Reference documentation and code samples for the Chronicle V1 API class Google::Backstory::Collection.
Collection represents a container of objects (such as events, entity context metadata, detection finding metadata) and state (such as investigation details).
An example use case for Collection is to model a detection and investigation from detection finding metadata to investigative state collected in the course of the investigation. For more complex investigation and response workflows a Collection could represent an incident consisting of multiple child findings or incidents. This can be expanded on to model remediation elements of a full detection and response workflow.
Inherits
- Object
Extended By
- Google::Protobuf::MessageExts::ClassMethods
Includes
- Google::Protobuf::MessageExts
Methods
#case_name
def case_name() -> ::String
Returns
- (::String) — The resource name of the Case that this collection belongs to. Example: projects/{project id}/locations/{region}/chronicle/cases/{internal_case_id}
#case_name=
def case_name=(value) -> ::String
Parameter
- value (::String) — The resource name of the Case that this collection belongs to. Example: projects/{project id}/locations/{region}/chronicle/cases/{internal_case_id}
Returns
- (::String) — The resource name of the Case that this collection belongs to. Example: projects/{project id}/locations/{region}/chronicle/cases/{internal_case_id}
#collection_elements
def collection_elements() -> ::Array<::Google::Backstory::Element>
Returns
- (::Array<::Google::Backstory::Element>) — Constituent elements of the collection. Each element shares an association that groups it together and is a component of the overall collection. For example, a detection collection may have several constituent elements that each share a correlation association that together represent a particular pattern or behavior.
#collection_elements=
def collection_elements=(value) -> ::Array<::Google::Backstory::Element>
Parameter
- value (::Array<::Google::Backstory::Element>) — Constituent elements of the collection. Each element shares an association that groups it together and is a component of the overall collection. For example, a detection collection may have several constituent elements that each share a correlation association that together represent a particular pattern or behavior.
Returns
- (::Array<::Google::Backstory::Element>) — Constituent elements of the collection. Each element shares an association that groups it together and is a component of the overall collection. For example, a detection collection may have several constituent elements that each share a correlation association that together represent a particular pattern or behavior.
#created_time
def created_time() -> ::Google::Protobuf::Timestamp
Returns
- (::Google::Protobuf::Timestamp) — Time the collection was created.
#created_time=
def created_time=(value) -> ::Google::Protobuf::Timestamp
Parameter
- value (::Google::Protobuf::Timestamp) — Time the collection was created.
Returns
- (::Google::Protobuf::Timestamp) — Time the collection was created.
#data_access_scope
def data_access_scope() -> ::String
Returns
- (::String) — The resource name of the DataAccessScope of this collection.
#data_access_scope=
def data_access_scope=(value) -> ::String
Parameter
- value (::String) — The resource name of the DataAccessScope of this collection.
Returns
- (::String) — The resource name of the DataAccessScope of this collection.
#detection
def detection() -> ::Array<::Google::Backstory::SecurityResult>
Returns
- (::Array<::Google::Backstory::SecurityResult>) — Detection metadata for findings that represent detections, can include rule details, machine learning model metadata, and indicators implicated in the detection (using the .about field).
#detection=
def detection=(value) -> ::Array<::Google::Backstory::SecurityResult>
Parameter
- value (::Array<::Google::Backstory::SecurityResult>) — Detection metadata for findings that represent detections, can include rule details, machine learning model metadata, and indicators implicated in the detection (using the .about field).
Returns
- (::Array<::Google::Backstory::SecurityResult>) — Detection metadata for findings that represent detections, can include rule details, machine learning model metadata, and indicators implicated in the detection (using the .about field).
#detection_time
def detection_time() -> ::Google::Protobuf::Timestamp
Returns
- (::Google::Protobuf::Timestamp) — Timestamp within the time_window related to the time of the collection_elements. For Rule Detections, this timestamp is the end of the the time_window for multi-event rules or the time of the event for single event rules. For late-arriving events that trigger new alerts, the detection_time will be the event time of the event.
#detection_time=
def detection_time=(value) -> ::Google::Protobuf::Timestamp
Parameter
- value (::Google::Protobuf::Timestamp) — Timestamp within the time_window related to the time of the collection_elements. For Rule Detections, this timestamp is the end of the the time_window for multi-event rules or the time of the event for single event rules. For late-arriving events that trigger new alerts, the detection_time will be the event time of the event.
Returns
- (::Google::Protobuf::Timestamp) — Timestamp within the time_window related to the time of the collection_elements. For Rule Detections, this timestamp is the end of the the time_window for multi-event rules or the time of the event for single event rules. For late-arriving events that trigger new alerts, the detection_time will be the event time of the event.
#detection_timing_details
def detection_timing_details() -> ::Array<::Google::Backstory::Collection::DetectionTimingDetails>
Returns
- (::Array<::Google::Backstory::Collection::DetectionTimingDetails>) — Detection timing details for the collection. These details are used to determine prossible causes of latency for the detection. This field is only set for detections that are generated by rules.
#detection_timing_details=
def detection_timing_details=(value) -> ::Array<::Google::Backstory::Collection::DetectionTimingDetails>
Parameter
- value (::Array<::Google::Backstory::Collection::DetectionTimingDetails>) — Detection timing details for the collection. These details are used to determine prossible causes of latency for the detection. This field is only set for detections that are generated by rules.
Returns
- (::Array<::Google::Backstory::Collection::DetectionTimingDetails>) — Detection timing details for the collection. These details are used to determine prossible causes of latency for the detection. This field is only set for detections that are generated by rules.
#id
def id() -> ::String
Returns
- (::String) — Unique ID for the collection. The ID is specific to the type of collection. For example, with rule detections this is the detection ID.
#id=
def id=(value) -> ::String
Parameter
- value (::String) — Unique ID for the collection. The ID is specific to the type of collection. For example, with rule detections this is the detection ID.
Returns
- (::String) — Unique ID for the collection. The ID is specific to the type of collection. For example, with rule detections this is the detection ID.
#id_namespace
def id_namespace() -> ::Google::Backstory::Id::Namespace
Returns
- (::Google::Backstory::Id::Namespace) — The ID namespace used for the Collection.
#id_namespace=
def id_namespace=(value) -> ::Google::Backstory::Id::Namespace
Parameter
- value (::Google::Backstory::Id::Namespace) — The ID namespace used for the Collection.
Returns
- (::Google::Backstory::Id::Namespace) — The ID namespace used for the Collection.
#investigation
def investigation() -> ::Google::Backstory::Investigation
Returns
- (::Google::Backstory::Investigation) — Consolidated investigation details (categorization, status, etc) typically for collections that begin as detection findings and then evolve with analyst action and feedback into investigations around the detection output.
#investigation=
def investigation=(value) -> ::Google::Backstory::Investigation
Parameter
- value (::Google::Backstory::Investigation) — Consolidated investigation details (categorization, status, etc) typically for collections that begin as detection findings and then evolve with analyst action and feedback into investigations around the detection output.
Returns
- (::Google::Backstory::Investigation) — Consolidated investigation details (categorization, status, etc) typically for collections that begin as detection findings and then evolve with analyst action and feedback into investigations around the detection output.
#last_updated_time
def last_updated_time() -> ::Google::Protobuf::Timestamp
Returns
- (::Google::Protobuf::Timestamp) — Time the collection was last updated.
#last_updated_time=
def last_updated_time=(value) -> ::Google::Protobuf::Timestamp
Parameter
- value (::Google::Protobuf::Timestamp) — Time the collection was last updated.
Returns
- (::Google::Protobuf::Timestamp) — Time the collection was last updated.
#latency_metrics
def latency_metrics() -> ::Google::Backstory::LatencyMetrics
Returns
- (::Google::Backstory::LatencyMetrics) — The latency metrics for the specific detection. These metrics are calculated from ALL of the events that contribute to the detection, not just the sampled ones.
#latency_metrics=
def latency_metrics=(value) -> ::Google::Backstory::LatencyMetrics
Parameter
- value (::Google::Backstory::LatencyMetrics) — The latency metrics for the specific detection. These metrics are calculated from ALL of the events that contribute to the detection, not just the sampled ones.
Returns
- (::Google::Backstory::LatencyMetrics) — The latency metrics for the specific detection. These metrics are calculated from ALL of the events that contribute to the detection, not just the sampled ones.
#response_platform_info
def response_platform_info() -> ::Google::Backstory::ResponsePlatformInfo
Returns
- (::Google::Backstory::ResponsePlatformInfo) — Alert related info of this same alert in customer's SOAR platform.
#response_platform_info=
def response_platform_info=(value) -> ::Google::Backstory::ResponsePlatformInfo
Parameter
- value (::Google::Backstory::ResponsePlatformInfo) — Alert related info of this same alert in customer's SOAR platform.
Returns
- (::Google::Backstory::ResponsePlatformInfo) — Alert related info of this same alert in customer's SOAR platform.
#rule_run_frequency
def rule_run_frequency() -> ::Google::Backstory::Collection::RunFrequency
Returns
- (::Google::Backstory::Collection::RunFrequency) — The run frequency of the rule when it generated the detection.
#rule_run_frequency=
def rule_run_frequency=(value) -> ::Google::Backstory::Collection::RunFrequency
Parameter
- value (::Google::Backstory::Collection::RunFrequency) — The run frequency of the rule when it generated the detection.
Returns
- (::Google::Backstory::Collection::RunFrequency) — The run frequency of the rule when it generated the detection.
#simulated_event_count
def simulated_event_count() -> ::Integer
Returns
- (::Integer) — The total number of simulated events that contributed to this detection. Simulated events are realistic threat sequences (Raw Logs or UDM) programmatically delivered into the production ingestion pipeline to verify the entire detection lifecycle—from identification to action.
#simulated_event_count=
def simulated_event_count=(value) -> ::Integer
Parameter
- value (::Integer) — The total number of simulated events that contributed to this detection. Simulated events are realistic threat sequences (Raw Logs or UDM) programmatically delivered into the production ingestion pipeline to verify the entire detection lifecycle—from identification to action.
Returns
- (::Integer) — The total number of simulated events that contributed to this detection. Simulated events are realistic threat sequences (Raw Logs or UDM) programmatically delivered into the production ingestion pipeline to verify the entire detection lifecycle—from identification to action.
#simulated_event_names
def simulated_event_names() -> ::Array<::String>
Returns
- (::Array<::String>) — The set of all values from event ingestion_labels where SIMULATED is set as the key, for all simulated events that participated in this detection.
#simulated_event_names=
def simulated_event_names=(value) -> ::Array<::String>
Parameter
- value (::Array<::String>) — The set of all values from event ingestion_labels where SIMULATED is set as the key, for all simulated events that participated in this detection.
Returns
- (::Array<::String>) — The set of all values from event ingestion_labels where SIMULATED is set as the key, for all simulated events that participated in this detection.
#soar_alert
def soar_alert() -> ::Boolean
Returns
- (::Boolean) — A boolean field indicating that the alert is present in SOAR.
#soar_alert=
def soar_alert=(value) -> ::Boolean
Parameter
- value (::Boolean) — A boolean field indicating that the alert is present in SOAR.
Returns
- (::Boolean) — A boolean field indicating that the alert is present in SOAR.
#soar_alert_metadata
def soar_alert_metadata() -> ::Google::Backstory::SoarAlertMetadata
Returns
- (::Google::Backstory::SoarAlertMetadata) — Metadata fields of alerts coming from other SIEM systems via SOAR.
#soar_alert_metadata=
def soar_alert_metadata=(value) -> ::Google::Backstory::SoarAlertMetadata
Parameter
- value (::Google::Backstory::SoarAlertMetadata) — Metadata fields of alerts coming from other SIEM systems via SOAR.
Returns
- (::Google::Backstory::SoarAlertMetadata) — Metadata fields of alerts coming from other SIEM systems via SOAR.
#tags
def tags() -> ::Array<::String>
Returns
- (::Array<::String>) — Tags set by UC/DSML/RE for the Finding during creation.
#tags=
def tags=(value) -> ::Array<::String>
Parameter
- value (::Array<::String>) — Tags set by UC/DSML/RE for the Finding during creation.
Returns
- (::Array<::String>) — Tags set by UC/DSML/RE for the Finding during creation.
#time_window
def time_window() -> ::Google::Type::Interval
Returns
- (::Google::Type::Interval) — Time interval that the collection represents.
#time_window=
def time_window=(value) -> ::Google::Type::Interval
Parameter
- value (::Google::Type::Interval) — Time interval that the collection represents.
Returns
- (::Google::Type::Interval) — Time interval that the collection represents.
#type
def type() -> ::Google::Backstory::Collection::CollectionType
Returns
- (::Google::Backstory::Collection::CollectionType) — What the collection represents.
#type=
def type=(value) -> ::Google::Backstory::Collection::CollectionType
Parameter
- value (::Google::Backstory::Collection::CollectionType) — What the collection represents.
Returns
- (::Google::Backstory::Collection::CollectionType) — What the collection represents.