Reference documentation and code samples for the Chronicle V1 API module Google::Backstory::Metadata::EventType.
An event type. Choose event type not based on the product that generated the event but the one that logged the event itself. So, for example, an antivirus (AV) scanning email on a client would generate an SMTP_PROXY event, not an AV event. A DLP device scanning a web upload would generate an HTTP_PROXY event and not a DLP or process activity event. Note: In the case of a HTTP_PROXY event, you might also include process details if this occurred on an endpoint. That would be optional, but there are a certain set of required fields and banned fields due to its status as an HTTP_PROXY event.
Constants
EVENTTYPE_UNSPECIFIED
value: 0
Default event type
PROCESS_UNCATEGORIZED
value: 10_000
Activity related to a process which does not match any other event types.
PROCESS_LAUNCH
value: 10_001
Process launch.
PROCESS_INJECTION
value: 10_002
Process injecting into another process.
PROCESS_PRIVILEGE_ESCALATION
value: 10_003
Process privilege escalation.
PROCESS_TERMINATION
value: 10_004
Process termination.
PROCESS_OPEN
value: 10_005
Process being opened.
PROCESS_MODULE_LOAD
value: 10_006
Process loading a module.
REGISTRY_UNCATEGORIZED
value: 11_000
Registry event which does not match any of the other event types.
REGISTRY_CREATION
value: 11_001
Registry creation.
REGISTRY_MODIFICATION
value: 11_002
Registry modification.
REGISTRY_DELETION
value: 11_003
Registry deletion.
SETTING_UNCATEGORIZED
value: 12_000
Settings-related event which does not match any of the other
event types.
SETTING_CREATION
value: 12_001
Setting creation.
SETTING_MODIFICATION
value: 12_002
Setting modification.
SETTING_DELETION
value: 12_003
Setting deletion.
MUTEX_UNCATEGORIZED
value: 13_000
Any mutex event other than creation.
MUTEX_CREATION
value: 13_001
Mutex creation.
FILE_UNCATEGORIZED
value: 14_000
File event which does not match any of the other event types.
FILE_CREATION
value: 14_001
File created.
FILE_DELETION
value: 14_002
File deleted.
FILE_MODIFICATION
value: 14_003
File modified.
FILE_READ
value: 14_004
File read.
FILE_COPY
value: 14_005
File copied.
Used for file copies, for example, to a thumb drive.
FILE_OPEN
value: 14_006
File opened.
FILE_MOVE
value: 14_007
File moved or renamed.
FILE_SYNC
value: 14_008
File synced (for example, Google Drive, Dropbox, backup).
USER_UNCATEGORIZED
value: 15_000
User activity which does not match any of the other event types.
USER_LOGIN
value: 15_001
User login.
USER_LOGOUT
value: 15_002
User logout.
USER_CREATION
value: 15_003
User creation.
USER_CHANGE_PASSWORD
value: 15_004
User password change event.
USER_CHANGE_PERMISSIONS
value: 15_005
Change in user permissions.
USER_STATS
value: 15_006
Deprecated. Used to update user info for an LDAP dump.
USER_BADGE_IN
value: 15_007
User physically badging into a location.
USER_DELETION
value: 15_008
User deletion.
USER_RESOURCE_CREATION
value: 15_009
User creating a virtual resource.
This is equivalent to RESOURCE_CREATION.
USER_RESOURCE_UPDATE_CONTENT
value: 15_010
User updating content of a virtual resource.
This is equivalent to RESOURCE_WRITTEN.
USER_RESOURCE_UPDATE_PERMISSIONS
value: 15_011
User updating permissions of a virtual resource.
This is equivalent to RESOURCE_PERMISSIONS_CHANGE.
USER_COMMUNICATION
value: 15_012
User initiating communication through a medium (for example, video).
USER_RESOURCE_ACCESS
value: 15_013
User accessing a virtual resource.
This is equivalent to RESOURCE_READ.
USER_RESOURCE_DELETION
value: 15_014
User deleting a virtual resource.
This is equivalent to RESOURCE_DELETION.
GROUP_UNCATEGORIZED
value: 23_000
A group activity that does not fall into one of the other event types.
GROUP_CREATION
value: 23_001
A group creation.
GROUP_DELETION
value: 23_002
A group deletion.
GROUP_MODIFICATION
value: 23_003
A group modification.
EMAIL_UNCATEGORIZED
value: 19_000
Email messages
EMAIL_TRANSACTION
value: 19_001
An email transaction.
EMAIL_URL_CLICK
value: 19_002
Deprecated: use NETWORK_HTTP instead. An email URL click event.
NETWORK_UNCATEGORIZED
value: 16_000
A network event that does not fit into one of the other event types.
NETWORK_FLOW
value: 16_001
Aggregated flow stats like netflow.
NETWORK_CONNECTION
value: 16_002
Network connection details like from a FW.
NETWORK_FTP
value: 16_003
FTP telemetry.
NETWORK_DHCP
value: 16_004
DHCP payload.
NETWORK_DNS
value: 16_005
DNS payload.
NETWORK_HTTP
value: 16_006
HTTP telemetry.
NETWORK_SMTP
value: 16_007
SMTP telemetry.
STATUS_UNCATEGORIZED
value: 17_000
A status message that does not fit into one of the other event types.
STATUS_HEARTBEAT
value: 17_001
Heartbeat indicating product is alive.
STATUS_STARTUP
value: 17_002
An agent startup.
STATUS_SHUTDOWN
value: 17_003
An agent shutdown.
STATUS_UPDATE
value: 17_004
A software or fingerprint update.
SCAN_UNCATEGORIZED
value: 18_000
Scan item that does not fit into one of the other event types.
SCAN_FILE
value: 18_001
A file scan.
SCAN_PROCESS_BEHAVIORS
value: 18_002
Scan process behaviors.
Please use SCAN_PROCESS instead.
SCAN_PROCESS
value: 18_003
Scan process.
SCAN_HOST
value: 18_004
Scan results from scanning an entire host device for threats/sensitive
documents.
SCAN_VULN_HOST
value: 18_005
Vulnerability scan logs about host vulnerabilities (e.g., out of date
software) and network vulnerabilities (e.g., unprotected service detected
via a network scan).
SCAN_VULN_NETWORK
value: 18_006
Vulnerability scan logs about network vulnerabilities.
SCAN_NETWORK
value: 18_007
Scan network for suspicious activity
SCHEDULED_TASK_UNCATEGORIZED
value: 20_000
Scheduled task event that does not fall into one of the other
event types.
SCHEDULED_TASK_CREATION
value: 20_001
Scheduled task creation.
SCHEDULED_TASK_DELETION
value: 20_002
Scheduled task deletion.
SCHEDULED_TASK_ENABLE
value: 20_003
Scheduled task being enabled.
SCHEDULED_TASK_DISABLE
value: 20_004
Scheduled task being disabled.
SCHEDULED_TASK_MODIFICATION
value: 20_005
Scheduled task being modified.
SYSTEM_AUDIT_LOG_UNCATEGORIZED
value: 21_000
A system audit log event that is not a wipe.
SYSTEM_AUDIT_LOG_WIPE
value: 21_001
A system audit log wipe.
SERVICE_UNSPECIFIED
value: 22_000
Service event that does not fit into one of the other event types.
SERVICE_CREATION
value: 22_001
A service creation.
SERVICE_DELETION
value: 22_002
A service deletion.
SERVICE_START
value: 22_003
A service start.
SERVICE_STOP
value: 22_004
A service stop.
SERVICE_MODIFICATION
value: 22_005
A service modification.
GENERIC_EVENT
value: 100_000
Operating system events that are not described by any of the other
event types. Might include uncategorized Microsoft Windows event logs.
RESOURCE_CREATION
value: 1
The resource was created/provisioned.
This is equivalent to USER_RESOURCE_CREATION.
RESOURCE_DELETION
value: 2
The resource was deleted/deprovisioned.
This is equivalent to USER_RESOURCE_DELETION.
RESOURCE_PERMISSIONS_CHANGE
value: 3
The resource had it's permissions or ACLs updated.
This is equivalent to USER_RESOURCE_UPDATE_PERMISSIONS.
RESOURCE_READ
value: 4
The resource was read.
This is equivalent to USER_RESOURCE_ACCESS.
RESOURCE_WRITTEN
value: 5
The resource was written to.
This is equivalent to USER_RESOURCE_UPDATE_CONTENT.
DEVICE_FIRMWARE_UPDATE
value: 25_000
Firmware update.
DEVICE_CONFIG_UPDATE
value: 25_001
Configuration update.
DEVICE_PROGRAM_UPLOAD
value: 25_002
A program or application uploaded to a device.
DEVICE_PROGRAM_DOWNLOAD
value: 25_003
A program or application downloaded to a device.
ANALYST_UPDATE_VERDICT
value: 24_000
Analyst update about the Verdict (such as true positive, false positive,
or disregard) of a finding.
ANALYST_UPDATE_REPUTATION
value: 24_001
Analyst update about the Reputation (such as useful or not useful) of a
finding.
ANALYST_UPDATE_SEVERITY_SCORE
value: 24_002
Analyst update about the Severity score (0-100) of a finding.
ANALYST_UPDATE_STATUS
value: 24_007
Analyst update about the finding status.
ANALYST_ADD_COMMENT
value: 24_008
Analyst addition of a comment for a finding.
ANALYST_UPDATE_PRIORITY
value: 24_009
Analyst update about the priority (such as low, medium, or high) for a
finding.
ANALYST_UPDATE_ROOT_CAUSE
value: 24_010
Analyst update about the root cause for a finding.
ANALYST_UPDATE_REASON
value: 24_011
Analyst update about the reason (such as malicious or not malicious) for
a finding.
ANALYST_UPDATE_RISK_SCORE
value: 24_012
Analyst update about the risk score (0-100) of a finding.
ENTITY_RISK_CHANGE
value: 26_000
An update to an entity risk score. This event type is restricted to
events published by Google Securit Operations Risk Analytics.
TRIAGE_AGENT_UPDATE_INVESTIGATION
value: 27_000
Triage Agent has investigated the finding.