Some or all of the information on this page might not apply to Cloud de Confiance by S3NS. See Differences from Google Cloud for more details.

Chronicle V1 API - Class Google::Backstory::File (v1.4.0)

Reference documentation and code samples for the Chronicle V1 API class Google::Backstory::File.

Information about a file.

Inherits

Object

Extended By

Google::Protobuf::MessageExts::ClassMethods

Includes

Google::Protobuf::MessageExts

Methods

#ahash

def ahash() -> ::String

Returns

(::String) — Deprecated. Use authentihash instead.

#ahash=

def ahash=(value) -> ::String

Parameter

value (::String) — Deprecated. Use authentihash instead.

Returns

(::String) — Deprecated. Use authentihash instead.

#app_compat_cache

def app_compat_cache() -> ::Google::Backstory::AppCompatMetadata

Returns

(::Google::Backstory::AppCompatMetadata) — Windows AppCompatCache (Application Compatibility) metadata.

#app_compat_cache=

def app_compat_cache=(value) -> ::Google::Backstory::AppCompatMetadata

Parameter

value (::Google::Backstory::AppCompatMetadata) — Windows AppCompatCache (Application Compatibility) metadata.

Returns

(::Google::Backstory::AppCompatMetadata) — Windows AppCompatCache (Application Compatibility) metadata.

#authentihash

def authentihash() -> ::String

Returns

(::String) — Authentihash of the file.

#authentihash=

def authentihash=(value) -> ::String

Parameter

value (::String) — Authentihash of the file.

Returns

(::String) — Authentihash of the file.

#capabilities_tags

def capabilities_tags() -> ::Array<::String>

Returns

(::Array<::String>) — Capabilities tags.

#capabilities_tags=

def capabilities_tags=(value) -> ::Array<::String>

Parameter

value (::Array<::String>) — Capabilities tags.

Returns

(::Array<::String>) — Capabilities tags.

#create_time

def create_time() -> ::Google::Protobuf::Timestamp

Returns

(::Google::Protobuf::Timestamp) — Timestamp when the file was created.

#create_time=

def create_time=(value) -> ::Google::Protobuf::Timestamp

Parameter

value (::Google::Protobuf::Timestamp) — Timestamp when the file was created.

Returns

(::Google::Protobuf::Timestamp) — Timestamp when the file was created.

#embedded_domains

def embedded_domains() -> ::Array<::String>

Returns

(::Array<::String>) — Embedded domains found in the file.

#embedded_domains=

def embedded_domains=(value) -> ::Array<::String>

Parameter

value (::Array<::String>) — Embedded domains found in the file.

Returns

(::Array<::String>) — Embedded domains found in the file.

#embedded_ips

def embedded_ips() -> ::Array<::String>

Returns

(::Array<::String>) — Embedded IP addresses found in the file.

#embedded_ips=

def embedded_ips=(value) -> ::Array<::String>

Parameter

value (::Array<::String>) — Embedded IP addresses found in the file.

Returns

(::Array<::String>) — Embedded IP addresses found in the file.

#embedded_urls

def embedded_urls() -> ::Array<::String>

Returns

(::Array<::String>) — Embedded urls found in the file.

#embedded_urls=

def embedded_urls=(value) -> ::Array<::String>

Parameter

value (::Array<::String>) — Embedded urls found in the file.

Returns

(::Array<::String>) — Embedded urls found in the file.

#exif_info

def exif_info() -> ::Google::Backstory::ExifInfo

Returns

(::Google::Backstory::ExifInfo) — Exif metadata from different file formats extracted by exiftool.

#exif_info=

def exif_info=(value) -> ::Google::Backstory::ExifInfo

Parameter

value (::Google::Backstory::ExifInfo) — Exif metadata from different file formats extracted by exiftool.

Returns

(::Google::Backstory::ExifInfo) — Exif metadata from different file formats extracted by exiftool.

#file_metadata

def file_metadata() -> ::Google::Backstory::FileMetadata

Returns

(::Google::Backstory::FileMetadata) — Metadata associated with the file. Deprecate FileMetadata in favor of using fields in File.

#file_metadata=

def file_metadata=(value) -> ::Google::Backstory::FileMetadata

Parameter

value (::Google::Backstory::FileMetadata) — Metadata associated with the file. Deprecate FileMetadata in favor of using fields in File.

Returns

(::Google::Backstory::FileMetadata) — Metadata associated with the file. Deprecate FileMetadata in favor of using fields in File.

#file_type

def file_type() -> ::Google::Backstory::File::FileType

Returns

(::Google::Backstory::File::FileType) — FileType field.

#file_type=

def file_type=(value) -> ::Google::Backstory::File::FileType

Parameter

value (::Google::Backstory::File::FileType) — FileType field.

Returns

(::Google::Backstory::File::FileType) — FileType field.

#first_seen_time

def first_seen_time() -> ::Google::Protobuf::Timestamp

Returns

(::Google::Protobuf::Timestamp) — Timestamp the file was first seen in the customer's environment.

#first_seen_time=

def first_seen_time=(value) -> ::Google::Protobuf::Timestamp

Parameter

value (::Google::Protobuf::Timestamp) — Timestamp the file was first seen in the customer's environment.

Returns

(::Google::Protobuf::Timestamp) — Timestamp the file was first seen in the customer's environment.

#first_submission_time

def first_submission_time() -> ::Google::Protobuf::Timestamp

Returns

(::Google::Protobuf::Timestamp) — First submission time of the file.

#first_submission_time=

def first_submission_time=(value) -> ::Google::Protobuf::Timestamp

Parameter

value (::Google::Protobuf::Timestamp) — First submission time of the file.

Returns

(::Google::Protobuf::Timestamp) — First submission time of the file.

#full_path

def full_path() -> ::String

Returns

(::String) — The full path identifying the location of the file on the system. This field can be used as an entity indicator for file entities.

#full_path=

def full_path=(value) -> ::String

Parameter

value (::String) — The full path identifying the location of the file on the system. This field can be used as an entity indicator for file entities.

Returns

(::String) — The full path identifying the location of the file on the system. This field can be used as an entity indicator for file entities.

#last_access_time

def last_access_time() -> ::Google::Protobuf::Timestamp

Returns

(::Google::Protobuf::Timestamp) — Timestamp when the file was accessed.

#last_access_time=

def last_access_time=(value) -> ::Google::Protobuf::Timestamp

Parameter

value (::Google::Protobuf::Timestamp) — Timestamp when the file was accessed.

Returns

(::Google::Protobuf::Timestamp) — Timestamp when the file was accessed.

#last_analysis_time

def last_analysis_time() -> ::Google::Protobuf::Timestamp

Returns

(::Google::Protobuf::Timestamp) — Timestamp the file was last analysed.

#last_analysis_time=

def last_analysis_time=(value) -> ::Google::Protobuf::Timestamp

Parameter

value (::Google::Protobuf::Timestamp) — Timestamp the file was last analysed.

Returns

(::Google::Protobuf::Timestamp) — Timestamp the file was last analysed.

#last_modification_time

def last_modification_time() -> ::Google::Protobuf::Timestamp

Returns

(::Google::Protobuf::Timestamp) — Timestamp when the file was last updated.

#last_modification_time=

def last_modification_time=(value) -> ::Google::Protobuf::Timestamp

Parameter

value (::Google::Protobuf::Timestamp) — Timestamp when the file was last updated.

Returns

(::Google::Protobuf::Timestamp) — Timestamp when the file was last updated.

#last_seen_time

def last_seen_time() -> ::Google::Protobuf::Timestamp

Returns

(::Google::Protobuf::Timestamp) — Timestamp the file was last seen in the customer's environment.

#last_seen_time=

def last_seen_time=(value) -> ::Google::Protobuf::Timestamp

Parameter

value (::Google::Protobuf::Timestamp) — Timestamp the file was last seen in the customer's environment.

Returns

(::Google::Protobuf::Timestamp) — Timestamp the file was last seen in the customer's environment.

#last_submission_time

def last_submission_time() -> ::Google::Protobuf::Timestamp

Returns

(::Google::Protobuf::Timestamp) — Last submission time of the file.

#last_submission_time=

def last_submission_time=(value) -> ::Google::Protobuf::Timestamp

Parameter

value (::Google::Protobuf::Timestamp) — Last submission time of the file.

Returns

(::Google::Protobuf::Timestamp) — Last submission time of the file.

#main_icon

def main_icon() -> ::Google::Backstory::Favicon

Returns

(::Google::Backstory::Favicon) — Icon's relevant hashes.

#main_icon=

def main_icon=(value) -> ::Google::Backstory::Favicon

Parameter

value (::Google::Backstory::Favicon) — Icon's relevant hashes.

Returns

(::Google::Backstory::Favicon) — Icon's relevant hashes.

#md5

def md5() -> ::String

Returns

(::String) — The MD5 hash of the file, as a hex-encoded string. This field can be used as an entity indicator for file entities.

#md5=

def md5=(value) -> ::String

Parameter

value (::String) — The MD5 hash of the file, as a hex-encoded string. This field can be used as an entity indicator for file entities.

Returns

(::String) — The MD5 hash of the file, as a hex-encoded string. This field can be used as an entity indicator for file entities.

#mime_type

def mime_type() -> ::String

Returns

(::String) — The MIME (Multipurpose Internet Mail Extensions) type of the file, for example "PE", "PDF", or "powershell script".

#mime_type=

def mime_type=(value) -> ::String

Parameter

value (::String) — The MIME (Multipurpose Internet Mail Extensions) type of the file, for example "PE", "PDF", or "powershell script".

Returns

(::String) — The MIME (Multipurpose Internet Mail Extensions) type of the file, for example "PE", "PDF", or "powershell script".

#names

def names() -> ::Array<::String>

Returns

(::Array<::String>) — Names fields.

#names=

def names=(value) -> ::Array<::String>

Parameter

value (::Array<::String>) — Names fields.

Returns

(::Array<::String>) — Names fields.

#ntfs

def ntfs() -> ::Google::Backstory::NtfsFileMetadata

Returns

(::Google::Backstory::NtfsFileMetadata) — NTFS metadata.

#ntfs=

def ntfs=(value) -> ::Google::Backstory::NtfsFileMetadata

Parameter

value (::Google::Backstory::NtfsFileMetadata) — NTFS metadata.

Returns

(::Google::Backstory::NtfsFileMetadata) — NTFS metadata.

#pdf_info

def pdf_info() -> ::Google::Backstory::PDFInfo

Returns

(::Google::Backstory::PDFInfo) — Information about the PDF file structure.

#pdf_info=

def pdf_info=(value) -> ::Google::Backstory::PDFInfo

Parameter

value (::Google::Backstory::PDFInfo) — Information about the PDF file structure.

Returns

(::Google::Backstory::PDFInfo) — Information about the PDF file structure.

#pe_file

def pe_file() -> ::Google::Backstory::FileMetadataPE

Returns

(::Google::Backstory::FileMetadataPE) — Metadata about the Portable Executable (PE) file.

#pe_file=

def pe_file=(value) -> ::Google::Backstory::FileMetadataPE

Parameter

value (::Google::Backstory::FileMetadataPE) — Metadata about the Portable Executable (PE) file.

Returns

(::Google::Backstory::FileMetadataPE) — Metadata about the Portable Executable (PE) file.

#prefetch_file_metadata

def prefetch_file_metadata() -> ::Google::Backstory::PrefetchFileMetadata

Returns

(::Google::Backstory::PrefetchFileMetadata) — Metadata about the prefetch file.

#prefetch_file_metadata=

def prefetch_file_metadata=(value) -> ::Google::Backstory::PrefetchFileMetadata

Parameter

value (::Google::Backstory::PrefetchFileMetadata) — Metadata about the prefetch file.

Returns

(::Google::Backstory::PrefetchFileMetadata) — Metadata about the prefetch file.

#prevalence

def prevalence() -> ::Google::Backstory::Prevalence

Returns

(::Google::Backstory::Prevalence) — Prevalence of the file hash in the customer's environment.

#prevalence=

def prevalence=(value) -> ::Google::Backstory::Prevalence

Parameter

value (::Google::Backstory::Prevalence) — Prevalence of the file hash in the customer's environment.

Returns

(::Google::Backstory::Prevalence) — Prevalence of the file hash in the customer's environment.

#security_result

def security_result() -> ::Google::Backstory::SecurityResult

Returns

(::Google::Backstory::SecurityResult) — Google Cloud Threat Intelligence (GCTI) security result for the file including threat context and detection metadata.

#security_result=

def security_result=(value) -> ::Google::Backstory::SecurityResult

Parameter

value (::Google::Backstory::SecurityResult) — Google Cloud Threat Intelligence (GCTI) security result for the file including threat context and detection metadata.

Returns

(::Google::Backstory::SecurityResult) — Google Cloud Threat Intelligence (GCTI) security result for the file including threat context and detection metadata.

#sha1

def sha1() -> ::String

Returns

(::String) — The SHA1 hash of the file, as a hex-encoded string. This field can be used as an entity indicator for file entities.

#sha1=

def sha1=(value) -> ::String

Parameter

value (::String) — The SHA1 hash of the file, as a hex-encoded string. This field can be used as an entity indicator for file entities.

Returns

(::String) — The SHA1 hash of the file, as a hex-encoded string. This field can be used as an entity indicator for file entities.

#sha256

def sha256() -> ::String

Returns

(::String) — The SHA256 hash of the file, as a hex-encoded string. This field can be used as an entity indicator for file entities.

#sha256=

def sha256=(value) -> ::String

Parameter

value (::String) — The SHA256 hash of the file, as a hex-encoded string. This field can be used as an entity indicator for file entities.

Returns

(::String) — The SHA256 hash of the file, as a hex-encoded string. This field can be used as an entity indicator for file entities.

#signature_info

def signature_info() -> ::Google::Backstory::SignatureInfo

Returns

(::Google::Backstory::SignatureInfo) — File signature information extracted from different tools.

#signature_info=

def signature_info=(value) -> ::Google::Backstory::SignatureInfo

Parameter

value (::Google::Backstory::SignatureInfo) — File signature information extracted from different tools.

Returns

(::Google::Backstory::SignatureInfo) — File signature information extracted from different tools.

#size

def size() -> ::Integer

Returns

(::Integer) — The size of the file in bytes.

#size=

def size=(value) -> ::Integer

Parameter

value (::Integer) — The size of the file in bytes.

Returns

(::Integer) — The size of the file in bytes.

#ssdeep

def ssdeep() -> ::String

Returns

(::String) — Ssdeep of the file

#ssdeep=

def ssdeep=(value) -> ::String

Parameter

value (::String) — Ssdeep of the file

Returns

(::String) — Ssdeep of the file

#stat_dev

def stat_dev() -> ::Integer

Returns

(::Integer) — The file system identifier to which the object belongs.

#stat_dev=

def stat_dev=(value) -> ::Integer

Parameter

value (::Integer) — The file system identifier to which the object belongs.

Returns

(::Integer) — The file system identifier to which the object belongs.

#stat_flags

def stat_flags() -> ::Integer

Returns

(::Integer) — User defined flags for file.

#stat_flags=

def stat_flags=(value) -> ::Integer

Parameter

value (::Integer) — User defined flags for file.

Returns

(::Integer) — User defined flags for file.

#stat_inode

def stat_inode() -> ::Integer

Returns

(::Integer) — The file identifier. Unique identifier of object within a file system.

#stat_inode=

def stat_inode=(value) -> ::Integer

Parameter

value (::Integer) — The file identifier. Unique identifier of object within a file system.

Returns

(::Integer) — The file identifier. Unique identifier of object within a file system.

#stat_mode

def stat_mode() -> ::Integer

Returns

(::Integer) — The mode of the file. A bit string indicating the permissions and privileges of the file.

#stat_mode=

def stat_mode=(value) -> ::Integer

Parameter

value (::Integer) — The mode of the file. A bit string indicating the permissions and privileges of the file.

Returns

(::Integer) — The mode of the file. A bit string indicating the permissions and privileges of the file.

#stat_nlink

def stat_nlink() -> ::Integer

Returns

(::Integer) — Number of links to file.

#stat_nlink=

def stat_nlink=(value) -> ::Integer

Parameter

value (::Integer) — Number of links to file.

Returns

(::Integer) — Number of links to file.

#symhash

def symhash() -> ::String

Returns

(::String) — SymHash of the file. Used for Mach-O (e.g. MacOS) binaries, to identify similar files based on their symbol table.

#symhash=

def symhash=(value) -> ::String

Parameter

value (::String) — SymHash of the file. Used for Mach-O (e.g. MacOS) binaries, to identify similar files based on their symbol table.

Returns

(::String) — SymHash of the file. Used for Mach-O (e.g. MacOS) binaries, to identify similar files based on their symbol table.

#tags

def tags() -> ::Array<::String>

Returns

(::Array<::String>) — Tags for the file.

#tags=

def tags=(value) -> ::Array<::String>

Parameter

value (::Array<::String>) — Tags for the file.

Returns

(::Array<::String>) — Tags for the file.

#vhash

def vhash() -> ::String

Returns

(::String) — Vhash of the file.

#vhash=

def vhash=(value) -> ::String

Parameter

value (::String) — Vhash of the file.

Returns

(::String) — Vhash of the file.