.Events.src.file.md5 | MD5 hash value of the file. | String |
| GoogleChronicleBackstory.Events.src.file.mimeType | Multipurpose Internet Mail Extensions (MIME) type of the file. | String |
| GoogleChronicleBackstory.Events.src.file.sha1 | SHA-1 hash value of the file. | String |
| GoogleChronicleBackstory.Events.src.file.sha256 | SHA-256 hash value of the file. | String |
| GoogleChronicleBackstory.Events.src.file.size | Size of the file. | String |
| GoogleChronicleBackstory.Events.src.process.commandLine | Stores the command line string for the process. | String |
| GoogleChronicleBackstory.Events.src.process.productSpecificProcessId | Stores the product specific process ID. | String |
| GoogleChronicleBackstory.Events.src.process.productSpecificParentProcessId | Stores the product specific process ID for the parent process. | String |
| GoogleChronicleBackstory.Events.src.process.file | Stores the file name of the file in use by the process. | String |
| GoogleChronicleBackstory.Events.src.process.file.fileMetadata | Metadata associated with the file. | String |
| GoogleChronicleBackstory.Events.src.process.file.fullPath | Full path identifying the location of the file on the system. | String |
| GoogleChronicleBackstory.Events.src.process.file.md5 | MD5 hash value of the file. | String |
| GoogleChronicleBackstory.Events.src.process.file.mimeType | Multipurpose Internet Mail Extensions (MIME) type of the file. | String |
| GoogleChronicleBackstory.Events.src.process.file.sha1 | SHA-1 hash value of the file. | String |
| GoogleChronicleBackstory.Events.src.process.file.sha256 | SHA-256 hash value of the file. | String |
| GoogleChronicleBackstory.Events.src.process.file.size | Size of the file. | String |
| GoogleChronicleBackstory.Events.src.process.parentPid | Stores the process ID for the parent process. | String |
| GoogleChronicleBackstory.Events.src.process.pid | Stores the process ID. | String |
| GoogleChronicleBackstory.Events.src.registry.registryKey | Stores the registry key associated with an application or system component. | String |
| GoogleChronicleBackstory.Events.src.registry.registryValueName | Stores the name of the registry value associated with an application or system component. | String |
| GoogleChronicleBackstory.Events.src.registry.registryValueData | Stores the data associated with a registry value. | String |
| GoogleChronicleBackstory.Events.src.user.emailAddresses | Stores the email addresses for the user. | String |
| GoogleChronicleBackstory.Events.src.user.employeeId | Stores the human resources employee ID for the user. | String |
| GoogleChronicleBackstory.Events.src.user.firstName | Stores the first name for the user. | String |
| GoogleChronicleBackstory.Events.src.user.middleName | Stores the middle name for the user. | String |
| GoogleChronicleBackstory.Events.src.user.lastName | Stores the last name for the user. | String |
| GoogleChronicleBackstory.Events.src.user.groupid | Stores the group ID associated with a user. | String |
| GoogleChronicleBackstory.Events.src.user.phoneNumbers | Stores the phone numbers for the user. | String |
| GoogleChronicleBackstory.Events.src.user.title | Stores the job title for the user. | String |
| GoogleChronicleBackstory.Events.src.user.userDisplayName | Stores the display name for the user. | String |
| GoogleChronicleBackstory.Events.src.user.userid | Stores the user ID. | String |
| GoogleChronicleBackstory.Events.src.user.windowsSid | Stores the Microsoft Windows security identifier (SID) associated with a user. | String |
| GoogleChronicleBackstory.Events.observer.assetId | Vendor-specific unique device identifier. | String |
| GoogleChronicleBackstory.Events.observer.email | Email address. | String |
| GoogleChronicleBackstory.Events.observer.hostname | Client hostname or domain name field. | String |
| GoogleChronicleBackstory.Events.observer.platform | Platform operating system. | String |
| GoogleChronicleBackstory.Events.observer.platformPatchLevel | Platform operating system patch level. | String |
| GoogleChronicleBackstory.Events.observer.platformVersion | Platform operating system version. | String |
| GoogleChronicleBackstory.Events.observer.ip | IP address associated with a network connection. | String |
| GoogleChronicleBackstory.Events.observer.port | Source or destination network port number when a specific network connection is described within an event. | String |
| GoogleChronicleBackstory.Events.observer.mac | One or more MAC addresses associated with a device. | String |
| GoogleChronicleBackstory.Events.observer.administrativeDomain | Domain which the device belongs to (for example, the Windows domain). | String |
| GoogleChronicleBackstory.Events.observer.url | Standard URL. | String |
| GoogleChronicleBackstory.Events.observer.file.fileMetadata | Metadata associated with the file. | String |
| GoogleChronicleBackstory.Events.observer.file.fullPath | Full path identifying the location of the file on the system. | String |
| GoogleChronicleBackstory.Events.observer.file.md5 | MD5 hash value of the file. | String |
| GoogleChronicleBackstory.Events.observer.file.mimeType | Multipurpose Internet Mail Extensions (MIME) type of the file. | String |
| GoogleChronicleBackstory.Events.observer.file.sha1 | SHA-1 hash value of the file. | String |
| GoogleChronicleBackstory.Events.observer.file.sha256 | SHA-256 hash value of the file. | String |
| GoogleChronicleBackstory.Events.observer.file.size | Size of the file. | String |
| GoogleChronicleBackstory.Events.observer.process.commandLine | Stores the command line string for the process. | String |
| GoogleChronicleBackstory.Events.observer.process.productSpecificProcessId | Stores the product specific process ID. | String |
| GoogleChronicleBackstory.Events.observer.process.productSpecificParentProcessId | Stores the product specific process ID for the parent process. | String |
| GoogleChronicleBackstory.Events.observer.process.file | Stores the file name of the file in use by the process. | String |
| GoogleChronicleBackstory.Events.observer.process.file.fileMetadata | Metadata associated with the file. | String |
| GoogleChronicleBackstory.Events.observer.process.file.fullPath | Full path identifying the location of the file on the system. | String |
| GoogleChronicleBackstory.Events.observer.process.file.md5 | MD5 hash value of the file. | String |
| GoogleChronicleBackstory.Events.observer.process.file.mimeType | Multipurpose Internet Mail Extensions (MIME) type of the file. | String |
| GoogleChronicleBackstory.Events.observer.process.file.sha1 | SHA-1 hash value of the file. | String |
| GoogleChronicleBackstory.Events.observer.process.file.sha256 | SHA-256 hash value of the file. | String |
| GoogleChronicleBackstory.Events.observer.process.file.size | Size of the file. | String |
| GoogleChronicleBackstory.Events.observer.process.parentPid | Stores the process ID for the parent process. | String |
| GoogleChronicleBackstory.Events.observer.process.pid | Stores the process ID. | String |
| GoogleChronicleBackstory.Events.observer.registry.registryKey | Stores the registry key associated with an application or system component. | String |
| GoogleChronicleBackstory.Events.observer.registry.registryValueName | Stores the name of the registry value associated with an application or system component. | String |
| GoogleChronicleBackstory.Events.observer.registry.registryValueData | Stores the data associated with a registry value. | String |
| GoogleChronicleBackstory.Events.observer.user.emailAddresses | Stores the email addresses for the user. | String |
| GoogleChronicleBackstory.Events.observer.user.employeeId | Stores the human resources employee ID for the user. | String |
| GoogleChronicleBackstory.Events.observer.user.firstName | Stores the first name for the user. | String |
| GoogleChronicleBackstory.Events.observer.user.middleName | Stores the middle name for the user. | String |
| GoogleChronicleBackstory.Events.observer.user.lastName | Stores the last name for the user. | String |
| GoogleChronicleBackstory.Events.observer.user.groupid | Stores the group ID associated with a user. | String |
| GoogleChronicleBackstory.Events.observer.user.phoneNumbers | Stores the phone numbers for the user. | String |
| GoogleChronicleBackstory.Events.observer.user.title | Stores the job title for the user. | String |
| GoogleChronicleBackstory.Events.observer.user.userDisplayName | Stores the display name for the user. | String |
| GoogleChronicleBackstory.Events.observer.user.userid | Stores the user ID. | String |
| GoogleChronicleBackstory.Events.observer.user.windowsSid | Stores the Microsoft Windows security identifier (SID) associated with a user. | String |
| GoogleChronicleBackstory.Events.about.assetId | Vendor-specific unique device identifier. | String |
| GoogleChronicleBackstory.Events.about.email | Email address. | String |
| GoogleChronicleBackstory.Events.about.hostname | Client hostname or domain name field. | String |
| GoogleChronicleBackstory.Events.about.platform | Platform operating system. | String |
| GoogleChronicleBackstory.Events.about.platformPatchLevel | Platform operating system patch level. | String |
| GoogleChronicleBackstory.Events.about.platformVersion | Platform operating system version. | String |
| GoogleChronicleBackstory.Events.about.ip | IP address associated with a network connection. | String |
| GoogleChronicleBackstory.Events.about.port | Source or destination network port number when a specific network connection is described within an event. | String |
| GoogleChronicleBackstory.Events.about.mac | One or more MAC addresses associated with a device. | String |
| GoogleChronicleBackstory.Events.about.administrativeDomain | Domain which the device belongs to (for example, the Windows domain). | String |
| GoogleChronicleBackstory.Events.about.url | Standard URL. | String |
| GoogleChronicleBackstory.Events.about.file.fileMetadata | Metadata associated with the file. | String |
| GoogleChronicleBackstory.Events.about.file.fullPath | Full path identifying the location of the file on the system. | String |
| GoogleChronicleBackstory.Events.about.file.md5 | MD5 hash value of the file. | String |
| GoogleChronicleBackstory.Events.about.file.mimeType | Multipurpose Internet Mail Extensions (MIME) type of the file. | String |
| GoogleChronicleBackstory.Events.about.file.sha1 | SHA-1 hash value of the file. | String |
| GoogleChronicleBackstory.Events.about.file.sha256 | SHA-256 hash value of the file. | String |
| GoogleChronicleBackstory.Events.about.file.size | Size of the file. | String |
| GoogleChronicleBackstory.Events.about.process.commandLine | Stores the command line string for the process. | String |
| GoogleChronicleBackstory.Events.about.process.productSpecificProcessId | Stores the product specific process ID. | String |
| GoogleChronicleBackstory.Events.about.process.productSpecificParentProcessId | Stores the product specific process ID for the parent process. | String |
| GoogleChronicleBackstory.Events.about.process.file | Stores the file name of the file in use by the process. | String |
| GoogleChronicleBackstory.Events.about.process.file.fileMetadata | Metadata associated with the file. | String |
| GoogleChronicleBackstory.Events.about.process.file.fullPath | Full path identifying the location of the file on the system. | String |
| GoogleChronicleBackstory.Events.about.process.file.md5 | MD5 hash value of the file. | String |
| GoogleChronicleBackstory.Events.about.process.file.mimeType | Multipurpose Internet Mail Extensions (MIME) type of the file. | String |
| GoogleChronicleBackstory.Events.about.process.file.sha1 | SHA-1 hash value of the file. | String |
| GoogleChronicleBackstory.Events.about.process.file.sha256 | SHA-256 hash value of the file. | String |
| GoogleChronicleBackstory.Events.about.process.file.size | Size of the file. | String |
| GoogleChronicleBackstory.Events.about.process.parentPid | Stores the process ID for the parent process. | String |
| GoogleChronicleBackstory.Events.about.process.pid | Stores the process ID. | String |
| GoogleChronicleBackstory.Events.about.registry.registryKey | Stores the registry key associated with an application or system component. | String |
| GoogleChronicleBackstory.Events.about.registry.registryValueName | Stores the name of the registry value associated with an application or system component. | String |
| GoogleChronicleBackstory.Events.about.registry.registryValueData | Stores the data associated with a registry value. | String |
| GoogleChronicleBackstory.Events.about.user.emailAddresses | Stores the email addresses for the user. | String |
| GoogleChronicleBackstory.Events.about.user.employeeId | Stores the human resources employee ID for the user. | String |
| GoogleChronicleBackstory.Events.about.user.firstName | Stores the first name for the user. | String |
| GoogleChronicleBackstory.Events.about.user.middleName | Stores the middle name for the user. | String |
| GoogleChronicleBackstory.Events.about.user.lastName | Stores the last name for the user. | String |
| GoogleChronicleBackstory.Events.about.user.groupid | Stores the group ID associated with a user. | String |
| GoogleChronicleBackstory.Events.about.user.phoneNumbers | Stores the phone numbers for the user. | String |
| GoogleChronicleBackstory.Events.about.user.title | Stores the job title for the user. | String |
| GoogleChronicleBackstory.Events.about.user.userDisplayName | Stores the display name for the user. | String |
| GoogleChronicleBackstory.Events.about.user.userid | Stores the user ID. | String |
| GoogleChronicleBackstory.Events.about.user.windowsSid | Stores the Microsoft Windows security identifier (SID) associated with a user. | String |
| GoogleChronicleBackstory.Events.network.applicationProtocol | Indicates the network application protocol. | String |
| GoogleChronicleBackstory.Events.network.direction | Indicates the direction of network traffic. | String |
| GoogleChronicleBackstory.Events.network.email | Specifies the email address for the sender/recipient. | String |
| GoogleChronicleBackstory.Events.network.ipProtocol | Indicates the IP protocol. | String |
| GoogleChronicleBackstory.Events.network.receivedBytes | Specifies the number of bytes received. | String |
| GoogleChronicleBackstory.Events.network.sentBytes | Specifies the number of bytes sent. | String |
| GoogleChronicleBackstory.Events.network.dhcp.clientHostname | Hostname for the client. | String |
| GoogleChronicleBackstory.Events.network.dhcp.clientIdentifier | Client identifier. | String |
| GoogleChronicleBackstory.Events.network.dhcp.file | Filename for the boot image. | String |
| GoogleChronicleBackstory.Events.network.dhcp.flags | Value for the DHCP flags field. | String |
| GoogleChronicleBackstory.Events.network.dhcp.hlen | Hardware address length. | String |
| GoogleChronicleBackstory.Events.network.dhcp.hops | DHCP hop count. | String |
| GoogleChronicleBackstory.Events.network.dhcp.htype | Hardware address type. | String |
| GoogleChronicleBackstory.Events.network.dhcp.leaseTimeSeconds | Client-requested lease time for an IP address in seconds. | String |
| GoogleChronicleBackstory.Events.network.dhcp.opcode | BOOTP op code. | String |
| GoogleChronicleBackstory.Events.network.dhcp.requestedAddress | Client identifier. | String |
| GoogleChronicleBackstory.Events.network.dhcp.seconds | Seconds elapsed since the client began the address acquisition/renewal process. | String |
| GoogleChronicleBackstory.Events.network.dhcp.sname | Name of the server which the client has requested to boot from. | String |
| GoogleChronicleBackstory.Events.network.dhcp.transactionId | Client transaction ID. | String |
| GoogleChronicleBackstory.Events.network.dhcp.type | DHCP message type. | String |
| GoogleChronicleBackstory.Events.network.dhcp.chaddr | IP address for the client hardware. | String |
| GoogleChronicleBackstory.Events.network.dhcp.ciaddr | IP address for the client. | String |
| GoogleChronicleBackstory.Events.network.dhcp.giaddr | IP address for the relay agent. | String |
| GoogleChronicleBackstory.Events.network.dhcp.siaddr | IP address for the next bootstrap server. | String |
| GoogleChronicleBackstory.Events.network.dhcp.yiaddr | Your IP address. | String |
| GoogleChronicleBackstory.Events.network.dns.authoritative | Set to true for authoritative DNS servers. | String |
| GoogleChronicleBackstory.Events.network.dns.id | Stores the DNS query identifier. | String |
| GoogleChronicleBackstory.Events.network.dns.response | Set to true if the event is a DNS response. | String |
| GoogleChronicleBackstory.Events.network.dns.opcode | Stores the DNS OpCode used to specify the type of DNS query (standard, inverse, server status, etc.). | String |
| GoogleChronicleBackstory.Events.network.dns.recursionAvailable | Set to true if a recursive DNS lookup is available. | String |
| GoogleChronicleBackstory.Events.network.dns.recursionDesired | Set to true if a recursive DNS lookup is requested. | String |
| GoogleChronicleBackstory.Events.network.dns.responseCode | Stores the DNS response code as defined by RFC 1035, Domain Names - Implementation and Specification. | String |
| GoogleChronicleBackstory.Events.network.dns.truncated | Set to true if this is a truncated DNS response. | String |
| GoogleChronicleBackstory.Events.network.dns.questions.name | Stores the domain name. | String |
| GoogleChronicleBackstory.Events.network.dns.questions.class | Stores the code specifying the class of the query. | String |
| GoogleChronicleBackstory.Events.network.dns.questions.type | Stores the code specifying the type of the query. | String |
| GoogleChronicleBackstory.Events.network.dns.answers.binaryData | Stores the raw bytes of any non-UTF8 strings that might be included as part of a DNS response. | String |
| GoogleChronicleBackstory.Events.network.dns.answers.class | Stores the code specifying the class of the resource record. | String |
| GoogleChronicleBackstory.Events.network.dns.answers.data | Stores the payload or response to the DNS question for all responses encoded in UTF-8 format. | String |
| GoogleChronicleBackstory.Events.network.dns.answers.name | Stores the name of the owner of the resource record. | String |
| GoogleChronicleBackstory.Events.network.dns.answers.ttl | Stores the time interval for which the resource record can be cached before the source of the information should again be queried. | String |
| GoogleChronicleBackstory.Events.network.dns.answers.type | Stores the code specifying the type of the resource record. | String |
| GoogleChronicleBackstory.Events.network.dns.authority.binaryData | Stores the raw bytes of any non-UTF8 strings that might be included as part of a DNS response. | String |
| GoogleChronicleBackstory.Events.network.dns.authority.class | Stores the code specifying the class of the resource record. | String |
| GoogleChronicleBackstory.Events.network.dns.authority.data | Stores the payload or response to the DNS question for all responses encoded in UTF-8 format. | String |
| GoogleChronicleBackstory.Events.network.dns.authority.name | Stores the name of the owner of the resource record. | String |
| GoogleChronicleBackstory.Events.network.dns.authority.ttl | Stores the time interval for which the resource record can be cached before the source of the information should again be queried. | String |
| GoogleChronicleBackstory.Events.network.dns.authority.type | Stores the code specifying the type of the resource record. | String |
| GoogleChronicleBackstory.Events.network.dns.additional.binaryData | Stores the raw bytes of any non-UTF8 strings that might be included as part of a DNS response. | String |
| GoogleChronicleBackstory.Events.network.dns.additional.class | Stores the code specifying the class of the resource record. | String |
| GoogleChronicleBackstory.Events.network.dns.additional.data | Stores the payload or response to the DNS question for all responses encoded in UTF-8 format. | String |
| GoogleChronicleBackstory.Events.network.dns.additional.name | Stores the name of the owner of the resource record. | String |
| GoogleChronicleBackstory.Events.network.dns.additional.ttl | Stores the time interval for which the resource record can be cached before the source of the information should again be queried. | String |
| GoogleChronicleBackstory.Events.network.dns.additional.type | Stores the code specifying the type of the resource record. | String |
| GoogleChronicleBackstory.Events.network.email.from | Stores the from email address. | String |
| GoogleChronicleBackstory.Events.network.email.replyTo | Stores the reply_to email address. | String |
| GoogleChronicleBackstory.Events.network.email.to | Stores the to email addresses. | String |
| GoogleChronicleBackstory.Events.network.email.cc | Stores the cc email addresses. | String |
| GoogleChronicleBackstory.Events.network.email.bcc | Stores the bcc email addresses. | String |
| GoogleChronicleBackstory.Events.network.email.mailId | Stores the mail (or message) ID. | String |
| GoogleChronicleBackstory.Events.network.email.subject | Stores the email subject line. | String |
| GoogleChronicleBackstory.Events.network.ftp.command | Stores the FTP command. | String |
| GoogleChronicleBackstory.Events.network.http.method | Stores the HTTP request method. | String |
| GoogleChronicleBackstory.Events.network.http.referralUrl | Stores the URL for the HTTP referer. | String |
| GoogleChronicleBackstory.Events.network.http.responseCode | Stores the HTTP response status code, which indicates whether a specific HTTP request has been successfully completed. | String |
| GoogleChronicleBackstory.Events.network.http.useragent | Stores the User-Agent request header which includes the application type, operating system, software vendor or software version of the requesting software user agent. | String |
| GoogleChronicleBackstory.Events.authentication.authType | Type of system an authentication event is associated with (Chronicle UDM). | String |
| GoogleChronicleBackstory.Events.authentication.mechanism | Mechanism(s) used for authentication. | String |
| GoogleChronicleBackstory.Events.securityResult.about | Provide a description of the security result. | String |
| GoogleChronicleBackstory.Events.securityResult.action | Specify a security action. | String |
| GoogleChronicleBackstory.Events.securityResult.category | Specify a security category. | String |
| GoogleChronicleBackstory.Events.securityResult.confidence | Specify a confidence with regards to a security event as estimated by the product. | String |
| GoogleChronicleBackstory.Events.securityResult.confidenceDetails | Additional detail with regards to the confidence of a security event as estimated by the product vendor. | String |
| GoogleChronicleBackstory.Events.securityResult.priority | Specify a priority with regards to a security event as estimated by the product vendor. | String |
| GoogleChronicleBackstory.Events.securityResult.priorityDetails | Vendor-specific information about the security result priority. | String |
| GoogleChronicleBackstory.Events.securityResult.ruleId | Identifier for the security rule. | String |
| GoogleChronicleBackstory.Events.securityResult.ruleName | Name of the security rule. | String |
| GoogleChronicleBackstory.Events.securityResult.severity | Severity of a security event as estimated by the product vendor using values defined by the Chronicle UDM. | String |
| GoogleChronicleBackstory.Events.securityResult.severityDetails | Severity for a security event as estimated by the product vendor. | String |
| GoogleChronicleBackstory.Events.securityResult.threatName | Name of the security threat. | String |
| GoogleChronicleBackstory.Events.securityResult.urlBackToProduct | URL to direct you to the source product console for this security event. | String |
There are no outputs for this script.
Script Example
!ListDeviceEvents asset_identifier="ray-xxx-laptop"
Context Example
{
"GoogleChronicleBackstory.Events": [
{
"principal": {
"ip": [
"10.0.XX.XX"
],
"mac": [
"88:a6:XX:XX:XX:XX"
],
"hostname": "ray-xxx-laptop"
},
"target": {
"ip": [
"8.8.8.8"
]
},
"network": {
"applicationProtocol": "DNS",
"dns": {
"questions": [
{
"type": 1,
"name": "is5-ssl.mzstatic.com"
}
],
"answers": [
{
"type": 1,
"data": "104.118.212.43",
"name": "is5-ssl.mzstatic.com",
"ttl": 11111
}
],
"response": true
}
},
"collectedTimestamp": "2020-01-02T00:00:00Z",
"productName": "ExtraHop",
"eventTimestamp": "2020-01-01T23:59:38Z",
"eventType": "NETWORK_DNS"
}
]
}
Human Readable Output
Event(s) Details
Event Timestamp Event Type Principal Asset Identifier Target Asset Identifier Queried Domain 2020-01-01T23:59:38Z NETWORK_DNS ray-xxx-laptop 8.8.8.8 ninthdecimal.com View events in Chronicle
Maximum number of events specified in page_size has been returned. There might still be more events in your Chronicle account. >To fetch the next set of events, execute the command with the start time as 2020-01-01T23:59:38Z
args: - default: true description: Host Name, IP Address or MAC Address of the asset. name: asset_identifier required: true comment: List all of the events discovered within your enterprise on a particular device within 2 hours earlier than the current time. commonfields: id: ListDeviceEvents version: -1 enabled: true name: ListDeviceEvents outputs: - contextPath: GoogleChronicleBackstory.Events.eventType description: Specifies the type of the event. type: String - contextPath: GoogleChronicleBackstory.Events.eventTimestamp description: The GMT timestamp when the event was generated. type: Date - contextPath: GoogleChronicleBackstory.Events.collectedTimestamp description: The GMT timestamp when the event was collected by the vendor's local collection infrastructure. type: Date - contextPath: GoogleChronicleBackstory.Events.description description: Human-readable description of the event. type: String - contextPath: GoogleChronicleBackstory.Events.productEventType description: Short, descriptive, human-readable, and product-specific event name or type. type: String - contextPath: GoogleChronicleBackstory.Events.productLogId description: A vendor-specific event identifier to uniquely identify the event (a GUID). Users might use this identifier to search the vendor's proprietary console for the event in question. type: String - contextPath: GoogleChronicleBackstory.Events.productName description: Specifies the name of the product. type: String - contextPath: GoogleChronicleBackstory.Events.productVersion description: Specifies the version of the product. type: String - contextPath: GoogleChronicleBackstory.Events.urlBackToProduct description: URL linking to a relevant website where you can view more information about this specific event or the general event category. type: String - contextPath: GoogleChronicleBackstory.Events.vendorName description: Specifies the product vendor's name. type: String - contextPath: GoogleChronicleBackstory.Events.principal.assetId description: Vendor-specific unique device identifier. type: String - contextPath: GoogleChronicleBackstory.Events.principal.email description: Email address. type: String - contextPath: GoogleChronicleBackstory.Events.principal.hostname description: Client hostname or domain name field. type: String - contextPath: GoogleChronicleBackstory.Events.principal.platform description: Platform operating system. type: String - contextPath: GoogleChronicleBackstory.Events.principal.platformPatchLevel description: Platform operating system patch level. type: String - contextPath: GoogleChronicleBackstory.Events.principal.platformVersion description: Platform operating system version. type: String - contextPath: GoogleChronicleBackstory.Events.principal.ip description: IP address associated with a network connection. type: String - contextPath: GoogleChronicleBackstory.Events.principal.port description: Source or destination network port number when a specific network connection is described within an event. type: String - contextPath: GoogleChronicleBackstory.Events.principal.mac description: MAC addresses associated with a device. type: String - contextPath: GoogleChronicleBackstory.Events.principal.administrativeDomain description: Domain which the device belongs to (for example, the Windows domain). type: String - contextPath: GoogleChronicleBackstory.Events.principal.url description: Standard URL. type: String - contextPath: GoogleChronicleBackstory.Events.principal.file.fileMetadata description: Metadata associated with the file. type: String - contextPath: GoogleChronicleBackstory.Events.principal.file.fullPath description: Full path identifying the location of the file on the system. type: String - contextPath: GoogleChronicleBackstory.Events.principal.file.md5 description: MD5 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.principal.file.mimeType description: Multipurpose Internet Mail Extensions (MIME) type of the file. type: String - contextPath: GoogleChronicleBackstory.Events.principal.file.sha1 description: SHA-1 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.principal.file.sha256 description: SHA-256 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.principal.file.size description: Size of the file. type: String - contextPath: GoogleChronicleBackstory.Events.principal.process.commandLine description: Stores the command line string for the process. type: String - contextPath: GoogleChronicleBackstory.Events.principal.process.productSpecificProcessId description: Stores the product specific process ID. type: String - contextPath: GoogleChronicleBackstory.Events.principal.process.productSpecificParentProcessId description: Stores the product specific process ID for the parent process. type: String - contextPath: GoogleChronicleBackstory.Events.principal.process.file description: Stores the file name of the file in use by the process. type: String - contextPath: GoogleChronicleBackstory.Events.principal.process.file.fileMetadata description: Metadata associated with the file. type: String - contextPath: GoogleChronicleBackstory.Events.principal.process.file.fullPath description: Full path identifying the location of the file on the system. type: String - contextPath: GoogleChronicleBackstory.Events.principal.process.file.md5 description: MD5 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.principal.process.file.mimeType description: Multipurpose Internet Mail Extensions (MIME) type of the file. type: String - contextPath: GoogleChronicleBackstory.Events.principal.process.file.sha1 description: SHA-1 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.principal.process.file.sha256 description: SHA-256 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.principal.process.file.size description: Size of the file. type: String - contextPath: GoogleChronicleBackstory.Events.principal.process.parentPid description: Stores the process ID for the parent process. type: String - contextPath: GoogleChronicleBackstory.Events.principal.process.pid description: Stores the process ID. type: String - contextPath: GoogleChronicleBackstory.Events.principal.registry.registryKey description: Stores the registry key associated with an application or system component. type: String - contextPath: GoogleChronicleBackstory.Events.principal.registry.registryValueName description: Stores the name of the registry value associated with an application or system component. type: String - contextPath: GoogleChronicleBackstory.Events.principal.registry.registryValueData description: Stores the data associated with a registry value. type: String - contextPath: GoogleChronicleBackstory.Events.principal.user.emailAddresses description: Stores the email addresses for the user. type: String - contextPath: GoogleChronicleBackstory.Events.principal.user.employeeId description: Stores the human resources employee ID for the user. type: String - contextPath: GoogleChronicleBackstory.Events.principal.user.firstName description: Stores the first name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.principal.user.middleName description: Stores the middle name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.principal.user.lastName description: Stores the last name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.principal.user.groupid description: Stores the group ID associated with a user. type: String - contextPath: GoogleChronicleBackstory.Events.principal.user.phoneNumbers description: Stores the phone numbers for the user. type: String - contextPath: GoogleChronicleBackstory.Events.principal.user.title description: Stores the job title for the user. type: String - contextPath: GoogleChronicleBackstory.Events.principal.user.userDisplayName description: Stores the display name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.principal.user.userid description: Stores the user ID. type: String - contextPath: GoogleChronicleBackstory.Events.principal.user.windowsSid description: Stores the Microsoft Windows security identifier (SID) associated with a user. type: String - contextPath: GoogleChronicleBackstory.Events.target.assetId description: Vendor-specific unique device identifier. type: String - contextPath: GoogleChronicleBackstory.Events.target.email description: Email address. type: String - contextPath: GoogleChronicleBackstory.Events.target.hostname description: Client hostname or domain name field. type: String - contextPath: GoogleChronicleBackstory.Events.target.platform description: Platform operating system. type: String - contextPath: GoogleChronicleBackstory.Events.target.platformPatchLevel description: Platform operating system patch level. type: String - contextPath: GoogleChronicleBackstory.Events.target.platformVersion description: Platform operating system version. type: String - contextPath: GoogleChronicleBackstory.Events.target.ip description: IP address associated with a network connection. type: String - contextPath: GoogleChronicleBackstory.Events.target.port description: Source or destination network port number when a specific network connection is described within an event. type: String - contextPath: GoogleChronicleBackstory.Events.target.mac description: One or more MAC addresses associated with a device. type: String - contextPath: GoogleChronicleBackstory.Events.target.administrativeDomain description: Domain which the device belongs to (for example, the Windows domain). type: String - contextPath: GoogleChronicleBackstory.Events.target.url description: Standard URL. type: String - contextPath: GoogleChronicleBackstory.Events.target.file.fileMetadata description: Metadata associated with the file. type: String - contextPath: GoogleChronicleBackstory.Events.target.file.fullPath description: Full path identifying the location of the file on the system. type: String - contextPath: GoogleChronicleBackstory.Events.target.file.md5 description: MD5 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.target.file.mimeType description: Multipurpose Internet Mail Extensions (MIME) type of the file. type: String - contextPath: GoogleChronicleBackstory.Events.target.file.sha1 description: SHA-1 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.target.file.sha256 description: SHA-256 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.target.file.size description: Size of the file. type: String - contextPath: GoogleChronicleBackstory.Events.target.process.commandLine description: Stores the command line string for the process. type: String - contextPath: GoogleChronicleBackstory.Events.target.process.productSpecificProcessId description: Stores the product specific process ID. type: String - contextPath: GoogleChronicleBackstory.Events.target.process.productSpecificParentProcessId description: Stores the product specific process ID for the parent process. type: String - contextPath: GoogleChronicleBackstory.Events.target.process.file description: Stores the file name of the file in use by the process. type: String - contextPath: GoogleChronicleBackstory.Events.target.process.file.fileMetadata description: Metadata associated with the file. type: String - contextPath: GoogleChronicleBackstory.Events.target.process.file.fullPath description: Full path identifying the location of the file on the system. type: String - contextPath: GoogleChronicleBackstory.Events.target.process.file.md5 description: MD5 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.target.process.file.mimeType description: Multipurpose Internet Mail Extensions (MIME) type of the file. type: String - contextPath: GoogleChronicleBackstory.Events.target.process.file.sha1 description: SHA-1 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.target.process.file.sha256 description: SHA-256 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.target.process.file.size description: Size of the file. type: String - contextPath: GoogleChronicleBackstory.Events.target.process.parentPid description: Stores the process ID for the parent process. type: String - contextPath: GoogleChronicleBackstory.Events.target.process.pid description: Stores the process ID. type: String - contextPath: GoogleChronicleBackstory.Events.target.registry.registryKey description: Stores the registry key associated with an application or system component. type: String - contextPath: GoogleChronicleBackstory.Events.target.registry.registryValueName description: Stores the name of the registry value associated with an application or system component. type: String - contextPath: GoogleChronicleBackstory.Events.target.registry.registryValueData description: Stores the data associated with a registry value. type: String - contextPath: GoogleChronicleBackstory.Events.target.user.emailAddresses description: Stores the email addresses for the user. type: String - contextPath: GoogleChronicleBackstory.Events.target.user.employeeId description: Stores the human resources employee ID for the user. type: String - contextPath: GoogleChronicleBackstory.Events.target.user.firstName description: Stores the first name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.target.user.middleName description: Stores the middle name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.target.user.lastName description: Stores the last name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.target.user.groupid description: Stores the group ID associated with a user. type: String - contextPath: GoogleChronicleBackstory.Events.target.user.phoneNumbers description: Stores the phone numbers for the user. type: String - contextPath: GoogleChronicleBackstory.Events.target.user.title description: Stores the job title for the user. type: String - contextPath: GoogleChronicleBackstory.Events.target.user.userDisplayName description: Stores the display name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.target.user.userid description: Stores the user ID. type: String - contextPath: GoogleChronicleBackstory.Events.target.user.windowsSid description: Stores the Microsoft Windows security identifier (SID) associated with a user. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.assetId description: Vendor-specific unique device identifier. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.email description: Email address. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.hostname description: Client hostname or domain name field. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.platform description: Platform operating system. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.platformPatchLevel description: Platform operating system patch level. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.platformVersion description: Platform operating system version. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.ip description: IP address associated with a network connection. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.port description: Source or destination network port number when a specific network connection is described within an event. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.mac description: One or more MAC addresses associated with a device. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.administrativeDomain description: Domain which the device belongs to (for example, the Windows domain). type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.url description: Standard URL. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.file.fileMetadata description: Metadata associated with the file. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.file.fullPath description: Full path identifying the location of the file on the system. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.file.md5 description: MD5 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.file.mimeType description: Multipurpose Internet Mail Extensions (MIME) type of the file. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.file.sha1 description: SHA-1 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.file.sha256 description: SHA-256 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.file.size description: Size of the file. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.process.commandLine description: Stores the command line string for the process. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.process.productSpecificProcessId description: Stores the product specific process ID. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.process.productSpecificParentProcessId description: Stores the product specific process ID for the parent process. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.process.file description: Stores the file name of the file in use by the process. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.process.file.fileMetadata description: Metadata associated with the file. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.process.file.fullPath description: Full path identifying the location of the file on the system. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.process.file.md5 description: MD5 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.process.file.mimeType description: Multipurpose Internet Mail Extensions (MIME) type of the file. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.process.file.sha1 description: SHA-1 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.process.file.sha256 description: SHA-256 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.process.file.size description: Size of the file. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.process.parentPid description: Stores the process ID for the parent process. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.process.pid description: Stores the process ID. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.registry.registryKey description: Stores the registry key associated with an application or system component. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.registry.registryValueName description: Stores the name of the registry value associated with an application or system component. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.registry.registryValueData description: Stores the data associated with a registry value. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.user.emailAddresses description: Stores the email addresses for the user. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.user.employeeId description: Stores the human resources employee ID for the user. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.user.firstName description: Stores the first name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.user.middleName description: Stores the middle name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.user.lastName description: Stores the last name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.user.groupid description: Stores the group ID associated with a user. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.user.phoneNumbers description: Stores the phone numbers for the user. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.user.title description: Stores the job title for the user. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.user.userDisplayName description: Stores the display name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.user.userid description: Stores the user ID. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.user.windowsSid description: Stores the Microsoft Windows security identifier (SID) associated with a user. type: String - contextPath: GoogleChronicleBackstory.Events.src.assetId description: Vendor-specific unique device identifier. type: String - contextPath: GoogleChronicleBackstory.Events.src.email description: Email address. type: String - contextPath: GoogleChronicleBackstory.Events.src.hostname description: Client hostname or domain name field. type: String - contextPath: GoogleChronicleBackstory.Events.src.platform description: Platform operating system. type: String - contextPath: GoogleChronicleBackstory.Events.src.platformPatchLevel description: Platform operating system patch level. type: String - contextPath: GoogleChronicleBackstory.Events.src.platformVersion description: Platform operating system version. type: String - contextPath: GoogleChronicleBackstory.Events.src.ip description: IP address associated with a network connection. type: String - contextPath: GoogleChronicleBackstory.Events.src.port description: Source or destination network port number when a specific network connection is described within an event. type: String - contextPath: GoogleChronicleBackstory.Events.src.mac description: One or more MAC addresses associated with a device. type: String - contextPath: GoogleChronicleBackstory.Events.src.administrativeDomain description: Domain which the device belongs to (for example, the Windows domain). type: String - contextPath: GoogleChronicleBackstory.Events.src.url description: Standard URL. type: String - contextPath: GoogleChronicleBackstory.Events.src.file.fileMetadata description: Metadata associated with the file. type: String - contextPath: GoogleChronicleBackstory.Events.src.file.fullPath description: Full path identifying the location of the file on the system. type: String - contextPath: GoogleChronicleBackstory.Events.src.file.md5 description: MD5 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.src.file.mimeType description: Multipurpose Internet Mail Extensions (MIME) type of the file. type: String - contextPath: GoogleChronicleBackstory.Events.src.file.sha1 description: SHA-1 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.src.file.sha256 description: SHA-256 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.src.file.size description: Size of the file. type: String - contextPath: GoogleChronicleBackstory.Events.src.process.commandLine description: Stores the command line string for the process. type: String - contextPath: GoogleChronicleBackstory.Events.src.process.productSpecificProcessId description: Stores the product specific process ID. type: String - contextPath: GoogleChronicleBackstory.Events.src.process.productSpecificParentProcessId description: Stores the product specific process ID for the parent process. type: String - contextPath: GoogleChronicleBackstory.Events.src.process.file description: Stores the file name of the file in use by the process. type: String - contextPath: GoogleChronicleBackstory.Events.src.process.file.fileMetadata description: Metadata associated with the file. type: String - contextPath: GoogleChronicleBackstory.Events.src.process.file.fullPath description: Full path identifying the location of the file on the system. type: String - contextPath: GoogleChronicleBackstory.Events.src.process.file.md5 description: MD5 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.src.process.file.mimeType description: Multipurpose Internet Mail Extensions (MIME) type of the file. type: String - contextPath: GoogleChronicleBackstory.Events.src.process.file.sha1 description: SHA-1 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.src.process.file.sha256 description: SHA-256 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.src.process.file.size description: Size of the file. type: String - contextPath: GoogleChronicleBackstory.Events.src.process.parentPid description: Stores the process ID for the parent process. type: String - contextPath: GoogleChronicleBackstory.Events.src.process.pid description: Stores the process ID. type: String - contextPath: GoogleChronicleBackstory.Events.src.registry.registryKey description: Stores the registry key associated with an application or system component. type: String - contextPath: GoogleChronicleBackstory.Events.src.registry.registryValueName description: Stores the name of the registry value associated with an application or system component. type: String - contextPath: GoogleChronicleBackstory.Events.src.registry.registryValueData description: Stores the data associated with a registry value. type: String - contextPath: GoogleChronicleBackstory.Events.src.user.emailAddresses description: Stores the email addresses for the user. type: String - contextPath: GoogleChronicleBackstory.Events.src.user.employeeId description: Stores the human resources employee ID for the user. type: String - contextPath: GoogleChronicleBackstory.Events.src.user.firstName description: Stores the first name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.src.user.middleName description: Stores the middle name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.src.user.lastName description: Stores the last name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.src.user.groupid description: Stores the group ID associated with a user. type: String - contextPath: GoogleChronicleBackstory.Events.src.user.phoneNumbers description: Stores the phone numbers for the user. type: String - contextPath: GoogleChronicleBackstory.Events.src.user.title description: Stores the job title for the user. type: String - contextPath: GoogleChronicleBackstory.Events.src.user.userDisplayName description: Stores the display name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.src.user.userid description: Stores the user ID. type: String - contextPath: GoogleChronicleBackstory.Events.src.user.windowsSid description: Stores the Microsoft Windows security identifier (SID) associated with a user. type: String - contextPath: GoogleChronicleBackstory.Events.observer.assetId description: Vendor-specific unique device identifier. type: String - contextPath: GoogleChronicleBackstory.Events.observer.email description: Email address. type: String - contextPath: GoogleChronicleBackstory.Events.observer.hostname description: Client hostname or domain name field. type: String - contextPath: GoogleChronicleBackstory.Events.observer.platform description: Platform operating system. type: String - contextPath: GoogleChronicleBackstory.Events.observer.platformPatchLevel description: Platform operating system patch level. type: String - contextPath: GoogleChronicleBackstory.Events.observer.platformVersion description: Platform operating system version. type: String - contextPath: GoogleChronicleBackstory.Events.observer.ip description: IP address associated with a network connection. type: String - contextPath: GoogleChronicleBackstory.Events.observer.port description: Source or destination network port number when a specific network connection is described within an event. type: String - contextPath: GoogleChronicleBackstory.Events.observer.mac description: One or more MAC addresses associated with a device. type: String - contextPath: GoogleChronicleBackstory.Events.observer.administrativeDomain description: Domain which the device belongs to (for example, the Windows domain). type: String - contextPath: GoogleChronicleBackstory.Events.observer.url description: Standard URL. type: String - contextPath: GoogleChronicleBackstory.Events.observer.file.fileMetadata description: Metadata associated with the file. type: String - contextPath: GoogleChronicleBackstory.Events.observer.file.fullPath description: Full path identifying the location of the file on the system. type: String - contextPath: GoogleChronicleBackstory.Events.observer.file.md5 description: MD5 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.observer.file.mimeType description: Multipurpose Internet Mail Extensions (MIME) type of the file. type: String - contextPath: GoogleChronicleBackstory.Events.observer.file.sha1 description: SHA-1 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.observer.file.sha256 description: SHA-256 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.observer.file.size description: Size of the file. type: String - contextPath: GoogleChronicleBackstory.Events.observer.process.commandLine description: Stores the command line string for the process. type: String - contextPath: GoogleChronicleBackstory.Events.observer.process.productSpecificProcessId description: Stores the product specific process ID. type: String - contextPath: GoogleChronicleBackstory.Events.observer.process.productSpecificParentProcessId description: Stores the product specific process ID for the parent process. type: String - contextPath: GoogleChronicleBackstory.Events.observer.process.file description: Stores the file name of the file in use by the process. type: String - contextPath: GoogleChronicleBackstory.Events.observer.process.file.fileMetadata description: Metadata associated with the file. type: String - contextPath: GoogleChronicleBackstory.Events.observer.process.file.fullPath description: Full path identifying the location of the file on the system. type: String - contextPath: GoogleChronicleBackstory.Events.observer.process.file.md5 description: MD5 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.observer.process.file.mimeType description: Multipurpose Internet Mail Extensions (MIME) type of the file. type: String - contextPath: GoogleChronicleBackstory.Events.observer.process.file.sha1 description: SHA-1 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.observer.process.file.sha256 description: SHA-256 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.observer.process.file.size description: Size of the file. type: String - contextPath: GoogleChronicleBackstory.Events.observer.process.parentPid description: Stores the process ID for the parent process. type: String - contextPath: GoogleChronicleBackstory.Events.observer.process.pid description: Stores the process ID. type: String - contextPath: GoogleChronicleBackstory.Events.observer.registry.registryKey description: Stores the registry key associated with an application or system component. type: String - contextPath: GoogleChronicleBackstory.Events.observer.registry.registryValueName description: Stores the name of the registry value associated with an application or system component. type: String - contextPath: GoogleChronicleBackstory.Events.observer.registry.registryValueData description: Stores the data associated with a registry value. type: String - contextPath: GoogleChronicleBackstory.Events.observer.user.emailAddresses description: Stores the email addresses for the user. type: String - contextPath: GoogleChronicleBackstory.Events.observer.user.employeeId description: Stores the human resources employee ID for the user. type: String - contextPath: GoogleChronicleBackstory.Events.observer.user.firstName description: Stores the first name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.observer.user.middleName description: Stores the middle name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.observer.user.lastName description: Stores the last name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.observer.user.groupid description: Stores the group ID associated with a user. type: String - contextPath: GoogleChronicleBackstory.Events.observer.user.phoneNumbers description: Stores the phone numbers for the user. type: String - contextPath: GoogleChronicleBackstory.Events.observer.user.title description: Stores the job title for the user. type: String - contextPath: GoogleChronicleBackstory.Events.observer.user.userDisplayName description: Stores the display name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.observer.user.userid description: Stores the user ID. type: String - contextPath: GoogleChronicleBackstory.Events.observer.user.windowsSid description: Stores the Microsoft Windows security identifier (SID) associated with a user. type: String - contextPath: GoogleChronicleBackstory.Events.about.assetId description: Vendor-specific unique device identifier. type: String - contextPath: GoogleChronicleBackstory.Events.about.email description: Email address. type: String - contextPath: GoogleChronicleBackstory.Events.about.hostname description: Client hostname or domain name field. type: String - contextPath: GoogleChronicleBackstory.Events.about.platform description: Platform operating system. type: String - contextPath: GoogleChronicleBackstory.Events.about.platformPatchLevel description: Platform operating system patch level. type: String - contextPath: GoogleChronicleBackstory.Events.about.platformVersion description: Platform operating system version. type: String - contextPath: GoogleChronicleBackstory.Events.about.ip description: IP address associated with a network connection. type: String - contextPath: GoogleChronicleBackstory.Events.about.port description: Source or destination network port number when a specific network connection is described within an event. type: String - contextPath: GoogleChronicleBackstory.Events.about.mac description: One or more MAC addresses associated with a device. type: String - contextPath: GoogleChronicleBackstory.Events.about.administrativeDomain description: Domain which the device belongs to (for example, the Windows domain). type: String - contextPath: GoogleChronicleBackstory.Events.about.url description: Standard URL. type: String - contextPath: GoogleChronicleBackstory.Events.about.file.fileMetadata description: Metadata associated with the file. type: String - contextPath: GoogleChronicleBackstory.Events.about.file.fullPath description: Full path identifying the location of the file on the system. type: String - contextPath: GoogleChronicleBackstory.Events.about.file.md5 description: MD5 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.about.file.mimeType description: Multipurpose Internet Mail Extensions (MIME) type of the file. type: String - contextPath: GoogleChronicleBackstory.Events.about.file.sha1 description: SHA-1 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.about.file.sha256 description: SHA-256 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.about.file.size description: Size of the file. type: String - contextPath: GoogleChronicleBackstory.Events.about.process.commandLine description: Stores the command line string for the process. type: String - contextPath: GoogleChronicleBackstory.Events.about.process.productSpecificProcessId description: Stores the product specific process ID. type: String - contextPath: GoogleChronicleBackstory.Events.about.process.productSpecificParentProcessId description: Stores the product specific process ID for the parent process. type: String - contextPath: GoogleChronicleBackstory.Events.about.process.file description: Stores the file name of the file in use by the process. type: String - contextPath: GoogleChronicleBackstory.Events.about.process.file.fileMetadata description: Metadata associated with the file. type: String - contextPath: GoogleChronicleBackstory.Events.about.process.file.fullPath description: Full path identifying the location of the file on the system. type: String - contextPath: GoogleChronicleBackstory.Events.about.process.file.md5 description: MD5 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.about.process.file.mimeType description: Multipurpose Internet Mail Extensions (MIME) type of the file. type: String - contextPath: GoogleChronicleBackstory.Events.about.process.file.sha1 description: SHA-1 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.about.process.file.sha256 description: SHA-256 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.about.process.file.size description: Size of the file. type: String - contextPath: GoogleChronicleBackstory.Events.about.process.parentPid description: Stores the process ID for the parent process. type: String - contextPath: GoogleChronicleBackstory.Events.about.process.pid description: Stores the process ID. type: String - contextPath: GoogleChronicleBackstory.Events.about.registry.registryKey description: Stores the registry key associated with an application or system component. type: String - contextPath: GoogleChronicleBackstory.Events.about.registry.registryValueName description: Stores the name of the registry value associated with an application or system component. type: String - contextPath: GoogleChronicleBackstory.Events.about.registry.registryValueData description: Stores the data associated with a registry value. type: String - contextPath: GoogleChronicleBackstory.Events.about.user.emailAddresses description: Stores the email addresses for the user. type: String - contextPath: GoogleChronicleBackstory.Events.about.user.employeeId description: Stores the human resources employee ID for the user. type: String - contextPath: GoogleChronicleBackstory.Events.about.user.firstName description: Stores the first name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.about.user.middleName description: Stores the middle name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.about.user.lastName description: Stores the last name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.about.user.groupid description: Stores the group ID associated with a user. type: String - contextPath: GoogleChronicleBackstory.Events.about.user.phoneNumbers description: Stores the phone numbers for the user. type: String - contextPath: GoogleChronicleBackstory.Events.about.user.title description: Stores the job title for the user. type: String - contextPath: GoogleChronicleBackstory.Events.about.user.userDisplayName description: Stores the display name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.about.user.userid description: Stores the user ID. type: String - contextPath: GoogleChronicleBackstory.Events.about.user.windowsSid description: Stores the Microsoft Windows security identifier (SID) associated with a user. type: String - contextPath: GoogleChronicleBackstory.Events.network.applicationProtocol description: Indicates the network application protocol. type: String - contextPath: GoogleChronicleBackstory.Events.network.direction description: Indicates the direction of network traffic. type: String - contextPath: GoogleChronicleBackstory.Events.network.email description: Specifies the email address for the sender/recipient. type: String - contextPath: GoogleChronicleBackstory.Events.network.ipProtocol description: Indicates the IP protocol. type: String - contextPath: GoogleChronicleBackstory.Events.network.receivedBytes description: Specifies the number of bytes received. type: String - contextPath: GoogleChronicleBackstory.Events.network.sentBytes description: Specifies the number of bytes sent. type: String - contextPath: GoogleChronicleBackstory.Events.network.dhcp.clientHostname description: Hostname for the client. type: String - contextPath: GoogleChronicleBackstory.Events.network.dhcp.clientIdentifier description: Client identifier. type: String - contextPath: GoogleChronicleBackstory.Events.network.dhcp.file description: Filename for the boot image. type: String - contextPath: GoogleChronicleBackstory.Events.network.dhcp.flags description: Value for the DHCP flags field. type: String - contextPath: GoogleChronicleBackstory.Events.network.dhcp.hlen description: Hardware address length. type: String - contextPath: GoogleChronicleBackstory.Events.network.dhcp.hops description: DHCP hop count. type: String - contextPath: GoogleChronicleBackstory.Events.network.dhcp.htype description: Hardware address type. type: String - contextPath: GoogleChronicleBackstory.Events.network.dhcp.leaseTimeSeconds description: Client-requested lease time for an IP address in seconds. type: String - contextPath: GoogleChronicleBackstory.Events.network.dhcp.opcode description: BOOTP op code. type: String - contextPath: GoogleChronicleBackstory.Events.network.dhcp.requestedAddress description: Client identifier. type: String - contextPath: GoogleChronicleBackstory.Events.network.dhcp.seconds description: Seconds elapsed since the client began the address acquisition/renewal process. type: String - contextPath: GoogleChronicleBackstory.Events.network.dhcp.sname description: Name of the server which the client has requested to boot from. type: String - contextPath: GoogleChronicleBackstory.Events.network.dhcp.transactionId description: Client transaction ID. type: String - contextPath: GoogleChronicleBackstory.Events.network.dhcp.type description: DHCP message type. type: String - contextPath: GoogleChronicleBackstory.Events.network.dhcp.chaddr description: IP address for the client hardware. type: String - contextPath: GoogleChronicleBackstory.Events.network.dhcp.ciaddr description: IP address for the client. type: String - contextPath: GoogleChronicleBackstory.Events.network.dhcp.giaddr description: IP address for the relay agent. type: String - contextPath: GoogleChronicleBackstory.Events.network.dhcp.siaddr description: IP address for the next bootstrap server. type: String - contextPath: GoogleChronicleBackstory.Events.network.dhcp.yiaddr description: Your IP address. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.authoritative description: Set to true for authoritative DNS servers. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.id description: Stores the DNS query identifier. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.response description: Set to true if the event is a DNS response. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.opcode description: Stores the DNS OpCode used to specify the type of DNS query (standard, inverse, server status, etc.). type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.recursionAvailable description: Set to true if a recursive DNS lookup is available. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.recursionDesired description: Set to true if a recursive DNS lookup is requested. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.responseCode description: Stores the DNS response code as defined by RFC 1035, Domain Names - Implementation and Specification. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.truncated description: Set to true if this is a truncated DNS response. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.questions.name description: Stores the domain name. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.questions.class description: Stores the code specifying the class of the query. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.questions.type description: Stores the code specifying the type of the query. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.answers.binaryData description: Stores the raw bytes of any non-UTF8 strings that might be included as part of a DNS response. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.answers.class description: Stores the code specifying the class of the resource record. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.answers.data description: Stores the payload or response to the DNS question for all responses encoded in UTF-8 format. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.answers.name description: Stores the name of the owner of the resource record. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.answers.ttl description: Stores the time interval for which the resource record can be cached before the source of the information should again be queried. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.answers.type description: Stores the code specifying the type of the resource record. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.authority.binaryData description: Stores the raw bytes of any non-UTF8 strings that might be included as part of a DNS response. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.authority.class description: Stores the code specifying the class of the resource record. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.authority.data description: Stores the payload or response to the DNS question for all responses encoded in UTF-8 format. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.authority.name description: Stores the name of the owner of the resource record. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.authority.ttl description: Stores the time interval for which the resource record can be cached before the source of the information should again be queried. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.authority.type description: Stores the code specifying the type of the resource record. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.additional.binaryData description: Stores the raw bytes of any non-UTF8 strings that might be included as part of a DNS response. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.additional.class description: Stores the code specifying the class of the resource record. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.additional.data description: Stores the payload or response to the DNS question for all responses encoded in UTF-8 format. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.additional.name description: Stores the name of the owner of the resource record. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.additional.ttl description: Stores the time interval for which the resource record can be cached before the source of the information should again be queried. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.additional.type description: Stores the code specifying the type of the resource record. type: String - contextPath: GoogleChronicleBackstory.Events.network.email.from description: Stores the from email address. type: String - contextPath: GoogleChronicleBackstory.Events.network.email.replyTo description: Stores the reply_to email address. type: String - contextPath: GoogleChronicleBackstory.Events.network.email.to description: Stores the to email addresses. type: String - contextPath: GoogleChronicleBackstory.Events.network.email.cc description: Stores the cc email addresses. type: String - contextPath: GoogleChronicleBackstory.Events.network.email.bcc description: Stores the bcc email addresses. type: String - contextPath: GoogleChronicleBackstory.Events.network.email.mailId description: Stores the mail (or message) ID. type: String - contextPath: GoogleChronicleBackstory.Events.network.email.subject description: Stores the email subject line. type: String - contextPath: GoogleChronicleBackstory.Events.network.ftp.command description: Stores the FTP command. type: String - contextPath: GoogleChronicleBackstory.Events.network.http.method description: Stores the HTTP request method. type: String - contextPath: GoogleChronicleBackstory.Events.network.http.referralUrl description: Stores the URL for the HTTP referer. type: String - contextPath: GoogleChronicleBackstory.Events.network.http.responseCode description: Stores the HTTP response status code, which indicates whether a specific HTTP request has been successfully completed. type: String - contextPath: GoogleChronicleBackstory.Events.network.http.useragent description: Stores the User-Agent request header which includes the application type, operating system, software vendor or software version of the requesting software user agent. type: String - contextPath: GoogleChronicleBackstory.Events.authentication.authType description: Type of system an authentication event is associated with (Chronicle UDM). type: String - contextPath: GoogleChronicleBackstory.Events.authentication.mechanism description: Mechanism(s) used for authentication. type: String - contextPath: GoogleChronicleBackstory.Events.securityResult.about description: Provide a description of the security result. type: String - contextPath: GoogleChronicleBackstory.Events.securityResult.action description: Specify a security action. type: String - contextPath: GoogleChronicleBackstory.Events.securityResult.category description: Specify a security category. type: String - contextPath: GoogleChronicleBackstory.Events.securityResult.confidence description: Specify a confidence with regards to a security event as estimated by the product. type: String - contextPath: GoogleChronicleBackstory.Events.securityResult.confidenceDetails description: Additional detail with regards to the confidence of a security event as estimated by the product vendor. type: String - contextPath: GoogleChronicleBackstory.Events.securityResult.priority description: Specify a priority with regards to a security event as estimated by the product vendor. type: String - contextPath: GoogleChronicleBackstory.Events.securityResult.priorityDetails description: Vendor-specific information about the security result priority. type: String - contextPath: GoogleChronicleBackstory.Events.securityResult.ruleId description: Identifier for the security rule. type: String - contextPath: GoogleChronicleBackstory.Events.securityResult.ruleName description: Name of the security rule. type: String - contextPath: GoogleChronicleBackstory.Events.securityResult.severity description: Severity of a security event as estimated by the product vendor using values defined by the Chronicle UDM. type: String - contextPath: GoogleChronicleBackstory.Events.securityResult.severityDetails description: Severity for a security event as estimated by the product vendor. type: String - contextPath: GoogleChronicleBackstory.Events.securityResult.threatName description: Name of the security threat. type: String - contextPath: GoogleChronicleBackstory.Events.securityResult.urlBackToProduct description: URL to direct you to the source product console for this security event. type: String script: '-' subtype: python3 tags: - enhancement timeout: '0' type: python dockerimage: demisto/python3:3.12.8.3296088 runas: DBotWeakRole tests: - No tests (auto formatted) dependson: must: - '|||gcb-list-events' fromversion: 5.0.0