Reference documentation and code samples for the Chronicle V1 API class Google::Backstory::Metadata.
General information associated with a UDM event.
Inherits
- Object
Extended By
- Google::Protobuf::MessageExts::ClassMethods
Includes
- Google::Protobuf::MessageExts
Methods
#base_labels
def base_labels() -> ::Google::Backstory::DataAccessLabels
Returns
- (::Google::Backstory::DataAccessLabels) — Data access labels on the base event.
#base_labels=
def base_labels=(value) -> ::Google::Backstory::DataAccessLabels
Parameter
- value (::Google::Backstory::DataAccessLabels) — Data access labels on the base event.
Returns
- (::Google::Backstory::DataAccessLabels) — Data access labels on the base event.
#collected_timestamp
def collected_timestamp() -> ::Google::Protobuf::Timestamp
Returns
- (::Google::Protobuf::Timestamp) — The GMT timestamp when the event was collected by the vendor's local collection infrastructure.
#collected_timestamp=
def collected_timestamp=(value) -> ::Google::Protobuf::Timestamp
Parameter
- value (::Google::Protobuf::Timestamp) — The GMT timestamp when the event was collected by the vendor's local collection infrastructure.
Returns
- (::Google::Protobuf::Timestamp) — The GMT timestamp when the event was collected by the vendor's local collection infrastructure.
#description
def description() -> ::String
Returns
- (::String) — A human-readable unparsable description of the event.
#description=
def description=(value) -> ::String
Parameter
- value (::String) — A human-readable unparsable description of the event.
Returns
- (::String) — A human-readable unparsable description of the event.
#enrichment_labels
def enrichment_labels() -> ::Google::Backstory::DataAccessLabels
Returns
- (::Google::Backstory::DataAccessLabels) — Data access labels from all the contextual events used to enrich the base event.
#enrichment_labels=
def enrichment_labels=(value) -> ::Google::Backstory::DataAccessLabels
Parameter
- value (::Google::Backstory::DataAccessLabels) — Data access labels from all the contextual events used to enrich the base event.
Returns
- (::Google::Backstory::DataAccessLabels) — Data access labels from all the contextual events used to enrich the base event.
#enrichment_state
def enrichment_state() -> ::Google::Backstory::Metadata::EnrichmentState
Returns
- (::Google::Backstory::Metadata::EnrichmentState) — The enrichment state.
#enrichment_state=
def enrichment_state=(value) -> ::Google::Backstory::Metadata::EnrichmentState
Parameter
- value (::Google::Backstory::Metadata::EnrichmentState) — The enrichment state.
Returns
- (::Google::Backstory::Metadata::EnrichmentState) — The enrichment state.
#event_timestamp
def event_timestamp() -> ::Google::Protobuf::Timestamp
Returns
- (::Google::Protobuf::Timestamp) — The GMT timestamp when the event was generated.
#event_timestamp=
def event_timestamp=(value) -> ::Google::Protobuf::Timestamp
Parameter
- value (::Google::Protobuf::Timestamp) — The GMT timestamp when the event was generated.
Returns
- (::Google::Protobuf::Timestamp) — The GMT timestamp when the event was generated.
#event_timestamp_attributes
def event_timestamp_attributes() -> ::Array<::Google::Backstory::Metadata::EventTimestampAttribute>
Returns
- (::Array<::Google::Backstory::Metadata::EventTimestampAttribute>) — Attributes associated with event_timestamp. This field is used to distinguish between different types of timestamps that can be used to represent the event_timestamp.
#event_timestamp_attributes=
def event_timestamp_attributes=(value) -> ::Array<::Google::Backstory::Metadata::EventTimestampAttribute>
Parameter
- value (::Array<::Google::Backstory::Metadata::EventTimestampAttribute>) — Attributes associated with event_timestamp. This field is used to distinguish between different types of timestamps that can be used to represent the event_timestamp.
Returns
- (::Array<::Google::Backstory::Metadata::EventTimestampAttribute>) — Attributes associated with event_timestamp. This field is used to distinguish between different types of timestamps that can be used to represent the event_timestamp.
#event_type
def event_type() -> ::Google::Backstory::Metadata::EventType
Returns
- (::Google::Backstory::Metadata::EventType) — The event type. If an event has multiple possible types, this specifies the most specific type.
#event_type=
def event_type=(value) -> ::Google::Backstory::Metadata::EventType
Parameter
- value (::Google::Backstory::Metadata::EventType) — The event type. If an event has multiple possible types, this specifies the most specific type.
Returns
- (::Google::Backstory::Metadata::EventType) — The event type. If an event has multiple possible types, this specifies the most specific type.
#id
def id() -> ::String
Returns
- (::String) — ID of the UDM event. Can be used for raw and normalized event retrieval.
#id=
def id=(value) -> ::String
Parameter
- value (::String) — ID of the UDM event. Can be used for raw and normalized event retrieval.
Returns
- (::String) — ID of the UDM event. Can be used for raw and normalized event retrieval.
#ingested_timestamp
def ingested_timestamp() -> ::Google::Protobuf::Timestamp
Returns
- (::Google::Protobuf::Timestamp) — The GMT timestamp when the event was ingested (received) by Chronicle.
#ingested_timestamp=
def ingested_timestamp=(value) -> ::Google::Protobuf::Timestamp
Parameter
- value (::Google::Protobuf::Timestamp) — The GMT timestamp when the event was ingested (received) by Chronicle.
Returns
- (::Google::Protobuf::Timestamp) — The GMT timestamp when the event was ingested (received) by Chronicle.
#ingestion_labels
def ingestion_labels() -> ::Array<::Google::Backstory::Label>
Returns
- (::Array<::Google::Backstory::Label>) — User-configured ingestion metadata labels.
#ingestion_labels=
def ingestion_labels=(value) -> ::Array<::Google::Backstory::Label>
Parameter
- value (::Array<::Google::Backstory::Label>) — User-configured ingestion metadata labels.
Returns
- (::Array<::Google::Backstory::Label>) — User-configured ingestion metadata labels.
#log_type
def log_type() -> ::String
Returns
- (::String) — The string value of log type.
#log_type=
def log_type=(value) -> ::String
Parameter
- value (::String) — The string value of log type.
Returns
- (::String) — The string value of log type.
#parser_version
def parser_version() -> ::String
Returns
- (::String) — The version of the parser that generated this UDM event.
#parser_version=
def parser_version=(value) -> ::String
Parameter
- value (::String) — The version of the parser that generated this UDM event.
Returns
- (::String) — The version of the parser that generated this UDM event.
#product_deployment_id
def product_deployment_id() -> ::String
Returns
- (::String) — The deployment identifier assigned by the vendor for a product deployment.
#product_deployment_id=
def product_deployment_id=(value) -> ::String
Parameter
- value (::String) — The deployment identifier assigned by the vendor for a product deployment.
Returns
- (::String) — The deployment identifier assigned by the vendor for a product deployment.
#product_event_type
def product_event_type() -> ::String
Returns
- (::String) — A short, descriptive, human-readable, product-specific event name or type (e.g. "Scanned X", "User account created", "process_start").
#product_event_type=
def product_event_type=(value) -> ::String
Parameter
- value (::String) — A short, descriptive, human-readable, product-specific event name or type (e.g. "Scanned X", "User account created", "process_start").
Returns
- (::String) — A short, descriptive, human-readable, product-specific event name or type (e.g. "Scanned X", "User account created", "process_start").
#product_log_id
def product_log_id() -> ::String
Returns
- (::String) — A vendor-specific event identifier to uniquely identify the event (e.g. a GUID).
#product_log_id=
def product_log_id=(value) -> ::String
Parameter
- value (::String) — A vendor-specific event identifier to uniquely identify the event (e.g. a GUID).
Returns
- (::String) — A vendor-specific event identifier to uniquely identify the event (e.g. a GUID).
#product_name
def product_name() -> ::String
Returns
- (::String) — The name of the product.
#product_name=
def product_name=(value) -> ::String
Parameter
- value (::String) — The name of the product.
Returns
- (::String) — The name of the product.
#product_version
def product_version() -> ::String
Returns
- (::String) — The version of the product.
#product_version=
def product_version=(value) -> ::String
Parameter
- value (::String) — The version of the product.
Returns
- (::String) — The version of the product.
#structured_fields
def structured_fields() -> ::Google::Protobuf::Struct
Returns
- (::Google::Protobuf::Struct) — Flattened fields extracted from the log.
#structured_fields=
def structured_fields=(value) -> ::Google::Protobuf::Struct
Parameter
- value (::Google::Protobuf::Struct) — Flattened fields extracted from the log.
Returns
- (::Google::Protobuf::Struct) — Flattened fields extracted from the log.
#tags
def tags() -> ::Google::Backstory::Tags
Returns
- (::Google::Backstory::Tags) — Tags added by Chronicle after an event is parsed. It is an error to populate this field from within a parser.
#tags=
def tags=(value) -> ::Google::Backstory::Tags
Parameter
- value (::Google::Backstory::Tags) — Tags added by Chronicle after an event is parsed. It is an error to populate this field from within a parser.
Returns
- (::Google::Backstory::Tags) — Tags added by Chronicle after an event is parsed. It is an error to populate this field from within a parser.
#url_back_to_product
def url_back_to_product() -> ::String
Returns
- (::String) — A URL that takes the user to the source product console for this event.
#url_back_to_product=
def url_back_to_product=(value) -> ::String
Parameter
- value (::String) — A URL that takes the user to the source product console for this event.
Returns
- (::String) — A URL that takes the user to the source product console for this event.
#vendor_name
def vendor_name() -> ::String
Returns
- (::String) — The name of the product vendor.
#vendor_name=
def vendor_name=(value) -> ::String
Parameter
- value (::String) — The name of the product vendor.
Returns
- (::String) — The name of the product vendor.