Chronicle V1 API - Class Google::Backstory::EntityRisk (v1.4.0)

Reference documentation and code samples for the Chronicle V1 API class Google::Backstory::EntityRisk.

Stores information related to the risk score of an entity.

Inherits

  • Object

Extended By

  • Google::Protobuf::MessageExts::ClassMethods

Includes

  • Google::Protobuf::MessageExts

Methods

#DEPRECATED_risk_score

def DEPRECATED_risk_score() -> ::Integer
Returns
  • (::Integer) — Deprecated risk score.

#DEPRECATED_risk_score=

def DEPRECATED_risk_score=(value) -> ::Integer
Parameter
  • value (::Integer) — Deprecated risk score.
Returns
  • (::Integer) — Deprecated risk score.

#detail_uri

def detail_uri() -> ::String
Returns
  • (::String) — Link to the Google Security Operations UI with information about the entity risk score. If the SecOps instance has multiple frontend paths configured, this will be a relative path that can be used to construct the full URL.

#detail_uri=

def detail_uri=(value) -> ::String
Parameter
  • value (::String) — Link to the Google Security Operations UI with information about the entity risk score. If the SecOps instance has multiple frontend paths configured, this will be a relative path that can be used to construct the full URL.
Returns
  • (::String) — Link to the Google Security Operations UI with information about the entity risk score. If the SecOps instance has multiple frontend paths configured, this will be a relative path that can be used to construct the full URL.

#detections_count

def detections_count() -> ::Integer
Returns
  • (::Integer) — Number of detections that make up the risk score within the time window.

#detections_count=

def detections_count=(value) -> ::Integer
Parameter
  • value (::Integer) — Number of detections that make up the risk score within the time window.
Returns
  • (::Integer) — Number of detections that make up the risk score within the time window.

#first_detection_time

def first_detection_time() -> ::Google::Protobuf::Timestamp
Returns
  • (::Google::Protobuf::Timestamp) — Timestamp of the first detection within the specified time window. This field is empty when there are no detections.

#first_detection_time=

def first_detection_time=(value) -> ::Google::Protobuf::Timestamp
Parameter
  • value (::Google::Protobuf::Timestamp) — Timestamp of the first detection within the specified time window. This field is empty when there are no detections.
Returns
  • (::Google::Protobuf::Timestamp) — Timestamp of the first detection within the specified time window. This field is empty when there are no detections.

#last_detection_time

def last_detection_time() -> ::Google::Protobuf::Timestamp
Returns
  • (::Google::Protobuf::Timestamp) — Timestamp of the last detection within the specified time window. This field is empty when there are no detections.

#last_detection_time=

def last_detection_time=(value) -> ::Google::Protobuf::Timestamp
Parameter
  • value (::Google::Protobuf::Timestamp) — Timestamp of the last detection within the specified time window. This field is empty when there are no detections.
Returns
  • (::Google::Protobuf::Timestamp) — Timestamp of the last detection within the specified time window. This field is empty when there are no detections.

#last_reset_time

def last_reset_time() -> ::Google::Protobuf::Timestamp
Returns

#last_reset_time=

def last_reset_time=(value) -> ::Google::Protobuf::Timestamp
Parameter
  • value (::Google::Protobuf::Timestamp) — Timestamp for UEBA risk score reset based deduplication. Used specifically for risk based meta rules.
Returns

#normalized_risk_score

def normalized_risk_score() -> ::Integer
Returns
  • (::Integer) — Normalized risk score for the entity. This value is between 0-1000.

#normalized_risk_score=

def normalized_risk_score=(value) -> ::Integer
Parameter
  • value (::Integer) — Normalized risk score for the entity. This value is between 0-1000.
Returns
  • (::Integer) — Normalized risk score for the entity. This value is between 0-1000.

#raw_risk_delta

def raw_risk_delta() -> ::Google::Backstory::RiskDelta
Returns
  • (::Google::Backstory::RiskDelta) — Represents the change in raw risk score for an entity between the end of the previous time window and the end of the current time window.

#raw_risk_delta=

def raw_risk_delta=(value) -> ::Google::Backstory::RiskDelta
Parameter
  • value (::Google::Backstory::RiskDelta) — Represents the change in raw risk score for an entity between the end of the previous time window and the end of the current time window.
Returns
  • (::Google::Backstory::RiskDelta) — Represents the change in raw risk score for an entity between the end of the previous time window and the end of the current time window.

#risk_delta

def risk_delta() -> ::Google::Backstory::RiskDelta
Returns
  • (::Google::Backstory::RiskDelta) — Represents the change in risk score for an entity between the end of the previous time window and the end of the current time window.

#risk_delta=

def risk_delta=(value) -> ::Google::Backstory::RiskDelta
Parameter
  • value (::Google::Backstory::RiskDelta) — Represents the change in risk score for an entity between the end of the previous time window and the end of the current time window.
Returns
  • (::Google::Backstory::RiskDelta) — Represents the change in risk score for an entity between the end of the previous time window and the end of the current time window.

#risk_score

def risk_score() -> ::Float
Returns
  • (::Float) — Raw risk score for the entity.

#risk_score=

def risk_score=(value) -> ::Float
Parameter
  • value (::Float) — Raw risk score for the entity.
Returns
  • (::Float) — Raw risk score for the entity.

#risk_version

def risk_version() -> ::String
Returns
  • (::String) — Version of the risk score calculation algorithm.

#risk_version=

def risk_version=(value) -> ::String
Parameter
  • value (::String) — Version of the risk score calculation algorithm.
Returns
  • (::String) — Version of the risk score calculation algorithm.

#risk_window

def risk_window() -> ::Google::Type::Interval
Returns
  • (::Google::Type::Interval) — Time window used when computing the risk score for an entity, for example 24 hours or 7 days.

#risk_window=

def risk_window=(value) -> ::Google::Type::Interval
Parameter
  • value (::Google::Type::Interval) — Time window used when computing the risk score for an entity, for example 24 hours or 7 days.
Returns
  • (::Google::Type::Interval) — Time window used when computing the risk score for an entity, for example 24 hours or 7 days.

#risk_window_has_new_detections

def risk_window_has_new_detections() -> ::Boolean
Returns
  • (::Boolean) — Whether there are new detections for the risk window.

#risk_window_has_new_detections=

def risk_window_has_new_detections=(value) -> ::Boolean
Parameter
  • value (::Boolean) — Whether there are new detections for the risk window.
Returns
  • (::Boolean) — Whether there are new detections for the risk window.

#risk_window_size

def risk_window_size() -> ::Google::Protobuf::Duration
Returns

#risk_window_size=

def risk_window_size=(value) -> ::Google::Protobuf::Duration
Parameter
Returns