category: Analytics & SIEM provider: Google sectionorder: - Connect - Collect commonfields: id: Google Chronicle Backstory version: -1 configuration: - display: User's Service Account JSON name: service_account_credential required: true type: 4 section: Connect - additionalinfo: Select the region based on the location of the chronicle backstory instance. If the region is not listed in the dropdown, choose the "Other" option and specify the region in the "Other Region" text field. defaultvalue: General display: Region name: region options: - General - Europe - Asia - Europe-west2 - Other type: 15 section: Connect - additionalinfo: Specify the region based on the location of the chronicle backstory instance. Only applicable if the "Other" option is selected in the Region dropdown. display: Other Region hidden: false name: other_region required: false type: 0 section: Connect - display: Provide comma(',') separated categories (e.g. APT-Activity, Phishing). Indicators belonging to these "categories" would be considered as "malicious" when executing reputation commands. name: malicious_categories type: 12 section: Collect advanced: true required: false - display: Provide comma(',') separated categories (e.g. Unwanted, VirusTotal YARA Rule Match). Indicators belonging to these "categories" would be considered as "suspicious" when executing reputation commands. name: suspicious_categories type: 12 section: Collect advanced: true required: false - display: Specify the "severity" of indicator that should be considered as "malicious" irrespective of the category. If you wish to consider all indicators with High severity as Malicious, set this parameter to 'High'. Allowed values are 'High', 'Medium' and 'Low'. This configuration is applicable to reputation commands only. name: override_severity_malicious options: - high - medium - low type: 16 section: Collect advanced: true required: false - display: Specify the "severity" of indicator that should be considered as "suspicious" irrespective of the category. If you wish to consider all indicators with Medium severity as Suspicious, set this parameter to 'Medium'. Allowed values are 'High', 'Medium' and 'Low'. This configuration is applicable to reputation commands only. name: override_severity_suspicious options: - high - medium - low type: 16 section: Collect advanced: true required: false - display: Specify the numeric value of "confidence score". If the indicator's confidence score is equal or above the configured threshold, it would be considered as "malicious". The value provided should be greater than the suspicious threshold. This configuration is applicable to reputation commands only. name: override_confidence_score_malicious_threshold type: 0 section: Collect advanced: true required: false - display: Specify the numeric value of "confidence score". If the indicator's confidence score is equal or above the configured threshold, it would be considered as "suspicious". The value provided should be smaller than the malicious threshold. This configuration is applicable to reputation commands only. name: override_confidence_score_suspicious_threshold type: 0 section: Collect advanced: true required: false - display: Select the confidence score level. If the indicator's confidence score level is equal or above the configured level, it would be considered as "malicious". The confidence level configured should have higher precedence than the suspicious level. This configuration is applicable to reputation commands only. Refer the "confidence score" level precedence UNKNOWN SEVERITY < INFORMATIONAL < LOW < MEDIUM < HIGH. name: override_confidence_level_malicious options: - unknown_severity - informational - low - medium - high type: 15 section: Collect advanced: true required: false - display: |- Select the confidence score level. If the indicator's confidence score level is equal or above the configured level, it would be considered as "suspicious". The confidence level configured should have lesser precedence than the malicious level. This configuration is applicable to reputation commands only. Refer the "confidence score" level precedence UNKNOWN SEVERITY < INFORMATIONAL < LOW < MEDIUM < HIGH. name: override_confidence_level_suspicious options: - unknown_severity - informational - low - medium - high type: 15 section: Collect advanced: true required: false - display: Fetch incidents name: isFetch type: 8 section: Collect required: false - display: Incident type name: incidentType type: 13 section: Connect required: false - display: Incidents Fetch Interval name: incidentFetchInterval defaultvalue: '1' required: false type: 19 section: Collect advanced: true - additionalinfo: |- The UTC date or relative timestamp from where to start fetching incidents. Supported formats: N minutes, N hours, N days, N weeks, N months, N years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ For example: 10 minutes, 5 hours, 8 days, 2 weeks, 8 months, 2021-12-31, 01 Mar 2021, 01 Feb 2021 04:45:33, 2022-04-17T14:05:44Z defaultvalue: 3 days display: First fetch time name: first_fetch type: 0 section: Collect required: false - defaultvalue: '100' display: How many incidents to fetch each time name: max_fetch type: 0 section: Collect - additionalinfo: Select Chronicle alert type to create an actionable incident. Available options are IOC Domain matches(Default), Assets with alerts, Curated Rule Detection alerts, Detection alerts and User alerts. defaultvalue: IOC Domain matches display: Chronicle Alert Type (Select the type of data to consider for fetch incidents). name: backstory_alert_type options: - IOC Domain matches - Assets with alerts - Curated Rule Detection alerts - Detection alerts - User alerts type: 15 section: Collect advanced: true required: false - display: Select the severity of alerts to be filtered for Fetch Incidents. Available options are 'High', 'Medium', 'Low' and 'Unspecified' (If not selected, fetches all alerts). name: incident_severity options: - High - Medium - Low - Unspecified type: 15 section: Collect advanced: true - additionalinfo: 'Fetches detection by either Rule ID (format: ru_{UUID}) or Version ID (format: {ruleId}@v_{int64}_{int64}). Enter in a comma-separated format to add multiples. Entered rules have precedence over the "Fetch all rules detections" checkbox. This parameter is mandatory when fetching Curated Rule Detection alerts.' display: Detections to fetch by Rule ID or Version ID name: fetch_detection_by_ids type: 0 section: Collect advanced: true - additionalinfo: Fetch detections for all versions of all the rules. This parameter will not be applicable when fetching Curated Rule Detection alerts. display: Fetch all rules detections name: fetch_all_detections type: 8 section: Collect advanced: true required: false - additionalinfo: Select the alert state to filter the detections to be fetched using fetch incidents. Available options are 'ALERTING' and 'NOT_ALERTING' (Default-No Selection). display: Filter detections by alert state name: fetch_detection_by_alert_state options: - ALERTING - NOT_ALERTING type: 15 section: Collect advanced: true required: false - additionalinfo: Select the time window to query Chronicle. While selecting the time window consider the time delay for an event to appear in Chronicle after generation. Available options are 15 (Default), 30, 45 and 60. This parameter is not applied when "IOC Domain matches" Chronicle Alert Type is selected. Don't touch unless you're missing alerts. defaultvalue: '15' display: Time window (in minutes) name: time_window options: - '15' - '30' - '45' - '60' type: 15 section: Collect advanced: true - additionalinfo: Sort detections by "DETECTION_TIME" or by "CREATED_TIME". If not specified, it defaults to "CREATED_TIME". This configuration is applicable to "Detection alerts" and "Curated Rule Detection alerts" only. defaultvalue: CREATED_TIME display: List Basis name: fetch_detection_by_list_basis options: - CREATED_TIME - DETECTION_TIME type: 15 section: Collect advanced: true required: false - display: Trust any certificate (not secure) name: insecure type: 8 section: Connect advanced: true required: false - display: Use system proxy settings name: proxy type: 8 section: Connect advanced: true required: false - additionalinfo: Reliability of the source providing the intelligence data. defaultvalue: B - Usually reliable display: Source Reliability name: integrationReliability options: - A+ - 3rd party enrichment - A - Completely reliable - B - Usually reliable - C - Fairly reliable - D - Not usually reliable - E - Unreliable - F - Reliability cannot be judged type: 15 section: Collect required: false - defaultvalue: indicatorType name: feedExpirationPolicy display: '' options: - never - interval - indicatorType - suddenDeath type: 17 section: Collect advanced: true required: false - defaultvalue: '20160' name: feedExpirationInterval display: '' type: 1 section: Collect advanced: true required: false description: Use the Chronicle integration to retrieve Asset alerts or IOC Domain matches as Incidents. Use it to fetch a list of infected assets based on the indicator accessed. This integration also provides reputation and threat enrichment of indicators observed in the enterprise. display: Chronicle name: Google Chronicle Backstory script: commands: - arguments: - auto: PREDEFINED description: Fetches IOC Domain matches in the specified time interval. If configured, overrides the start_time argument. name: preset_time_range predefined: - Last 1 day - Last 7 days - Last 15 days - Last 30 days - description: 'The value of the start time for your request, in RFC 3339 format (e.g. 2002-10-02T15:00:00Z) or relative time. If not supplied, the default is the UTC time corresponding to 3 days earlier than current time. Formats: YYYY-MM-ddTHH:mm:ssZ, YYYY-MM-dd, N days, N hours. Example: 2020-05-01T00:00:00Z, 2020-05-01, 2 days, 5 hours, 01 Mar 2021, 01 Feb 2021 04:45:33, 15 Jun.' name: start_time - defaultValue: '10000' description: The maximum number of IOCs to return. You can specify between 1 and 10000. name: page_size description: Lists the IOC Domain matches within your enterprise for the specified time interval. The indicator of compromise (IOC) domain matches lists for which the domains that your security infrastructure has flagged as both suspicious and that have been seen recently within your enterprise. name: gcb-list-iocs outputs: - contextPath: Domain.Name description: The domain name of the artifact. type: String - contextPath: GoogleChronicleBackstory.Iocs.Artifact description: The Indicator artifact. type: String - contextPath: GoogleChronicleBackstory.Iocs.IocIngestTime description: Time(UTC) the IOC was first seen by Chronicle. type: Date - contextPath: GoogleChronicleBackstory.Iocs.FirstAccessedTime description: Time(UTC) the artifact was first seen within your enterprise. type: Date - contextPath: GoogleChronicleBackstory.Iocs.LastAccessedTime description: Time(UTC) the artifact was most recently seen within your enterprise. type: Date - contextPath: GoogleChronicleBackstory.Iocs.Sources.Category description: Source Category represents the behavior of the artifact. type: String - contextPath: GoogleChronicleBackstory.Iocs.Sources.IntRawConfidenceScore description: The numeric confidence score of the IOC reported by the source. type: Number - contextPath: GoogleChronicleBackstory.Iocs.Sources.NormalizedConfidenceScore description: The normalized confidence score of the IOC reported by the source. type: String - contextPath: GoogleChronicleBackstory.Iocs.Sources.RawSeverity description: The severity of the IOC as reported by the source. type: String - contextPath: GoogleChronicleBackstory.Iocs.Sources.Source description: The source that reported the IOC. type: String - arguments: - default: true description: ' The artifact indicator associated with assets. The artifact type can be one of the following: IP, Domain, MD5, SHA1, or SHA256. ' name: artifact_value required: true - auto: PREDEFINED description: Fetches assets that accessed the artifact during the interval specified. If configured, overrides the start_time and end_time arguments. name: preset_time_range predefined: - Last 1 day - Last 7 days - Last 15 days - Last 30 days - description: 'The value of the start time for your request, in RFC 3339 format (e.g. 2002-10-02T15:00:00Z) or relative time. If not supplied, the default is the UTC time corresponding to 3 days earlier than current time. Formats: YYYY-MM-ddTHH:mm:ssZ, YYYY-MM-dd, N days, N hours. Example: 2020-05-01T00:00:00Z, 2020-05-01, 2 days, 5 hours, 01 Mar 2021, 01 Feb 2021 04:45:33, 15 Jun.' name: start_time - description: 'The value of the end time for your request, in RFC 3339 format (e.g. 2002-10-02T15:00:00Z) or relative time. If not supplied, the default is current UTC time. Formats: YYYY-MM-ddTHH:mm:ssZ, YYYY-MM-dd, N days, N hours. Example: 2020-05-01T00:00:00Z, 2020-05-01, 2 days, 5 hours, 01 Mar 2021, 01 Feb 2021 04:45:33, 15 Jun.' name: end_time - defaultValue: '10000' description: The maximum number of IOCs to return. You can specify between 1 and 10000. name: page_size description: Returns a list of the assets that accessed the input artifact (IP, domain, MD5, SHA1 and SHA256) during the specified time. name: gcb-assets outputs: - contextPath: GoogleChronicleBackstory.Asset.HostName description: The hostname of the asset that accessed the artifact. type: String - contextPath: GoogleChronicleBackstory.Asset.IpAddress description: The IP address of the asset that accessed the artifact. type: String - contextPath: GoogleChronicleBackstory.Asset.MacAddress description: The MAC address of the asset that accessed the artifact. type: String - contextPath: GoogleChronicleBackstory.Asset.ProductId description: The Product ID of the asset that accessed the artifact. type: String - contextPath: GoogleChronicleBackstory.Asset.AccessedDomain description: The domain artifact accessed by the asset. type: String - contextPath: GoogleChronicleBackstory.Asset.AccessedIP description: The IP address artifact accessed by the asset. type: String - contextPath: GoogleChronicleBackstory.Asset.AccessedMD5 description: The MD5 file hash artifact accessed by the asset. type: String - contextPath: GoogleChronicleBackstory.Asset.AccessedSHA1 description: The SHA1 file hash artifact accessed by the asset. type: String - contextPath: GoogleChronicleBackstory.Asset.AccessedSHA256 description: The SHA256 file hash artifact accessed by the asset. type: String - contextPath: GoogleChronicleBackstory.Asset.FirstAccessedTime description: The time when the asset first accessed the artifact. type: Date - contextPath: GoogleChronicleBackstory.Asset.LastAccessedTime description: The time when the asset last accessed the artifact. type: Date - contextPath: Host.Hostname description: The hostname of the asset that accessed the artifact. type: String - contextPath: Host.ID description: The Product ID of the asset that accessed the artifact. type: String - contextPath: Host.IP description: The IP address of the asset that accessed the artifact. type: String - contextPath: Host.MACAddress description: The MAC address of the asset that accessed the artifact. type: String - arguments: - default: true description: The IP address to check. isArray: true name: ip required: true description: Checks the reputation of an IP address. name: ip outputs: - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: DBotScore.Score description: 'The actual score.' type: Number - contextPath: IP.Address description: The IP address of the artifact. type: String - contextPath: IP.Malicious.Vendor description: For malicious IPs, the vendor that made the decision. type: String - contextPath: IP.Malicious.Description description: For malicious IPs, the reason that the vendor made the decision. type: String - contextPath: GoogleChronicleBackstory.IP.IoCQueried description: The artifact that was queried. type: String - contextPath: GoogleChronicleBackstory.IP.Sources.Address.IpAddress description: The IP address of the artifact. type: String - contextPath: GoogleChronicleBackstory.IP.Sources.Address.Domain description: The domain name of the artifact. type: String - contextPath: GoogleChronicleBackstory.IP.Sources.Address.Port description: The port numbers of the artifact. type: Unknown - contextPath: GoogleChronicleBackstory.IP.Sources.Category description: The behavior of the artifact. type: String - contextPath: GoogleChronicleBackstory.IP.Sources.ConfidenceScore description: The confidence score indicating the accuracy and appropriateness of the assigned category. type: Number - contextPath: GoogleChronicleBackstory.IP.Sources.FirstAccessedTime description: The time the IOC was first accessed within the enterprise. type: Date - contextPath: GoogleChronicleBackstory.IP.Sources.LastAccessedTime description: The time the IOC was most recently seen within your enterprise. type: Date - contextPath: GoogleChronicleBackstory.IP.Sources.Severity description: Impact of the artifact on the enterprise. type: String - arguments: - default: true description: The domain name to check. isArray: true name: domain required: true description: Checks the reputation of a domain. name: domain outputs: - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: DBotScore.Score description: 'The actual score.' type: Number - contextPath: Domain.Name description: The domain name of the artifact. type: String - contextPath: Domain.Malicious.Vendor description: For malicious domains, the vendor that made the decision. type: String - contextPath: Domain.Malicious.Description description: For malicious domains, the reason that the vendor made the decision. type: String - contextPath: GoogleChronicleBackstory.Domain.IoCQueried description: The domain that queried. type: String - contextPath: GoogleChronicleBackstory.Domain.Sources.Address.IpAddress description: The IP address of the artifact. type: String - contextPath: GoogleChronicleBackstory.Domain.Sources.Address.Domain description: The domain name of the artifact. type: String - contextPath: GoogleChronicleBackstory.Domain.Sources.Address.Port description: The port numbers of the artifact. type: Unknown - contextPath: GoogleChronicleBackstory.Domain.Sources.Category description: The behavior of the artifact. type: String - contextPath: GoogleChronicleBackstory.Domain.Sources.ConfidenceScore description: The confidence score indicating the accuracy and appropriateness of the assigned category. type: Number - contextPath: GoogleChronicleBackstory.Domain.Sources.FirstAccessedTime description: The time the IOC was first accessed within the enterprise. type: Date - contextPath: GoogleChronicleBackstory.Domain.Sources.LastAccessedTime description: The time the IOC was most recently seen within your enterprise. type: Date - contextPath: GoogleChronicleBackstory.Domain.Sources.Severity description: Impact of the artifact on the enterprise. type: String - arguments: - description: The artifact indicator value. The supported artifact types are IP and domain. name: artifact_value required: true description: Accepts an artifact indicator and returns any threat intelligence associated with the artifact. The threat intelligence information is drawn from your enterprise security systems and from Chronicle's IoC partners (for example, the DHS threat feed). name: gcb-ioc-details outputs: - contextPath: Domain.Name description: The domain name of the artifact. type: String - contextPath: IP.Address description: The IP address of the of the artifact. type: String - contextPath: GoogleChronicleBackstory.IocDetails.IoCQueried description: The artifact entered by the user. type: String - contextPath: GoogleChronicleBackstory.IocDetails.Sources.Address.IpAddress description: The IP address of the artifact. type: String - contextPath: GoogleChronicleBackstory.IocDetails.Sources.Address.Domain description: The domain name of the artifact. type: String - contextPath: GoogleChronicleBackstory.IocDetails.Sources.Address.Port description: The port numbers of the artifact. type: Unknown - contextPath: GoogleChronicleBackstory.IocDetails.Sources.Category description: The behavior of the artifact. type: String - contextPath: GoogleChronicleBackstory.IocDetails.Sources.ConfidenceScore description: The confidence score indicating the accuracy and appropriateness of the assigned category. type: Number - contextPath: GoogleChronicleBackstory.IocDetails.Sources.FirstAccessedTime description: The time the IOC was first accessed within the enterprise. type: Date - contextPath: GoogleChronicleBackstory.IocDetails.Sources.LastAccessedTime description: The time the IOC was most recently seen within your enterprise. type: Date - contextPath: GoogleChronicleBackstory.IocDetails.Sources.Severity description: Impact of the artifact on the enterprise. type: String - arguments: - auto: PREDEFINED description: Fetch alerts for the specified time range. If preset_time_range is configured, overrides the start_time and end_time arguments. name: preset_time_range predefined: - Last 1 day - Last 7 days - Last 15 days - Last 30 days - description: 'The value of the start time for your request, in RFC 3339 format (e.g. 2002-10-02T15:00:00Z) or relative time. If not supplied, the default is the UTC time corresponding to 3 days earlier than current time. Formats: YYYY-MM-ddTHH:mm:ssZ, YYYY-MM-dd, N days, N hours. Example: 2020-05-01T00:00:00Z, 2020-05-01, 2 days, 5 hours, 01 Mar 2021, 01 Feb 2021 04:45:33, 15 Jun.' name: start_time - description: 'The value of the end time for your request, in RFC 3339 format (e.g. 2002-10-02T15:00:00Z) or relative time. If not supplied, the default is current UTC time. Formats: YYYY-MM-ddTHH:mm:ssZ, YYYY-MM-dd, N days, N hours. Example: 2020-05-01T00:00:00Z, 2020-05-01, 2 days, 5 hours, 01 Mar 2021, 01 Feb 2021 04:45:33, 15 Jun.' name: end_time - defaultValue: '10000' description: The maximum number of IOCs to return. You can specify between 1 and 100000. name: page_size - auto: PREDEFINED description: The severity by which to filter the returned alerts. If not supplied, all alerts are fetched. This is applicable for asset alerts only. The possible values are "High", "Medium", "Low", or "Unspecified". name: severity predefined: - High - Medium - Low - Unspecified - auto: PREDEFINED defaultValue: Asset Alerts description: Specify which type of alerts you want. The possible values are "Asset Alerts" or "User Alerts". name: alert_type predefined: - Asset Alerts - User Alerts description: List all the alerts tracked within your enterprise for the specified time range. Both the parsed alerts and their corresponding raw alert logs are returned. name: gcb-list-alerts outputs: - contextPath: GoogleChronicleBackstory.Alert.AssetName description: The asset identifier. It can be IP Address, MAC Address, Hostname or Product ID. type: String - contextPath: GoogleChronicleBackstory.Alert.AlertInfo.Name description: The name of the alert. type: String - contextPath: GoogleChronicleBackstory.Alert.AlertInfo.Severity description: The severity of the alert. type: String - contextPath: GoogleChronicleBackstory.Alert.AlertInfo.SourceProduct description: The source of the alert. type: String - contextPath: GoogleChronicleBackstory.Alert.AlertInfo.Timestamp description: The time of the alert in Chronicle. type: String - contextPath: GoogleChronicleBackstory.Alert.AlertCounts description: The total number of alerts. type: Number - contextPath: GoogleChronicleBackstory.UserAlert.User description: The user identifier. It can be username or email address. type: String - contextPath: GoogleChronicleBackstory.UserAlert.AlertInfo.Name description: The name of the user alert. type: String - contextPath: GoogleChronicleBackstory.UserAlert.AlertInfo.SourceProduct description: The source of the user alert. type: String - contextPath: GoogleChronicleBackstory.UserAlert.AlertInfo.Timestamp description: The time of the user alert in Chronicle. type: String - contextPath: GoogleChronicleBackstory.UserAlert.AlertInfo.RawLog description: The raw log of the user alert. type: String - contextPath: GoogleChronicleBackstory.UserAlert.AlertCounts description: The total number of user alerts. type: Number - arguments: - auto: PREDEFINED description: Specify the identifier type of the asset you are investigating. The possible values are Host Name, IP Address, MAC Address or Product ID. name: asset_identifier_type predefined: - Host Name - IP Address - MAC Address - Product ID required: true - description: Value of the asset identifier. name: asset_identifier required: true - auto: PREDEFINED description: Get events that are discovered during the interval specified. If configured, overrides the start_time and end_time arguments. name: preset_time_range predefined: - Last 1 day - Last 7 days - Last 15 days - Last 30 days - description: ' The value of the start time for your request. The format of Date should comply with RFC 3339 (e.g. 2002-10-02T15:00:00Z) or relative time. If not supplied, the product considers UTC time corresponding to 2 hours earlier than current time. Formats: YYYY-MM-ddTHH:mm:ssZ, YYYY-MM-dd, N days, N hours. Example: 2020-05-01T00:00:00Z, 2020-05-01, 2 days, 5 hours, 01 Mar 2021, 01 Feb 2021 04:45:33, 15 Jun.' name: start_time - description: 'The value of the end time for your request. The format of Date should comply with RFC 3339 (e.g. 2002-10-02T15:00:00Z) or relative time. If not supplied, the product considers current UTC time. Formats: YYYY-MM-ddTHH:mm:ssZ, YYYY-MM-dd, N days, N hours. Example: 2020-05-01T00:00:00Z, 2020-05-01, 2 days, 5 hours, 01 Mar 2021, 01 Feb 2021 04:45:33, 15 Jun.' name: end_time - defaultValue: '10000' description: Specify the maximum number of events to fetch. You can specify between 1 and 10000. name: page_size - description: 'Specify the reference time for the asset you are investigating, in RFC 3339 format (e.g. 2002-10-02T15:00:00Z) or relative time. If not supplied, the product considers start time as reference time. Formats: YYYY-MM-ddTHH:mm:ssZ, YYYY-MM-dd, N days, N hours. Example: 2020-05-01T00:00:00Z, 2020-05-01, 2 days, 5 hours, 01 Mar 2021, 01 Feb 2021 04:45:33, 15 Jun.' name: reference_time description: List all of the events discovered within your enterprise on a particular device within the specified time range. If you receive the maximum number of events you specified using the page_size parameter (or 100, the default), there might still be more events within your Chronicle account. You can narrow the time range and issue the call again to ensure you have visibility into all possible events. This command returns more than 60 different types of events. Any event would have only specific output context set. Refer the UDM documentation to figure out the output properties specific to the event types. name: gcb-list-events outputs: - contextPath: GoogleChronicleBackstory.Events.eventType description: Specifies the type of the event. type: String - contextPath: GoogleChronicleBackstory.Events.eventTimestamp description: The GMT timestamp when the event was generated. type: Date - contextPath: GoogleChronicleBackstory.Events.collectedTimestamp description: The GMT timestamp when the event was collected by the vendor's local collection infrastructure. type: Date - contextPath: GoogleChronicleBackstory.Events.description description: Human-readable description of the event. type: String - contextPath: GoogleChronicleBackstory.Events.productEventType description: Short, descriptive, human-readable, and product-specific event name or type. type: String - contextPath: GoogleChronicleBackstory.Events.productLogId description: A vendor-specific event identifier to uniquely identify the event (a GUID). Users might use this identifier to search the vendor's proprietary console for the event in question. type: String - contextPath: GoogleChronicleBackstory.Events.productName description: Specifies the name of the product. type: String - contextPath: GoogleChronicleBackstory.Events.productVersion description: Specifies the version of the product. type: String - contextPath: GoogleChronicleBackstory.Events.urlBackToProduct description: URL linking to a relevant website where you can view more information about this specific event or the general event category. type: String - contextPath: GoogleChronicleBackstory.Events.vendorName description: Specifies the product vendor's name. type: String - contextPath: GoogleChronicleBackstory.Events.principal.assetId description: Vendor-specific unique device identifier. type: String - contextPath: GoogleChronicleBackstory.Events.principal.email description: Email address. type: String - contextPath: GoogleChronicleBackstory.Events.principal.hostname description: Client hostname or domain name field. type: String - contextPath: GoogleChronicleBackstory.Events.principal.platform description: Platform operating system. type: String - contextPath: GoogleChronicleBackstory.Events.principal.platformPatchLevel description: Platform operating system patch level. type: String - contextPath: GoogleChronicleBackstory.Events.principal.platformVersion description: Platform operating system version. type: String - contextPath: GoogleChronicleBackstory.Events.principal.ip description: IP address associated with a network connection. type: String - contextPath: GoogleChronicleBackstory.Events.principal.port description: Source or destination network port number when a specific network connection is described within an event. type: String - contextPath: GoogleChronicleBackstory.Events.principal.mac description: MAC addresses associated with a device. type: String - contextPath: GoogleChronicleBackstory.Events.principal.administrativeDomain description: Domain which the device belongs to (for example, the Windows domain). type: String - contextPath: GoogleChronicleBackstory.Events.principal.url description: Standard URL. type: String - contextPath: GoogleChronicleBackstory.Events.principal.file.fileMetadata description: Metadata associated with the file. type: String - contextPath: GoogleChronicleBackstory.Events.principal.file.fullPath description: Full path identifying the location of the file on the system. type: String - contextPath: GoogleChronicleBackstory.Events.principal.file.md5 description: MD5 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.principal.file.mimeType description: Multipurpose Internet Mail Extensions (MIME) type of the file. type: String - contextPath: GoogleChronicleBackstory.Events.principal.file.sha1 description: SHA-1 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.principal.file.sha256 description: SHA-256 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.principal.file.size description: Size of the file. type: String - contextPath: GoogleChronicleBackstory.Events.principal.process.commandLine description: Stores the command line string for the process. type: String - contextPath: GoogleChronicleBackstory.Events.principal.process.productSpecificProcessId description: Stores the product specific process ID. type: String - contextPath: GoogleChronicleBackstory.Events.principal.process.productSpecificParentProcessId description: Stores the product specific process ID for the parent process. type: String - contextPath: GoogleChronicleBackstory.Events.principal.process.file description: Stores the file name of the file in use by the process. type: String - contextPath: GoogleChronicleBackstory.Events.principal.process.file.fileMetadata description: Metadata associated with the file. type: String - contextPath: GoogleChronicleBackstory.Events.principal.process.file.fullPath description: Full path identifying the location of the file on the system. type: String - contextPath: GoogleChronicleBackstory.Events.principal.process.file.md5 description: MD5 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.principal.process.file.mimeType description: Multipurpose Internet Mail Extensions (MIME) type of the file. type: String - contextPath: GoogleChronicleBackstory.Events.principal.process.file.sha1 description: SHA-1 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.principal.process.file.sha256 description: SHA-256 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.principal.process.file.size description: Size of the file. type: String - contextPath: GoogleChronicleBackstory.Events.principal.process.parentPid description: Stores the process ID for the parent process. type: String - contextPath: GoogleChronicleBackstory.Events.principal.process.pid description: Stores the process ID. type: String - contextPath: GoogleChronicleBackstory.Events.principal.registry.registryKey description: Stores the registry key associated with an application or system component. type: String - contextPath: GoogleChronicleBackstory.Events.principal.registry.registryValueName description: Stores the name of the registry value associated with an application or system component. type: String - contextPath: GoogleChronicleBackstory.Events.principal.registry.registryValueData description: Stores the data associated with a registry value. type: String - contextPath: GoogleChronicleBackstory.Events.principal.user.emailAddresses description: Stores the email addresses for the user. type: String - contextPath: GoogleChronicleBackstory.Events.principal.user.employeeId description: Stores the human resources employee ID for the user. type: String - contextPath: GoogleChronicleBackstory.Events.principal.user.firstName description: Stores the first name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.principal.user.middleName description: Stores the middle name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.principal.user.lastName description: Stores the last name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.principal.user.groupid description: Stores the group ID associated with a user. type: String - contextPath: GoogleChronicleBackstory.Events.principal.user.phoneNumbers description: Stores the phone numbers for the user. type: String - contextPath: GoogleChronicleBackstory.Events.principal.user.title description: Stores the job title for the user. type: String - contextPath: GoogleChronicleBackstory.Events.principal.user.userDisplayName description: Stores the display name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.principal.user.userid description: Stores the user ID. type: String - contextPath: GoogleChronicleBackstory.Events.principal.user.windowsSid description: Stores the Microsoft Windows security identifier (SID) associated with a user. type: String - contextPath: GoogleChronicleBackstory.Events.target.assetId description: Vendor-specific unique device identifier. type: String - contextPath: GoogleChronicleBackstory.Events.target.email description: Email address. type: String - contextPath: GoogleChronicleBackstory.Events.target.hostname description: Client hostname or domain name field. type: String - contextPath: GoogleChronicleBackstory.Events.target.platform description: Platform operating system. type: String - contextPath: GoogleChronicleBackstory.Events.target.platformPatchLevel description: Platform operating system patch level. type: String - contextPath: GoogleChronicleBackstory.Events.target.platformVersion description: Platform operating system version. type: String - contextPath: GoogleChronicleBackstory.Events.target.ip description: IP address associated with a network connection. type: String - contextPath: GoogleChronicleBackstory.Events.target.port description: Source or destination network port number when a specific network connection is described within an event. type: String - contextPath: GoogleChronicleBackstory.Events.target.mac description: One or more MAC addresses associated with a device. type: String - contextPath: GoogleChronicleBackstory.Events.target.administrativeDomain description: Domain which the device belongs to (for example, the Windows domain). type: String - contextPath: GoogleChronicleBackstory.Events.target.url description: Standard URL. type: String - contextPath: GoogleChronicleBackstory.Events.target.file.fileMetadata description: Metadata associated with the file. type: String - contextPath: GoogleChronicleBackstory.Events.target.file.fullPath description: Full path identifying the location of the file on the system. type: String - contextPath: GoogleChronicleBackstory.Events.target.file.md5 description: MD5 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.target.file.mimeType description: Multipurpose Internet Mail Extensions (MIME) type of the file. type: String - contextPath: GoogleChronicleBackstory.Events.target.file.sha1 description: SHA-1 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.target.file.sha256 description: SHA-256 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.target.file.size description: Size of the file. type: String - contextPath: GoogleChronicleBackstory.Events.target.process.commandLine description: Stores the command line string for the process. type: String - contextPath: GoogleChronicleBackstory.Events.target.process.productSpecificProcessId description: Stores the product specific process ID. type: String - contextPath: GoogleChronicleBackstory.Events.target.process.productSpecificParentProcessId description: Stores the product specific process ID for the parent process. type: String - contextPath: GoogleChronicleBackstory.Events.target.process.file description: Stores the file name of the file in use by the process. type: String - contextPath: GoogleChronicleBackstory.Events.target.process.file.fileMetadata description: Metadata associated with the file. type: String - contextPath: GoogleChronicleBackstory.Events.target.process.file.fullPath description: Full path identifying the location of the file on the system. type: String - contextPath: GoogleChronicleBackstory.Events.target.process.file.md5 description: MD5 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.target.process.file.mimeType description: Multipurpose Internet Mail Extensions (MIME) type of the file. type: String - contextPath: GoogleChronicleBackstory.Events.target.process.file.sha1 description: SHA-1 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.target.process.file.sha256 description: SHA-256 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.target.process.file.size description: Size of the file. type: String - contextPath: GoogleChronicleBackstory.Events.target.process.parentPid description: Stores the process ID for the parent process. type: String - contextPath: GoogleChronicleBackstory.Events.target.process.pid description: Stores the process ID. type: String - contextPath: GoogleChronicleBackstory.Events.target.registry.registryKey description: Stores the registry key associated with an application or system component. type: String - contextPath: GoogleChronicleBackstory.Events.target.registry.registryValueName description: Stores the name of the registry value associated with an application or system component. type: String - contextPath: GoogleChronicleBackstory.Events.target.registry.registryValueData description: Stores the data associated with a registry value. type: String - contextPath: GoogleChronicleBackstory.Events.target.user.emailAddresses description: Stores the email addresses for the user. type: String - contextPath: GoogleChronicleBackstory.Events.target.user.employeeId description: Stores the human resources employee ID for the user. type: String - contextPath: GoogleChronicleBackstory.Events.target.user.firstName description: Stores the first name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.target.user.middleName description: Stores the middle name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.target.user.lastName description: Stores the last name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.target.user.groupid description: Stores the group ID associated with a user. type: String - contextPath: GoogleChronicleBackstory.Events.target.user.phoneNumbers description: Stores the phone numbers for the user. type: String - contextPath: GoogleChronicleBackstory.Events.target.user.title description: Stores the job title for the user. type: String - contextPath: GoogleChronicleBackstory.Events.target.user.userDisplayName description: Stores the display name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.target.user.userid description: Stores the user ID. type: String - contextPath: GoogleChronicleBackstory.Events.target.user.windowsSid description: Stores the Microsoft Windows security identifier (SID) associated with a user. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.assetId description: Vendor-specific unique device identifier. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.email description: Email address. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.hostname description: Client hostname or domain name field. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.platform description: Platform operating system. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.platformPatchLevel description: Platform operating system patch level. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.platformVersion description: Platform operating system version. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.ip description: IP address associated with a network connection. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.port description: Source or destination network port number when a specific network connection is described within an event. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.mac description: One or more MAC addresses associated with a device. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.administrativeDomain description: Domain which the device belongs to (for example, the Windows domain). type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.url description: Standard URL. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.file.fileMetadata description: Metadata associated with the file. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.file.fullPath description: Full path identifying the location of the file on the system. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.file.md5 description: MD5 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.file.mimeType description: Multipurpose Internet Mail Extensions (MIME) type of the file. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.file.sha1 description: SHA-1 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.file.sha256 description: SHA-256 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.file.size description: Size of the file. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.process.commandLine description: Stores the command line string for the process. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.process.productSpecificProcessId description: Stores the product specific process ID. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.process.productSpecificParentProcessId description: Stores the product specific process ID for the parent process. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.process.file description: Stores the file name of the file in use by the process. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.process.file.fileMetadata description: Metadata associated with the file. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.process.file.fullPath description: Full path identifying the location of the file on the system. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.process.file.md5 description: MD5 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.process.file.mimeType description: Multipurpose Internet Mail Extensions (MIME) type of the file. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.process.file.sha1 description: SHA-1 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.process.file.sha256 description: SHA-256 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.process.file.size description: Size of the file. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.process.parentPid description: Stores the process ID for the parent process. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.process.pid description: Stores the process ID. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.registry.registryKey description: Stores the registry key associated with an application or system component. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.registry.registryValueName description: Stores the name of the registry value associated with an application or system component. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.registry.registryValueData description: Stores the data associated with a registry value. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.user.emailAddresses description: Stores the email addresses for the user. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.user.employeeId description: Stores the human resources employee ID for the user. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.user.firstName description: Stores the first name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.user.middleName description: Stores the middle name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.user.lastName description: Stores the last name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.user.groupid description: Stores the group ID associated with a user. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.user.phoneNumbers description: Stores the phone numbers for the user. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.user.title description: Stores the job title for the user. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.user.userDisplayName description: Stores the display name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.user.userid description: Stores the user ID. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.user.windowsSid description: Stores the Microsoft Windows security identifier (SID) associated with a user. type: String - contextPath: GoogleChronicleBackstory.Events.src.assetId description: Vendor-specific unique device identifier. type: String - contextPath: GoogleChronicleBackstory.Events.src.email description: Email address. type: String - contextPath: GoogleChronicleBackstory.Events.src.hostname description: Client hostname or domain name field. type: String - contextPath: GoogleChronicleBackstory.Events.src.platform description: Platform operating system. type: String - contextPath: GoogleChronicleBackstory.Events.src.platformPatchLevel description: Platform operating system patch level. type: String - contextPath: GoogleChronicleBackstory.Events.src.platformVersion description: Platform operating system version. type: String - contextPath: GoogleChronicleBackstory.Events.src.ip description: IP address associated with a network connection. type: String - contextPath: GoogleChronicleBackstory.Events.src.port description: Source or destination network port number when a specific network connection is described within an event. type: String - contextPath: GoogleChronicleBackstory.Events.src.mac description: One or more MAC addresses associated with a device. type: String - contextPath: GoogleChronicleBackstory.Events.src.administrativeDomain description: Domain which the device belongs to (for example, the Windows domain). type: String - contextPath: GoogleChronicleBackstory.Events.src.url description: Standard URL. type: String - contextPath: GoogleChronicleBackstory.Events.src.file.fileMetadata description: Metadata associated with the file. type: String - contextPath: GoogleChronicleBackstory.Events.src.file.fullPath description: Full path identifying the location of the file on the system. type: String - contextPath: GoogleChronicleBackstory.Events.src.file.md5 description: MD5 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.src.file.mimeType description: Multipurpose Internet Mail Extensions (MIME) type of the file. type: String - contextPath: GoogleChronicleBackstory.Events.src.file.sha1 description: SHA-1 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.src.file.sha256 description: SHA-256 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.src.file.size description: Size of the file. type: String - contextPath: GoogleChronicleBackstory.Events.src.process.commandLine description: Stores the command line string for the process. type: String - contextPath: GoogleChronicleBackstory.Events.src.process.productSpecificProcessId description: Stores the product specific process ID. type: String - contextPath: GoogleChronicleBackstory.Events.src.process.productSpecificParentProcessId description: Stores the product specific process ID for the parent process. type: String - contextPath: GoogleChronicleBackstory.Events.src.process.file description: Stores the file name of the file in use by the process. type: String - contextPath: GoogleChronicleBackstory.Events.src.process.file.fileMetadata description: Metadata associated with the file. type: String - contextPath: GoogleChronicleBackstory.Events.src.process.file.fullPath description: Full path identifying the location of the file on the system. type: String - contextPath: GoogleChronicleBackstory.Events.src.process.file.md5 description: MD5 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.src.process.file.mimeType description: Multipurpose Internet Mail Extensions (MIME) type of the file. type: String - contextPath: GoogleChronicleBackstory.Events.src.process.file.sha1 description: SHA-1 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.src.process.file.sha256 description: SHA-256 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.src.process.file.size description: Size of the file. type: String - contextPath: GoogleChronicleBackstory.Events.src.process.parentPid description: Stores the process ID for the parent process. type: String - contextPath: GoogleChronicleBackstory.Events.src.process.pid description: Stores the process ID. type: String - contextPath: GoogleChronicleBackstory.Events.src.registry.registryKey description: Stores the registry key associated with an application or system component. type: String - contextPath: GoogleChronicleBackstory.Events.src.registry.registryValueName description: Stores the name of the registry value associated with an application or system component. type: String - contextPath: GoogleChronicleBackstory.Events.src.registry.registryValueData description: Stores the data associated with a registry value. type: String - contextPath: GoogleChronicleBackstory.Events.src.user.emailAddresses description: Stores the email addresses for the user. type: String - contextPath: GoogleChronicleBackstory.Events.src.user.employeeId description: Stores the human resources employee ID for the user. type: String - contextPath: GoogleChronicleBackstory.Events.src.user.firstName description: Stores the first name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.src.user.middleName description: Stores the middle name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.src.user.lastName description: Stores the last name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.src.user.groupid description: Stores the group ID associated with a user. type: String - contextPath: GoogleChronicleBackstory.Events.src.user.phoneNumbers description: Stores the phone numbers for the user. type: String - contextPath: GoogleChronicleBackstory.Events.src.user.title description: Stores the job title for the user. type: String - contextPath: GoogleChronicleBackstory.Events.src.user.userDisplayName description: Stores the display name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.src.user.userid description: Stores the user ID. type: String - contextPath: GoogleChronicleBackstory.Events.src.user.windowsSid description: Stores the Microsoft Windows security identifier (SID) associated with a user. type: String - contextPath: GoogleChronicleBackstory.Events.observer.assetId description: Vendor-specific unique device identifier. type: String - contextPath: GoogleChronicleBackstory.Events.observer.email description: Email address. type: String - contextPath: GoogleChronicleBackstory.Events.observer.hostname description: Client hostname or domain name field. type: String - contextPath: GoogleChronicleBackstory.Events.observer.platform description: Platform operating system. type: String - contextPath: GoogleChronicleBackstory.Events.observer.platformPatchLevel description: Platform operating system patch level. type: String - contextPath: GoogleChronicleBackstory.Events.observer.platformVersion description: Platform operating system version. type: String - contextPath: GoogleChronicleBackstory.Events.observer.ip description: IP address associated with a network connection. type: String - contextPath: GoogleChronicleBackstory.Events.observer.port description: Source or destination network port number when a specific network connection is described within an event. type: String - contextPath: GoogleChronicleBackstory.Events.observer.mac description: One or more MAC addresses associated with a device. type: String - contextPath: GoogleChronicleBackstory.Events.observer.administrativeDomain description: Domain which the device belongs to (for example, the Windows domain). type: String - contextPath: GoogleChronicleBackstory.Events.observer.url description: Standard URL. type: String - contextPath: GoogleChronicleBackstory.Events.observer.file.fileMetadata description: Metadata associated with the file. type: String - contextPath: GoogleChronicleBackstory.Events.observer.file.fullPath description: Full path identifying the location of the file on the system. type: String - contextPath: GoogleChronicleBackstory.Events.observer.file.md5 description: MD5 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.observer.file.mimeType description: Multipurpose Internet Mail Extensions (MIME) type of the file. type: String - contextPath: GoogleChronicleBackstory.Events.observer.file.sha1 description: SHA-1 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.observer.file.sha256 description: SHA-256 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.observer.file.size description: Size of the file. type: String - contextPath: GoogleChronicleBackstory.Events.observer.process.commandLine description: Stores the command line string for the process. type: String - contextPath: GoogleChronicleBackstory.Events.observer.process.productSpecificProcessId description: Stores the product specific process ID. type: String - contextPath: GoogleChronicleBackstory.Events.observer.process.productSpecificParentProcessId description: Stores the product specific process ID for the parent process. type: String - contextPath: GoogleChronicleBackstory.Events.observer.process.file description: Stores the file name of the file in use by the process. type: String - contextPath: GoogleChronicleBackstory.Events.observer.process.file.fileMetadata description: Metadata associated with the file. type: String - contextPath: GoogleChronicleBackstory.Events.observer.process.file.fullPath description: Full path identifying the location of the file on the system. type: String - contextPath: GoogleChronicleBackstory.Events.observer.process.file.md5 description: MD5 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.observer.process.file.mimeType description: Multipurpose Internet Mail Extensions (MIME) type of the file. type: String - contextPath: GoogleChronicleBackstory.Events.observer.process.file.sha1 description: SHA-1 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.observer.process.file.sha256 description: SHA-256 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.observer.process.file.size description: Size of the file. type: String - contextPath: GoogleChronicleBackstory.Events.observer.process.parentPid description: Stores the process ID for the parent process. type: String - contextPath: GoogleChronicleBackstory.Events.observer.process.pid description: Stores the process ID. type: String - contextPath: GoogleChronicleBackstory.Events.observer.registry.registryKey description: Stores the registry key associated with an application or system component. type: String - contextPath: GoogleChronicleBackstory.Events.observer.registry.registryValueName description: Stores the name of the registry value associated with an application or system component. type: String - contextPath: GoogleChronicleBackstory.Events.observer.registry.registryValueData description: Stores the data associated with a registry value. type: String - contextPath: GoogleChronicleBackstory.Events.observer.user.emailAddresses description: Stores the email addresses for the user. type: String - contextPath: GoogleChronicleBackstory.Events.observer.user.employeeId description: Stores the human resources employee ID for the user. type: String - contextPath: GoogleChronicleBackstory.Events.observer.user.firstName description: Stores the first name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.observer.user.middleName description: Stores the middle name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.observer.user.lastName description: Stores the last name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.observer.user.groupid description: Stores the group ID associated with a user. type: String - contextPath: GoogleChronicleBackstory.Events.observer.user.phoneNumbers description: Stores the phone numbers for the user. type: String - contextPath: GoogleChronicleBackstory.Events.observer.user.title description: Stores the job title for the user. type: String - contextPath: GoogleChronicleBackstory.Events.observer.user.userDisplayName description: Stores the display name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.observer.user.userid description: Stores the user ID. type: String - contextPath: GoogleChronicleBackstory.Events.observer.user.windowsSid description: Stores the Microsoft Windows security identifier (SID) associated with a user. type: String - contextPath: GoogleChronicleBackstory.Events.about.assetId description: Vendor-specific unique device identifier. type: String - contextPath: GoogleChronicleBackstory.Events.about.email description: Email address. type: String - contextPath: GoogleChronicleBackstory.Events.about.hostname description: Client hostname or domain name field. type: String - contextPath: GoogleChronicleBackstory.Events.about.platform description: Platform operating system. type: String - contextPath: GoogleChronicleBackstory.Events.about.platformPatchLevel description: Platform operating system patch level. type: String - contextPath: GoogleChronicleBackstory.Events.about.platformVersion description: Platform operating system version. type: String - contextPath: GoogleChronicleBackstory.Events.about.ip description: IP address associated with a network connection. type: String - contextPath: GoogleChronicleBackstory.Events.about.port description: Source or destination network port number when a specific network connection is described within an event. type: String - contextPath: GoogleChronicleBackstory.Events.about.mac description: One or more MAC addresses associated with a device. type: String - contextPath: GoogleChronicleBackstory.Events.about.administrativeDomain description: Domain which the device belongs to (for example, the Windows domain). type: String - contextPath: GoogleChronicleBackstory.Events.about.url description: Standard URL. type: String - contextPath: GoogleChronicleBackstory.Events.about.file.fileMetadata description: Metadata associated with the file. type: String - contextPath: GoogleChronicleBackstory.Events.about.file.fullPath description: Full path identifying the location of the file on the system. type: String - contextPath: GoogleChronicleBackstory.Events.about.file.md5 description: MD5 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.about.file.mimeType description: Multipurpose Internet Mail Extensions (MIME) type of the file. type: String - contextPath: GoogleChronicleBackstory.Events.about.file.sha1 description: SHA-1 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.about.file.sha256 description: SHA-256 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.about.file.size description: Size of the file. type: String - contextPath: GoogleChronicleBackstory.Events.about.process.commandLine description: Stores the command line string for the process. type: String - contextPath: GoogleChronicleBackstory.Events.about.process.productSpecificProcessId description: Stores the product specific process ID. type: String - contextPath: GoogleChronicleBackstory.Events.about.process.productSpecificParentProcessId description: Stores the product specific process ID for the parent process. type: String - contextPath: GoogleChronicleBackstory.Events.about.process.file description: Stores the file name of the file in use by the process. type: String - contextPath: GoogleChronicleBackstory.Events.about.process.file.fileMetadata description: Metadata associated with the file. type: String - contextPath: GoogleChronicleBackstory.Events.about.process.file.fullPath description: Full path identifying the location of the file on the system. type: String - contextPath: GoogleChronicleBackstory.Events.about.process.file.md5 description: MD5 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.about.process.file.mimeType description: Multipurpose Internet Mail Extensions (MIME) type of the file. type: String - contextPath: GoogleChronicleBackstory.Events.about.process.file.sha1 description: SHA-1 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.about.process.file.sha256 description: SHA-256 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.about.process.file.size description: Size of the file. type: String - contextPath: GoogleChronicleBackstory.Events.about.process.parentPid description: Stores the process ID for the parent process. type: String - contextPath: GoogleChronicleBackstory.Events.about.process.pid description: Stores the process ID. type: String - contextPath: GoogleChronicleBackstory.Events.about.registry.registryKey description: Stores the registry key associated with an application or system component. type: String - contextPath: GoogleChronicleBackstory.Events.about.registry.registryValueName description: Stores the name of the registry value associated with an application or system component. type: String - contextPath: GoogleChronicleBackstory.Events.about.registry.registryValueData description: Stores the data associated with a registry value. type: String - contextPath: GoogleChronicleBackstory.Events.about.user.emailAddresses description: Stores the email addresses for the user. type: String - contextPath: GoogleChronicleBackstory.Events.about.user.employeeId description: Stores the human resources employee ID for the user. type: String - contextPath: GoogleChronicleBackstory.Events.about.user.firstName description: Stores the first name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.about.user.middleName description: Stores the middle name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.about.user.lastName description: Stores the last name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.about.user.groupid description: Stores the group ID associated with a user. type: String - contextPath: GoogleChronicleBackstory.Events.about.user.phoneNumbers description: Stores the phone numbers for the user. type: String - contextPath: GoogleChronicleBackstory.Events.about.user.title description: Stores the job title for the user. type: String - contextPath: GoogleChronicleBackstory.Events.about.user.userDisplayName description: Stores the display name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.about.user.userid description: Stores the user ID. type: String - contextPath: GoogleChronicleBackstory.Events.about.user.windowsSid description: Stores the Microsoft Windows security identifier (SID) associated with a user. type: String - contextPath: GoogleChronicleBackstory.Events.network.applicationProtocol description: Indicates the network application protocol. type: String - contextPath: GoogleChronicleBackstory.Events.network.direction description: Indicates the direction of network traffic. type: String - contextPath: GoogleChronicleBackstory.Events.network.email description: Specifies the email address for the sender/recipient. type: String - contextPath: GoogleChronicleBackstory.Events.network.ipProtocol description: Indicates the IP protocol. type: String - contextPath: GoogleChronicleBackstory.Events.network.receivedBytes description: Specifies the number of bytes received. type: String - contextPath: GoogleChronicleBackstory.Events.network.sentBytes description: Specifies the number of bytes sent. type: String - contextPath: GoogleChronicleBackstory.Events.network.dhcp.clientHostname description: Hostname for the client. type: String - contextPath: GoogleChronicleBackstory.Events.network.dhcp.clientIdentifier description: Client identifier. type: String - contextPath: GoogleChronicleBackstory.Events.network.dhcp.file description: Filename for the boot image. type: String - contextPath: GoogleChronicleBackstory.Events.network.dhcp.flags description: Value for the DHCP flags field. type: String - contextPath: GoogleChronicleBackstory.Events.network.dhcp.hlen description: Hardware address length. type: String - contextPath: GoogleChronicleBackstory.Events.network.dhcp.hops description: DHCP hop count. type: String - contextPath: GoogleChronicleBackstory.Events.network.dhcp.htype description: Hardware address type. type: String - contextPath: GoogleChronicleBackstory.Events.network.dhcp.leaseTimeSeconds description: Client-requested lease time for an IP address in seconds. type: String - contextPath: GoogleChronicleBackstory.Events.network.dhcp.opcode description: BOOTP op code. type: String - contextPath: GoogleChronicleBackstory.Events.network.dhcp.requestedAddress description: Client identifier. type: String - contextPath: GoogleChronicleBackstory.Events.network.dhcp.seconds description: Seconds elapsed since the client began the address acquisition/renewal process. type: String - contextPath: GoogleChronicleBackstory.Events.network.dhcp.sname description: Name of the server which the client has requested to boot from. type: String - contextPath: GoogleChronicleBackstory.Events.network.dhcp.transactionId description: Client transaction ID. type: String - contextPath: GoogleChronicleBackstory.Events.network.dhcp.type description: DHCP message type. type: String - contextPath: GoogleChronicleBackstory.Events.network.dhcp.chaddr description: IP address for the client hardware. type: String - contextPath: GoogleChronicleBackstory.Events.network.dhcp.ciaddr description: IP address for the client. type: String - contextPath: GoogleChronicleBackstory.Events.network.dhcp.giaddr description: IP address for the relay agent. type: String - contextPath: GoogleChronicleBackstory.Events.network.dhcp.siaddr description: IP address for the next bootstrap server. type: String - contextPath: GoogleChronicleBackstory.Events.network.dhcp.yiaddr description: Your IP address. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.authoritative description: Set to true for authoritative DNS servers. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.id description: Stores the DNS query identifier. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.response description: Set to true if the event is a DNS response. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.opcode description: Stores the DNS OpCode used to specify the type of DNS query (standard, inverse, server status, etc.). type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.recursionAvailable description: Set to true if a recursive DNS lookup is available. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.recursionDesired description: Set to true if a recursive DNS lookup is requested. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.responseCode description: Stores the DNS response code as defined by RFC 1035, Domain Names - Implementation and Specification. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.truncated description: Set to true if this is a truncated DNS response. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.questions.name description: Stores the domain name. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.questions.class description: Stores the code specifying the class of the query. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.questions.type description: Stores the code specifying the type of the query. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.answers.binaryData description: Stores the raw bytes of any non-UTF8 strings that might be included as part of a DNS response. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.answers.class description: Stores the code specifying the class of the resource record. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.answers.data description: Stores the payload or response to the DNS question for all responses encoded in UTF-8 format. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.answers.name description: Stores the name of the owner of the resource record. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.answers.ttl description: Stores the time interval for which the resource record can be cached before the source of the information should again be queried. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.answers.type description: Stores the code specifying the type of the resource record. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.authority.binaryData description: Stores the raw bytes of any non-UTF8 strings that might be included as part of a DNS response. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.authority.class description: Stores the code specifying the class of the resource record. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.authority.data description: Stores the payload or response to the DNS question for all responses encoded in UTF-8 format. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.authority.name description: Stores the name of the owner of the resource record. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.authority.ttl description: Stores the time interval for which the resource record can be cached before the source of the information should again be queried. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.authority.type description: Stores the code specifying the type of the resource record. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.additional.binaryData description: Stores the raw bytes of any non-UTF8 strings that might be included as part of a DNS response. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.additional.class description: Stores the code specifying the class of the resource record. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.additional.data description: Stores the payload or response to the DNS question for all responses encoded in UTF-8 format. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.additional.name description: Stores the name of the owner of the resource record. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.additional.ttl description: Stores the time interval for which the resource record can be cached before the source of the information should again be queried. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.additional.type description: Stores the code specifying the type of the resource record. type: String - contextPath: GoogleChronicleBackstory.Events.network.email.from description: Stores the from email address. type: String - contextPath: GoogleChronicleBackstory.Events.network.email.replyTo description: Stores the reply_to email address. type: String - contextPath: GoogleChronicleBackstory.Events.network.email.to description: Stores the to email addresses. type: String - contextPath: GoogleChronicleBackstory.Events.network.email.cc description: Stores the cc email addresses. type: String - contextPath: GoogleChronicleBackstory.Events.network.email.bcc description: Stores the bcc email addresses. type: String - contextPath: GoogleChronicleBackstory.Events.network.email.mailId description: Stores the mail (or message) ID. type: String - contextPath: GoogleChronicleBackstory.Events.network.email.subject description: Stores the email subject line. type: String - contextPath: GoogleChronicleBackstory.Events.network.ftp.command description: Stores the FTP command. type: String - contextPath: GoogleChronicleBackstory.Events.network.http.method description: Stores the HTTP request method. type: String - contextPath: GoogleChronicleBackstory.Events.network.http.referralUrl description: Stores the URL for the HTTP referer. type: String - contextPath: GoogleChronicleBackstory.Events.network.http.responseCode description: Stores the HTTP response status code, which indicates whether a specific HTTP request has been successfully completed. type: String - contextPath: GoogleChronicleBackstory.Events.network.http.useragent description: Stores the User-Agent request header which includes the application type, operating system, software vendor or software version of the requesting software user agent. type: String - contextPath: GoogleChronicleBackstory.Events.authentication.authType description: Type of system an authentication event is associated with (Chronicle UDM). type: String - contextPath: GoogleChronicleBackstory.Events.authentication.mechanism description: Mechanism(s) used for authentication. type: String - contextPath: GoogleChronicleBackstory.Events.securityResult.about description: Provide a description of the security result. type: String - contextPath: GoogleChronicleBackstory.Events.securityResult.action description: Specify a security action. type: String - contextPath: GoogleChronicleBackstory.Events.securityResult.category description: Specify a security category. type: String - contextPath: GoogleChronicleBackstory.Events.securityResult.confidence description: Specify a confidence with regards to a security event as estimated by the product. type: String - contextPath: GoogleChronicleBackstory.Events.securityResult.confidenceDetails description: Additional detail with regards to the confidence of a security event as estimated by the product vendor. type: String - contextPath: GoogleChronicleBackstory.Events.securityResult.priority description: Specify a priority with regards to a security event as estimated by the product vendor. type: String - contextPath: GoogleChronicleBackstory.Events.securityResult.priorityDetails description: Vendor-specific information about the security result priority. type: String - contextPath: GoogleChronicleBackstory.Events.securityResult.ruleId description: Identifier for the security rule. type: String - contextPath: GoogleChronicleBackstory.Events.securityResult.ruleName description: Name of the security rule. type: String - contextPath: GoogleChronicleBackstory.Events.securityResult.severity description: Severity of a security event as estimated by the product vendor using values defined by the Chronicle UDM. type: String - contextPath: GoogleChronicleBackstory.Events.securityResult.severityDetails description: Severity for a security event as estimated by the product vendor. type: String - contextPath: GoogleChronicleBackstory.Events.securityResult.threatName description: Name of the security threat. type: String - contextPath: GoogleChronicleBackstory.Events.securityResult.urlBackToProduct description: URL to direct you to the source product console for this security event. type: String - arguments: - default: true description: |- Unique identifier for a rule or specific version of a rule, defined and returned by the server. You can specify exactly one rule identifier. Use the following format to specify the id: ru_{UUID} or {ruleId}@v_{int64}_{int64}. If not specified then detections for all versions of all rules are returned. name: id - description: |- (Deprecated: use `start_time` instead) Time to begin returning detections, filtering on a detection's "detectionTime". If not specified, the start time is treated as open-ended. Formats: YYYY-MM-ddTHH:mm:ssZ, YYYY-MM-dd, N days, N hours. Example: 2020-05-01T00:00:00Z, 2020-05-01, 2 days, 5 hours, 01 Mar 2021, 01 Feb 2021 04:45:33, 15 Jun. name: detection_start_time - description: |- (Deprecated: use `end_time` instead) Time to stop returning detections, filtering on a detection's "detectionTime". If not specified, the end time is treated as open-ended. Formats: YYYY-MM-ddTHH:mm:ssZ, YYYY-MM-dd, N days, N hours. Example: 2020-05-01T00:00:00Z, 2020-05-01, 2 days, 5 hours, 01 Mar 2021, 01 Feb 2021 04:45:33, 15 Jun. name: detection_end_time - auto: PREDEFINED description: |- Filter detections on if they are ALERTING or NOT_ALERTING. Avoid specifying to return all detections. name: alert_state predefined: - ALERTING - NOT_ALERTING - defaultValue: '100' description: Specify the limit on the number of detections to display. You can specify between 1 and 1000. name: page_size - description: A page token received from a previous call. Provide this to retrieve the subsequent page. If the page token is configured, overrides the detection start and end time arguments. name: page_token - auto: PREDEFINED defaultValue: 'False' description: |- Whether the user wants to retrieve detections for all versions of a rule with a given rule identifier. Note: If this option is set to true, rule id is required. name: detection_for_all_versions predefined: - 'True' - 'False' - auto: PREDEFINED description: |- Sort detections by "DETECTION_TIME" or by "CREATED_TIME". If not specified, it defaults to "DETECTION_TIME". Detections are returned in descending order of the timestamp. Note: Requires either "start_time" or "end_time" argument. name: list_basis predefined: - DETECTION_TIME - CREATED_TIME - description: |- Time to begin returning detections, filtering by the detection field specified in the listBasis parameter. If not specified, the start time is treated as open-ended. Formats: YYYY-MM-ddTHH:mm:ssZ, YYYY-MM-dd, N days, N hours. Example: 2020-05-01T00:00:00Z, 2020-05-01, 2 days, 5 hours, 01 Mar 2021, 01 Feb 2021 04:45:33, 15 Jun. name: start_time - description: |- Time to stop returning detections, filtering by the detection field specified by the listBasis parameter. If not specified, the end time is treated as open-ended. Formats: YYYY-MM-ddTHH:mm:ssZ, YYYY-MM-dd, N days, N hours. Example: 2020-05-01T00:00:00Z, 2020-05-01, 2 days, 5 hours, 01 Mar 2021, 01 Feb 2021 04:45:33, 15 Jun. name: end_time description: Return the detections for the specified version of a rule, the latest version of a rule, all versions of a rule, or all versions of all rules. name: gcb-list-detections outputs: - contextPath: GoogleChronicleBackstory.Detections.id description: Identifier for the detection. type: String - contextPath: GoogleChronicleBackstory.Detections.ruleId description: Identifier for the rule generating the detection. type: String - contextPath: GoogleChronicleBackstory.Detections.ruleVersion description: Identifier for the rule version generating the detection. type: String - contextPath: GoogleChronicleBackstory.Detections.ruleName description: Name of the rule generating the detection, as parsed from ruleText. type: String - contextPath: GoogleChronicleBackstory.Detections.timeWindowStartTime description: The start time of the window the detection was found in. type: Date - contextPath: GoogleChronicleBackstory.Detections.timeWindowEndTime description: The end time of the window the detection was found in. type: Date - contextPath: GoogleChronicleBackstory.Detections.alertState description: Indicates whether the rule generating this detection currently has alerting enabled or disabled. type: String - contextPath: GoogleChronicleBackstory.Detections.urlBackToProduct description: URL pointing to the Chronicle UI for this detection. type: String - contextPath: GoogleChronicleBackstory.Detections.type description: Type of detection. type: String - contextPath: GoogleChronicleBackstory.Detections.createdTime description: Time the detection was created. type: Date - contextPath: GoogleChronicleBackstory.Detections.detectionTime description: The time period the detection was found in. type: Date - contextPath: GoogleChronicleBackstory.Detections.ruleType description: Whether the rule generating this detection is a single event or multi-event rule. type: String - contextPath: GoogleChronicleBackstory.Detections.detectionFields.key description: The key for a field specified in the rule, for MULTI_EVENT rules. type: String - contextPath: GoogleChronicleBackstory.Detections.detectionFields.value description: The value for a field specified in the rule, for MULTI_EVENT rules. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.label description: The variable a given set of UDM events belongs to. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.principalAssetIdentifier description: Specifies the principal asset identifier of the event. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.targetAssetIdentifier description: Specifies the target asset identifier of the event. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.eventType description: Specifies the type of the event. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.eventTimestamp description: The GMT timestamp when the event was generated. type: Date - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.ingestedTimestamp description: The GMT timestamp when the event was ingested in the vendor's instance. type: Date - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.description description: Human-readable description of the event. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.productEventType description: Short, descriptive, human-readable, and product-specific event name or type. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.productLogId description: A vendor-specific event identifier to uniquely identify the event (a GUID). Users might use this identifier to search the vendor's proprietary console for the event in question. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.productName description: Specifies the name of the product. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.productVersion description: Specifies the version of the product. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.urlBackToProduct description: URL linking to a relevant website where you can view more information about this specific event or the general event category. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.vendorName description: Specifies the product vendor's name. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.principal.assetId description: Vendor-specific unique device identifier. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.principal.email description: Email address. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.principal.hostname description: Client hostname or domain name field. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.principal.platform description: Platform operating system. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.principal.platformPatchLevel description: Platform operating system patch level. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.principal.platformVersion description: Platform operating system version. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.principal.ip description: IP address associated with a network connection. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.principal.port description: Source or destination network port number when a specific network connection is described within an event. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.principal.mac description: MAC addresses associated with a device. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.principal.administrativeDomain description: Domain which the device belongs to (for example, the Windows domain). type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.principal.url description: Standard URL. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.principal.file.fileMetadata description: Metadata associated with the file. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.principal.file.fullPath description: Full path identifying the location of the file on the system. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.principal.file.md5 description: MD5 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.principal.file.mimeType description: Multipurpose Internet Mail Extensions (MIME) type of the file. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.principal.file.sha1 description: SHA-1 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.principal.file.sha256 description: SHA-256 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.principal.file.size description: Size of the file. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.principal.process.commandLine description: Stores the command line string for the process. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.principal.process.productSpecificProcessId description: Stores the product specific process ID. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.principal.process.productSpecificParentProcessId description: Stores the product specific process ID for the parent process. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.principal.process.file description: Stores the file name of the file in use by the process. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.principal.process.file.fileMetadata description: Metadata associated with the file. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.principal.process.file.fullPath description: Full path identifying the location of the file on the system. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.principal.process.file.md5 description: MD5 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.principal.process.file.mimeType description: Multipurpose Internet Mail Extensions (MIME) type of the file. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.principal.process.file.sha1 description: SHA-1 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.principal.process.file.sha256 description: SHA-256 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.principal.process.file.size description: Size of the file. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.principal.process.parentPid description: Stores the process ID for the parent process. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.principal.process.pid description: Stores the process ID. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.principal.registry.registryKey description: Stores the registry key associated with an application or system component. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.principal.registry.registryValueName description: Stores the name of the registry value associated with an application or system component. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.principal.registry.registryValueData description: Stores the data associated with a registry value. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.principal.user.emailAddresses description: Stores the email addresses for the user. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.principal.user.employeeId description: Stores the human resources employee ID for the user. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.principal.user.firstName description: Stores the first name for the user. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.principal.user.middleName description: Stores the middle name for the user. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.principal.user.lastName description: Stores the last name for the user. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.principal.user.groupid description: Stores the group ID associated with a user. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.principal.user.phoneNumbers description: Stores the phone numbers for the user. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.principal.user.title description: Stores the job title for the user. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.principal.user.userDisplayName description: Stores the display name for the user. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.principal.user.userid description: Stores the user ID. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.principal.user.windowsSid description: Stores the Microsoft Windows security identifier (SID) associated with a user. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.target.assetId description: Vendor-specific unique device identifier. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.target.email description: Email address. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.target.hostname description: Client hostname or domain name field. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.target.platform description: Platform operating system. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.target.platformPatchLevel description: Platform operating system patch level. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.target.platformVersion description: Platform operating system version. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.target.ip description: IP address associated with a network connection. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.target.port description: Source or destination network port number when a specific network connection is described within an event. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.target.mac description: One or more MAC addresses associated with a device. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.target.administrativeDomain description: Domain which the device belongs to (for example, the Windows domain). type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.target.url description: Standard URL. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.target.file.fileMetadata description: Metadata associated with the file. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.target.file.fullPath description: Full path identifying the location of the file on the system. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.target.file.md5 description: MD5 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.target.file.mimeType description: Multipurpose Internet Mail Extensions (MIME) type of the file. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.target.file.sha1 description: SHA-1 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.target.file.sha256 description: SHA-256 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.target.file.size description: Size of the file. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.target.process.commandLine description: Stores the command line string for the process. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.target.process.productSpecificProcessId description: Stores the product specific process ID. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.target.process.productSpecificParentProcessId description: Stores the product specific process ID for the parent process. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.target.process.file description: Stores the file name of the file in use by the process. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.target.process.file.fileMetadata description: Metadata associated with the file. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.target.process.file.fullPath description: Full path identifying the location of the file on the system. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.target.process.file.md5 description: MD5 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.target.process.file.mimeType description: Multipurpose Internet Mail Extensions (MIME) type of the file. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.target.process.file.sha1 description: SHA-1 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.target.process.file.sha256 description: SHA-256 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.target.process.file.size description: Size of the file. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.target.process.parentPid description: Stores the process ID for the parent process. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.target.process.pid description: Stores the process ID. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.target.registry.registryKey description: Stores the registry key associated with an application or system component. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.target.registry.registryValueName description: Stores the name of the registry value associated with an application or system component. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.target.registry.registryValueData description: Stores the data associated with a registry value. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.target.user.emailAddresses description: Stores the email addresses for the user. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.target.user.employeeId description: Stores the human resources employee ID for the user. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.target.user.firstName description: Stores the first name for the user. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.target.user.middleName description: Stores the middle name for the user. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.target.user.lastName description: Stores the last name for the user. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.target.user.groupid description: Stores the group ID associated with a user. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.target.user.phoneNumbers description: Stores the phone numbers for the user. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.target.user.title description: Stores the job title for the user. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.target.user.userDisplayName description: Stores the display name for the user. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.target.user.userid description: Stores the user ID. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.target.user.windowsSid description: Stores the Microsoft Windows security identifier (SID) associated with a user. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.intermediary.assetId description: Vendor-specific unique device identifier. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.intermediary.email description: Email address. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.intermediary.hostname description: Client hostname or domain name field. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.intermediary.platform description: Platform operating system. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.intermediary.platformPatchLevel description: Platform operating system patch level. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.intermediary.platformVersion description: Platform operating system version. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.intermediary.ip description: IP address associated with a network connection. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.intermediary.port description: Source or destination network port number when a specific network connection is described within an event. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.intermediary.mac description: One or more MAC addresses associated with a device. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.intermediary.administrativeDomain description: Domain which the device belongs to (for example, the Windows domain). type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.intermediary.url description: Standard URL. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.intermediary.file.fileMetadata description: Metadata associated with the file. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.intermediary.file.fullPath description: Full path identifying the location of the file on the system. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.intermediary.file.md5 description: MD5 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.intermediary.file.mimeType description: Multipurpose Internet Mail Extensions (MIME) type of the file. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.intermediary.file.sha1 description: SHA-1 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.intermediary.file.sha256 description: SHA-256 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.intermediary.file.size description: Size of the file. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.intermediary.process.commandLine description: Stores the command line string for the process. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.intermediary.process.productSpecificProcessId description: Stores the product specific process ID. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.intermediary.process.productSpecificParentProcessId description: Stores the product specific process ID for the parent process. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.intermediary.process.file description: Stores the file name of the file in use by the process. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.intermediary.process.file.fileMetadata description: Metadata associated with the file. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.intermediary.process.file.fullPath description: Full path identifying the location of the file on the system. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.intermediary.process.file.md5 description: MD5 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.intermediary.process.file.mimeType description: Multipurpose Internet Mail Extensions (MIME) type of the file. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.intermediary.process.file.sha1 description: SHA-1 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.intermediary.process.file.sha256 description: SHA-256 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.intermediary.process.file.size description: Size of the file. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.intermediary.process.parentPid description: Stores the process ID for the parent process. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.intermediary.process.pid description: Stores the process ID. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.intermediary.registry.registryKey description: Stores the registry key associated with an application or system component. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.intermediary.registry.registryValueName description: Stores the name of the registry value associated with an application or system component. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.intermediary.registry.registryValueData description: Stores the data associated with a registry value. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.intermediary.user.emailAddresses description: Stores the email addresses for the user. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.intermediary.user.employeeId description: Stores the human resources employee ID for the user. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.intermediary.user.firstName description: Stores the first name for the user. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.intermediary.user.middleName description: Stores the middle name for the user. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.intermediary.user.lastName description: Stores the last name for the user. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.intermediary.user.groupid description: Stores the group ID associated with a user. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.intermediary.user.phoneNumbers description: Stores the phone numbers for the user. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.intermediary.user.title description: Stores the job title for the user. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.intermediary.user.userDisplayName description: Stores the display name for the user. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.intermediary.user.userid description: Stores the user ID. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.intermediary.user.windowsSid description: Stores the Microsoft Windows security identifier (SID) associated with a user. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.src.assetId description: Vendor-specific unique device identifier. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.src.email description: Email address. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.src.hostname description: Client hostname or domain name field. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.src.platform description: Platform operating system. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.src.platformPatchLevel description: Platform operating system patch level. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.src.platformVersion description: Platform operating system version. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.src.ip description: IP address associated with a network connection. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.src.port description: Source or destination network port number when a specific network connection is described within an event. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.src.mac description: One or more MAC addresses associated with a device. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.src.administrativeDomain description: Domain which the device belongs to (for example, the Windows domain). type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.src.url description: Standard URL. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.src.file.fileMetadata description: Metadata associated with the file. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.src.file.fullPath description: Full path identifying the location of the file on the system. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.src.file.md5 description: MD5 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.src.file.mimeType description: Multipurpose Internet Mail Extensions (MIME) type of the file. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.src.file.sha1 description: SHA-1 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.src.file.sha256 description: SHA-256 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.src.file.size description: Size of the file. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.src.process.commandLine description: Stores the command line string for the process. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.src.process.productSpecificProcessId description: Stores the product specific process ID. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.src.process.productSpecificParentProcessId description: Stores the product specific process ID for the parent process. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.src.process.file description: Stores the file name of the file in use by the process. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.src.process.file.fileMetadata description: Metadata associated with the file. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.src.process.file.fullPath description: Full path identifying the location of the file on the system. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.src.process.file.md5 description: MD5 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.src.process.file.mimeType description: Multipurpose Internet Mail Extensions (MIME) type of the file. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.src.process.file.sha1 description: SHA-1 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.src.process.file.sha256 description: SHA-256 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.src.process.file.size description: Size of the file. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.src.process.parentPid description: Stores the process ID for the parent process. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.src.process.pid description: Stores the process ID. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.src.registry.registryKey description: Stores the registry key associated with an application or system component. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.src.registry.registryValueName description: Stores the name of the registry value associated with an application or system component. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.src.registry.registryValueData description: Stores the data associated with a registry value. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.src.user.emailAddresses description: Stores the email addresses for the user. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.src.user.employeeId description: Stores the human resources employee ID for the user. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.src.user.firstName description: Stores the first name for the user. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.src.user.middleName description: Stores the middle name for the user. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.src.user.lastName description: Stores the last name for the user. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.src.user.groupid description: Stores the group ID associated with a user. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.src.user.phoneNumbers description: Stores the phone numbers for the user. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.src.user.title description: Stores the job title for the user. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.src.user.userDisplayName description: Stores the display name for the user. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.src.user.userid description: Stores the user ID. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.src.user.windowsSid description: Stores the Microsoft Windows security identifier (SID) associated with a user. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.observer.assetId description: Vendor-specific unique device identifier. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.observer.email description: Email address. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.observer.hostname description: Client hostname or domain name field. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.observer.platform description: Platform operating system. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.observer.platformPatchLevel description: Platform operating system patch level. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.observer.platformVersion description: Platform operating system version. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.observer.ip description: IP address associated with a network connection. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.observer.port description: Source or destination network port number when a specific network connection is described within an event. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.observer.mac description: One or more MAC addresses associated with a device. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.observer.administrativeDomain description: Domain which the device belongs to (for example, the Windows domain). type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.observer.url description: Standard URL. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.observer.file.fileMetadata description: Metadata associated with the file. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.observer.file.fullPath description: Full path identifying the location of the file on the system. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.observer.file.md5 description: MD5 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.observer.file.mimeType description: Multipurpose Internet Mail Extensions (MIME) type of the file. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.observer.file.sha1 description: SHA-1 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.observer.file.sha256 description: SHA-256 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.observer.file.size description: Size of the file. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.observer.process.commandLine description: Stores the command line string for the process. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.observer.process.productSpecificProcessId description: Stores the product specific process ID. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.observer.process.productSpecificParentProcessId description: Stores the product specific process ID for the parent process. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.observer.process.file description: Stores the file name of the file in use by the process. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.observer.process.file.fileMetadata description: Metadata associated with the file. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.observer.process.file.fullPath description: Full path identifying the location of the file on the system. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.observer.process.file.md5 description: MD5 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.observer.process.file.mimeType description: Multipurpose Internet Mail Extensions (MIME) type of the file. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.observer.process.file.sha1 description: SHA-1 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.observer.process.file.sha256 description: SHA-256 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.observer.process.file.size description: Size of the file. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.observer.process.parentPid description: Stores the process ID for the parent process. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.observer.process.pid description: Stores the process ID. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.observer.registry.registryKey description: Stores the registry key associated with an application or system component. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.observer.registry.registryValueName description: Stores the name of the registry value associated with an application or system component. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.observer.registry.registryValueData description: Stores the data associated with a registry value. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.observer.user.emailAddresses description: Stores the email addresses for the user. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.observer.user.employeeId description: Stores the human resources employee ID for the user. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.observer.user.firstName description: Stores the first name for the user. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.observer.user.middleName description: Stores the middle name for the user. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.observer.user.lastName description: Stores the last name for the user. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.observer.user.groupid description: Stores the group ID associated with a user. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.observer.user.phoneNumbers description: Stores the phone numbers for the user. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.observer.user.title description: Stores the job title for the user. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.observer.user.userDisplayName description: Stores the display name for the user. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.observer.user.userid description: Stores the user ID. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.observer.user.windowsSid description: Stores the Microsoft Windows security identifier (SID) associated with a user. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.about.assetId description: Vendor-specific unique device identifier. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.about.email description: Email address. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.about.hostname description: Client hostname or domain name field. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.about.platform description: Platform operating system. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.about.platformPatchLevel description: Platform operating system patch level. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.about.platformVersion description: Platform operating system version. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.about.ip description: IP address associated with a network connection. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.about.port description: Source or destination network port number when a specific network connection is described within an event. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.about.mac description: One or more MAC addresses associated with a device. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.about.administrativeDomain description: Domain which the device belongs to (for example, the Windows domain). type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.about.url description: Standard URL. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.about.file.fileMetadata description: Metadata associated with the file. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.about.file.fullPath description: Full path identifying the location of the file on the system. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.about.file.md5 description: MD5 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.about.file.mimeType description: Multipurpose Internet Mail Extensions (MIME) type of the file. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.about.file.sha1 description: SHA-1 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.about.file.sha256 description: SHA-256 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.about.file.size description: Size of the file. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.about.process.commandLine description: Stores the command line string for the process. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.about.process.productSpecificProcessId description: Stores the product specific process ID. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.about.process.productSpecificParentProcessId description: Stores the product specific process ID for the parent process. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.about.process.file description: Stores the file name of the file in use by the process. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.about.process.file.fileMetadata description: Metadata associated with the file. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.about.process.file.fullPath description: Full path identifying the location of the file on the system. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.about.process.file.md5 description: MD5 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.about.process.file.mimeType description: Multipurpose Internet Mail Extensions (MIME) type of the file. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.about.process.file.sha1 description: SHA-1 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.about.process.file.sha256 description: SHA-256 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.about.process.file.size description: Size of the file. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.about.process.parentPid description: Stores the process ID for the parent process. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.about.process.pid description: Stores the process ID. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.about.registry.registryKey description: Stores the registry key associated with an application or system component. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.about.registry.registryValueName description: Stores the name of the registry value associated with an application or system component. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.about.registry.registryValueData description: Stores the data associated with a registry value. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.about.user.emailAddresses description: Stores the email addresses for the user. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.about.user.employeeId description: Stores the human resources employee ID for the user. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.about.user.firstName description: Stores the first name for the user. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.about.user.middleName description: Stores the middle name for the user. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.about.user.lastName description: Stores the last name for the user. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.about.user.groupid description: Stores the group ID associated with a user. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.about.user.phoneNumbers description: Stores the phone numbers for the user. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.about.user.title description: Stores the job title for the user. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.about.user.userDisplayName description: Stores the display name for the user. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.about.user.userid description: Stores the user ID. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.about.user.windowsSid description: Stores the Microsoft Windows security identifier (SID) associated with a user. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.network.applicationProtocol description: Indicates the network application protocol. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.network.direction description: Indicates the direction of network traffic. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.network.email description: Specifies the email address for the sender/recipient. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.network.ipProtocol description: Indicates the IP protocol. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.network.receivedBytes description: Specifies the number of bytes received. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.network.sentBytes description: Specifies the number of bytes sent. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.network.dhcp.clientHostname description: Hostname for the client. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.network.dhcp.clientIdentifier description: Client identifier. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.network.dhcp.file description: Filename for the boot image. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.network.dhcp.flags description: Value for the DHCP flags field. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.network.dhcp.hlen description: Hardware address length. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.network.dhcp.hops description: DHCP hop count. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.network.dhcp.htype description: Hardware address type. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.network.dhcp.leaseTimeSeconds description: Client-requested lease time for an IP address in seconds. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.network.dhcp.opcode description: BOOTP op code. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.network.dhcp.requestedAddress description: Client identifier. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.network.dhcp.seconds description: Seconds elapsed since the client began the address acquisition/renewal process. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.network.dhcp.sname description: Name of the server which the client has requested to boot from. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.network.dhcp.transactionId description: Client transaction ID. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.network.dhcp.type description: DHCP message type. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.network.dhcp.chaddr description: IP address for the client hardware. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.network.dhcp.ciaddr description: IP address for the client. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.network.dhcp.giaddr description: IP address for the relay agent. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.network.dhcp.siaddr description: IP address for the next bootstrap server. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.network.dhcp.yiaddr description: Your IP address. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.network.dns.authoritative description: Set to true for authoritative DNS servers. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.network.dns.id description: Stores the DNS query identifier. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.network.dns.response description: Set to true if the event is a DNS response. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.network.dns.opcode description: Stores the DNS OpCode used to specify the type of DNS query (standard, inverse, server status, etc.). type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.network.dns.recursionAvailable description: Set to true if a recursive DNS lookup is available. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.network.dns.recursionDesired description: Set to true if a recursive DNS lookup is requested. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.network.dns.responseCode description: Stores the DNS response code as defined by RFC 1035, Domain Names - Implementation and Specification. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.network.dns.truncated description: Set to true if this is a truncated DNS response. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.network.dns.questions.name description: Stores the domain name. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.network.dns.questions.class description: Stores the code specifying the class of the query. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.network.dns.questions.type description: Stores the code specifying the type of the query. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.network.dns.answers.binaryData description: Stores the raw bytes of any non-UTF8 strings that might be included as part of a DNS response. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.network.dns.answers.class description: Stores the code specifying the class of the resource record. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.network.dns.answers.data description: Stores the payload or response to the DNS question for all responses encoded in UTF-8 format. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.network.dns.answers.name description: Stores the name of the owner of the resource record. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.network.dns.answers.ttl description: Stores the time interval for which the resource record can be cached before the source of the information should again be queried. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.network.dns.answers.type description: Stores the code specifying the type of the resource record. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.network.dns.authority.binaryData description: Stores the raw bytes of any non-UTF8 strings that might be included as part of a DNS response. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.network.dns.authority.class description: Stores the code specifying the class of the resource record. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.network.dns.authority.data description: Stores the payload or response to the DNS question for all responses encoded in UTF-8 format. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.network.dns.authority.name description: Stores the name of the owner of the resource record. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.network.dns.authority.ttl description: Stores the time interval for which the resource record can be cached before the source of the information should again be queried. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.network.dns.authority.type description: Stores the code specifying the type of the resource record. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.network.dns.additional.binaryData description: Stores the raw bytes of any non-UTF8 strings that might be included as part of a DNS response. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.network.dns.additional.class description: Stores the code specifying the class of the resource record. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.network.dns.additional.data description: Stores the payload or response to the DNS question for all responses encoded in UTF-8 format. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.network.dns.additional.name description: Stores the name of the owner of the resource record. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.network.dns.additional.ttl description: Stores the time interval for which the resource record can be cached before the source of the information should again be queried. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.network.dns.additional.type description: Stores the code specifying the type of the resource record. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.network.email.from description: Stores the from email address. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.network.email.replyTo description: Stores the reply_to email address. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.network.email.to description: Stores the to email addresses. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.network.email.cc description: Stores the cc email addresses. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.network.email.bcc description: Stores the bcc email addresses. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.network.email.mailId description: Stores the mail (or message) ID. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.network.email.subject description: Stores the email subject line. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.network.ftp.command description: Stores the FTP command. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.network.http.method description: Stores the HTTP request method. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.network.http.referralUrl description: Stores the URL for the HTTP referer. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.network.http.responseCode description: Stores the HTTP response status code, which indicates whether a specific HTTP request has been successfully completed. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.network.http.useragent description: Stores the User-Agent request header which includes the application type, operating system, software vendor or software version of the requesting software user agent. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.authentication.authType description: Type of system an authentication event is associated with (Chronicle UDM). type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.authentication.mechanism description: Mechanism(s) used for authentication. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.securityResult.about description: Provide a description of the security result. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.securityResult.action description: Specify a security action. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.securityResult.category description: Specify a security category. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.securityResult.confidence description: Specify a confidence with regards to a security event as estimated by the product. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.securityResult.confidenceDetails description: Additional detail with regards to the confidence of a security event as estimated by the product vendor. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.securityResult.priority description: Specify a priority with regards to a security event as estimated by the product vendor. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.securityResult.priorityDetails description: Vendor-specific information about the security result priority. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.securityResult.ruleId description: Identifier for the security rule. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.securityResult.ruleName description: Name of the security rule. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.securityResult.severity description: Severity of a security event as estimated by the product vendor using values defined by the Chronicle UDM. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.securityResult.severityDetails description: Severity for a security event as estimated by the product vendor. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.securityResult.threatName description: Name of the security threat. type: String - contextPath: GoogleChronicleBackstory.Detections.collectionElements.references.securityResult.urlBackToProduct description: URL to direct you to the source product console for this security event. type: String - contextPath: GoogleChronicleBackstory.Token.name description: The name of the command to which the value of the nextPageToken corresponds. type: String - contextPath: GoogleChronicleBackstory.Token.nextPageToken description: A page token that can be provided to the next call to view the next page of detections. Absent if this is the last page. type: String - arguments: - defaultValue: '100' description: Specify the maximum number of Rules to return. You can specify between 1 and 1000. name: page_size - description: A page token, received from a previous call. Provide this to retrieve the subsequent page. name: page_token - auto: PREDEFINED description: To filter live rules. name: live_rule predefined: - 'true' - 'false' description: List the latest versions of all Rules. name: gcb-list-rules outputs: - contextPath: GoogleChronicleBackstory.Rules.ruleId description: Unique identifier for a Rule. type: String - contextPath: GoogleChronicleBackstory.Rules.versionId description: Unique identifier for a specific version of a rule. type: String - contextPath: GoogleChronicleBackstory.Rules.ruleName description: Name of the rule, as parsed from ruleText. type: String - contextPath: GoogleChronicleBackstory.Rules.ruleText description: Source code for the rule, as defined by the user. type: String - contextPath: GoogleChronicleBackstory.Rules.liveRuleEnabled description: Whether the rule is enabled to run as a Live Rule. type: Boolean - contextPath: GoogleChronicleBackstory.Rules.alertingEnabled description: Whether the rule is enabled to generate Alerts. type: Boolean - contextPath: GoogleChronicleBackstory.Rules.versionCreateTime description: A string representing the time in ISO-8601 format. type: String - contextPath: GoogleChronicleBackstory.Rules.compilationState description: Compilation state of the rule. It can be SUCCEEDED or FAILED. type: String - contextPath: GoogleChronicleBackstory.Rules.compilationError description: A compilation error if compilationState is FAILED, absent if compilationState is SUCCEEDED. type: String - contextPath: GoogleChronicleBackstory.Rules.Metadata.severity description: Severity for the rule. type: String - contextPath: GoogleChronicleBackstory.Rules.Metadata.author description: Name of author for the rule. type: String - contextPath: GoogleChronicleBackstory.Rules.Metadata.description description: Description of the rule. type: String - contextPath: GoogleChronicleBackstory.Rules.Metadata.reference description: Reference link for the rule. type: String - contextPath: GoogleChronicleBackstory.Rules.Metadata.created description: Time at which the rule is created. type: String - contextPath: GoogleChronicleBackstory.Rules.Metadata.updated description: Time at which the rule is updated. type: String - contextPath: GoogleChronicleBackstory.Token.name description: The name of the command to which the value of the nextPageToken corresponds. type: String - contextPath: GoogleChronicleBackstory.Token.nextPageToken description: A page token that can be provided to the next call to view the next page of Rules. Absent if this is the last page. type: String - arguments: - description: Rule text in YARA-L 2.0 format for the rule to be created. name: rule_text required: true description: Creates a new rule. By default the live rule status will be set to disabled. name: gcb-create-rule outputs: - contextPath: GoogleChronicleBackstory.Rules.ruleId description: Unique identifier for a Rule. type: String - contextPath: GoogleChronicleBackstory.Rules.versionId description: Unique identifier for a specific version of a rule. type: String - contextPath: GoogleChronicleBackstory.Rules.ruleName description: Name of the rule, as parsed from ruleText. type: String - contextPath: GoogleChronicleBackstory.Rules.ruleText description: Source code for the rule, as defined by the user. type: String - contextPath: GoogleChronicleBackstory.Rules.liveRuleEnabled description: Whether the rule is enabled to run as a Live Rule. type: Boolean - contextPath: GoogleChronicleBackstory.Rules.alertingEnabled description: Whether the rule is enabled to generate Alerts. type: Boolean - contextPath: GoogleChronicleBackstory.Rules.versionCreateTime description: A string representing the time in ISO-8601 format. type: String - contextPath: GoogleChronicleBackstory.Rules.compilationState description: Compilation state of the rule. It can be SUCCEEDED or FAILED. type: String - contextPath: GoogleChronicleBackstory.Rules.compilationError description: A compilation error if compilationState is FAILED, absent if compilationState is SUCCEEDED. type: String - contextPath: GoogleChronicleBackstory.Rules.ruleType description: Indicates the type of event in rule. It can be SINGLE_EVENT or MULTI_EVENT. type: String - contextPath: GoogleChronicleBackstory.Rules.metadata.severity description: Severity for the rule. type: String - contextPath: GoogleChronicleBackstory.Rules.metadata.author description: Name of author for the rule. type: String - contextPath: GoogleChronicleBackstory.Rules.metadata.description description: Description of the rule. type: String - contextPath: GoogleChronicleBackstory.Rules.metadata.reference description: Reference link for the rule. type: String - contextPath: GoogleChronicleBackstory.Rules.metadata.created description: Time at which the rule is created. type: String - contextPath: GoogleChronicleBackstory.Rules.metadata.updated description: Time at which the rule is updated. type: String - arguments: - description: Rule ID or Version ID of the rule to be retrieved. name: id required: true description: Retrieves the rule details of specified Rule ID or Version ID. name: gcb-get-rule outputs: - contextPath: GoogleChronicleBackstory.Rules.ruleId description: Unique identifier for a Rule. type: String - contextPath: GoogleChronicleBackstory.Rules.versionId description: Unique identifier for a specific version of a rule. type: String - contextPath: GoogleChronicleBackstory.Rules.ruleName description: Name of the rule, as parsed from ruleText. type: String - contextPath: GoogleChronicleBackstory.Rules.ruleText description: Source code for the rule, as defined by the user. type: String - contextPath: GoogleChronicleBackstory.Rules.liveRuleEnabled description: Whether the rule is enabled to run as a Live Rule. type: Boolean - contextPath: GoogleChronicleBackstory.Rules.alertingEnabled description: Whether the rule is enabled to generate Alerts. type: Boolean - contextPath: GoogleChronicleBackstory.Rules.versionCreateTime description: A string representing the time in ISO-8601 format. type: String - contextPath: GoogleChronicleBackstory.Rules.compilationState description: Compilation state of the rule. It can be SUCCEEDED or FAILED. type: String - contextPath: GoogleChronicleBackstory.Rules.compilationError description: A compilation error if compilationState is FAILED, absent if compilationState is SUCCEEDED. type: String - contextPath: GoogleChronicleBackstory.Rules.ruleType description: Indicates the type of event in rule. It can be SINGLE_EVENT or MULTI_EVENT. type: String - contextPath: GoogleChronicleBackstory.Rules.metadata.severity description: Severity for the rule. type: String - contextPath: GoogleChronicleBackstory.Rules.metadata.author description: Name of author for the rule. type: String - contextPath: GoogleChronicleBackstory.Rules.metadata.description description: Description of the rule. type: String - contextPath: GoogleChronicleBackstory.Rules.metadata.reference description: Reference link for the rule. type: String - contextPath: GoogleChronicleBackstory.Rules.metadata.created description: Time at which the rule is created. type: String - contextPath: GoogleChronicleBackstory.Rules.metadata.updated description: Time at which the rule is updated. type: String - arguments: - description: ID of the rule to be deleted. name: rule_id required: true description: Deletes the rule specified by Rule ID. name: gcb-delete-rule outputs: - contextPath: GoogleChronicleBackstory.DeleteRule.ruleId description: Unique identifier for a Rule. type: String - contextPath: GoogleChronicleBackstory.DeleteRule.actionStatus description: Whether the rule is successfully deleted or not. type: String - arguments: - description: Rule ID for a Rule for which to create a new version. name: rule_id required: true - description: Rule text in YARA-L 2.0 format for the new version of the rule to be created. name: rule_text required: true description: Creates a new version of an existing rule. name: gcb-create-rule-version outputs: - contextPath: GoogleChronicleBackstory.Rules.ruleId description: Unique identifier for a Rule. type: String - contextPath: GoogleChronicleBackstory.Rules.versionId description: Unique identifier for a specific version of a rule. type: String - contextPath: GoogleChronicleBackstory.Rules.ruleName description: Name of the rule, as parsed from ruleText. type: String - contextPath: GoogleChronicleBackstory.Rules.ruleText description: Source code for the rule, as defined by the user. type: String - contextPath: GoogleChronicleBackstory.Rules.liveRuleEnabled description: Whether the rule is enabled to run as a Live Rule. type: Boolean - contextPath: GoogleChronicleBackstory.Rules.alertingEnabled description: Whether the rule is enabled to generate Alerts. type: Boolean - contextPath: GoogleChronicleBackstory.Rules.versionCreateTime description: A string representing the time in ISO-8601 format. type: String - contextPath: GoogleChronicleBackstory.Rules.compilationState description: Compilation state of the rule. It can be SUCCEEDED or FAILED. type: String - contextPath: GoogleChronicleBackstory.Rules.compilationError description: A compilation error if compilationState is FAILED, absent if compilationState is SUCCEEDED. type: String - contextPath: GoogleChronicleBackstory.Rules.ruleType description: Indicates the type of event in rule. It can be SINGLE_EVENT or MULTI_EVENT. type: String - contextPath: GoogleChronicleBackstory.Rules.metadata.severity description: Severity for the rule. type: String - contextPath: GoogleChronicleBackstory.Rules.metadata.author description: Name of author for the rule. type: String - contextPath: GoogleChronicleBackstory.Rules.metadata.description description: Description of the rule. type: String - contextPath: GoogleChronicleBackstory.Rules.metadata.reference description: Reference link for the rule. type: String - contextPath: GoogleChronicleBackstory.Rules.metadata.created description: Time at which the rule is created. type: String - contextPath: GoogleChronicleBackstory.Rules.metadata.updated description: Time at which the rule is updated. type: String - arguments: - description: ID of the rule. name: rule_id required: true - auto: PREDEFINED description: New alerting status for the Rule. Possible values are 'enable' or 'disable'. name: alerting_status predefined: - enable - disable required: true description: Updates the alerting status for a rule specified by Rule ID. name: gcb-change-rule-alerting-status outputs: - contextPath: GoogleChronicleBackstory.RuleAlertingChange.ruleId description: Unique identifier for a Rule. type: String - contextPath: GoogleChronicleBackstory.RuleAlertingChange.actionStatus description: Whether the alerting status for the rule is successfully updated or not. type: String - contextPath: GoogleChronicleBackstory.RuleAlertingChange.alertingStatus description: New alerting status for the rule. type: String - arguments: - description: ID of the rule. name: rule_id required: true - auto: PREDEFINED description: New live rule status for the Rule. Possible values are 'enable' or 'disable'. name: live_rule_status predefined: - enable - disable required: true description: Updates the live rule status for a rule specified by Rule ID. name: gcb-change-live-rule-status outputs: - contextPath: GoogleChronicleBackstory.LiveRuleStatusChange.ruleId description: Unique identifier for a Rule. type: String - contextPath: GoogleChronicleBackstory.LiveRuleStatusChange.actionStatus description: Whether the live rule status for the rule is successfully updated or not. type: String - contextPath: GoogleChronicleBackstory.LiveRuleStatusChange.liveRuleStatus description: New live rule status for the rule. type: String - arguments: - description: Rule ID or Version ID of the rule whose retrohunt is to be started. name: rule_id required: true - defaultValue: 1 week description: |- Start time for the time range of logs being processed. The format of Date should comply with RFC 3339 (e.g. 2002-10-02T15:00:00Z) or relative time. If not supplied, the product considers UTC time corresponding to 1 week earlier than current time. Formats: YYYY-MM-ddTHH:mm:ssZ, YYYY-MM-dd, N days, N hours. Example: 2020-05-01T00:00:00Z, 2020-05-01, 2 days, 5 hours, 01 Mar 2021, 01 Feb 2021 04:45:33, 15 Jun. name: start_time - defaultValue: 10 min description: |- End time for the time range of logs being processed. The format of Date should comply with RFC 3339 (e.g. 2002-10-02T15:00:00Z) or relative time. If not supplied, the product considers UTC time corresponding to 10 minutes earlier than current time. Formats: YYYY-MM-ddTHH:mm:ssZ, YYYY-MM-dd, N days, N hours. Example: 2020-05-01T00:00:00Z, 2020-05-01, 2 days, 5 hours, 01 Mar 2021, 01 Feb 2021 04:45:33, 15 Jun. name: end_time description: Initiate a retrohunt for the specified rule. name: gcb-start-retrohunt outputs: - contextPath: GoogleChronicleBackstory.RetroHunt.retrohuntId description: Unique identifier for a retrohunt, defined and returned by the server. type: String - contextPath: GoogleChronicleBackstory.RetroHunt.ruleId description: Unique identifier for a Rule. type: String - contextPath: GoogleChronicleBackstory.RetroHunt.versionId description: Unique identifier for a specific version of a rule. type: String - contextPath: GoogleChronicleBackstory.RetroHunt.eventStartTime description: Start time for the time range of logs being processed. type: Date - contextPath: GoogleChronicleBackstory.RetroHunt.eventEndTime description: End time for the time range of logs being processed. type: Date - contextPath: GoogleChronicleBackstory.RetroHunt.retrohuntStartTime description: Start time for the retrohunt. type: Date - contextPath: GoogleChronicleBackstory.RetroHunt.state description: Current state of the retrohunt. It can be STATE_UNSPECIFIED, RUNNING, DONE, or CANCELLED. type: String - arguments: - description: Rule ID or Version ID of the rule whose retrohunt is to be retrieved. name: id required: true - description: Unique identifier for a retrohunt, defined and returned by the server. You must specify exactly one retrohunt identifier. name: retrohunt_id required: true description: Get retrohunt for a specific version of rule. name: gcb-get-retrohunt outputs: - contextPath: GoogleChronicleBackstory.RetroHunt.retrohuntId description: Unique identifier for a retrohunt, defined and returned by the server. type: String - contextPath: GoogleChronicleBackstory.RetroHunt.ruleId description: Unique identifier for a Rule. type: String - contextPath: GoogleChronicleBackstory.RetroHunt.versionId description: Unique identifier for a specific version of a rule. type: String - contextPath: GoogleChronicleBackstory.RetroHunt.eventStartTime description: Start time for the time range of logs being processed. type: Date - contextPath: GoogleChronicleBackstory.RetroHunt.eventEndTime description: End time for the time range of logs being processed. type: Date - contextPath: GoogleChronicleBackstory.RetroHunt.retrohuntStartTime description: Start time for the retrohunt. type: Date - contextPath: GoogleChronicleBackstory.RetroHunt.retrohuntEndTime description: End time for the retrohunt. type: Date - contextPath: GoogleChronicleBackstory.RetroHunt.state description: Current state of the retrohunt. It can be STATE_UNSPECIFIED, RUNNING, DONE or CANCELLED. type: String - contextPath: GoogleChronicleBackstory.RetroHunt.progressPercentage description: Percentage progress towards retrohunt completion (0.00 to 100.00). type: Number - arguments: - description: Rule ID or Version ID of the rule whose retrohunts are to be listed. If not supplied, retohunts for all versions of all rules will be listed. name: id - auto: PREDEFINED defaultValue: 'false' description: |- Whether to retrieve retrohunts for all versions of a rule with a given rule identifier. Note: If this option is set to true, rule id is required. name: retrohunts_for_all_versions predefined: - 'true' - 'false' - auto: PREDEFINED description: Filter retrohunts based on their status. The possible values are "RUNNING", "DONE", or "CANCELLED". name: state predefined: - RUNNING - DONE - CANCELLED - defaultValue: '100' description: Specify the maximum number of retohunts to return. You can specify between 1 and 1000. name: page_size - description: A page token, received from a previous call. Provide this to retrieve the subsequent page. name: page_token description: List retrohunts for a rule. name: gcb-list-retrohunts outputs: - contextPath: GoogleChronicleBackstory.RetroHunt.retrohuntId description: Unique identifier for a retrohunt, defined and returned by the server. type: String - contextPath: GoogleChronicleBackstory.RetroHunt.ruleId description: Unique identifier for a Rule. type: String - contextPath: GoogleChronicleBackstory.RetroHunt.versionId description: Unique identifier for a specific version of a rule. type: String - contextPath: GoogleChronicleBackstory.RetroHunt.eventStartTime description: Start time for the time range of logs being processed. type: Date - contextPath: GoogleChronicleBackstory.RetroHunt.eventEndTime description: End time for the time range of logs being processed. type: Date - contextPath: GoogleChronicleBackstory.RetroHunt.retrohuntStartTime description: Start time for the retrohunt. type: Date - contextPath: GoogleChronicleBackstory.RetroHunt.retrohuntEndTime description: End time for the retrohunt. type: Date - contextPath: GoogleChronicleBackstory.RetroHunt.state description: Current state of the retrohunt. It can be STATE_UNSPECIFIED, RUNNING, DONE or CANCELLED. type: String - contextPath: GoogleChronicleBackstory.RetroHunt.progressPercentage description: Percentage progress towards retrohunt completion (0.00 to 100.00). type: Number - arguments: - description: Rule ID or Version ID of the rule whose retrohunt is to be cancelled. name: id required: true - description: Unique identifier for a retrohunt, defined and returned by the server. You must specify exactly one retrohunt identifier. name: retrohunt_id required: true description: Cancel a retrohunt for a specified rule. name: gcb-cancel-retrohunt outputs: - contextPath: GoogleChronicleBackstory.RetroHunt.id description: Unique identifier for a Rule. type: String - contextPath: GoogleChronicleBackstory.RetroHunt.retrohuntId description: Unique identifier for a retrohunt, defined and returned by the server. type: String - contextPath: GoogleChronicleBackstory.RetroHunt.cancelled description: Whether the retrohunt is cancelled or not. type: Boolean - arguments: - description: Provide a unique name of the list to create a reference list. name: name required: true - description: Description of the list. name: description required: true - description: |- Enter the content to be added into the reference list. Format accepted is: "Line 1, Line 2, Line 3". name: lines required: false - description: |- Provide a unique file id consisting of lines to add. Note: Please provide either one of "lines" or "entry_id". name: entry_id required: false - default: true defaultValue: ',' description: |- Delimiter by which the content of the list is separated. Eg: " , " , " : ", " ; ". name: delimiter - auto: PREDEFINED defaultValue: PLAIN_TEXT description: Select the content type for reference list. name: content_type predefined: - PLAIN_TEXT - CIDR - REGEX - defaultValue: 'False' description: Flag to control how the file content is split. If set to True, it uses the provided delimiter; otherwise it splits by new lines (\n). name: use_delimiter_for_file required: false auto: PREDEFINED predefined: - 'True' - 'False' description: Create a new reference list. name: gcb-create-reference-list outputs: - contextPath: GoogleChronicleBackstory.ReferenceList.name description: Unique name of the list. type: String - contextPath: GoogleChronicleBackstory.ReferenceList.description description: Description of the list. type: String - contextPath: GoogleChronicleBackstory.ReferenceList.lines description: List of line items. type: String - contextPath: GoogleChronicleBackstory.ReferenceList.createTime description: Time when the list was created. type: Date - contextPath: GoogleChronicleBackstory.ReferenceList.contentType description: Content type of the reference list. type: String - arguments: - default: true defaultValue: '100' description: Number of results to retrieve in the response. Maximum size allowed is 1000. name: page_size - description: The next page token to retrieve the next set of results. name: page_token - auto: PREDEFINED defaultValue: BASIC description: Select option to control the returned response. BASIC will return the metadata for the list, but not the full contents. FULL will return everything. name: view predefined: - BASIC - FULL description: Retrieve all the reference lists. name: gcb-list-reference-list outputs: - contextPath: GoogleChronicleBackstory.ReferenceLists.name description: Unique name of the list. type: String - contextPath: GoogleChronicleBackstory.ReferenceLists.description description: Description of the list. type: String - contextPath: GoogleChronicleBackstory.ReferenceLists.createTime description: Time when the list was created. type: Date - contextPath: GoogleChronicleBackstory.ReferenceLists.lines description: List of line items. type: String - contextPath: GoogleChronicleBackstory.ReferenceLists.contentType description: Content type of the reference list. type: String - arguments: - description: Provide a unique name of the list to retrieve the result. name: name required: true - auto: PREDEFINED default: true defaultValue: FULL description: Select option to control the returned response. BASIC will return the metadata for the list, but not the full contents. FULL will return everything. name: view predefined: - FULL - BASIC description: Returns the specified list. name: gcb-get-reference-list outputs: - contextPath: GoogleChronicleBackstory.ReferenceList.name description: Unique name of the list. type: String - contextPath: GoogleChronicleBackstory.ReferenceList.description description: Description of the list. type: String - contextPath: GoogleChronicleBackstory.ReferenceList.createTime description: Time when the list was created. type: Date - contextPath: GoogleChronicleBackstory.ReferenceList.lines description: List of line items. type: String - contextPath: GoogleChronicleBackstory.ReferenceList.contentType description: Content type of the reference list. type: String - arguments: - description: Provide a unique name of the list to update. name: name required: true - description: |- Enter the content to be updated into the reference list. Format accepted is: "Line 1, Line 2, Line 3". Note: Use gcb-get-reference-list to retrieve the content and description of the list. name: lines required: false - description: |- Provide a unique file id consisting of lines to update. Note: Please provide either one of "lines" or "entry_id". name: entry_id required: false - description: Description to be updated of the list. name: description - defaultValue: ',' description: |- Delimiter by which the content of the list is separated. Eg: " , " , " : ", " ; ". name: delimiter - auto: PREDEFINED description: Select the content type for reference list. name: content_type predefined: - PLAIN_TEXT - CIDR - REGEX - defaultValue: 'False' description: Flag to control how the file content is split. If set to True, it uses the provided delimiter; otherwise it splits by new lines (\n). name: use_delimiter_for_file required: false auto: PREDEFINED predefined: - 'True' - 'False' description: Updates an existing reference list. name: gcb-update-reference-list outputs: - contextPath: GoogleChronicleBackstory.ReferenceList.name description: Unique name of the list. type: String - contextPath: GoogleChronicleBackstory.ReferenceList.description description: Description of the list. type: String - contextPath: GoogleChronicleBackstory.ReferenceList.lines description: List of line items. type: String - contextPath: GoogleChronicleBackstory.ReferenceList.createTime description: Time when the list was created. type: Date - contextPath: GoogleChronicleBackstory.ReferenceList.contentType description: Content type of the reference list. type: String - arguments: - description: "Enter the content to be validated in the reference list.\nFormat accepted is: 'Line 1, Line 2, Line 3'." name: lines required: true - auto: PREDEFINED defaultValue: PLAIN_TEXT description: Select the content type for reference list. name: content_type predefined: - PLAIN_TEXT - CIDR - REGEX - defaultValue: ',' description: |- Delimiter by which the content of the list is separated. Eg: " , " , " : ", " ; ". name: delimiter description: Validates list content and returns any errors found for each line. name: gcb-verify-reference-list outputs: - contextPath: GoogleChronicleBackstory.VerifyReferenceList.success description: Whether lines content are valid or not. type: Boolean - contextPath: GoogleChronicleBackstory.VerifyReferenceList.errors.linenumber description: The line number where the error occurred. type: Number - contextPath: GoogleChronicleBackstory.VerifyReferenceList.errors.errorMessage description: The error message describing the invalid pattern. type: String - contextPath: GoogleChronicleBackstory.VerifyReferenceList.command_name description: The name of the command. type: String - arguments: - description: Rule text in YARA-L 2.0 format for the rule to stream. name: rule_text required: true - description: "Start time for the time range of the rule being tested. The format of Date should comply with RFC 3339 (e.g. 2022-10-02T15:00:00Z) or relative time. \n\nFormats: YYYY-MM-ddTHH:mm:ssZ, YYYY-MM-dd, N days, N hours.\nExample: 2022-05-01T00:00:00Z, 2022-05-01, 2 days, 5 hours, 01 Mar 2022, 01 Feb 2022 04:45:33, 15 Jun.\n\n\nNote: The time window between start_time and end_time cannot be greater than 2 weeks." name: start_time required: true - description: "End time for the time range of the rule being tested. The format of Date should comply with RFC 3339 (e.g. 2022-10-02T15:00:00Z) or relative time. \n\nFormats: YYYY-MM-ddTHH:mm:ssZ, YYYY-MM-dd, N days, N hours.\nExample: 2022-05-01T00:00:00Z, 2022-05-01, 2 days, 5 hours, 01 Mar 2022, 01 Feb 2022 04:45:33, 15 Jun.\n\nNote: The time window between start_time and end_time cannot be greater than 2 weeks." name: end_time required: true - default: true defaultValue: '1000' description: 'Maximum number of results to return. Specify a value between 1 and 10,000. ' name: max_results description: Test a rule over a specified time range. Return any errors and any detections up to the specified maximum. name: gcb-test-rule-stream outputs: - contextPath: GoogleChronicleBackstory.StreamRules.list.detection.type description: Type of detection. type: String - contextPath: GoogleChronicleBackstory.StreamRules.list.detection.detection.ruleName description: Name of the rule generating the detection, as parsed from ruleText. type: String - contextPath: GoogleChronicleBackstory.StreamRules.list.detection.detection.ruleType description: Whether the rule generating this detection is a single event or multi-event rule. type: String - contextPath: GoogleChronicleBackstory.StreamRules.list.detection.detection.ruleLabels description: Information about the rule. type: Unknown - contextPath: GoogleChronicleBackstory.StreamRules.list.detection.id description: Identifier for the detection. type: String - contextPath: GoogleChronicleBackstory.StreamRules.list.detection.timeWindow.startTime description: The start time of the window the detection was found in. type: Date - contextPath: GoogleChronicleBackstory.StreamRules.list.detection.timeWindow.endTime description: The end time of the window the detection was found in. type: Date - contextPath: GoogleChronicleBackstory.StreamRules.list.detection.collectionElements.references.event.metadata.productLogId description: A vendor-specific event identifier to uniquely identify the event (a GUID). Users might use this identifier to search the vendor's proprietary console for the event in question. type: String - contextPath: GoogleChronicleBackstory.StreamRules.list.detection.collectionElements.references.event.metadata.eventTimestamp description: The GMT timestamp when the event was generated. type: Date - contextPath: GoogleChronicleBackstory.StreamRules.list.detection.collectionElements.references.event.metadata.eventType description: Specifies the type of the event. type: String - contextPath: GoogleChronicleBackstory.StreamRules.list.detection.collectionElements.references.event.metadata.vendorName description: Specifies the product vendor's name. type: String - contextPath: GoogleChronicleBackstory.StreamRules.list.detection.collectionElements.references.event.metadata.productName description: Specifies the name of the product. type: String - contextPath: GoogleChronicleBackstory.StreamRules.list.detection.collectionElements.references.event.metadata.productEventType description: Short, descriptive, human-readable, and product-specific event name or type. type: String - contextPath: GoogleChronicleBackstory.StreamRules.list.detection.collectionElements.references.event.metadata.ingestedTimestamp description: The GMT timestamp when the event was ingested in the vendor's instance. type: Date - contextPath: GoogleChronicleBackstory.StreamRules.list.detection.collectionElements.references.event.metadata.id description: Stores the ID of metadata. type: String - contextPath: GoogleChronicleBackstory.StreamRules.list.detection.collectionElements.references.event.principal.hostname description: Client hostname or domain name field. type: String - contextPath: GoogleChronicleBackstory.StreamRules.list.detection.collectionElements.references.event.principal.user.userid description: Stores the user ID. type: String - contextPath: GoogleChronicleBackstory.StreamRules.list.detection.collectionElements.references.event.principal.user.userDisplayName description: Stores the display name for the user. type: String - contextPath: GoogleChronicleBackstory.StreamRules.list.detection.collectionElements.references.event.principal.user.windowsSid description: Stores the Microsoft Windows security identifier (SID) associated with a user. type: String - contextPath: GoogleChronicleBackstory.StreamRules.list.detection.collectionElements.references.event.principal.user.emailAddresses description: Stores the email addresses for the user. type: Unknown - contextPath: GoogleChronicleBackstory.StreamRules.list.detection.collectionElements.references.event.principal.user.productObjectId description: Stores the products object ID. type: String - contextPath: GoogleChronicleBackstory.StreamRules.list.detection.collectionElements.references.event.principal.user.attribute.labels description: Stores users session metrics. type: Unknown - contextPath: GoogleChronicleBackstory.StreamRules.list.detection.collectionElements.references.event.principal.user.firstName description: Stores the first name for the user. type: String - contextPath: GoogleChronicleBackstory.StreamRules.list.detection.collectionElements.references.event.principal.user.lastName description: Stores the last name for the user. type: String - contextPath: GoogleChronicleBackstory.StreamRules.list.detection.collectionElements.references.event.principal.user.phoneNumbers description: Stores the phone numbers for the user. type: Unknown - contextPath: GoogleChronicleBackstory.StreamRules.list.detection.collectionElements.references.event.principal.user.personalAddress.city description: Stores city of user. type: String - contextPath: GoogleChronicleBackstory.StreamRules.list.detection.collectionElements.references.event.principal.user.personalAddress.state description: Stores state of user. type: String - contextPath: GoogleChronicleBackstory.StreamRules.list.detection.collectionElements.references.event.principal.user.personalAddress.name description: Stores address name of user. type: String - contextPath: GoogleChronicleBackstory.StreamRules.list.detection.collectionElements.references.event.principal.user.title description: Stores the job title for the user. type: String - contextPath: GoogleChronicleBackstory.StreamRules.list.detection.collectionElements.references.event.principal.user.companyName description: Stores users company name. type: String - contextPath: GoogleChronicleBackstory.StreamRules.list.detection.collectionElements.references.event.principal.user.department description: Stores users departments. type: Unknown - contextPath: GoogleChronicleBackstory.StreamRules.list.detection.collectionElements.references.event.principal.user.officeAddress.name description: Stores company official address name. type: String - contextPath: GoogleChronicleBackstory.StreamRules.list.detection.collectionElements.references.event.principal.process.pid description: Stores the process ID. type: String - contextPath: GoogleChronicleBackstory.StreamRules.list.detection.collectionElements.references.event.principal.process.file.fullPath description: Full path identifying the location of the file on the system. type: String - contextPath: GoogleChronicleBackstory.StreamRules.list.detection.collectionElements.references.event.principal.process.productSpecificProcessId description: Stores the product specific process ID. type: String - contextPath: GoogleChronicleBackstory.StreamRules.list.detection.collectionElements.references.event.principal.administrativeDomain description: Domain which the device belongs to (for example, the Windows domain). type: String - contextPath: GoogleChronicleBackstory.StreamRules.list.detection.collectionElements.references.event.about description: Stores event labels. type: Unknown - contextPath: GoogleChronicleBackstory.StreamRules.list.detection.collectionElements.references.event.securityResult description: Provide a description of the security result. type: Unknown - contextPath: GoogleChronicleBackstory.StreamRules.list.detection.collectionElements.references.event.network.applicationProtocol description: Indicates the network application protocol. type: String - contextPath: GoogleChronicleBackstory.StreamRules.list.detection.collectionElements.references.event.network.dns.questions description: Stores the domain name. type: Unknown - contextPath: GoogleChronicleBackstory.StreamRules.list.detection.collectionElements.references.event.network.dns.answers description: Stores dns associated data. type: Unknown - contextPath: GoogleChronicleBackstory.StreamRules.list.detection.collectionElements.label description: The variable a given set of UDM events belongs to. type: String - contextPath: GoogleChronicleBackstory.StreamRules.list.detection.detectionTime description: The time period the detection was found in. type: Date - arguments: - default: false description: |- The value of the start time for your request. The date format should comply with RFC 3339 (e.g., 2023-01-02T15:00:00Z) or relative time. If not supplied, the product considers UTC time corresponding to 3 days earlier than the current time. Formats: YYYY-MM-ddTHH:mm:ssZ, YYYY-MM-dd, N days, N hours. Example: 2023-04-25T00:00:00Z, 2023-04-25, 2 days, 5 hours, 01 Mar 2023, 01 Feb 2023 04:45:33, 15 Jun. isArray: false name: start_time required: false secret: false - default: false description: |- The value of the end time for your request. The date format should comply with RFC 3339 (e.g., 2023-01-02T15:00:00Z) or relative time. If not supplied, the product considers the current UTC time. Formats: YYYY-MM-ddTHH:mm:ssZ, YYYY-MM-dd, N days, N hours. Example: 2023-04-25T00:00:00Z, 2023-04-25, 2 days, 5 hours, 01 Mar 2023, 01 Feb 2023 04:45:33, 15 Jun. isArray: false name: end_time required: false secret: false - default: false defaultValue: '10000' description: Specify the maximum number of asset aliases to fetch. You can specify between 1 and 10000. isArray: false name: page_size required: false secret: false - auto: PREDEFINED default: false description: Specify the identifier type of the asset indicator. isArray: false name: asset_identifier_type predefined: - Host Name - IP Address - MAC Address - Product ID required: true secret: false - default: false description: Value of the asset identifier. isArray: false name: asset_identifier required: true secret: false deprecated: false description: Lists all the aliases of an asset in an enterprise for the specified asset identifier and time period. execution: false name: gcb-list-assetaliases outputs: - contextPath: GoogleChronicleBackstory.AssetAliases.asset.product_id description: Product ID associated with the asset alias. type: String - contextPath: GoogleChronicleBackstory.AssetAliases.asset.mac description: MAC address associated with the asset alias. type: String - contextPath: GoogleChronicleBackstory.AssetAliases.asset.assetIpAddress description: IP address associated with the asset alias. type: String - contextPath: GoogleChronicleBackstory.AssetAliases.asset.hostname description: Hostname associated with the asset alias. type: String - contextPath: GoogleChronicleBackstory.AssetAliases.asset.aliases.metadata.interval.startTime description: Start time of the interval from which asset aliases are found. type: Date - contextPath: GoogleChronicleBackstory.AssetAliases.asset.aliases.metadata.interval.endTime description: End time of the interval from which asset aliases are found. type: Date - contextPath: GoogleChronicleBackstory.AssetAliases.asset.aliases.entity.asset.ip description: The IP address of the asset. type: String - contextPath: GoogleChronicleBackstory.AssetAliases.asset.aliases.metadata.collectedTimestamp description: The timestamp when the data was collected. type: Date - contextPath: GoogleChronicleBackstory.AssetAliases.asset.aliases.metadata.vendorName description: The name of the vendor. type: String - contextPath: GoogleChronicleBackstory.AssetAliases.asset.aliases.metadata.productName description: The name of the product. type: String - contextPath: GoogleChronicleBackstory.AssetAliases.asset.aliases.metadata.entityType description: The type of the entity. type: String - contextPath: GoogleChronicleBackstory.AssetAliases.asset.aliases.metadata.description description: A description of the entity. type: String - contextPath: GoogleChronicleBackstory.AssetAliases.asset.aliases.entity.asset.productObjectId description: The unique identifier of the product. type: String - contextPath: GoogleChronicleBackstory.AssetAliases.asset.aliases.entity.asset.hostname description: The hostname of the asset. type: String - contextPath: GoogleChronicleBackstory.AssetAliases.asset.aliases.entity.asset.assetId description: The identifier of the asset. type: String - contextPath: GoogleChronicleBackstory.AssetAliases.asset.aliases.entity.asset.platformSoftware description: The software running on the asset. type: Unknown - contextPath: GoogleChronicleBackstory.AssetAliases.asset.aliases.entity.asset.vulnerabilities.name description: The name of the vulnerability. type: String - contextPath: GoogleChronicleBackstory.AssetAliases.asset.aliases.entity.asset.vulnerabilities.description description: A description of the vulnerability. type: String - contextPath: GoogleChronicleBackstory.AssetAliases.asset.aliases.entity.asset.vulnerabilities.scanStartTime description: The start time of the vulnerability scan. type: Date - contextPath: GoogleChronicleBackstory.AssetAliases.asset.aliases.entity.asset.vulnerabilities.scanEndTime description: The end time of the vulnerability scan. type: Date - contextPath: GoogleChronicleBackstory.AssetAliases.asset.aliases.entity.asset.vulnerabilities.firstFound description: The first time the vulnerability was found. type: Date - contextPath: GoogleChronicleBackstory.AssetAliases.asset.aliases.entity.asset.vulnerabilities.lastFound description: The most recent time the vulnerability was found. type: Date - contextPath: GoogleChronicleBackstory.AssetAliases.asset.aliases.entity.asset.platformSoftware.platformVersion description: The version of the platform software. type: String - contextPath: GoogleChronicleBackstory.AssetAliases.asset.aliases.entity.asset.networkDomain description: The network domain of the asset. type: String - contextPath: GoogleChronicleBackstory.AssetAliases.asset.aliases.entity.asset.attribute.labels.key description: The key of an attribute label associated with the asset. type: String - contextPath: GoogleChronicleBackstory.AssetAliases.asset.aliases.entity.asset.attribute.labels.value description: The value of an attribute label associated with the asset. type: String - arguments: - default: false description: Page token received from a previous call. Use to retrieve the next page. isArray: false name: page_token required: false secret: false - default: false defaultValue: '100' description: Specify the maximum number of rules to return. You can specify between 1 and 1000. isArray: false name: page_size required: false secret: false deprecated: false description: List curated rules. execution: false name: gcb-list-curatedrules outputs: - contextPath: GoogleChronicleBackstory.CuratedRules.ruleId description: Unique identifier for a rule, defined and returned by the server. type: String - contextPath: GoogleChronicleBackstory.CuratedRules.ruleName description: Name of the rule. type: String - contextPath: GoogleChronicleBackstory.CuratedRules.severity description: Severity of the rule ("Info", "Low", or "High"). type: String - contextPath: GoogleChronicleBackstory.CuratedRules.ruleType description: Type of the rule ("SINGLE_EVENT" or "MULTI_EVENT"). type: String - contextPath: GoogleChronicleBackstory.CuratedRules.precision description: Precision of the rule ("BROAD" or "PRECISE"). type: String - contextPath: GoogleChronicleBackstory.CuratedRules.tactics description: List of MITRE tactic IDs covered by the rule. type: String - contextPath: GoogleChronicleBackstory.CuratedRules.techniques description: List of MITRE technique IDs covered by the rule. type: String - contextPath: GoogleChronicleBackstory.CuratedRules.updateTime description: String representing the time the rule was last updated, in RFC 3339 format. type: Date - contextPath: GoogleChronicleBackstory.CuratedRules.ruleSet description: Unique identifier of the Chronicle rule set containing the rule. type: String - contextPath: GoogleChronicleBackstory.CuratedRules.description description: Description of the rule. type: String - contextPath: GoogleChronicleBackstory.CuratedRules.metadata.false_positives description: Metadata for the rule. type: String - contextPath: GoogleChronicleBackstory.CuratedRules.metadata.reference description: Reference for the rule. type: String - contextPath: GoogleChronicleBackstory.Token.name description: The name of the command to which the value of the nextPageToken corresponds. type: String - contextPath: GoogleChronicleBackstory.Token.nextPageToken description: A page token that can be provided to the next call to view the next page of rules. Absent if this is the last page. type: String - arguments: - default: false description: |- The value of the start time for your request. The date format should comply with RFC 3339 (e.g., 2023-01-02T15:00:00Z) or relative time. If not supplied, the product considers UTC time corresponding to 3 days earlier than the current time. Formats: YYYY-MM-ddTHH:mm:ssZ, YYYY-MM-dd, N days, N hours. Example: 2023-04-25T00:00:00Z, 2023-04-25, 2 days, 5 hours, 01 Mar 2023, 01 Feb 2023 04:45:33, 15 Jun. isArray: false name: start_time required: false secret: false - default: false description: |- The value of the end time for your request. The date format should comply with RFC 3339 (e.g., 2023-01-02T15:00:00Z) or relative time. If not supplied, the product considers the current UTC time. Formats: YYYY-MM-ddTHH:mm:ssZ, YYYY-MM-dd, N days, N hours. Example: 2023-04-25T00:00:00Z, 2023-04-25, 2 days, 5 hours, 01 Mar 2023, 01 Feb 2023 04:45:33, 15 Jun. isArray: false name: end_time required: false secret: false - default: false defaultValue: '10000' description: Specify the maximum number of user aliases to fetch. You can specify between 1 and 10000. isArray: false name: page_size required: false secret: false - auto: PREDEFINED default: false description: Specify the identifier type of the user indicator. isArray: false name: user_identifier_type predefined: - Email - Username - Windows SID - Employee ID - Product object ID required: true secret: false - default: false description: Value of the user identifier. isArray: false name: user_identifier required: true secret: false deprecated: false description: Lists all the aliases of a user in an enterprise for a specified user identifier and time period. execution: false name: gcb-list-useraliases outputs: - contextPath: GoogleChronicleBackstory.UserAliases.user.email description: Email associated with the user alias. type: String - contextPath: GoogleChronicleBackstory.UserAliases.user.username description: Username associated with the user alias. type: String - contextPath: GoogleChronicleBackstory.UserAliases.user.windows_sid description: Windows Security Identifier (SID) associated with the user alias. type: String - contextPath: GoogleChronicleBackstory.UserAliases.user.employee_id description: Employee ID associated with the user alias. type: String - contextPath: GoogleChronicleBackstory.UserAliases.user.product_object_id description: Product object ID associated with the user alias. type: String - contextPath: GoogleChronicleBackstory.UserAliases.user.aliases.metadata.collectedTimestamp description: Collected timestamp of the user alias metadata. type: Date - contextPath: GoogleChronicleBackstory.UserAliases.user.aliases.metadata.vendorName description: Vendor name associated with the user alias metadata. type: String - contextPath: GoogleChronicleBackstory.UserAliases.user.aliases.metadata.productName description: Product name associated with the user alias metadata. type: String - contextPath: GoogleChronicleBackstory.UserAliases.user.aliases.metadata.entityType description: Entity type of the user alias metadata. type: String - contextPath: GoogleChronicleBackstory.UserAliases.user.aliases.metadata.interval.startTime description: Start time of the interval from which user aliases are found. type: Date - contextPath: GoogleChronicleBackstory.UserAliases.user.aliases.metadata.interval.endTime description: End time of the interval from which user aliases are found. type: Date - contextPath: GoogleChronicleBackstory.UserAliases.user.aliases.entity.asset.productObjectId description: Product object ID associated with the user alias entity asset. type: String - contextPath: GoogleChronicleBackstory.UserAliases.user.aliases.entity.asset.hostname description: Hostname associated with the user alias entity asset. type: String - contextPath: GoogleChronicleBackstory.UserAliases.user.aliases.entity.asset.assetId description: Asset ID associated with the user alias entity asset. type: String - contextPath: GoogleChronicleBackstory.UserAliases.user.aliases.entity.asset.ip description: IP address associated with the user alias entity asset. type: String - contextPath: GoogleChronicleBackstory.UserAliases.user.aliases.entity.asset.vulnerabilities.name description: Name of the vulnerability associated with the user alias entity asset. type: String - contextPath: GoogleChronicleBackstory.UserAliases.user.aliases.entity.asset.vulnerabilities.description description: Description of the vulnerability associated with the user alias entity asset. type: String - contextPath: GoogleChronicleBackstory.UserAliases.user.aliases.entity.asset.vulnerabilities.scanStartTime description: Start time of the vulnerability scan associated with the user alias entity asset. type: Date - contextPath: GoogleChronicleBackstory.UserAliases.user.aliases.entity.asset.vulnerabilities.scanEndTime description: End time of the vulnerability scan associated with the user alias entity asset. type: Date - contextPath: GoogleChronicleBackstory.UserAliases.user.aliases.entity.asset.vulnerabilities.firstFound description: Timestamp of the first detection of the vulnerability associated with the user alias entity asset. type: Date - contextPath: GoogleChronicleBackstory.UserAliases.user.aliases.entity.asset.vulnerabilities.lastFound description: Timestamp of the last detection of the vulnerability associated with the user alias entity asset. type: Date - contextPath: GoogleChronicleBackstory.UserAliases.user.aliases.metadata.description description: Description of the user alias metadata. type: String - contextPath: GoogleChronicleBackstory.UserAliases.user.aliases.entity.asset.platformSoftware description: Platform software associated with the user alias entity asset. type: Unknown - contextPath: GoogleChronicleBackstory.UserAliases.user.aliases.entity.asset.platformSoftware.platformVersion description: Platform version of the platform software associated with the user alias entity asset. type: String - contextPath: GoogleChronicleBackstory.UserAliases.user.aliases.entity.asset.networkDomain description: Network domain associated with the user alias entity asset. type: String - contextPath: GoogleChronicleBackstory.UserAliases.user.aliases.entity.asset.attribute.labels.key description: Key of the label associated with the user alias entity asset attribute. type: String - contextPath: GoogleChronicleBackstory.UserAliases.user.aliases.entity.asset.attribute.labels.value description: Value of the label associated with the user alias entity asset attribute. type: String - contextPath: GoogleChronicleBackstory.UserAliases.user.aliases.metadata.productEntityId description: Product entity ID associated with the user alias metadata. type: String - contextPath: GoogleChronicleBackstory.UserAliases.user.aliases.entity.user.userid description: ID of the user. type: String - contextPath: GoogleChronicleBackstory.UserAliases.user.aliases.entity.user.userDisplayName description: Display name of the user. type: String - contextPath: GoogleChronicleBackstory.UserAliases.user.aliases.entity.user.productObjectId description: Stores the product's object ID. type: String - contextPath: GoogleChronicleBackstory.UserAliases.user.aliases.entity.user.title description: Title of the user. type: String - contextPath: GoogleChronicleBackstory.UserAliases.user.aliases.entity.user.companyName description: User's company name. type: String - contextPath: GoogleChronicleBackstory.UserAliases.user.aliases.relations.entity.asset.hostname description: Hostname associated with the relations entity asset. type: String - contextPath: GoogleChronicleBackstory.UserAliases.user.aliases.relations.entity.asset.hardware description: Hardware information associated with the relations entity asset. type: Unknown - contextPath: GoogleChronicleBackstory.UserAliases.user.aliases.relations.entity.asset.systemLastUpdateTime description: Last update time of the system associated with the relations entity asset. type: Date - contextPath: GoogleChronicleBackstory.UserAliases.user.aliases.relations.entityType description: Entity type of the relations entity. type: String - contextPath: GoogleChronicleBackstory.UserAliases.user.aliases.relations.relationship description: Relationship between entities in the relations. type: String - arguments: - default: false description: Unique identifier for a curated rule, defined and returned by the server. You can specify exactly one curated rule identifier. isArray: false name: id required: true secret: false - auto: PREDEFINED default: false description: |- Filter detections based on whether the alert state is ALERTING or NOT_ALERTING. Do not specify to return all detections. isArray: false name: alert_state predefined: - ALERTING - NOT_ALERTING required: false secret: false - default: false defaultValue: '100' description: Specify the limit on the number of detections to display. You can specify between 1 and 1000. isArray: false name: page_size required: false secret: false - default: false description: A page token received from a previous call. Provide this to retrieve the subsequent page. If the page token is configured, overrides the detection start and end time arguments. isArray: false name: page_token required: false secret: false - auto: PREDEFINED default: false description: Sort detections by "DETECTION_TIME" or by "CREATED_TIME". If not specified, it defaults to "DETECTION_TIME". Detections are returned in descending order of the timestamp. isArray: false name: list_basis predefined: - DETECTION_TIME - CREATED_TIME required: false secret: false - default: false description: |- Start time of the time range to return detections for, filtered by the detection field specified in the list_basis parameter. If not specified, the start time is treated as open-ended. Formats: YYYY-MM-ddTHH:mm:ssZ, YYYY-MM-dd, N days, N hours. Example: 2023-05-01T00:00:00Z, 2023-05-01, 2 days, 5 hours, 01 Mar 2021, 01 Feb 2023 04:45:33, 15 Jun. isArray: false name: start_time required: false secret: false - default: false description: |- End time of the time range to return detections for, filtered by the detection field specified by the list_basis parameter. If not specified, the end time is treated as open-ended. Formats: YYYY-MM-ddTHH:mm:ssZ, YYYY-MM-dd, N days, N hours. Example: 2023-05-01T00:00:00Z, 2023-05-01, 2 days, 5 hours, 01 Mar 2023, 01 Feb 2021 04:45:33, 15 Jun. isArray: false name: end_time required: false secret: false deprecated: false description: Return the detections for the specified curated rule identifier. execution: false name: gcb-list-curatedrule-detections outputs: - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.id description: Identifier for the detection. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.ruleId description: Identifier for the rule generating the detection. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.ruleName description: Name of the rule generating the detection, as parsed from ruleText. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.ruleSet description: The identifier of the Chronicle rule set that generated this detection. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.ruleSetDisplayName description: The display name of the Chronicle rule set that generated this detection. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.tags description: A list of MITRE tactic and technique IDs covered by the Chronicle rule. type: Unknown - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.timeWindowStartTime description: The start time of the window the detection was found in. type: Date - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.timeWindowEndTime description: The end time of the window the detection was found in. type: Date - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.alertState description: Indicates whether the rule generating this detection currently has alerting enabled or disabled. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.description description: Description of the Chronicle rule that generated the detection. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.urlBackToProduct description: URL pointing to the Chronicle UI for this detection. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.type description: Type of detection. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.createdTime description: Time the detection was created. type: Date - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.detectionTime description: The time period the detection was found in. type: Date - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.lastUpdatedTime description: The time period of when the detection was last updated. type: Date - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.riskScore description: Risk score of the detection. type: Number - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.severity description: Severity of the detection ("INFORMATIONAL" or "LOW" or "HIGH"). type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.summary description: Summary for the generated detection. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.ruleType description: Whether the rule generating this detection is a single event or multi-event rule. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.detectionFields.key description: The key for a field specified in the rule, for MULTI_EVENT rules. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.detectionFields.source description: The source for a field specified in the rule, for MULTI_EVENT rules. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.detectionFields.value description: The value for a field specified in the rule, for MULTI_EVENT rules. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.outcomes.key description: The key for a field specified in the outcomes of the detection, for "MULTI_EVENT" rules. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.outcomes.source description: The source for a field specified in the outcomes of the detection, for "MULTI_EVENT" rules. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.outcomes.value description: The value for a field specified in the outcomes of the detection, for "MULTI_EVENT" rules. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.ruleLabels.key description: The key for a field specified in the Chronicle rule metadata. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.ruleLabels.value description: The value for a field specified in the Chronicle rule metadata. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.label description: The variable a given set of UDM events belongs to. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principalAssetIdentifier description: Specifies the principal asset identifier of the event. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.targetAssetIdentifier description: Specifies the target asset identifier of the event. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.collectedTimestamp description: The GMT timestamp when the event was collected. type: Date - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.eventType description: Specifies the type of the event. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.eventTimestamp description: The GMT timestamp when the event was generated. type: Date - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.id description: The event ID. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.ingestedTimestamp description: The GMT timestamp when the event was ingested in the vendor's instance. type: Date - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.ingestionLabels.key description: The key for a field specified in the ingestion labels of the event. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.ingestionLabels.value description: The value for a field specified in the ingestion labels of the event. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.logType description: Type of log. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.description description: Human-readable description of the event. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.productEventType description: Short, descriptive, human-readable, and product-specific event name or type. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.productLogId description: A vendor-specific event identifier to uniquely identify the event (a GUID). Users might use this identifier to search the vendor's proprietary console for the event in question. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.productName description: Specifies the name of the product. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.productVersion description: Specifies the version of the product. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.urlBackToProduct description: URL linking to a relevant website where you can view more information about this specific event or the general event category. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.vendorName description: Specifies the product vendor's name. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.assetId description: Vendor-specific unique device identifier. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.email description: Email address. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.hostname description: Client hostname or domain name field. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.platform description: Platform operating system. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.platformPatchLevel description: Platform operating system patch level. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.platformVersion description: Platform operating system version. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.ip description: IP address associated with a network connection. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.ipGeoArtifact.ip description: IP address associated with a network connection for IP Geolocation. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.ipGeoArtifact.location.countryOrRegion description: Associated country or region for IP Geolocation. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.ipGeoArtifact.location.regionCoordinates.latitude description: Latitude coordinates of the region for IP Geolocation. type: Number - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.ipGeoArtifact.location.regionCoordinates.longitude description: Longitude coordinates of the region for IP Geolocation. type: Number - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.ipGeoArtifact.location.regionLatitude description: Latitude of the region for IP Geolocation. type: Number - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.ipGeoArtifact.location.regionLongitude description: Longitude of the region for IP Geolocation. type: Number - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.ipGeoArtifact.location.state description: Associated state of IP Geolocation. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.ipGeoArtifact.network.asn description: Associated ASN with a network connection for IP Geolocation. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.ipGeoArtifact.network.carrierName description: Associated carrier name with a network connection for IP Geolocation. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.ipGeoArtifact.network.dnsDomain description: Associated DNS domain with a network connection for IP Geolocation. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.ipGeoArtifact.network.organizationName description: Associated organization name with a network connection for IP Geolocation. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.ipLocation.countryOrRegion description: Associated country or region for the IP location. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.ipLocation.regionCoordinates.latitude description: Latitude coordinates of the region for the IP location. type: Number - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.ipLocation.regionCoordinates.longitude description: Longitude coordinates of the region for IP location. type: Number - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.ipLocation.regionLatitude description: Latitude of the region for the IP location. type: Number - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.ipLocation.regionLongitude description: Longitude of the region for the IP location. type: Number - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.ipLocation.state description: Associated state of the IP location. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.labels.key description: The key for a field specified in the principal labels of the event. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.labels.value description: The value for a field specified in the principal labels of the event. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.location.countryOrRegion description: Associated country or region for the principal location. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.location.regionCoordinates.latitude description: Latitude coordinates of the region for the principal location. type: Number - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.location.regionCoordinates.longitude description: Longitude coordinates of the region for the principal location. type: Number - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.location.regionLatitude description: Latitude of the region for the principal location. type: Number - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.location.regionLongitude description: Longitude of the region for the principal location. type: Number - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.location.state description: Associated state of the principal location. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.resource.attribute.cloud.project.name description: Associated name of the project specified in the principal resource. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.resource.attribute.cloud.project.resourceSubtype description: Associated resource sub-type of the project specified in the principal resource. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.resource.attribute.labels.key description: The key for a field specified in the principal resource labels of the event. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.resource.attribute.labels.value description: The value for a field specified in the principal resource labels of the event. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.user.attribute.cloud.environment description: Associated environment specified in the principal user. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.user.attribute.cloud.project.id description: Associated ID of the project specified in the principal user. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.user.attribute.permissions.name description: Associated name of the permission specified in the principal user. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.user.attribute.permissions.type description: Associated type of the permission specified in the principal user. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.user.attribute.roles.description description: Associated description of the role specified in the principal user. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.user.attribute.roles.name description: Associated name of the role specified in the principal user. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.user.attribute.roles.type description: Associated type of the role specified in the principal user. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.port description: Source or destination network port number when a specific network connection is described within an event. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.mac description: MAC addresses associated with a device. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.administrativeDomain description: Domain that the device belongs to (for example, the Windows domain). type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.url description: Standard URL. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.file.fileMetadata description: Metadata associated with the file. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.file.fullPath description: Full path identifying the location of the file on the system. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.file.md5 description: MD5 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.file.mimeType description: Multipurpose Internet Mail Extensions (MIME) type of the file. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.file.sha1 description: SHA-1 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.file.sha256 description: SHA-256 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.file.size description: Size of the file. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.process.commandLine description: Stores the command line string for the process. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.process.productSpecificProcessId description: Stores the product specific process ID. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.process.productSpecificParentProcessId description: Stores the product specific process ID for the parent process. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.process.file description: Stores the file name of the file in use by the process. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.process.file.fileMetadata description: Metadata associated with the file. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.process.file.fullPath description: Full path identifying the location of the file on the system. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.process.file.md5 description: MD5 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.process.file.mimeType description: Multipurpose Internet Mail Extensions (MIME) type of the file. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.process.file.sha1 description: SHA-1 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.process.file.sha256 description: SHA-256 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.process.file.size description: Size of the file. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.process.parentPid description: Stores the process ID for the parent process. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.process.pid description: Stores the process ID. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.registry.registryKey description: Stores the registry key associated with an application or system component. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.registry.registryValueName description: Stores the name of the registry value associated with an application or system component. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.registry.registryValueData description: Stores the data associated with a registry value. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.user.emailAddresses description: Stores the email addresses for the user. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.user.productObjectId description: Stores the product object ID for the user. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.user.employeeId description: Stores the human resources employee ID for the user. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.user.firstName description: Stores the first name for the user. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.user.middleName description: Stores the middle name for the user. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.user.lastName description: Stores the last name for the user. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.user.groupid description: Stores the group ID associated with a user. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.user.phoneNumbers description: Stores the phone numbers for the user. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.user.title description: Stores the job title for the user. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.user.userDisplayName description: Stores the display name for the user. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.user.userid description: Stores the user ID. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.principal.user.windowsSid description: Stores the Microsoft Windows security identifier (SID) associated with a user. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.target.assetId description: Vendor-specific unique device identifier. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.target.email description: Email address. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.target.hostname description: Client hostname or domain name field. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.target.platform description: Platform operating system. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.target.platformPatchLevel description: Platform operating system patch level. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.target.platformVersion description: Platform operating system version. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.target.ip description: IP address associated with a network connection. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.target.port description: Source or destination network port number when a specific network connection is described within an event. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.target.mac description: One or more MAC addresses associated with a device. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.target.administrativeDomain description: Domain for which the device belongs to (for example, the Windows domain). type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.target.application description: Application of the target related to the event. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.target.cloud.availabilityZone description: Associated availability zone specified in the event target. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.target.cloud.environment description: Associated environment specified in the event target. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.target.cloud.project.name description: Associated name of the project specified in the event target. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.target.cloud.vpc description: Associated VPC specified in the event target. type: Unknown - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.target.resource.name description: Associated resource name specified in the event target. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.target.resource.productObjectId description: Associated product object ID specified in the event target. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.target.resource.resourceType description: Associated resource type specified in the event target. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.target.resource.attribute.labels.key description: The key for a field specified in the principal resource labels of the event. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.target.resource.attribute.labels.value description: The value for a field specified in the principal resource labels of the event. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.target.url description: Standard URL. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.target.file.fileMetadata description: Metadata associated with the file. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.target.file.fullPath description: Full path identifying the location of the file on the system. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.target.file.md5 description: MD5 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.target.file.mimeType description: Multipurpose Internet Mail Extensions (MIME) type of the file. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.target.file.sha1 description: SHA-1 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.target.file.sha256 description: SHA-256 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.target.file.size description: Size of the file. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.target.process.commandLine description: Stores the command line string for the process. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.target.process.productSpecificProcessId description: Stores the product specific process ID. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.target.process.productSpecificParentProcessId description: Stores the product specific process ID for the parent process. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.target.process.file description: Stores the file name of the file in use by the process. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.target.process.file.fileMetadata description: Metadata associated with the file. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.target.process.file.fullPath description: Full path identifying the location of the file on the system. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.target.process.file.md5 description: MD5 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.target.process.file.mimeType description: Multipurpose Internet Mail Extensions (MIME) type of the file. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.target.process.file.sha1 description: SHA-1 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.target.process.file.sha256 description: SHA-256 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.target.process.file.size description: Size of the file. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.target.process.parentPid description: Stores the process ID for the parent process. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.target.process.pid description: Stores the process ID. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.target.registry.registryKey description: Stores the registry key associated with an application or system component. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.target.registry.registryValueName description: Stores the name of the registry value associated with an application or system component. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.target.registry.registryValueData description: Stores the data associated with a registry value. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.target.user.attribute.cloud.environment description: Associated environment specified in the target user. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.target.user.attribute.cloud.project.id description: Associated ID of the project specified in the target user. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.target.user.attribute.roles.name description: Associated name of the role specified in the target user. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.target.user.attribute.roles.type description: Associated type of the role specified in the target user. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.target.user.emailAddresses description: Stores the email addresses for the user. type: Unknown - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.target.user.productObjectId description: Stores the human resources product object ID for the user. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.target.user.employeeId description: Stores the human resources employee ID for the user. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.target.user.firstName description: Stores the first name for the user. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.target.user.middleName description: Stores the middle name for the user. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.target.user.lastName description: Stores the last name for the user. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.target.user.groupid description: Stores the group ID associated with a user. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.target.user.phoneNumbers description: Stores the phone numbers for the user. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.target.user.title description: Stores the job title for the user. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.target.user.userDisplayName description: Stores the display name for the user. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.target.user.userid description: Stores the user ID. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.target.user.windowsSid description: Stores the Microsoft Windows security identifier (SID) associated with a user. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.intermediary.assetId description: Vendor-specific unique device identifier. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.intermediary.email description: Email address. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.intermediary.hostname description: Client hostname or domain name field. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.intermediary.platform description: Platform operating system. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.intermediary.platformPatchLevel description: Platform operating system patch level. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.intermediary.platformVersion description: Platform operating system version. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.intermediary.ip description: IP address associated with a network connection. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.intermediary.port description: Source or destination network port number when a specific network connection is described within an event. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.intermediary.mac description: One or more MAC addresses associated with a device. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.intermediary.administrativeDomain description: Domain that the device belongs to (for example, the Windows domain). type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.intermediary.url description: Standard URL. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.intermediary.file.fileMetadata description: Metadata associated with the file. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.intermediary.file.fullPath description: Full path identifying the location of the file on the system. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.intermediary.file.md5 description: MD5 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.intermediary.file.mimeType description: Multipurpose Internet Mail Extensions (MIME) type of the file. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.intermediary.file.sha1 description: SHA-1 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.intermediary.file.sha256 description: SHA-256 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.intermediary.file.size description: Size of the file. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.intermediary.process.commandLine description: Stores the command line string for the process. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.intermediary.process.productSpecificProcessId description: Stores the product specific process ID. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.intermediary.process.productSpecificParentProcessId description: Stores the product specific process ID for the parent process. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.intermediary.process.file description: Stores the file name of the file in use by the process. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.intermediary.process.file.fileMetadata description: Metadata associated with the file. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.intermediary.process.file.fullPath description: Full path identifying the location of the file on the system. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.intermediary.process.file.md5 description: MD5 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.intermediary.process.file.mimeType description: Multipurpose Internet Mail Extensions (MIME) type of the file. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.intermediary.process.file.sha1 description: SHA-1 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.intermediary.process.file.sha256 description: SHA-256 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.intermediary.process.file.size description: Size of the file. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.intermediary.process.parentPid description: Stores the process ID for the parent process. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.intermediary.process.pid description: Stores the process ID. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.intermediary.registry.registryKey description: Stores the registry key associated with an application or system component. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.intermediary.registry.registryValueName description: Stores the name of the registry value associated with an application or system component. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.intermediary.registry.registryValueData description: Stores the data associated with a registry value. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.intermediary.user.emailAddresses description: Stores the email addresses for the user. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.intermediary.user.employeeId description: Stores the human resources employee ID for the user. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.intermediary.user.firstName description: Stores the first name for the user. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.intermediary.user.middleName description: Stores the middle name for the user. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.intermediary.user.lastName description: Stores the last name for the user. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.intermediary.user.groupid description: Stores the group ID associated with a user. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.intermediary.user.phoneNumbers description: Stores the phone numbers for the user. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.intermediary.user.title description: Stores the job title for the user. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.intermediary.user.userDisplayName description: Stores the display name for the user. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.intermediary.user.userid description: Stores the user ID. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.intermediary.user.windowsSid description: Stores the Microsoft Windows security identifier (SID) associated with a user. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.src.assetId description: Vendor-specific unique device identifier. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.src.email description: Email address. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.src.hostname description: Client hostname or domain name field. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.src.platform description: Platform operating system. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.src.platformPatchLevel description: Platform operating system patch level. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.src.platformVersion description: Platform operating system version. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.src.ip description: IP address associated with a network connection. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.src.port description: Source or destination network port number when a specific network connection is described within an event. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.src.mac description: One or more MAC addresses associated with a device. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.src.administrativeDomain description: Domain that the device belongs to (for example, the Windows domain). type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.src.url description: Standard URL. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.src.file.fileMetadata description: Metadata associated with the file. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.src.file.fullPath description: Full path identifying the location of the file on the system. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.src.file.md5 description: MD5 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.src.file.mimeType description: Multipurpose Internet Mail Extensions (MIME) type of the file. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.src.file.sha1 description: SHA-1 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.src.file.sha256 description: SHA-256 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.src.file.size description: Size of the file. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.src.process.commandLine description: Stores the command line string for the process. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.src.process.productSpecificProcessId description: Stores the product specific process ID. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.src.process.productSpecificParentProcessId description: Stores the product specific process ID for the parent process. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.src.process.file description: Stores the file name of the file in use by the process. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.src.process.file.fileMetadata description: Metadata associated with the file. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.src.process.file.fullPath description: Full path identifying the location of the file on the system. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.src.process.file.md5 description: MD5 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.src.process.file.mimeType description: Multipurpose Internet Mail Extensions (MIME) type of the file. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.src.process.file.sha1 description: SHA-1 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.src.process.file.sha256 description: SHA-256 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.src.process.file.size description: Size of the file. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.src.process.parentPid description: Stores the process ID for the parent process. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.src.process.pid description: Stores the process ID. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.src.registry.registryKey description: Stores the registry key associated with an application or system component. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.src.registry.registryValueName description: Stores the name of the registry value associated with an application or system component. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.src.registry.registryValueData description: Stores the data associated with a registry value. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.src.user.emailAddresses description: Stores the email addresses for the user. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.src.user.employeeId description: Stores the human resources employee ID for the user. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.src.user.firstName description: Stores the first name for the user. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.src.user.middleName description: Stores the middle name for the user. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.src.user.lastName description: Stores the last name for the user. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.src.user.groupid description: Stores the group ID associated with a user. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.src.user.phoneNumbers description: Stores the phone numbers for the user. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.src.user.title description: Stores the job title for the user. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.src.user.userDisplayName description: Stores the display name for the user. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.src.user.userid description: Stores the user ID. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.src.user.windowsSid description: Stores the Microsoft Windows security identifier (SID) associated with a user. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.observer.assetId description: Vendor-specific unique device identifier. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.observer.email description: Email address. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.observer.hostname description: Client hostname or domain name field. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.observer.platform description: Platform operating system. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.observer.platformPatchLevel description: Platform operating system patch level. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.observer.platformVersion description: Platform operating system version. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.observer.ip description: IP address associated with a network connection. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.observer.port description: Source or destination network port number when a specific network connection is described within an event. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.observer.mac description: One or more MAC addresses associated with a device. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.observer.administrativeDomain description: Domain that the device belongs to (for example, the Windows domain). type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.observer.url description: Standard URL. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.observer.file.fileMetadata description: Metadata associated with the file. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.observer.file.fullPath description: Full path identifying the location of the file on the system. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.observer.file.md5 description: MD5 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.observer.file.mimeType description: Multipurpose Internet Mail Extensions (MIME) type of the file. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.observer.file.sha1 description: SHA-1 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.observer.file.sha256 description: SHA-256 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.observer.file.size description: Size of the file. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.observer.process.commandLine description: Stores the command line string for the process. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.observer.process.productSpecificProcessId description: Stores the product specific process ID. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.observer.process.productSpecificParentProcessId description: Stores the product specific process ID for the parent process. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.observer.process.file description: Stores the file name of the file in use by the process. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.observer.process.file.fileMetadata description: Metadata associated with the file. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.observer.process.file.fullPath description: Full path identifying the location of the file on the system. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.observer.process.file.md5 description: MD5 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.observer.process.file.mimeType description: Multipurpose Internet Mail Extensions (MIME) type of the file. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.observer.process.file.sha1 description: SHA-1 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.observer.process.file.sha256 description: SHA-256 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.observer.process.file.size description: Size of the file. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.observer.process.parentPid description: Stores the process ID for the parent process. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.observer.process.pid description: Stores the process ID. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.observer.registry.registryKey description: Stores the registry key associated with an application or system component. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.observer.registry.registryValueName description: Stores the name of the registry value associated with an application or system component. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.observer.registry.registryValueData description: Stores the data associated with a registry value. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.observer.user.emailAddresses description: Stores the email addresses for the user. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.observer.user.employeeId description: Stores the human resources employee ID for the user. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.observer.user.firstName description: Stores the first name for the user. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.observer.user.middleName description: Stores the middle name for the user. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.observer.user.lastName description: Stores the last name for the user. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.observer.user.groupid description: Stores the group ID associated with a user. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.observer.user.phoneNumbers description: Stores the phone numbers for the user. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.observer.user.title description: Stores the job title for the user. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.observer.user.userDisplayName description: Stores the display name for the user. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.observer.user.userid description: Stores the user ID. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.observer.user.windowsSid description: Stores the Microsoft Windows security identifier (SID) associated with a user. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.about.assetId description: Vendor-specific unique device identifier. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.about.email description: Email address. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.about.hostname description: Client hostname or domain name field. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.about.platform description: Platform operating system. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.about.platformPatchLevel description: Platform operating system patch level. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.about.platformVersion description: Platform operating system version. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.about.ip description: IP address associated with a network connection. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.about.port description: Source or destination network port number when a specific network connection is described within an event. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.about.mac description: One or more MAC addresses associated with a device. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.about.administrativeDomain description: Domain that the device belongs to (for example, the Windows domain). type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.about.url description: Standard URL. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.about.file.fileMetadata description: Metadata associated with the file. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.about.file.fullPath description: Full path identifying the location of the file on the system. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.about.file.md5 description: MD5 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.about.file.mimeType description: Multipurpose Internet Mail Extensions (MIME) type of the file. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.about.file.sha1 description: SHA-1 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.about.file.sha256 description: SHA-256 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.about.file.size description: Size of the file. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.about.process.commandLine description: Stores the command line string for the process. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.about.process.productSpecificProcessId description: Stores the product specific process ID. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.about.process.productSpecificParentProcessId description: Stores the product specific process ID for the parent process. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.about.process.file description: Stores the file name of the file in use by the process. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.about.process.file.fileMetadata description: Metadata associated with the file. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.about.process.file.fullPath description: Full path identifying the location of the file on the system. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.about.process.file.md5 description: MD5 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.about.process.file.mimeType description: Multipurpose Internet Mail Extensions (MIME) type of the file. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.about.process.file.sha1 description: SHA-1 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.about.process.file.sha256 description: SHA-256 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.about.process.file.size description: Size of the file. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.about.process.parentPid description: Stores the process ID for the parent process. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.about.process.pid description: Stores the process ID. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.about.registry.registryKey description: Stores the registry key associated with an application or system component. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.about.registry.registryValueName description: Stores the name of the registry value associated with an application or system component. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.about.registry.registryValueData description: Stores the data associated with a registry value. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.about.user.emailAddresses description: Stores the email addresses for the user. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.about.user.employeeId description: Stores the human resources employee ID for the user. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.about.user.firstName description: Stores the first name for the user. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.about.user.middleName description: Stores the middle name for the user. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.about.user.lastName description: Stores the last name for the user. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.about.user.groupid description: Stores the group ID associated with a user. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.about.user.phoneNumbers description: Stores the phone numbers for the user. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.about.user.title description: Stores the job title for the user. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.about.user.userDisplayName description: Stores the display name for the user. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.about.user.userid description: Stores the user ID. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.about.user.windowsSid description: Stores the Microsoft Windows security identifier (SID) associated with a user. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.network.applicationProtocol description: Indicates the network application protocol. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.network.direction description: Indicates the direction of network traffic. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.network.email description: Specifies the email address for the sender/recipient. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.network.ipProtocol description: Indicates the IP protocol. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.network.receivedBytes description: Specifies the number of bytes received. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.network.sentBytes description: Specifies the number of bytes sent. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.network.dhcp.clientHostname description: Hostname for the client. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.network.dhcp.clientIdentifier description: Client identifier. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.network.dhcp.file description: Filename for the boot image. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.network.dhcp.flags description: Value for the DHCP flags field. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.network.dhcp.hlen description: Hardware address length. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.network.dhcp.hops description: DHCP hop count. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.network.dhcp.htype description: Hardware address type. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.network.dhcp.leaseTimeSeconds description: Client-requested lease time for an IP address in seconds. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.network.dhcp.opcode description: BOOTP op code. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.network.dhcp.requestedAddress description: Client identifier. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.network.dhcp.seconds description: Seconds elapsed since the client began the address acquisition/renewal process. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.network.dhcp.sname description: Name of the server that the client has requested to boot from. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.network.dhcp.transactionId description: Client transaction ID. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.network.dhcp.type description: DHCP message type. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.network.dhcp.chaddr description: IP address for the client hardware. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.network.dhcp.ciaddr description: IP address for the client. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.network.dhcp.giaddr description: IP address for the relay agent. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.network.dhcp.siaddr description: IP address for the next bootstrap server. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.network.dhcp.yiaddr description: Your IP address. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.network.dns.authoritative description: Set to true for authoritative DNS servers. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.network.dns.id description: Stores the DNS query identifier. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.network.dns.response description: Set to true if the event is a DNS response. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.network.dns.opcode description: Stores the DNS OpCode used to specify the type of DNS query (standard, inverse, server status, etc.). type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.network.dns.recursionAvailable description: Set to true if a recursive DNS lookup is available. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.network.dns.recursionDesired description: Set to true if a recursive DNS lookup is requested. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.network.dns.responseCode description: Stores the DNS response code as defined by RFC 1035, Domain Names - Implementation and Specification. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.network.dns.truncated description: Set to true if this is a truncated DNS response. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.network.dns.questions.name description: Stores the domain name. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.network.dns.questions.class description: Stores the code specifying the class of the query. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.network.dns.questions.type description: Stores the code specifying the type of the query. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.network.dns.answers.binaryData description: Stores the raw bytes of any non-UTF8 strings that might be included as part of a DNS response. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.network.dns.answers.class description: Stores the code specifying the class of the resource record. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.network.dns.answers.data description: Stores the payload or response to the DNS question for all responses encoded in UTF-8 format. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.network.dns.answers.name description: Stores the name of the owner of the resource record. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.network.dns.answers.ttl description: Stores the time interval for which the resource record can be cached before the source of the information should again be queried. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.network.dns.answers.type description: Stores the code specifying the type of the resource record. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.network.dns.authority.binaryData description: Stores the raw bytes of any non-UTF8 strings that might be included as part of a DNS response. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.network.dns.authority.class description: Stores the code specifying the class of the resource record. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.network.dns.authority.data description: Stores the payload or response to the DNS question for all responses encoded in UTF-8 format. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.network.dns.authority.name description: Stores the name of the owner of the resource record. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.network.dns.authority.ttl description: Stores the time interval for which the resource record can be cached before the source of the information should again be queried. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.network.dns.authority.type description: Stores the code specifying the type of the resource record. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.network.dns.additional.binaryData description: Stores the raw bytes of any non-UTF8 strings that might be included as part of a DNS response. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.network.dns.additional.class description: Stores the code specifying the class of the resource record. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.network.dns.additional.data description: Stores the payload or response to the DNS question for all responses encoded in UTF-8 format. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.network.dns.additional.name description: Stores the name of the owner of the resource record. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.network.dns.additional.ttl description: Stores the time interval for which the resource record can be cached before the source of the information should again be queried. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.network.dns.additional.type description: Stores the code specifying the type of the resource record. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.network.email.from description: Stores the from email address. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.network.email.replyTo description: Stores the reply_to email address. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.network.email.to description: Stores the to email addresses. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.network.email.cc description: Stores the cc email addresses. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.network.email.bcc description: Stores the bcc email addresses. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.network.email.mailId description: Stores the mail (or message) ID. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.network.email.subject description: Stores the email subject line. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.network.ftp.command description: Stores the FTP command. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.network.http.method description: Stores the HTTP request method. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.network.http.referralUrl description: Stores the URL for the HTTP referer. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.network.http.responseCode description: Stores the HTTP response status code, which indicates whether a specific HTTP request has been successfully completed. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.network.http.useragent description: Stores the User-Agent request header which includes the application type, operating system, software vendor or software version of the requesting software user agent. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.authentication.authType description: Type of system an authentication event is associated with (Chronicle UDM). type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.authentication.mechanism description: Mechanism(s) used for authentication. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.securityResult.about description: Provide a description of the security result. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.securityResult.action description: Specify a security action. type: Unknown - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.securityResult.category description: Specify a security category. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.securityResult.categoryDetails description: Specify the security category details. type: Unknown - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.securityResult.detectionFields.key description: The key for a field specified in the security result, for MULTI_EVENT rules. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.securityResult.detectionFields.value description: The value for a field specified in the security result, for MULTI_EVENT rules. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.securityResult.confidence description: Specify a confidence with regards to a security event as estimated by the product. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.securityResult.confidenceDetails description: Additional details with regards to the confidence of a security event as estimated by the product vendor. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.securityResult.priority description: Specify a priority with regards to a security event as estimated by the product vendor. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.securityResult.priorityDetails description: Vendor-specific information about the security result priority. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.securityResult.ruleId description: Identifier for the security rule. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.securityResult.ruleName description: Name of the security rule. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.securityResult.severity description: Severity of a security event as estimated by the product vendor using values defined by the Chronicle UDM. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.securityResult.severityDetails description: Severity for a security event as estimated by the product vendor. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.securityResult.threatName description: Name of the security threat. type: String - contextPath: GoogleChronicleBackstory.CuratedRuleDetections.collectionElements.references.securityResult.urlBackToProduct description: URL to direct you to the source product console for this security event. type: String - contextPath: GoogleChronicleBackstory.Token.name description: The name of the command to which the value of the nextPageToken corresponds. type: String - contextPath: GoogleChronicleBackstory.Token.nextPageToken description: A page token that can be provided to the next call to view the next page of detections. Absent if this is the last page. type: String - arguments: - default: false description: 'The value of the start time for your request. The date format should comply with RFC 3339 (e.g., 2023-01-02T15:00:00Z) or relative time. If not supplied, the product considers UTC time corresponding to 3 days earlier than the current time. Formats: YYYY-MM-ddTHH:mm:ssZ, YYYY-MM-dd, N days, N hours. If the date is supplied in duration, it will be calculated as time.now() - duration. Example: 2023-04-25T00:00:00Z, 2023-04-25, 2 days, 5 hours, 01 Mar 2023, 01 Feb 2023 04:45:33, 15 Jun.' isArray: false name: start_time required: false secret: false - default: false description: 'The value of the end time for your request. The date format should comply with RFC 3339 (e.g., 2023-01-02T15:00:00Z) or relative time. If not supplied, the product considers current UTC time. Formats: YYYY-MM-ddTHH:mm:ssZ, YYYY-MM-dd, N days, N hours. If the date is supplied in duration, it will be calculated as time.now() - duration. Example: 2023-04-25T00:00:00Z, 2023-04-25, 2 days, 5 hours, 01 Mar 2023, 01 Feb 2023 04:45:33, 15 Jun.' isArray: false name: end_time required: false secret: false - default: false defaultValue: '200' description: Specify the maximum number of matched events to return. You can specify between 1 and 1000. isArray: false name: limit required: false secret: false - default: false description: UDM search query. isArray: false name: query required: true secret: false deprecated: false description: "Lists the events for the specified UDM Search query.\nNote: The underlying API has the rate limit of 120 queries per hour." execution: false name: gcb-udm-search outputs: - contextPath: GoogleChronicleBackstory.Events.eventType description: Specifies the type of the event. type: String - contextPath: GoogleChronicleBackstory.Events.eventTimestamp description: The GMT timestamp when the event was generated. type: Date - contextPath: GoogleChronicleBackstory.Events.id description: The event ID. type: String - contextPath: GoogleChronicleBackstory.Events.ingestedTimestamp description: The GMT timestamp when the event was ingested in the vendor's instance. type: Date - contextPath: GoogleChronicleBackstory.Events.ingestionLabels.key description: The key for a field specified in the ingestion labels of the event. type: String - contextPath: GoogleChronicleBackstory.Events.ingestionLabels.value description: The value for a field specified in the ingestion labels of the event. type: String - contextPath: GoogleChronicleBackstory.Events.collectedTimestamp description: The GMT timestamp when the event was collected by the vendor's local collection infrastructure. type: Date - contextPath: GoogleChronicleBackstory.Events.logType description: Type of log. type: String - contextPath: GoogleChronicleBackstory.Events.description description: Human-readable description of the event. type: String - contextPath: GoogleChronicleBackstory.Events.productEventType description: Short, descriptive, human-readable, and product-specific event name or type. type: String - contextPath: GoogleChronicleBackstory.Events.productLogId description: A vendor-specific event identifier to uniquely identify the event (a GUID). Users might use this identifier to search the vendor's proprietary console for the event in question. type: String - contextPath: GoogleChronicleBackstory.Events.productName description: Specifies the name of the product. type: String - contextPath: GoogleChronicleBackstory.Events.productVersion description: Specifies the version of the product. type: String - contextPath: GoogleChronicleBackstory.Events.urlBackToProduct description: URL linking to a relevant website where you can view more information about this specific event or the general event category. type: String - contextPath: GoogleChronicleBackstory.Events.vendorName description: Specifies the product vendor's name. type: String - contextPath: GoogleChronicleBackstory.Events.principal.assetId description: Vendor-specific unique device identifier. type: String - contextPath: GoogleChronicleBackstory.Events.principal.email description: Email address. type: String - contextPath: GoogleChronicleBackstory.Events.principal.hostname description: Client hostname or domain name field. type: String - contextPath: GoogleChronicleBackstory.Events.principal.platform description: Platform operating system. type: String - contextPath: GoogleChronicleBackstory.Events.principal.platformPatchLevel description: Platform operating system patch level. type: String - contextPath: GoogleChronicleBackstory.Events.principal.platformVersion description: Platform operating system version. type: String - contextPath: GoogleChronicleBackstory.Events.principal.ip description: IP address associated with a network connection. type: String - contextPath: GoogleChronicleBackstory.Events.principal.ipGeoArtifact.ip description: IP address associated with a network connection for IP Geolocation. type: String - contextPath: GoogleChronicleBackstory.Events.principal.ipGeoArtifact.location.countryOrRegion description: Associated country or region for IP Geolocation. type: String - contextPath: GoogleChronicleBackstory.Events.principal.ipGeoArtifact.location.regionCoordinates.latitude description: Latitude coordinates of the region for IP Geolocation. type: Number - contextPath: GoogleChronicleBackstory.Events.principal.ipGeoArtifact.location.regionCoordinates.longitude description: Longitude coordinates of the region for IP Geolocation. type: Number - contextPath: GoogleChronicleBackstory.Events.principal.ipGeoArtifact.location.regionLatitude description: Latitude of the region for IP Geolocation. type: Number - contextPath: GoogleChronicleBackstory.Events.principal.ipGeoArtifact.location.regionLongitude description: Longitude of the region for IP Geolocation. type: Number - contextPath: GoogleChronicleBackstory.Events.principal.ipGeoArtifact.location.state description: Associated state of IP Geolocation. type: String - contextPath: GoogleChronicleBackstory.Events.principal.ipGeoArtifact.network.asn description: Associated ASN with a network connection for IP Geolocation. type: String - contextPath: GoogleChronicleBackstory.Events.principal.ipGeoArtifact.network.carrierName description: Associated carrier name with a network connection for IP Geolocation. type: String - contextPath: GoogleChronicleBackstory.Events.principal.ipGeoArtifact.network.dnsDomain description: Associated DNS domain with a network connection for IP Geolocation. type: String - contextPath: GoogleChronicleBackstory.Events.principal.ipGeoArtifact.network.organizationName description: Associated organization name with a network connection for IP Geolocation. type: String - contextPath: GoogleChronicleBackstory.Events.principal.ipLocation.countryOrRegion description: Associated country or region for the IP location. type: String - contextPath: GoogleChronicleBackstory.Events.principal.ipLocation.regionCoordinates.latitude description: Latitude coordinates of the region for the IP location. type: Number - contextPath: GoogleChronicleBackstory.Events.principal.ipLocation.regionCoordinates.longitude description: Longitude coordinates of the region for the IP location. type: Number - contextPath: GoogleChronicleBackstory.Events.principal.ipLocation.regionLatitude description: Latitude of the region for the IP location. type: Number - contextPath: GoogleChronicleBackstory.Events.principal.ipLocation.regionLongitude description: Longitude of the region for the IP location. type: Number - contextPath: GoogleChronicleBackstory.Events.principal.ipLocation.state description: Associated state of the IP location. type: String - contextPath: GoogleChronicleBackstory.Events.principal.labels.key description: The key for a field specified in the principal labels of the event. type: String - contextPath: GoogleChronicleBackstory.Events.principal.labels.value description: The value for a field specified in the principal labels of the event. type: String - contextPath: GoogleChronicleBackstory.Events.principal.location.countryOrRegion description: Associated country or region for the principal location. type: String - contextPath: GoogleChronicleBackstory.Events.principal.location.regionCoordinates.latitude description: Latitude coordinates of the region for the principal location. type: Number - contextPath: GoogleChronicleBackstory.Events.principal.location.regionCoordinates.longitude description: Longitude coordinates of the region for the principal location. type: Number - contextPath: GoogleChronicleBackstory.Events.principal.location.regionLatitude description: Latitude of the region for the principal location. type: Number - contextPath: GoogleChronicleBackstory.Events.principal.location.regionLongitude description: Longitude of the region for the principal location. type: Number - contextPath: GoogleChronicleBackstory.Events.principal.location.state description: Associated state of the principal location. type: String - contextPath: GoogleChronicleBackstory.Events.principal.resource.attribute.cloud.project.name description: Associated name of the project specified in the principal resource. type: String - contextPath: GoogleChronicleBackstory.Events.principal.resource.attribute.cloud.project.resourceSubtype description: Associated resource sub-type of the project specified in the principal resource. type: String - contextPath: GoogleChronicleBackstory.Events.principal.resource.attribute.labels.key description: The key for a field specified in the principal resource labels of the event. type: String - contextPath: GoogleChronicleBackstory.Events.principal.resource.attribute.labels.value description: The value for a field specified in the principal resource labels of the event. type: String - contextPath: GoogleChronicleBackstory.Events.principal.user.attribute.cloud.environment description: Associated environment specified in the principal user. type: String - contextPath: GoogleChronicleBackstory.Events.principal.user.attribute.cloud.project.id description: Associated ID of the project specified in the principal user. type: String - contextPath: GoogleChronicleBackstory.Events.principal.user.attribute.permissions.name description: Associated name of the permission specified in the principal user. type: String - contextPath: GoogleChronicleBackstory.Events.principal.user.attribute.permissions.type description: Associated type of the permission specified in the principal user. type: String - contextPath: GoogleChronicleBackstory.Events.principal.user.attribute.roles.description description: Associated description of the role specified in the principal user. type: String - contextPath: GoogleChronicleBackstory.Events.principal.user.attribute.roles.name description: Associated name of the role specified in the principal user. type: String - contextPath: GoogleChronicleBackstory.Events.principal.user.attribute.roles.type description: Associated type of the role specified in the principal user. type: String - contextPath: GoogleChronicleBackstory.Events.principal.port description: Source or destination network port number when a specific network connection is described within an event. type: String - contextPath: GoogleChronicleBackstory.Events.principal.mac description: MAC addresses associated with a device. type: String - contextPath: GoogleChronicleBackstory.Events.principal.administrativeDomain description: Domain that the device belongs to (for example, the Windows domain). type: String - contextPath: GoogleChronicleBackstory.Events.principal.url description: Standard URL. type: String - contextPath: GoogleChronicleBackstory.Events.principal.file.fileMetadata description: Metadata associated with the file. type: String - contextPath: GoogleChronicleBackstory.Events.principal.file.fullPath description: Full path identifying the location of the file on the system. type: String - contextPath: GoogleChronicleBackstory.Events.principal.file.md5 description: MD5 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.principal.file.mimeType description: Multipurpose Internet Mail Extensions (MIME) type of the file. type: String - contextPath: GoogleChronicleBackstory.Events.principal.file.sha1 description: SHA-1 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.principal.file.sha256 description: SHA-256 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.principal.file.size description: Size of the file. type: String - contextPath: GoogleChronicleBackstory.Events.principal.process.commandLine description: Stores the command line string for the process. type: String - contextPath: GoogleChronicleBackstory.Events.principal.process.productSpecificProcessId description: Stores the product specific process ID. type: String - contextPath: GoogleChronicleBackstory.Events.principal.process.productSpecificParentProcessId description: Stores the product specific process ID for the parent process. type: String - contextPath: GoogleChronicleBackstory.Events.principal.process.file description: Stores the file name of the file in use by the process. type: String - contextPath: GoogleChronicleBackstory.Events.principal.process.file.fileMetadata description: Metadata associated with the file. type: String - contextPath: GoogleChronicleBackstory.Events.principal.process.file.fullPath description: Full path identifying the location of the file on the system. type: String - contextPath: GoogleChronicleBackstory.Events.principal.process.file.md5 description: MD5 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.principal.process.file.mimeType description: Multipurpose Internet Mail Extensions (MIME) type of the file. type: String - contextPath: GoogleChronicleBackstory.Events.principal.process.file.sha1 description: SHA-1 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.principal.process.file.sha256 description: SHA-256 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.principal.process.file.size description: Size of the file. type: String - contextPath: GoogleChronicleBackstory.Events.principal.process.parentPid description: Stores the process ID for the parent process. type: String - contextPath: GoogleChronicleBackstory.Events.principal.process.pid description: Stores the process ID. type: String - contextPath: GoogleChronicleBackstory.Events.principal.registry.registryKey description: Stores the registry key associated with an application or system component. type: String - contextPath: GoogleChronicleBackstory.Events.principal.registry.registryValueName description: Stores the name of the registry value associated with an application or system component. type: String - contextPath: GoogleChronicleBackstory.Events.principal.registry.registryValueData description: Stores the data associated with a registry value. type: String - contextPath: GoogleChronicleBackstory.Events.principal.user.emailAddresses description: Stores the email addresses for the user. type: String - contextPath: GoogleChronicleBackstory.Events.principal.user.employeeId description: Stores the product object ID for the user. type: String - contextPath: GoogleChronicleBackstory.Events.principal.user.productObjectId description: Stores the human resources employee ID for the user. type: String - contextPath: GoogleChronicleBackstory.Events.principal.user.firstName description: Stores the first name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.principal.user.middleName description: Stores the middle name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.principal.user.lastName description: Stores the last name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.principal.user.groupid description: Stores the group ID associated with a user. type: String - contextPath: GoogleChronicleBackstory.Events.principal.user.phoneNumbers description: Stores the phone numbers for the user. type: String - contextPath: GoogleChronicleBackstory.Events.principal.user.title description: Stores the job title for the user. type: String - contextPath: GoogleChronicleBackstory.Events.principal.user.userDisplayName description: Stores the display name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.principal.user.userid description: Stores the user ID. type: String - contextPath: GoogleChronicleBackstory.Events.principal.user.windowsSid description: Stores the Microsoft Windows security identifier (SID) associated with a user. type: String - contextPath: GoogleChronicleBackstory.Events.target.assetId description: Vendor-specific unique device identifier. type: String - contextPath: GoogleChronicleBackstory.Events.target.email description: Email address. type: String - contextPath: GoogleChronicleBackstory.Events.target.hostname description: Client hostname or domain name field. type: String - contextPath: GoogleChronicleBackstory.Events.target.platform description: Platform operating system. type: String - contextPath: GoogleChronicleBackstory.Events.target.platformPatchLevel description: Platform operating system patch level. type: String - contextPath: GoogleChronicleBackstory.Events.target.platformVersion description: Platform operating system version. type: String - contextPath: GoogleChronicleBackstory.Events.target.ip description: IP address associated with a network connection. type: String - contextPath: GoogleChronicleBackstory.Events.target.port description: Source or destination network port number when a specific network connection is described within an event. type: String - contextPath: GoogleChronicleBackstory.Events.target.mac description: One or more MAC addresses associated with a device. type: String - contextPath: GoogleChronicleBackstory.Events.target.administrativeDomain description: Domain that the device belongs to (for example, the Windows domain). type: String - contextPath: GoogleChronicleBackstory.Events.target.application description: Application of the target related to the event. type: String - contextPath: GoogleChronicleBackstory.Events.target.cloud.availabilityZone description: Associated availability zone specified in the event target. type: String - contextPath: GoogleChronicleBackstory.Events.target.cloud.environment description: Associated environment specified in the event target. type: String - contextPath: GoogleChronicleBackstory.Events.target.cloud.project.name description: Associated name of the project specified in the event target. type: String - contextPath: GoogleChronicleBackstory.Events.target.cloud.vpc description: Associated VPC specified in the event target. type: Unknown - contextPath: GoogleChronicleBackstory.Events.target.resource.name description: Associated resource name specified in the event target. type: String - contextPath: GoogleChronicleBackstory.Events.target.resource.productObjectId description: Associated product object ID specified in the event target. type: String - contextPath: GoogleChronicleBackstory.Events.target.resource.resourceType description: Associated resource type specified in the event target. type: String - contextPath: GoogleChronicleBackstory.Events.target.resource.attribute.labels.key description: The key for a field specified in the principal resource labels of the event. type: String - contextPath: GoogleChronicleBackstory.Events.target.resource.attribute.labels.value description: The value for a field specified in the principal resource labels of the event. type: String - contextPath: GoogleChronicleBackstory.Events.target.url description: Standard URL. type: String - contextPath: GoogleChronicleBackstory.Events.target.file.fileMetadata description: Metadata associated with the file. type: String - contextPath: GoogleChronicleBackstory.Events.target.file.fullPath description: Full path identifying the location of the file on the system. type: String - contextPath: GoogleChronicleBackstory.Events.target.file.md5 description: MD5 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.target.file.mimeType description: Multipurpose Internet Mail Extensions (MIME) type of the file. type: String - contextPath: GoogleChronicleBackstory.Events.target.file.sha1 description: SHA-1 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.target.file.sha256 description: SHA-256 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.target.file.size description: Size of the file. type: String - contextPath: GoogleChronicleBackstory.Events.target.process.commandLine description: Stores the command line string for the process. type: String - contextPath: GoogleChronicleBackstory.Events.target.process.productSpecificProcessId description: Stores the product specific process ID. type: String - contextPath: GoogleChronicleBackstory.Events.target.process.productSpecificParentProcessId description: Stores the product specific process ID for the parent process. type: String - contextPath: GoogleChronicleBackstory.Events.target.process.file description: Stores the file name of the file in use by the process. type: String - contextPath: GoogleChronicleBackstory.Events.target.process.file.fileMetadata description: Metadata associated with the file. type: String - contextPath: GoogleChronicleBackstory.Events.target.process.file.fullPath description: Full path identifying the location of the file on the system. type: String - contextPath: GoogleChronicleBackstory.Events.target.process.file.md5 description: MD5 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.target.process.file.mimeType description: Multipurpose Internet Mail Extensions (MIME) type of the file. type: String - contextPath: GoogleChronicleBackstory.Events.target.process.file.sha1 description: SHA-1 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.target.process.file.sha256 description: SHA-256 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.target.process.file.size description: Size of the file. type: String - contextPath: GoogleChronicleBackstory.Events.target.process.parentPid description: Stores the process ID for the parent process. type: String - contextPath: GoogleChronicleBackstory.Events.target.process.pid description: Stores the process ID. type: String - contextPath: GoogleChronicleBackstory.Events.target.registry.registryKey description: Stores the registry key associated with an application or system component. type: String - contextPath: GoogleChronicleBackstory.Events.target.registry.registryValueName description: Stores the name of the registry value associated with an application or system component. type: String - contextPath: GoogleChronicleBackstory.Events.target.registry.registryValueData description: Stores the data associated with a registry value. type: String - contextPath: GoogleChronicleBackstory.Events.target.user.attribute.cloud.environment description: Associated environment specified in the target user. type: String - contextPath: GoogleChronicleBackstory.Events.target.user.attribute.cloud.project.id description: Associated ID of the project specified in the target user. type: String - contextPath: GoogleChronicleBackstory.Events.target.user.attribute.roles.name description: Associated name of the role specified in the target user. type: String - contextPath: GoogleChronicleBackstory.Events.target.user.attribute.roles.type description: Associated type of the role specified in the target user. type: String - contextPath: GoogleChronicleBackstory.Events.target.user.emailAddresses description: Stores the email addresses for the user. type: String - contextPath: GoogleChronicleBackstory.Events.target.user.productObjectId description: Stores the human resources product object ID for the user. type: String - contextPath: GoogleChronicleBackstory.Events.target.user.employeeId description: Stores the human resources employee ID for the user. type: String - contextPath: GoogleChronicleBackstory.Events.target.user.firstName description: Stores the first name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.target.user.middleName description: Stores the middle name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.target.user.lastName description: Stores the last name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.target.user.groupid description: Stores the group ID associated with a user. type: String - contextPath: GoogleChronicleBackstory.Events.target.user.phoneNumbers description: Stores the phone numbers for the user. type: String - contextPath: GoogleChronicleBackstory.Events.target.user.title description: Stores the job title for the user. type: String - contextPath: GoogleChronicleBackstory.Events.target.user.userDisplayName description: Stores the display name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.target.user.userid description: Stores the user ID. type: String - contextPath: GoogleChronicleBackstory.Events.target.user.windowsSid description: Stores the Microsoft Windows security identifier (SID) associated with a user. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.assetId description: Vendor-specific unique device identifier. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.email description: Email address. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.hostname description: Client hostname or domain name field. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.platform description: Platform operating system. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.platformPatchLevel description: Platform operating system patch level. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.platformVersion description: Platform operating system version. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.ip description: IP address associated with a network connection. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.port description: Source or destination network port number when a specific network connection is described within an event. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.mac description: One or more MAC addresses associated with a device. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.administrativeDomain description: Domain that the device belongs to (for example, the Windows domain). type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.url description: Standard URL. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.file.fileMetadata description: Metadata associated with the file. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.file.fullPath description: Full path identifying the location of the file on the system. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.file.md5 description: MD5 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.file.mimeType description: Multipurpose Internet Mail Extensions (MIME) type of the file. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.file.sha1 description: SHA-1 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.file.sha256 description: SHA-256 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.file.size description: Size of the file. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.process.commandLine description: Stores the command line string for the process. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.process.productSpecificProcessId description: Stores the product specific process ID. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.process.productSpecificParentProcessId description: Stores the product specific process ID for the parent process. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.process.file description: Stores the file name of the file in use by the process. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.process.file.fileMetadata description: Metadata associated with the file. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.process.file.fullPath description: Full path identifying the location of the file on the system. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.process.file.md5 description: MD5 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.process.file.mimeType description: Multipurpose Internet Mail Extensions (MIME) type of the file. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.process.file.sha1 description: SHA-1 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.process.file.sha256 description: SHA-256 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.process.file.size description: Size of the file. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.process.parentPid description: Stores the process ID for the parent process. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.process.pid description: Stores the process ID. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.registry.registryKey description: Stores the registry key associated with an application or system component. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.registry.registryValueName description: Stores the name of the registry value associated with an application or system component. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.registry.registryValueData description: Stores the data associated with a registry value. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.user.emailAddresses description: Stores the email addresses for the user. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.user.employeeId description: Stores the human resources employee ID for the user. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.user.firstName description: Stores the first name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.user.middleName description: Stores the middle name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.user.lastName description: Stores the last name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.user.groupid description: Stores the group ID associated with a user. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.user.phoneNumbers description: Stores the phone numbers for the user. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.user.title description: Stores the job title for the user. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.user.userDisplayName description: Stores the display name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.user.userid description: Stores the user ID. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.user.windowsSid description: Stores the Microsoft Windows security identifier (SID) associated with a user. type: String - contextPath: GoogleChronicleBackstory.Events.src.assetId description: Vendor-specific unique device identifier. type: String - contextPath: GoogleChronicleBackstory.Events.src.email description: Email address. type: String - contextPath: GoogleChronicleBackstory.Events.src.hostname description: Client hostname or domain name field. type: String - contextPath: GoogleChronicleBackstory.Events.src.platform description: Platform operating system. type: String - contextPath: GoogleChronicleBackstory.Events.src.platformPatchLevel description: Platform operating system patch level. type: String - contextPath: GoogleChronicleBackstory.Events.src.platformVersion description: Platform operating system version. type: String - contextPath: GoogleChronicleBackstory.Events.src.ip description: IP address associated with a network connection. type: String - contextPath: GoogleChronicleBackstory.Events.src.port description: Source or destination network port number when a specific network connection is described within an event. type: String - contextPath: GoogleChronicleBackstory.Events.src.mac description: One or more MAC addresses associated with a device. type: String - contextPath: GoogleChronicleBackstory.Events.src.administrativeDomain description: Domain that the device belongs to (for example, the Windows domain). type: String - contextPath: GoogleChronicleBackstory.Events.src.url description: Standard URL. type: String - contextPath: GoogleChronicleBackstory.Events.src.file.fileMetadata description: Metadata associated with the file. type: String - contextPath: GoogleChronicleBackstory.Events.src.file.fullPath description: Full path identifying the location of the file on the system. type: String - contextPath: GoogleChronicleBackstory.Events.src.file.md5 description: MD5 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.src.file.mimeType description: Multipurpose Internet Mail Extensions (MIME) type of the file. type: String - contextPath: GoogleChronicleBackstory.Events.src.file.sha1 description: SHA-1 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.src.file.sha256 description: SHA-256 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.src.file.size description: Size of the file. type: String - contextPath: GoogleChronicleBackstory.Events.src.process.commandLine description: Stores the command line string for the process. type: String - contextPath: GoogleChronicleBackstory.Events.src.process.productSpecificProcessId description: Stores the product specific process ID. type: String - contextPath: GoogleChronicleBackstory.Events.src.process.productSpecificParentProcessId description: Stores the product specific process ID for the parent process. type: String - contextPath: GoogleChronicleBackstory.Events.src.process.file description: Stores the file name of the file in use by the process. type: String - contextPath: GoogleChronicleBackstory.Events.src.process.file.fileMetadata description: Metadata associated with the file. type: String - contextPath: GoogleChronicleBackstory.Events.src.process.file.fullPath description: Full path identifying the location of the file on the system. type: String - contextPath: GoogleChronicleBackstory.Events.src.process.file.md5 description: MD5 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.src.process.file.mimeType description: Multipurpose Internet Mail Extensions (MIME) type of the file. type: String - contextPath: GoogleChronicleBackstory.Events.src.process.file.sha1 description: SHA-1 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.src.process.file.sha256 description: SHA-256 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.src.process.file.size description: Size of the file. type: String - contextPath: GoogleChronicleBackstory.Events.src.process.parentPid description: Stores the process ID for the parent process. type: String - contextPath: GoogleChronicleBackstory.Events.src.process.pid description: Stores the process ID. type: String - contextPath: GoogleChronicleBackstory.Events.src.registry.registryKey description: Stores the registry key associated with an application or system component. type: String - contextPath: GoogleChronicleBackstory.Events.src.registry.registryValueName description: Stores the name of the registry value associated with an application or system component. type: String - contextPath: GoogleChronicleBackstory.Events.src.registry.registryValueData description: Stores the data associated with a registry value. type: String - contextPath: GoogleChronicleBackstory.Events.src.user.emailAddresses description: Stores the email addresses for the user. type: String - contextPath: GoogleChronicleBackstory.Events.src.user.employeeId description: Stores the human resources employee ID for the user. type: String - contextPath: GoogleChronicleBackstory.Events.src.user.firstName description: Stores the first name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.src.user.middleName description: Stores the middle name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.src.user.lastName description: Stores the last name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.src.user.groupid description: Stores the group ID associated with a user. type: String - contextPath: GoogleChronicleBackstory.Events.src.user.phoneNumbers description: Stores the phone numbers for the user. type: String - contextPath: GoogleChronicleBackstory.Events.src.user.title description: Stores the job title for the user. type: String - contextPath: GoogleChronicleBackstory.Events.src.user.userDisplayName description: Stores the display name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.src.user.userid description: Stores the user ID. type: String - contextPath: GoogleChronicleBackstory.Events.src.user.windowsSid description: Stores the Microsoft Windows security identifier (SID) associated with a user. type: String - contextPath: GoogleChronicleBackstory.Events.observer.assetId description: Vendor-specific unique device identifier. type: String - contextPath: GoogleChronicleBackstory.Events.observer.email description: Email address. type: String - contextPath: GoogleChronicleBackstory.Events.observer.hostname description: Client hostname or domain name field. type: String - contextPath: GoogleChronicleBackstory.Events.observer.platform description: Platform operating system. type: String - contextPath: GoogleChronicleBackstory.Events.observer.platformPatchLevel description: Platform operating system patch level. type: String - contextPath: GoogleChronicleBackstory.Events.observer.platformVersion description: Platform operating system version. type: String - contextPath: GoogleChronicleBackstory.Events.observer.ip description: IP address associated with a network connection. type: String - contextPath: GoogleChronicleBackstory.Events.observer.port description: Source or destination network port number when a specific network connection is described within an event. type: String - contextPath: GoogleChronicleBackstory.Events.observer.mac description: One or more MAC addresses associated with a device. type: String - contextPath: GoogleChronicleBackstory.Events.observer.administrativeDomain description: Domain that the device belongs to (for example, the Windows domain). type: String - contextPath: GoogleChronicleBackstory.Events.observer.url description: Standard URL. type: String - contextPath: GoogleChronicleBackstory.Events.observer.file.fileMetadata description: Metadata associated with the file. type: String - contextPath: GoogleChronicleBackstory.Events.observer.file.fullPath description: Full path identifying the location of the file on the system. type: String - contextPath: GoogleChronicleBackstory.Events.observer.file.md5 description: MD5 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.observer.file.mimeType description: Multipurpose Internet Mail Extensions (MIME) type of the file. type: String - contextPath: GoogleChronicleBackstory.Events.observer.file.sha1 description: SHA-1 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.observer.file.sha256 description: SHA-256 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.observer.file.size description: Size of the file. type: String - contextPath: GoogleChronicleBackstory.Events.observer.process.commandLine description: Stores the command line string for the process. type: String - contextPath: GoogleChronicleBackstory.Events.observer.process.productSpecificProcessId description: Stores the product specific process ID. type: String - contextPath: GoogleChronicleBackstory.Events.observer.process.productSpecificParentProcessId description: Stores the product specific process ID for the parent process. type: String - contextPath: GoogleChronicleBackstory.Events.observer.process.file description: Stores the file name of the file in use by the process. type: String - contextPath: GoogleChronicleBackstory.Events.observer.process.file.fileMetadata description: Metadata associated with the file. type: String - contextPath: GoogleChronicleBackstory.Events.observer.process.file.fullPath description: Full path identifying the location of the file on the system. type: String - contextPath: GoogleChronicleBackstory.Events.observer.process.file.md5 description: MD5 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.observer.process.file.mimeType description: Multipurpose Internet Mail Extensions (MIME) type of the file. type: String - contextPath: GoogleChronicleBackstory.Events.observer.process.file.sha1 description: SHA-1 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.observer.process.file.sha256 description: SHA-256 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.observer.process.file.size description: Size of the file. type: String - contextPath: GoogleChronicleBackstory.Events.observer.process.parentPid description: Stores the process ID for the parent process. type: String - contextPath: GoogleChronicleBackstory.Events.observer.process.pid description: Stores the process ID. type: String - contextPath: GoogleChronicleBackstory.Events.observer.registry.registryKey description: Stores the registry key associated with an application or system component. type: String - contextPath: GoogleChronicleBackstory.Events.observer.registry.registryValueName description: Stores the name of the registry value associated with an application or system component. type: String - contextPath: GoogleChronicleBackstory.Events.observer.registry.registryValueData description: Stores the data associated with a registry value. type: String - contextPath: GoogleChronicleBackstory.Events.observer.user.emailAddresses description: Stores the email addresses for the user. type: String - contextPath: GoogleChronicleBackstory.Events.observer.user.employeeId description: Stores the human resources employee ID for the user. type: String - contextPath: GoogleChronicleBackstory.Events.observer.user.firstName description: Stores the first name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.observer.user.middleName description: Stores the middle name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.observer.user.lastName description: Stores the last name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.observer.user.groupid description: Stores the group ID associated with a user. type: String - contextPath: GoogleChronicleBackstory.Events.observer.user.phoneNumbers description: Stores the phone numbers for the user. type: String - contextPath: GoogleChronicleBackstory.Events.observer.user.title description: Stores the job title for the user. type: String - contextPath: GoogleChronicleBackstory.Events.observer.user.userDisplayName description: Stores the display name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.observer.user.userid description: Stores the user ID. type: String - contextPath: GoogleChronicleBackstory.Events.observer.user.windowsSid description: Stores the Microsoft Windows security identifier (SID) associated with a user. type: String - contextPath: GoogleChronicleBackstory.Events.about.assetId description: Vendor-specific unique device identifier. type: String - contextPath: GoogleChronicleBackstory.Events.about.email description: Email address. type: String - contextPath: GoogleChronicleBackstory.Events.about.hostname description: Client hostname or domain name field. type: String - contextPath: GoogleChronicleBackstory.Events.about.platform description: Platform operating system. type: String - contextPath: GoogleChronicleBackstory.Events.about.platformPatchLevel description: Platform operating system patch level. type: String - contextPath: GoogleChronicleBackstory.Events.about.platformVersion description: Platform operating system version. type: String - contextPath: GoogleChronicleBackstory.Events.about.ip description: IP address associated with a network connection. type: String - contextPath: GoogleChronicleBackstory.Events.about.port description: Source or destination network port number when a specific network connection is described within an event. type: String - contextPath: GoogleChronicleBackstory.Events.about.mac description: One or more MAC addresses associated with a device. type: String - contextPath: GoogleChronicleBackstory.Events.about.administrativeDomain description: Domain that the device belongs to (for example, the Windows domain). type: String - contextPath: GoogleChronicleBackstory.Events.about.url description: Standard URL. type: String - contextPath: GoogleChronicleBackstory.Events.about.file.fileMetadata description: Metadata associated with the file. type: String - contextPath: GoogleChronicleBackstory.Events.about.file.fullPath description: Full path identifying the location of the file on the system. type: String - contextPath: GoogleChronicleBackstory.Events.about.file.md5 description: MD5 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.about.file.mimeType description: Multipurpose Internet Mail Extensions (MIME) type of the file. type: String - contextPath: GoogleChronicleBackstory.Events.about.file.sha1 description: SHA-1 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.about.file.sha256 description: SHA-256 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.about.file.size description: Size of the file. type: String - contextPath: GoogleChronicleBackstory.Events.about.process.commandLine description: Stores the command line string for the process. type: String - contextPath: GoogleChronicleBackstory.Events.about.process.productSpecificProcessId description: Stores the product specific process ID. type: String - contextPath: GoogleChronicleBackstory.Events.about.process.productSpecificParentProcessId description: Stores the product specific process ID for the parent process. type: String - contextPath: GoogleChronicleBackstory.Events.about.process.file description: Stores the file name of the file in use by the process. type: String - contextPath: GoogleChronicleBackstory.Events.about.process.file.fileMetadata description: Metadata associated with the file. type: String - contextPath: GoogleChronicleBackstory.Events.about.process.file.fullPath description: Full path identifying the location of the file on the system. type: String - contextPath: GoogleChronicleBackstory.Events.about.process.file.md5 description: MD5 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.about.process.file.mimeType description: Multipurpose Internet Mail Extensions (MIME) type of the file. type: String - contextPath: GoogleChronicleBackstory.Events.about.process.file.sha1 description: SHA-1 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.about.process.file.sha256 description: SHA-256 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.about.process.file.size description: Size of the file. type: String - contextPath: GoogleChronicleBackstory.Events.about.process.parentPid description: Stores the process ID for the parent process. type: String - contextPath: GoogleChronicleBackstory.Events.about.process.pid description: Stores the process ID. type: String - contextPath: GoogleChronicleBackstory.Events.about.registry.registryKey description: Stores the registry key associated with an application or system component. type: String - contextPath: GoogleChronicleBackstory.Events.about.registry.registryValueName description: Stores the name of the registry value associated with an application or system component. type: String - contextPath: GoogleChronicleBackstory.Events.about.registry.registryValueData description: Stores the data associated with a registry value. type: String - contextPath: GoogleChronicleBackstory.Events.about.user.emailAddresses description: Stores the email addresses for the user. type: String - contextPath: GoogleChronicleBackstory.Events.about.user.employeeId description: Stores the human resources employee ID for the user. type: String - contextPath: GoogleChronicleBackstory.Events.about.user.firstName description: Stores the first name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.about.user.middleName description: Stores the middle name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.about.user.lastName description: Stores the last name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.about.user.groupid description: Stores the group ID associated with a user. type: String - contextPath: GoogleChronicleBackstory.Events.about.user.phoneNumbers description: Stores the phone numbers for the user. type: String - contextPath: GoogleChronicleBackstory.Events.about.user.title description: Stores the job title for the user. type: String - contextPath: GoogleChronicleBackstory.Events.about.user.userDisplayName description: Stores the display name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.about.user.userid description: Stores the user ID. type: String - contextPath: GoogleChronicleBackstory.Events.about.user.windowsSid description: Stores the Microsoft Windows security identifier (SID) associated with a user. type: String - contextPath: GoogleChronicleBackstory.Events.network.applicationProtocol description: Indicates the network application protocol. type: String - contextPath: GoogleChronicleBackstory.Events.network.direction description: Indicates the direction of network traffic. type: String - contextPath: GoogleChronicleBackstory.Events.network.email description: Specifies the email address for the sender/recipient. type: String - contextPath: GoogleChronicleBackstory.Events.network.ipProtocol description: Indicates the IP protocol. type: String - contextPath: GoogleChronicleBackstory.Events.network.receivedBytes description: Specifies the number of bytes received. type: String - contextPath: GoogleChronicleBackstory.Events.network.sentBytes description: Specifies the number of bytes sent. type: String - contextPath: GoogleChronicleBackstory.Events.network.dhcp.clientHostname description: Hostname for the client. type: String - contextPath: GoogleChronicleBackstory.Events.network.dhcp.clientIdentifier description: Client identifier. type: String - contextPath: GoogleChronicleBackstory.Events.network.dhcp.file description: Filename for the boot image. type: String - contextPath: GoogleChronicleBackstory.Events.network.dhcp.flags description: Value for the DHCP flags field. type: String - contextPath: GoogleChronicleBackstory.Events.network.dhcp.hlen description: Hardware address length. type: String - contextPath: GoogleChronicleBackstory.Events.network.dhcp.hops description: DHCP hop count. type: String - contextPath: GoogleChronicleBackstory.Events.network.dhcp.htype description: Hardware address type. type: String - contextPath: GoogleChronicleBackstory.Events.network.dhcp.leaseTimeSeconds description: Client-requested lease time for an IP address in seconds. type: String - contextPath: GoogleChronicleBackstory.Events.network.dhcp.opcode description: BOOTP op code. type: String - contextPath: GoogleChronicleBackstory.Events.network.dhcp.requestedAddress description: Client identifier. type: String - contextPath: GoogleChronicleBackstory.Events.network.dhcp.seconds description: Seconds elapsed since the client began the address acquisition/renewal process. type: String - contextPath: GoogleChronicleBackstory.Events.network.dhcp.sname description: Name of the server that the client has requested to boot from. type: String - contextPath: GoogleChronicleBackstory.Events.network.dhcp.transactionId description: Client transaction ID. type: String - contextPath: GoogleChronicleBackstory.Events.network.dhcp.type description: DHCP message type. type: String - contextPath: GoogleChronicleBackstory.Events.network.dhcp.chaddr description: IP address for the client hardware. type: String - contextPath: GoogleChronicleBackstory.Events.network.dhcp.ciaddr description: IP address for the client. type: String - contextPath: GoogleChronicleBackstory.Events.network.dhcp.giaddr description: IP address for the relay agent. type: String - contextPath: GoogleChronicleBackstory.Events.network.dhcp.siaddr description: IP address for the next bootstrap server. type: String - contextPath: GoogleChronicleBackstory.Events.network.dhcp.yiaddr description: Your IP address. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.authoritative description: Set to true for authoritative DNS servers. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.id description: Stores the DNS query identifier. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.response description: Set to true if the event is a DNS response. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.opcode description: Stores the DNS OpCode used to specify the type of DNS query (standard, inverse, server status, etc.). type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.recursionAvailable description: Set to true if a recursive DNS lookup is available. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.recursionDesired description: Set to true if a recursive DNS lookup is requested. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.responseCode description: Stores the DNS response code as defined by RFC 1035, Domain Names - Implementation and Specification. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.truncated description: Set to true if this is a truncated DNS response. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.questions.name description: Stores the domain name. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.questions.class description: Stores the code specifying the class of the query. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.questions.type description: Stores the code specifying the type of the query. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.answers.binaryData description: Stores the raw bytes of any non-UTF8 strings that might be included as part of a DNS response. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.answers.class description: Stores the code specifying the class of the resource record. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.answers.data description: Stores the payload or response to the DNS question for all responses encoded in UTF-8 format. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.answers.name description: Stores the name of the owner of the resource record. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.answers.ttl description: Stores the time interval for which the resource record can be cached before the source of the information should again be queried. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.answers.type description: Stores the code specifying the type of the resource record. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.authority.binaryData description: Stores the raw bytes of any non-UTF8 strings that might be included as part of a DNS response. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.authority.class description: Stores the code specifying the class of the resource record. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.authority.data description: Stores the payload or response to the DNS question for all responses encoded in UTF-8 format. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.authority.name description: Stores the name of the owner of the resource record. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.authority.ttl description: Stores the time interval for which the resource record can be cached before the source of the information should again be queried. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.authority.type description: Stores the code specifying the type of the resource record. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.additional.binaryData description: Stores the raw bytes of any non-UTF8 strings that might be included as part of a DNS response. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.additional.class description: Stores the code specifying the class of the resource record. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.additional.data description: Stores the payload or response to the DNS question for all responses encoded in UTF-8 format. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.additional.name description: Stores the name of the owner of the resource record. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.additional.ttl description: Stores the time interval for which the resource record can be cached before the source of the information should again be queried. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.additional.type description: Stores the code specifying the type of the resource record. type: String - contextPath: GoogleChronicleBackstory.Events.network.email.from description: Stores the from email address. type: String - contextPath: GoogleChronicleBackstory.Events.network.email.replyTo description: Stores the reply_to email address. type: String - contextPath: GoogleChronicleBackstory.Events.network.email.to description: Stores the to email addresses. type: String - contextPath: GoogleChronicleBackstory.Events.network.email.cc description: Stores the cc email addresses. type: String - contextPath: GoogleChronicleBackstory.Events.network.email.bcc description: Stores the bcc email addresses. type: String - contextPath: GoogleChronicleBackstory.Events.network.email.mailId description: Stores the mail (or message) ID. type: String - contextPath: GoogleChronicleBackstory.Events.network.email.subject description: Stores the email subject line. type: String - contextPath: GoogleChronicleBackstory.Events.network.ftp.command description: Stores the FTP command. type: String - contextPath: GoogleChronicleBackstory.Events.network.http.method description: Stores the HTTP request method. type: String - contextPath: GoogleChronicleBackstory.Events.network.http.referralUrl description: Stores the URL for the HTTP referer. type: String - contextPath: GoogleChronicleBackstory.Events.network.http.responseCode description: Stores the HTTP response status code, which indicates whether a specific HTTP request has been successfully completed. type: String - contextPath: GoogleChronicleBackstory.Events.network.http.useragent description: Stores the User-Agent request header which includes the application type, operating system, software vendor or software version of the requesting software user agent. type: String - contextPath: GoogleChronicleBackstory.Events.authentication.authType description: Type of system an authentication event is associated with (Chronicle UDM). type: String - contextPath: GoogleChronicleBackstory.Events.authentication.mechanism description: Mechanism(s) used for authentication. type: String - contextPath: GoogleChronicleBackstory.Events.securityResult.about description: Provide a description of the security result. type: String - contextPath: GoogleChronicleBackstory.Events.securityResult.action description: Specify a security action. type: String - contextPath: GoogleChronicleBackstory.Events.securityResult.category description: Specify a security category. type: String - contextPath: GoogleChronicleBackstory.Events.securityResult.categoryDetails description: Specify the security category details. type: Unknown - contextPath: GoogleChronicleBackstory.Events.securityResult.detectionFields.key description: The key for a field specified in the security result, for MULTI_EVENT rules. type: String - contextPath: GoogleChronicleBackstory.Events.securityResult.detectionFields.value description: The value for a field specified in the security result, for MULTI_EVENT rules. type: String - contextPath: GoogleChronicleBackstory.Events.securityResult.confidence description: Specify a confidence with regards to a security event as estimated by the product. type: String - contextPath: GoogleChronicleBackstory.Events.securityResult.confidenceDetails description: Additional details with regards to the confidence of a security event as estimated by the product vendor. type: String - contextPath: GoogleChronicleBackstory.Events.securityResult.priority description: Specify a priority with regards to a security event as estimated by the product vendor. type: String - contextPath: GoogleChronicleBackstory.Events.securityResult.priorityDetails description: Vendor-specific information about the security result priority. type: String - contextPath: GoogleChronicleBackstory.Events.securityResult.ruleId description: Identifier for the security rule. type: String - contextPath: GoogleChronicleBackstory.Events.securityResult.ruleName description: Name of the security rule. type: String - contextPath: GoogleChronicleBackstory.Events.securityResult.severity description: Severity of a security event as estimated by the product vendor using values defined by the Chronicle UDM. type: String - contextPath: GoogleChronicleBackstory.Events.securityResult.severityDetails description: Severity for a security event as estimated by the product vendor. type: String - contextPath: GoogleChronicleBackstory.Events.securityResult.threatName description: Name of the security threat. type: String - contextPath: GoogleChronicleBackstory.Events.securityResult.urlBackToProduct description: URL to direct you to the source product console for this security event. type: String - arguments: - description: |- Specify the values to search in reference lists. Format accepted is: "value 1, value 2, value 3". name: values required: true isArray: true - description: Specify the reference list names to search through. Supports comma separated values. name: reference_list_names required: true isArray: true - description: If set to true, the command performs case insensitive matching. name: case_insensitive_search required: false defaultValue: 'False' auto: PREDEFINED predefined: - 'True' - 'False' - description: |- Delimiter by which the content of the values list is separated. Eg: " , " , " : ", " ; ". defaultValue: ',' name: delimiter - description: If set to true, the command will add the not found reference list names to the HR and the context. name: add_not_found_reference_lists required: false defaultValue: 'False' auto: PREDEFINED predefined: - 'True' - 'False' description: Check if provided values are found in the reference lists in Google Chronicle. name: gcb-verify-value-in-reference-list outputs: - contextPath: GoogleChronicleBackstory.VerifyValueInReferenceList.value description: The item value to search in the reference list. type: String - contextPath: GoogleChronicleBackstory.VerifyValueInReferenceList.found_in_lists description: List of Reference list names, where item was found. type: String - contextPath: GoogleChronicleBackstory.VerifyValueInReferenceList.not_found_in_lists description: List of Reference list names, where item not was found. type: String - contextPath: GoogleChronicleBackstory.VerifyValueInReferenceList.overall_status description: Whether value found in any reference list. type: String - arguments: - description: Specify the Rule text in YARA-L 2.0 format to verify. name: rule_text required: true description: Verifies that a rule is a valid YARA-L 2.0 rule without creating a new rule or evaluating it over data. name: gcb-verify-rule outputs: - contextPath: GoogleChronicleBackstory.VerifyRule.success description: Whether rule_text has a valid YARA-L 2.0 format. type: Boolean - contextPath: GoogleChronicleBackstory.VerifyRule.context description: Contains the success message or the compilation error if the verification fails. type: String - contextPath: GoogleChronicleBackstory.VerifyRule.command_name description: The command name. type: String - arguments: - description: |- Specify the ID of the event. Note: The event_id can be retrieved from the output context path (GoogleChronicleBackstory.Events.id) of the gcb-list-events command. name: event_id required: true description: |- Get the specific event with the given ID from Chronicle. Note: This command returns more than 60 different types of events. Any event would have only specific output context set. Refer the UDM documentation to figure out the output properties specific to the event types. name: gcb-get-event outputs: - contextPath: GoogleChronicleBackstory.Events.eventType description: Specifies the type of the event. type: String - contextPath: GoogleChronicleBackstory.Events.eventTimestamp description: The GMT timestamp when the event was generated. type: Date - contextPath: GoogleChronicleBackstory.Events.collectedTimestamp description: The GMT timestamp when the event was collected by the vendor's local collection infrastructure. type: Date - contextPath: GoogleChronicleBackstory.Events.description description: Human-readable description of the event. type: String - contextPath: GoogleChronicleBackstory.Events.productEventType description: Short, descriptive, human-readable, and product-specific event name or type. type: String - contextPath: GoogleChronicleBackstory.Events.productLogId description: A vendor-specific event identifier to uniquely identify the event (a GUID). Users might use this identifier to search the vendor's proprietary console for the event in question. type: String - contextPath: GoogleChronicleBackstory.Events.productName description: Specifies the name of the product. type: String - contextPath: GoogleChronicleBackstory.Events.productVersion description: Specifies the version of the product. type: String - contextPath: GoogleChronicleBackstory.Events.urlBackToProduct description: URL linking to a relevant website where you can view more information about this specific event or the general event category. type: String - contextPath: GoogleChronicleBackstory.Events.vendorName description: Specifies the product vendor's name. type: String - contextPath: GoogleChronicleBackstory.Events.principal.assetId description: Vendor-specific unique device identifier. type: String - contextPath: GoogleChronicleBackstory.Events.principal.email description: Email address. type: String - contextPath: GoogleChronicleBackstory.Events.principal.hostname description: Client hostname or domain name field. type: String - contextPath: GoogleChronicleBackstory.Events.principal.platform description: Platform operating system. type: String - contextPath: GoogleChronicleBackstory.Events.principal.platformPatchLevel description: Platform operating system patch level. type: String - contextPath: GoogleChronicleBackstory.Events.principal.platformVersion description: Platform operating system version. type: String - contextPath: GoogleChronicleBackstory.Events.principal.ip description: IP address associated with a network connection. type: String - contextPath: GoogleChronicleBackstory.Events.principal.port description: Source or destination network port number when a specific network connection is described within an event. type: String - contextPath: GoogleChronicleBackstory.Events.principal.mac description: MAC addresses associated with a device. type: String - contextPath: GoogleChronicleBackstory.Events.principal.administrativeDomain description: Domain which the device belongs to (for example, the Windows domain). type: String - contextPath: GoogleChronicleBackstory.Events.principal.url description: Standard URL. type: String - contextPath: GoogleChronicleBackstory.Events.principal.file.fileMetadata description: Metadata associated with the file. type: String - contextPath: GoogleChronicleBackstory.Events.principal.file.fullPath description: Full path identifying the location of the file on the system. type: String - contextPath: GoogleChronicleBackstory.Events.principal.file.md5 description: MD5 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.principal.file.mimeType description: Multipurpose Internet Mail Extensions (MIME) type of the file. type: String - contextPath: GoogleChronicleBackstory.Events.principal.file.sha1 description: SHA-1 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.principal.file.sha256 description: SHA-256 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.principal.file.size description: Size of the file. type: String - contextPath: GoogleChronicleBackstory.Events.principal.process.commandLine description: Stores the command line string for the process. type: String - contextPath: GoogleChronicleBackstory.Events.principal.process.productSpecificProcessId description: Stores the product specific process ID. type: String - contextPath: GoogleChronicleBackstory.Events.principal.process.productSpecificParentProcessId description: Stores the product specific process ID for the parent process. type: String - contextPath: GoogleChronicleBackstory.Events.principal.process.file description: Stores the file name of the file in use by the process. type: String - contextPath: GoogleChronicleBackstory.Events.principal.process.file.fileMetadata description: Metadata associated with the file. type: String - contextPath: GoogleChronicleBackstory.Events.principal.process.file.fullPath description: Full path identifying the location of the file on the system. type: String - contextPath: GoogleChronicleBackstory.Events.principal.process.file.md5 description: MD5 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.principal.process.file.mimeType description: Multipurpose Internet Mail Extensions (MIME) type of the file. type: String - contextPath: GoogleChronicleBackstory.Events.principal.process.file.sha1 description: SHA-1 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.principal.process.file.sha256 description: SHA-256 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.principal.process.file.size description: Size of the file. type: String - contextPath: GoogleChronicleBackstory.Events.principal.process.parentPid description: Stores the process ID for the parent process. type: String - contextPath: GoogleChronicleBackstory.Events.principal.process.pid description: Stores the process ID. type: String - contextPath: GoogleChronicleBackstory.Events.principal.registry.registryKey description: Stores the registry key associated with an application or system component. type: String - contextPath: GoogleChronicleBackstory.Events.principal.registry.registryValueName description: Stores the name of the registry value associated with an application or system component. type: String - contextPath: GoogleChronicleBackstory.Events.principal.registry.registryValueData description: Stores the data associated with a registry value. type: String - contextPath: GoogleChronicleBackstory.Events.principal.user.emailAddresses description: Stores the email addresses for the user. type: String - contextPath: GoogleChronicleBackstory.Events.principal.user.employeeId description: Stores the human resources employee ID for the user. type: String - contextPath: GoogleChronicleBackstory.Events.principal.user.firstName description: Stores the first name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.principal.user.middleName description: Stores the middle name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.principal.user.lastName description: Stores the last name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.principal.user.groupid description: Stores the group ID associated with a user. type: String - contextPath: GoogleChronicleBackstory.Events.principal.user.phoneNumbers description: Stores the phone numbers for the user. type: String - contextPath: GoogleChronicleBackstory.Events.principal.user.title description: Stores the job title for the user. type: String - contextPath: GoogleChronicleBackstory.Events.principal.user.userDisplayName description: Stores the display name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.principal.user.userid description: Stores the user ID. type: String - contextPath: GoogleChronicleBackstory.Events.principal.user.windowsSid description: Stores the Microsoft Windows security identifier (SID) associated with a user. type: String - contextPath: GoogleChronicleBackstory.Events.target.assetId description: Vendor-specific unique device identifier. type: String - contextPath: GoogleChronicleBackstory.Events.target.email description: Email address. type: String - contextPath: GoogleChronicleBackstory.Events.target.hostname description: Client hostname or domain name field. type: String - contextPath: GoogleChronicleBackstory.Events.target.platform description: Platform operating system. type: String - contextPath: GoogleChronicleBackstory.Events.target.platformPatchLevel description: Platform operating system patch level. type: String - contextPath: GoogleChronicleBackstory.Events.target.platformVersion description: Platform operating system version. type: String - contextPath: GoogleChronicleBackstory.Events.target.ip description: IP address associated with a network connection. type: String - contextPath: GoogleChronicleBackstory.Events.target.port description: Source or destination network port number when a specific network connection is described within an event. type: String - contextPath: GoogleChronicleBackstory.Events.target.mac description: One or more MAC addresses associated with a device. type: String - contextPath: GoogleChronicleBackstory.Events.target.administrativeDomain description: Domain which the device belongs to (for example, the Windows domain). type: String - contextPath: GoogleChronicleBackstory.Events.target.url description: Standard URL. type: String - contextPath: GoogleChronicleBackstory.Events.target.file.fileMetadata description: Metadata associated with the file. type: String - contextPath: GoogleChronicleBackstory.Events.target.file.fullPath description: Full path identifying the location of the file on the system. type: String - contextPath: GoogleChronicleBackstory.Events.target.file.md5 description: MD5 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.target.file.mimeType description: Multipurpose Internet Mail Extensions (MIME) type of the file. type: String - contextPath: GoogleChronicleBackstory.Events.target.file.sha1 description: SHA-1 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.target.file.sha256 description: SHA-256 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.target.file.size description: Size of the file. type: String - contextPath: GoogleChronicleBackstory.Events.target.process.commandLine description: Stores the command line string for the process. type: String - contextPath: GoogleChronicleBackstory.Events.target.process.productSpecificProcessId description: Stores the product specific process ID. type: String - contextPath: GoogleChronicleBackstory.Events.target.process.productSpecificParentProcessId description: Stores the product specific process ID for the parent process. type: String - contextPath: GoogleChronicleBackstory.Events.target.process.file description: Stores the file name of the file in use by the process. type: String - contextPath: GoogleChronicleBackstory.Events.target.process.file.fileMetadata description: Metadata associated with the file. type: String - contextPath: GoogleChronicleBackstory.Events.target.process.file.fullPath description: Full path identifying the location of the file on the system. type: String - contextPath: GoogleChronicleBackstory.Events.target.process.file.md5 description: MD5 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.target.process.file.mimeType description: Multipurpose Internet Mail Extensions (MIME) type of the file. type: String - contextPath: GoogleChronicleBackstory.Events.target.process.file.sha1 description: SHA-1 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.target.process.file.sha256 description: SHA-256 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.target.process.file.size description: Size of the file. type: String - contextPath: GoogleChronicleBackstory.Events.target.process.parentPid description: Stores the process ID for the parent process. type: String - contextPath: GoogleChronicleBackstory.Events.target.process.pid description: Stores the process ID. type: String - contextPath: GoogleChronicleBackstory.Events.target.registry.registryKey description: Stores the registry key associated with an application or system component. type: String - contextPath: GoogleChronicleBackstory.Events.target.registry.registryValueName description: Stores the name of the registry value associated with an application or system component. type: String - contextPath: GoogleChronicleBackstory.Events.target.registry.registryValueData description: Stores the data associated with a registry value. type: String - contextPath: GoogleChronicleBackstory.Events.target.user.emailAddresses description: Stores the email addresses for the user. type: String - contextPath: GoogleChronicleBackstory.Events.target.user.employeeId description: Stores the human resources employee ID for the user. type: String - contextPath: GoogleChronicleBackstory.Events.target.user.firstName description: Stores the first name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.target.user.middleName description: Stores the middle name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.target.user.lastName description: Stores the last name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.target.user.groupid description: Stores the group ID associated with a user. type: String - contextPath: GoogleChronicleBackstory.Events.target.user.phoneNumbers description: Stores the phone numbers for the user. type: String - contextPath: GoogleChronicleBackstory.Events.target.user.title description: Stores the job title for the user. type: String - contextPath: GoogleChronicleBackstory.Events.target.user.userDisplayName description: Stores the display name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.target.user.userid description: Stores the user ID. type: String - contextPath: GoogleChronicleBackstory.Events.target.user.windowsSid description: Stores the Microsoft Windows security identifier (SID) associated with a user. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.assetId description: Vendor-specific unique device identifier. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.email description: Email address. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.hostname description: Client hostname or domain name field. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.platform description: Platform operating system. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.platformPatchLevel description: Platform operating system patch level. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.platformVersion description: Platform operating system version. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.ip description: IP address associated with a network connection. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.port description: Source or destination network port number when a specific network connection is described within an event. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.mac description: One or more MAC addresses associated with a device. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.administrativeDomain description: Domain which the device belongs to (for example, the Windows domain). type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.url description: Standard URL. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.file.fileMetadata description: Metadata associated with the file. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.file.fullPath description: Full path identifying the location of the file on the system. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.file.md5 description: MD5 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.file.mimeType description: Multipurpose Internet Mail Extensions (MIME) type of the file. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.file.sha1 description: SHA-1 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.file.sha256 description: SHA-256 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.file.size description: Size of the file. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.process.commandLine description: Stores the command line string for the process. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.process.productSpecificProcessId description: Stores the product specific process ID. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.process.productSpecificParentProcessId description: Stores the product specific process ID for the parent process. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.process.file description: Stores the file name of the file in use by the process. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.process.file.fileMetadata description: Metadata associated with the file. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.process.file.fullPath description: Full path identifying the location of the file on the system. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.process.file.md5 description: MD5 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.process.file.mimeType description: Multipurpose Internet Mail Extensions (MIME) type of the file. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.process.file.sha1 description: SHA-1 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.process.file.sha256 description: SHA-256 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.process.file.size description: Size of the file. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.process.parentPid description: Stores the process ID for the parent process. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.process.pid description: Stores the process ID. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.registry.registryKey description: Stores the registry key associated with an application or system component. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.registry.registryValueName description: Stores the name of the registry value associated with an application or system component. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.registry.registryValueData description: Stores the data associated with a registry value. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.user.emailAddresses description: Stores the email addresses for the user. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.user.employeeId description: Stores the human resources employee ID for the user. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.user.firstName description: Stores the first name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.user.middleName description: Stores the middle name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.user.lastName description: Stores the last name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.user.groupid description: Stores the group ID associated with a user. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.user.phoneNumbers description: Stores the phone numbers for the user. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.user.title description: Stores the job title for the user. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.user.userDisplayName description: Stores the display name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.user.userid description: Stores the user ID. type: String - contextPath: GoogleChronicleBackstory.Events.intermediary.user.windowsSid description: Stores the Microsoft Windows security identifier (SID) associated with a user. type: String - contextPath: GoogleChronicleBackstory.Events.src.assetId description: Vendor-specific unique device identifier. type: String - contextPath: GoogleChronicleBackstory.Events.src.email description: Email address. type: String - contextPath: GoogleChronicleBackstory.Events.src.hostname description: Client hostname or domain name field. type: String - contextPath: GoogleChronicleBackstory.Events.src.platform description: Platform operating system. type: String - contextPath: GoogleChronicleBackstory.Events.src.platformPatchLevel description: Platform operating system patch level. type: String - contextPath: GoogleChronicleBackstory.Events.src.platformVersion description: Platform operating system version. type: String - contextPath: GoogleChronicleBackstory.Events.src.ip description: IP address associated with a network connection. type: String - contextPath: GoogleChronicleBackstory.Events.src.port description: Source or destination network port number when a specific network connection is described within an event. type: String - contextPath: GoogleChronicleBackstory.Events.src.mac description: One or more MAC addresses associated with a device. type: String - contextPath: GoogleChronicleBackstory.Events.src.administrativeDomain description: Domain which the device belongs to (for example, the Windows domain). type: String - contextPath: GoogleChronicleBackstory.Events.src.url description: Standard URL. type: String - contextPath: GoogleChronicleBackstory.Events.src.file.fileMetadata description: Metadata associated with the file. type: String - contextPath: GoogleChronicleBackstory.Events.src.file.fullPath description: Full path identifying the location of the file on the system. type: String - contextPath: GoogleChronicleBackstory.Events.src.file.md5 description: MD5 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.src.file.mimeType description: Multipurpose Internet Mail Extensions (MIME) type of the file. type: String - contextPath: GoogleChronicleBackstory.Events.src.file.sha1 description: SHA-1 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.src.file.sha256 description: SHA-256 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.src.file.size description: Size of the file. type: String - contextPath: GoogleChronicleBackstory.Events.src.process.commandLine description: Stores the command line string for the process. type: String - contextPath: GoogleChronicleBackstory.Events.src.process.productSpecificProcessId description: Stores the product specific process ID. type: String - contextPath: GoogleChronicleBackstory.Events.src.process.productSpecificParentProcessId description: Stores the product specific process ID for the parent process. type: String - contextPath: GoogleChronicleBackstory.Events.src.process.file description: Stores the file name of the file in use by the process. type: String - contextPath: GoogleChronicleBackstory.Events.src.process.file.fileMetadata description: Metadata associated with the file. type: String - contextPath: GoogleChronicleBackstory.Events.src.process.file.fullPath description: Full path identifying the location of the file on the system. type: String - contextPath: GoogleChronicleBackstory.Events.src.process.file.md5 description: MD5 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.src.process.file.mimeType description: Multipurpose Internet Mail Extensions (MIME) type of the file. type: String - contextPath: GoogleChronicleBackstory.Events.src.process.file.sha1 description: SHA-1 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.src.process.file.sha256 description: SHA-256 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.src.process.file.size description: Size of the file. type: String - contextPath: GoogleChronicleBackstory.Events.src.process.parentPid description: Stores the process ID for the parent process. type: String - contextPath: GoogleChronicleBackstory.Events.src.process.pid description: Stores the process ID. type: String - contextPath: GoogleChronicleBackstory.Events.src.registry.registryKey description: Stores the registry key associated with an application or system component. type: String - contextPath: GoogleChronicleBackstory.Events.src.registry.registryValueName description: Stores the name of the registry value associated with an application or system component. type: String - contextPath: GoogleChronicleBackstory.Events.src.registry.registryValueData description: Stores the data associated with a registry value. type: String - contextPath: GoogleChronicleBackstory.Events.src.user.emailAddresses description: Stores the email addresses for the user. type: String - contextPath: GoogleChronicleBackstory.Events.src.user.employeeId description: Stores the human resources employee ID for the user. type: String - contextPath: GoogleChronicleBackstory.Events.src.user.firstName description: Stores the first name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.src.user.middleName description: Stores the middle name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.src.user.lastName description: Stores the last name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.src.user.groupid description: Stores the group ID associated with a user. type: String - contextPath: GoogleChronicleBackstory.Events.src.user.phoneNumbers description: Stores the phone numbers for the user. type: String - contextPath: GoogleChronicleBackstory.Events.src.user.title description: Stores the job title for the user. type: String - contextPath: GoogleChronicleBackstory.Events.src.user.userDisplayName description: Stores the display name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.src.user.userid description: Stores the user ID. type: String - contextPath: GoogleChronicleBackstory.Events.src.user.windowsSid description: Stores the Microsoft Windows security identifier (SID) associated with a user. type: String - contextPath: GoogleChronicleBackstory.Events.observer.assetId description: Vendor-specific unique device identifier. type: String - contextPath: GoogleChronicleBackstory.Events.observer.email description: Email address. type: String - contextPath: GoogleChronicleBackstory.Events.observer.hostname description: Client hostname or domain name field. type: String - contextPath: GoogleChronicleBackstory.Events.observer.platform description: Platform operating system. type: String - contextPath: GoogleChronicleBackstory.Events.observer.platformPatchLevel description: Platform operating system patch level. type: String - contextPath: GoogleChronicleBackstory.Events.observer.platformVersion description: Platform operating system version. type: String - contextPath: GoogleChronicleBackstory.Events.observer.ip description: IP address associated with a network connection. type: String - contextPath: GoogleChronicleBackstory.Events.observer.port description: Source or destination network port number when a specific network connection is described within an event. type: String - contextPath: GoogleChronicleBackstory.Events.observer.mac description: One or more MAC addresses associated with a device. type: String - contextPath: GoogleChronicleBackstory.Events.observer.administrativeDomain description: Domain which the device belongs to (for example, the Windows domain). type: String - contextPath: GoogleChronicleBackstory.Events.observer.url description: Standard URL. type: String - contextPath: GoogleChronicleBackstory.Events.observer.file.fileMetadata description: Metadata associated with the file. type: String - contextPath: GoogleChronicleBackstory.Events.observer.file.fullPath description: Full path identifying the location of the file on the system. type: String - contextPath: GoogleChronicleBackstory.Events.observer.file.md5 description: MD5 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.observer.file.mimeType description: Multipurpose Internet Mail Extensions (MIME) type of the file. type: String - contextPath: GoogleChronicleBackstory.Events.observer.file.sha1 description: SHA-1 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.observer.file.sha256 description: SHA-256 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.observer.file.size description: Size of the file. type: String - contextPath: GoogleChronicleBackstory.Events.observer.process.commandLine description: Stores the command line string for the process. type: String - contextPath: GoogleChronicleBackstory.Events.observer.process.productSpecificProcessId description: Stores the product specific process ID. type: String - contextPath: GoogleChronicleBackstory.Events.observer.process.productSpecificParentProcessId description: Stores the product specific process ID for the parent process. type: String - contextPath: GoogleChronicleBackstory.Events.observer.process.file description: Stores the file name of the file in use by the process. type: String - contextPath: GoogleChronicleBackstory.Events.observer.process.file.fileMetadata description: Metadata associated with the file. type: String - contextPath: GoogleChronicleBackstory.Events.observer.process.file.fullPath description: Full path identifying the location of the file on the system. type: String - contextPath: GoogleChronicleBackstory.Events.observer.process.file.md5 description: MD5 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.observer.process.file.mimeType description: Multipurpose Internet Mail Extensions (MIME) type of the file. type: String - contextPath: GoogleChronicleBackstory.Events.observer.process.file.sha1 description: SHA-1 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.observer.process.file.sha256 description: SHA-256 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.observer.process.file.size description: Size of the file. type: String - contextPath: GoogleChronicleBackstory.Events.observer.process.parentPid description: Stores the process ID for the parent process. type: String - contextPath: GoogleChronicleBackstory.Events.observer.process.pid description: Stores the process ID. type: String - contextPath: GoogleChronicleBackstory.Events.observer.registry.registryKey description: Stores the registry key associated with an application or system component. type: String - contextPath: GoogleChronicleBackstory.Events.observer.registry.registryValueName description: Stores the name of the registry value associated with an application or system component. type: String - contextPath: GoogleChronicleBackstory.Events.observer.registry.registryValueData description: Stores the data associated with a registry value. type: String - contextPath: GoogleChronicleBackstory.Events.observer.user.emailAddresses description: Stores the email addresses for the user. type: String - contextPath: GoogleChronicleBackstory.Events.observer.user.employeeId description: Stores the human resources employee ID for the user. type: String - contextPath: GoogleChronicleBackstory.Events.observer.user.firstName description: Stores the first name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.observer.user.middleName description: Stores the middle name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.observer.user.lastName description: Stores the last name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.observer.user.groupid description: Stores the group ID associated with a user. type: String - contextPath: GoogleChronicleBackstory.Events.observer.user.phoneNumbers description: Stores the phone numbers for the user. type: String - contextPath: GoogleChronicleBackstory.Events.observer.user.title description: Stores the job title for the user. type: String - contextPath: GoogleChronicleBackstory.Events.observer.user.userDisplayName description: Stores the display name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.observer.user.userid description: Stores the user ID. type: String - contextPath: GoogleChronicleBackstory.Events.observer.user.windowsSid description: Stores the Microsoft Windows security identifier (SID) associated with a user. type: String - contextPath: GoogleChronicleBackstory.Events.about.assetId description: Vendor-specific unique device identifier. type: String - contextPath: GoogleChronicleBackstory.Events.about.email description: Email address. type: String - contextPath: GoogleChronicleBackstory.Events.about.hostname description: Client hostname or domain name field. type: String - contextPath: GoogleChronicleBackstory.Events.about.platform description: Platform operating system. type: String - contextPath: GoogleChronicleBackstory.Events.about.platformPatchLevel description: Platform operating system patch level. type: String - contextPath: GoogleChronicleBackstory.Events.about.platformVersion description: Platform operating system version. type: String - contextPath: GoogleChronicleBackstory.Events.about.ip description: IP address associated with a network connection. type: String - contextPath: GoogleChronicleBackstory.Events.about.port description: Source or destination network port number when a specific network connection is described within an event. type: String - contextPath: GoogleChronicleBackstory.Events.about.mac description: One or more MAC addresses associated with a device. type: String - contextPath: GoogleChronicleBackstory.Events.about.administrativeDomain description: Domain which the device belongs to (for example, the Windows domain). type: String - contextPath: GoogleChronicleBackstory.Events.about.url description: Standard URL. type: String - contextPath: GoogleChronicleBackstory.Events.about.file.fileMetadata description: Metadata associated with the file. type: String - contextPath: GoogleChronicleBackstory.Events.about.file.fullPath description: Full path identifying the location of the file on the system. type: String - contextPath: GoogleChronicleBackstory.Events.about.file.md5 description: MD5 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.about.file.mimeType description: Multipurpose Internet Mail Extensions (MIME) type of the file. type: String - contextPath: GoogleChronicleBackstory.Events.about.file.sha1 description: SHA-1 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.about.file.sha256 description: SHA-256 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.about.file.size description: Size of the file. type: String - contextPath: GoogleChronicleBackstory.Events.about.process.commandLine description: Stores the command line string for the process. type: String - contextPath: GoogleChronicleBackstory.Events.about.process.productSpecificProcessId description: Stores the product specific process ID. type: String - contextPath: GoogleChronicleBackstory.Events.about.process.productSpecificParentProcessId description: Stores the product specific process ID for the parent process. type: String - contextPath: GoogleChronicleBackstory.Events.about.process.file description: Stores the file name of the file in use by the process. type: String - contextPath: GoogleChronicleBackstory.Events.about.process.file.fileMetadata description: Metadata associated with the file. type: String - contextPath: GoogleChronicleBackstory.Events.about.process.file.fullPath description: Full path identifying the location of the file on the system. type: String - contextPath: GoogleChronicleBackstory.Events.about.process.file.md5 description: MD5 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.about.process.file.mimeType description: Multipurpose Internet Mail Extensions (MIME) type of the file. type: String - contextPath: GoogleChronicleBackstory.Events.about.process.file.sha1 description: SHA-1 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.about.process.file.sha256 description: SHA-256 hash value of the file. type: String - contextPath: GoogleChronicleBackstory.Events.about.process.file.size description: Size of the file. type: String - contextPath: GoogleChronicleBackstory.Events.about.process.parentPid description: Stores the process ID for the parent process. type: String - contextPath: GoogleChronicleBackstory.Events.about.process.pid description: Stores the process ID. type: String - contextPath: GoogleChronicleBackstory.Events.about.registry.registryKey description: Stores the registry key associated with an application or system component. type: String - contextPath: GoogleChronicleBackstory.Events.about.registry.registryValueName description: Stores the name of the registry value associated with an application or system component. type: String - contextPath: GoogleChronicleBackstory.Events.about.registry.registryValueData description: Stores the data associated with a registry value. type: String - contextPath: GoogleChronicleBackstory.Events.about.user.emailAddresses description: Stores the email addresses for the user. type: String - contextPath: GoogleChronicleBackstory.Events.about.user.employeeId description: Stores the human resources employee ID for the user. type: String - contextPath: GoogleChronicleBackstory.Events.about.user.firstName description: Stores the first name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.about.user.middleName description: Stores the middle name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.about.user.lastName description: Stores the last name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.about.user.groupid description: Stores the group ID associated with a user. type: String - contextPath: GoogleChronicleBackstory.Events.about.user.phoneNumbers description: Stores the phone numbers for the user. type: String - contextPath: GoogleChronicleBackstory.Events.about.user.title description: Stores the job title for the user. type: String - contextPath: GoogleChronicleBackstory.Events.about.user.userDisplayName description: Stores the display name for the user. type: String - contextPath: GoogleChronicleBackstory.Events.about.user.userid description: Stores the user ID. type: String - contextPath: GoogleChronicleBackstory.Events.about.user.windowsSid description: Stores the Microsoft Windows security identifier (SID) associated with a user. type: String - contextPath: GoogleChronicleBackstory.Events.network.applicationProtocol description: Indicates the network application protocol. type: String - contextPath: GoogleChronicleBackstory.Events.network.direction description: Indicates the direction of network traffic. type: String - contextPath: GoogleChronicleBackstory.Events.network.email description: Specifies the email address for the sender/recipient. type: String - contextPath: GoogleChronicleBackstory.Events.network.ipProtocol description: Indicates the IP protocol. type: String - contextPath: GoogleChronicleBackstory.Events.network.receivedBytes description: Specifies the number of bytes received. type: String - contextPath: GoogleChronicleBackstory.Events.network.sentBytes description: Specifies the number of bytes sent. type: String - contextPath: GoogleChronicleBackstory.Events.network.dhcp.clientHostname description: Hostname for the client. type: String - contextPath: GoogleChronicleBackstory.Events.network.dhcp.clientIdentifier description: Client identifier. type: String - contextPath: GoogleChronicleBackstory.Events.network.dhcp.file description: Filename for the boot image. type: String - contextPath: GoogleChronicleBackstory.Events.network.dhcp.flags description: Value for the DHCP flags field. type: String - contextPath: GoogleChronicleBackstory.Events.network.dhcp.hlen description: Hardware address length. type: String - contextPath: GoogleChronicleBackstory.Events.network.dhcp.hops description: DHCP hop count. type: String - contextPath: GoogleChronicleBackstory.Events.network.dhcp.htype description: Hardware address type. type: String - contextPath: GoogleChronicleBackstory.Events.network.dhcp.leaseTimeSeconds description: Client-requested lease time for an IP address in seconds. type: String - contextPath: GoogleChronicleBackstory.Events.network.dhcp.opcode description: BOOTP op code. type: String - contextPath: GoogleChronicleBackstory.Events.network.dhcp.requestedAddress description: Client identifier. type: String - contextPath: GoogleChronicleBackstory.Events.network.dhcp.seconds description: Seconds elapsed since the client began the address acquisition/renewal process. type: String - contextPath: GoogleChronicleBackstory.Events.network.dhcp.sname description: Name of the server which the client has requested to boot from. type: String - contextPath: GoogleChronicleBackstory.Events.network.dhcp.transactionId description: Client transaction ID. type: String - contextPath: GoogleChronicleBackstory.Events.network.dhcp.type description: DHCP message type. type: String - contextPath: GoogleChronicleBackstory.Events.network.dhcp.chaddr description: IP address for the client hardware. type: String - contextPath: GoogleChronicleBackstory.Events.network.dhcp.ciaddr description: IP address for the client. type: String - contextPath: GoogleChronicleBackstory.Events.network.dhcp.giaddr description: IP address for the relay agent. type: String - contextPath: GoogleChronicleBackstory.Events.network.dhcp.siaddr description: IP address for the next bootstrap server. type: String - contextPath: GoogleChronicleBackstory.Events.network.dhcp.yiaddr description: Your IP address. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.authoritative description: Set to true for authoritative DNS servers. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.id description: Stores the DNS query identifier. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.response description: Set to true if the event is a DNS response. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.opcode description: Stores the DNS OpCode used to specify the type of DNS query (standard, inverse, server status, etc.). type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.recursionAvailable description: Set to true if a recursive DNS lookup is available. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.recursionDesired description: Set to true if a recursive DNS lookup is requested. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.responseCode description: Stores the DNS response code as defined by RFC 1035, Domain Names - Implementation and Specification. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.truncated description: Set to true if this is a truncated DNS response. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.questions.name description: Stores the domain name. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.questions.class description: Stores the code specifying the class of the query. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.questions.type description: Stores the code specifying the type of the query. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.answers.binaryData description: Stores the raw bytes of any non-UTF8 strings that might be included as part of a DNS response. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.answers.class description: Stores the code specifying the class of the resource record. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.answers.data description: Stores the payload or response to the DNS question for all responses encoded in UTF-8 format. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.answers.name description: Stores the name of the owner of the resource record. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.answers.ttl description: Stores the time interval for which the resource record can be cached before the source of the information should again be queried. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.answers.type description: Stores the code specifying the type of the resource record. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.authority.binaryData description: Stores the raw bytes of any non-UTF8 strings that might be included as part of a DNS response. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.authority.class description: Stores the code specifying the class of the resource record. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.authority.data description: Stores the payload or response to the DNS question for all responses encoded in UTF-8 format. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.authority.name description: Stores the name of the owner of the resource record. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.authority.ttl description: Stores the time interval for which the resource record can be cached before the source of the information should again be queried. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.authority.type description: Stores the code specifying the type of the resource record. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.additional.binaryData description: Stores the raw bytes of any non-UTF8 strings that might be included as part of a DNS response. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.additional.class description: Stores the code specifying the class of the resource record. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.additional.data description: Stores the payload or response to the DNS question for all responses encoded in UTF-8 format. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.additional.name description: Stores the name of the owner of the resource record. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.additional.ttl description: Stores the time interval for which the resource record can be cached before the source of the information should again be queried. type: String - contextPath: GoogleChronicleBackstory.Events.network.dns.additional.type description: Stores the code specifying the type of the resource record. type: String - contextPath: GoogleChronicleBackstory.Events.network.email.from description: Stores the from email address. type: String - contextPath: GoogleChronicleBackstory.Events.network.email.replyTo description: Stores the reply_to email address. type: String - contextPath: GoogleChronicleBackstory.Events.network.email.to description: Stores the to email addresses. type: String - contextPath: GoogleChronicleBackstory.Events.network.email.cc description: Stores the cc email addresses. type: String - contextPath: GoogleChronicleBackstory.Events.network.email.bcc description: Stores the bcc email addresses. type: String - contextPath: GoogleChronicleBackstory.Events.network.email.mailId description: Stores the mail (or message) ID. type: String - contextPath: GoogleChronicleBackstory.Events.network.email.subject description: Stores the email subject line. type: String - contextPath: GoogleChronicleBackstory.Events.network.ftp.command description: Stores the FTP command. type: String - contextPath: GoogleChronicleBackstory.Events.network.http.method description: Stores the HTTP request method. type: String - contextPath: GoogleChronicleBackstory.Events.network.http.referralUrl description: Stores the URL for the HTTP referer. type: String - contextPath: GoogleChronicleBackstory.Events.network.http.responseCode description: Stores the HTTP response status code, which indicates whether a specific HTTP request has been successfully completed. type: String - contextPath: GoogleChronicleBackstory.Events.network.http.useragent description: Stores the User-Agent request header which includes the application type, operating system, software vendor or software version of the requesting software user agent. type: String - contextPath: GoogleChronicleBackstory.Events.authentication.authType description: Type of system an authentication event is associated with (Chronicle UDM). type: String - contextPath: GoogleChronicleBackstory.Events.authentication.mechanism description: Mechanism(s) used for authentication. type: String - contextPath: GoogleChronicleBackstory.Events.securityResult.about description: Provide a description of the security result. type: String - contextPath: GoogleChronicleBackstory.Events.securityResult.action description: Specify a security action. type: String - contextPath: GoogleChronicleBackstory.Events.securityResult.category description: Specify a security category. type: String - contextPath: GoogleChronicleBackstory.Events.securityResult.confidence description: Specify a confidence with regards to a security event as estimated by the product. type: String - contextPath: GoogleChronicleBackstory.Events.securityResult.confidenceDetails description: Additional detail with regards to the confidence of a security event as estimated by the product vendor. type: String - contextPath: GoogleChronicleBackstory.Events.securityResult.priority description: Specify a priority with regards to a security event as estimated by the product vendor. type: String - contextPath: GoogleChronicleBackstory.Events.securityResult.priorityDetails description: Vendor-specific information about the security result priority. type: String - contextPath: GoogleChronicleBackstory.Events.securityResult.ruleId description: Identifier for the security rule. type: String - contextPath: GoogleChronicleBackstory.Events.securityResult.ruleName description: Name of the security rule. type: String - contextPath: GoogleChronicleBackstory.Events.securityResult.severity description: Severity of a security event as estimated by the product vendor using values defined by the Chronicle UDM. type: String - contextPath: GoogleChronicleBackstory.Events.securityResult.severityDetails description: Severity for a security event as estimated by the product vendor. type: String - contextPath: GoogleChronicleBackstory.Events.securityResult.threatName description: Name of the security threat. type: String - contextPath: GoogleChronicleBackstory.Events.securityResult.urlBackToProduct description: URL to direct you to the source product console for this security event. type: String - arguments: - description: Provide a unique name of the list to append content. name: name required: true - description: |- Enter the content to be appended into the reference list. Format accepted is: "Line 1, Line 2, Line 3". Note: Use "gcb-get-reference-list" to retrieve the content of the list. name: lines isArray: true required: false - description: |- Provide a unique file id consisting of lines to append. Note: Please provide either one of "lines" or "entry_id". name: entry_id required: false - defaultValue: ',' description: |- Delimiter by which the content of the list is separated. Eg: " , " , " : ", " ; ". name: delimiter - defaultValue: 'False' description: Flag to control how the file content is split. If set to True, it uses the provided delimiter; otherwise it splits by new lines (\n). name: use_delimiter_for_file required: false auto: PREDEFINED predefined: - 'True' - 'False' - defaultValue: 'False' description: A flag to determine whether to apply deduplication logic over new lines. name: append_unique required: false auto: PREDEFINED predefined: - 'True' - 'False' description: Appends lines into an existing reference list. name: gcb-reference-list-append-content outputs: - contextPath: GoogleChronicleBackstory.ReferenceList.name description: The unique name of the list. type: String - contextPath: GoogleChronicleBackstory.ReferenceList.description description: The description of the list. type: String - contextPath: GoogleChronicleBackstory.ReferenceList.lines description: The list of line items. type: String - contextPath: GoogleChronicleBackstory.ReferenceList.createTime description: The time when the list was created. type: Date - contextPath: GoogleChronicleBackstory.ReferenceList.contentType description: The content type of the reference list. type: String - arguments: - description: Provide a unique name of the list to remove content. name: name required: true - description: |- Enter the content to be removed from the reference list. Format accepted is: "Line 1, Line 2, Line 3". Note: Use "gcb-get-reference-list" to retrieve the content of the list. name: lines isArray: true required: false - description: |- Provide a unique file id consisting of lines to remove. Note: Please provide either one of "lines" or "entry_id". name: entry_id required: false - defaultValue: ',' description: |- Delimiter by which the content of the list is separated. Eg: " , " , " : ", " ; ". name: delimiter - defaultValue: 'False' description: Flag to control how the file content is split. If set to True, it uses the provided delimiter; otherwise it splits by new lines (\n). name: use_delimiter_for_file required: false auto: PREDEFINED predefined: - 'True' - 'False' description: Removes lines from an existing reference list. name: gcb-reference-list-remove-content outputs: - contextPath: GoogleChronicleBackstory.ReferenceList.name description: The unique name of the list. type: String - contextPath: GoogleChronicleBackstory.ReferenceList.description description: The description of the list. type: String - contextPath: GoogleChronicleBackstory.ReferenceList.lines description: The list of line items. type: String - contextPath: GoogleChronicleBackstory.ReferenceList.createTime description: The time when the list was created. type: Date - contextPath: GoogleChronicleBackstory.ReferenceList.contentType description: The content type of the reference list. type: String dockerimage: demisto/googleapi-python3:1.0.0.10182333 isfetch: true runonce: false script: '-' subtype: python3 type: python tests: - Google Chronicle Backstory Asset - Test - Google Chronicle Backstory List IOCs - Test - Google Chronicle Backstory List Alerts - Test - Google Chronicle Backstory IOC Details - Test - Google Chronicle Backstory List Events - Test - Google Chronicle Backstory List Detections - Test - Google Chronicle Backstory Reputation - Test - Google Chronicle Backstory Stream Test Rule fromversion: 5.0.0