Reference documentation and code samples for the Chronicle V1 API class Google::Backstory::AtiPrioritization.
AtiPrioritization contains various fields used to calculate a priority score for an entity identified as a threat.
Inherits
- Object
Extended By
- Google::Protobuf::MessageExts::ClassMethods
Includes
- Google::Protobuf::MessageExts
Methods
#active_ir
def active_ir() -> ::Boolean
Returns
- (::Boolean) — Whether one or more Mandiant incident response customers had this indicator in their environment.
#active_ir=
def active_ir=(value) -> ::Boolean
Parameter
- value (::Boolean) — Whether one or more Mandiant incident response customers had this indicator in their environment.
Returns
- (::Boolean) — Whether one or more Mandiant incident response customers had this indicator in their environment.
#active_ir_first_tagged_time
def active_ir_first_tagged_time() -> ::Google::Protobuf::Timestamp
Returns
- (::Google::Protobuf::Timestamp) — The timestamp of the first time an active IR was applied to this entity.
#active_ir_first_tagged_time=
def active_ir_first_tagged_time=(value) -> ::Google::Protobuf::Timestamp
Parameter
- value (::Google::Protobuf::Timestamp) — The timestamp of the first time an active IR was applied to this entity.
Returns
- (::Google::Protobuf::Timestamp) — The timestamp of the first time an active IR was applied to this entity.
#attributed_malware
def attributed_malware() -> ::Array<::Google::Backstory::SecurityResult::Association>
Returns
- (::Array<::Google::Backstory::SecurityResult::Association>) — Malware families associated with this indicator.
#attributed_malware=
def attributed_malware=(value) -> ::Array<::Google::Backstory::SecurityResult::Association>
Parameter
- value (::Array<::Google::Backstory::SecurityResult::Association>) — Malware families associated with this indicator.
Returns
- (::Array<::Google::Backstory::SecurityResult::Association>) — Malware families associated with this indicator.
#attributed_threat_actors
def attributed_threat_actors() -> ::Array<::Google::Backstory::SecurityResult::Association>
Returns
- (::Array<::Google::Backstory::SecurityResult::Association>) — Threat actors associated with this indicator.
#attributed_threat_actors=
def attributed_threat_actors=(value) -> ::Array<::Google::Backstory::SecurityResult::Association>
Parameter
- value (::Array<::Google::Backstory::SecurityResult::Association>) — Threat actors associated with this indicator.
Returns
- (::Array<::Google::Backstory::SecurityResult::Association>) — Threat actors associated with this indicator.
#exclusive
def exclusive() -> ::Boolean
Returns
- (::Boolean) — Whether the indicator is being used by a maximum of one threat actor.
#exclusive=
def exclusive=(value) -> ::Boolean
Parameter
- value (::Boolean) — Whether the indicator is being used by a maximum of one threat actor.
Returns
- (::Boolean) — Whether the indicator is being used by a maximum of one threat actor.
#global_customer_count
def global_customer_count() -> ::Integer
Returns
- (::Integer) — Global customer count over the last 30 days
#global_customer_count=
def global_customer_count=(value) -> ::Integer
Parameter
- value (::Integer) — Global customer count over the last 30 days
Returns
- (::Integer) — Global customer count over the last 30 days
#global_hit_count
def global_hit_count() -> ::Integer
Returns
- (::Integer) — Global hit count over the last 30 days
#global_hit_count=
def global_hit_count=(value) -> ::Integer
Parameter
- value (::Integer) — Global hit count over the last 30 days
Returns
- (::Integer) — Global hit count over the last 30 days
#gti_severity
def gti_severity() -> ::Integer
Returns
- (::Integer) — The confidence score from "GTI severity" source.
#gti_severity=
def gti_severity=(value) -> ::Integer
Parameter
- value (::Integer) — The confidence score from "GTI severity" source.
Returns
- (::Integer) — The confidence score from "GTI severity" source.
#gti_threat_score
def gti_threat_score() -> ::Integer
Returns
- (::Integer) — The confidence score from "GTI threat score" source.
#gti_threat_score=
def gti_threat_score=(value) -> ::Integer
Parameter
- value (::Integer) — The confidence score from "GTI threat score" source.
Returns
- (::Integer) — The confidence score from "GTI threat score" source.
#gti_update_time
def gti_update_time() -> ::Google::Protobuf::Timestamp
Returns
- (::Google::Protobuf::Timestamp) — Timestamp of the latest update for GTI verdict, severity, or threat score.
#gti_update_time=
def gti_update_time=(value) -> ::Google::Protobuf::Timestamp
Parameter
- value (::Google::Protobuf::Timestamp) — Timestamp of the latest update for GTI verdict, severity, or threat score.
Returns
- (::Google::Protobuf::Timestamp) — Timestamp of the latest update for GTI verdict, severity, or threat score.
#gti_verdict
def gti_verdict() -> ::Integer
Returns
- (::Integer) — The confidence score from "GTI verdict" source.
#gti_verdict=
def gti_verdict=(value) -> ::Integer
Parameter
- value (::Integer) — The confidence score from "GTI verdict" source.
Returns
- (::Integer) — The confidence score from "GTI verdict" source.
#mandiant_analyst_confidence
def mandiant_analyst_confidence() -> ::Integer
Returns
- (::Integer) — The confidence score from "Mandiant Analyst Intel" source.
#mandiant_analyst_confidence=
def mandiant_analyst_confidence=(value) -> ::Integer
Parameter
- value (::Integer) — The confidence score from "Mandiant Analyst Intel" source.
Returns
- (::Integer) — The confidence score from "Mandiant Analyst Intel" source.
#osint
def osint() -> ::Boolean
Returns
- (::Boolean) — Whether the indicator details are available in open source.
#osint=
def osint=(value) -> ::Boolean
Parameter
- value (::Boolean) — Whether the indicator details are available in open source.
Returns
- (::Boolean) — Whether the indicator details are available in open source.
#reviewed
def reviewed() -> ::Boolean
Returns
- (::Boolean) — Whether the indicator verdict has passed review.
#reviewed=
def reviewed=(value) -> ::Boolean
Parameter
- value (::Boolean) — Whether the indicator verdict has passed review.
Returns
- (::Boolean) — Whether the indicator verdict has passed review.
#scanner
def scanner() -> ::Boolean
Returns
- (::Boolean) — Whether the indicator is a scanner.
#scanner=
def scanner=(value) -> ::Boolean
Parameter
- value (::Boolean) — Whether the indicator is a scanner.
Returns
- (::Boolean) — Whether the indicator is a scanner.