google-cloud-chronicle-v1 1.3.0 → 1.4.0

data/proto_docs/backstory/entity_risk.rb

@@ -0,0 +1,98 @@
+# frozen_string_literal: true
+
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Auto-generated by gapic-generator-ruby. DO NOT EDIT!
+
+
+module Google
+  module Backstory
+    # Stores information related to the risk score of an entity.
+    # @!attribute [rw] risk_version
+    #   @return [::String]
+    #     Version of the risk score calculation algorithm.
+    # @!attribute [rw] risk_window
+    #   @return [::Google::Type::Interval]
+    #     Time window used when computing the risk score for an entity, for
+    #     example 24 hours or 7 days.
+    # @!attribute [rw] DEPRECATED_risk_score
+    #   @deprecated This field is deprecated and may be removed in the next major version update.
+    #   @return [::Integer]
+    #     Deprecated risk score.
+    # @!attribute [rw] risk_delta
+    #   @return [::Google::Backstory::RiskDelta]
+    #     Represents the change in risk score for an entity between the end of the
+    #     previous time window and the end of the current time window.
+    # @!attribute [rw] detections_count
+    #   @return [::Integer]
+    #     Number of detections that make up the risk score within the time window.
+    # @!attribute [rw] first_detection_time
+    #   @return [::Google::Protobuf::Timestamp]
+    #     Timestamp of the first detection within the specified time window.
+    #     This field is empty when there are no detections.
+    # @!attribute [rw] last_detection_time
+    #   @return [::Google::Protobuf::Timestamp]
+    #     Timestamp of the last detection within the specified time window.
+    #     This field is empty when there are no detections.
+    # @!attribute [rw] risk_score
+    #   @return [::Float]
+    #     Raw risk score for the entity.
+    # @!attribute [rw] normalized_risk_score
+    #   @return [::Integer]
+    #     Normalized risk score for the entity. This value is between 0-1000.
+    # @!attribute [rw] risk_window_size
+    #   @return [::Google::Protobuf::Duration]
+    #     Risk window duration for the entity.
+    # @!attribute [rw] raw_risk_delta
+    #   @return [::Google::Backstory::RiskDelta]
+    #     Represents the change in raw risk score for an entity between the end of
+    #     the previous time window and the end of the current time window.
+    # @!attribute [rw] last_reset_time
+    #   @return [::Google::Protobuf::Timestamp]
+    #     Timestamp for UEBA risk score reset based deduplication. Used specifically
+    #     for risk based meta rules.
+    # @!attribute [rw] detail_uri
+    #   @return [::String]
+    #     Link to the Google Security Operations UI with information about the entity
+    #     risk score.
+    #     If the SecOps instance has multiple frontend paths configured, this will be
+    #     a relative path that can be used to construct the full URL.
+    # @!attribute [rw] risk_window_has_new_detections
+    #   @return [::Boolean]
+    #     Whether there are new detections for the risk window.
+    class EntityRisk
+      include ::Google::Protobuf::MessageExts
+      extend ::Google::Protobuf::MessageExts::ClassMethods
+    end
+
+    # Describes the difference in risk score between two points in time.
+    # @!attribute [rw] previous_range_end_time
+    #   @return [::Google::Protobuf::Timestamp]
+    #     End time of the previous time window.
+    # @!attribute [rw] risk_score_delta
+    #   @return [::Integer]
+    #     Difference in the normalized risk score from the previous recorded value.
+    # @!attribute [rw] previous_risk_score
+    #   @return [::Integer]
+    #     Risk score from previous risk window
+    # @!attribute [rw] risk_score_numeric_delta
+    #   @return [::Integer]
+    #     Numeric change between current and previous risk score
+    class RiskDelta
+      include ::Google::Protobuf::MessageExts
+      extend ::Google::Protobuf::MessageExts::ClassMethods
+    end
+  end
+end

data/proto_docs/backstory/id.rb

@@ -0,0 +1,73 @@
+# frozen_string_literal: true
+
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Auto-generated by gapic-generator-ruby. DO NOT EDIT!
+
+
+module Google
+  module Backstory
+    # Identifier to identify a UDM object like a UDM event, Entity, Collection.
+    # The full identifier for persistence is created by setting the 32 most
+    # significant bits as the Id.Namespace enum This is a convenience wrapper to
+    # define the id space enum values and provide an easy interface for RPCs, most
+    # persistence use cases should use a denormalized form.
+    # @!attribute [rw] namespace
+    #   @return [::Google::Backstory::Id::Namespace]
+    #     Namespace the id belongs to.
+    # @!attribute [rw] id
+    #   @return [::String]
+    #     Full raw ID.
+    # @!attribute [rw] string_id
+    #   @return [::String]
+    #     Some ids are stored as strings that are not able to be translated to bytes,
+    #     so store these separately.
+    #     Ex. detection id of the form de_aaaaaaaa-aaaa...
+    class Id
+      include ::Google::Protobuf::MessageExts
+      extend ::Google::Protobuf::MessageExts::ClassMethods
+
+      # Extracted Namespace Component
+      module Namespace
+        # Ingested and Normalized telemetry events
+        NORMALIZED_TELEMETRY = 0
+
+        # Ingested Raw telemetry
+        RAW_TELEMETRY = 1
+
+        # Chronicle Rules engine
+        RULE_DETECTIONS = 2
+
+        # Uppercase
+        UPPERCASE = 3
+
+        # DSML - Machine Intelligence
+        MACHINE_INTELLIGENCE = 4
+
+        # A normalized telemetry event from Google Security Command Center.
+        SECURITY_COMMAND_CENTER = 5
+
+        # Unspecified Namespace
+        UNSPECIFIED = 6
+
+        # An alert coming from other SIEMs via Chronicle SOAR.
+        SOAR_ALERT = 7
+
+        # VirusTotal.
+        VIRUS_TOTAL = 8
+      end
+    end
+  end
+end