google-cloud-chronicle-v1 1.3.0 → 1.4.0

data/proto_docs/google/cloud/chronicle/v1/entity.rb

@@ -21,6 +21,44 @@ module Google
   module Cloud
     module Chronicle
       module V1
+        # An Entity provides additional context about an entity in a UDM event (asset,
+        # user, etc.). For example, a PROCESS_LAUNCH event describes that user
+        # 'abc@example.corp' launched process 'shady.exe'. The event does not include
+        # information that user 'abc@example.com' is a recently terminated employee who
+        # administers a server storing finance data. Information stored in one or more
+        # Entities can add this additional context.
+        # @!attribute [rw] name
+        #   @return [::String]
+        #     The resource name of the entity.
+        #     Format:
+        #     `projects/{project}/locations/{location}/instances/{instance}/entities/{entity}`
+        #     `projects/{project}/locations/{location}/instances/{instance}/analytics/{analytic}/entities/{entity}`
+        #     `projects/{project}/locations/{location}/instances/{instance}/watchlists/{watchlist}/entities/{entity}`
+        # @!attribute [rw] metadata
+        #   @return [::Google::Backstory::EntityMetadata]
+        #     Entity metadata such as timestamp, product, etc.
+        # @!attribute [rw] entity
+        #   @return [::Google::Backstory::Noun]
+        #     Noun in the UDM event that this entity represents.
+        # @!attribute [rw] additional
+        #   @return [::Google::Protobuf::Struct]
+        #     Important entity data that cannot be adequately represented within
+        #     the formal sections of the Entity.
+        # @!attribute [rw] risk_score
+        #   @return [::Google::Backstory::EntityRisk]
+        #     Represents the entity risk scores resource
+        # @!attribute [rw] metric
+        #   @return [::Google::Backstory::Metric]
+        #     Metric details of the entity. Used if EntityType is METRIC.
+        # @!attribute [rw] relations
+        #   @return [::Array<::Google::Backstory::Relation>]
+        #     One or more relationships between the entity (a) and other entities,
+        #     including the relationship type and related entity.
+        class Entity
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+        end
+
         # A watchlist is a list of entities that allows for bulk operations over the
         # included entities.
         # @!attribute [rw] name

data/proto_docs/google/cloud/chronicle/v1/event.rb

@@ -0,0 +1,42 @@
+# frozen_string_literal: true
+
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Auto-generated by gapic-generator-ruby. DO NOT EDIT!
+
+
+module Google
+  module Cloud
+    module Chronicle
+      module V1
+        # Event is a resource that contains information about a telemetry event.
+        # @!attribute [rw] name
+        #   @return [::String]
+        #     The resource name of the event.
+        #     Format:
+        #     projects/\\{project}/locations/\\{location}/instances/\\{instance}/events/\\{event}
+        #     where 'event' is URL-encoded Base64. The unencoded value of 'event' can
+        #     also be found in udm.metadata.id.
+        # @!attribute [rw] udm
+        #   @return [::Google::Backstory::UDM]
+        #     Event data in UDM format.
+        class Event
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+        end
+      end
+    end
+  end
+end

data/proto_docs/google/cloud/chronicle/v1/search.rb

@@ -0,0 +1,593 @@
+# frozen_string_literal: true
+
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Auto-generated by gapic-generator-ruby. DO NOT EDIT!
+
+
+module Google
+  module Cloud
+    module Chronicle
+      module V1
+        # SearchSession represents an asynchronous search session.
+        # @!attribute [rw] name
+        #   @return [::String]
+        #     Identifier. The resource name of the search session.
+        #     Format:
+        #     projects/\\{project}/locations/\\{location}/instances/\\{instance}/searchSessions/\\{search_session}
+        # @!attribute [rw] query
+        #   @return [::String]
+        #     Required. The search query, in the dialect set in `dialect`.
+        #     Example: 'ip=/172.*/ AND metadata.event_type!="NETWORK_CONNECTION" AND (
+        #     target.ip = "3.225.179.73" OR target.ip = "23.47.48.70")'
+        # @!attribute [rw] time_range
+        #   @return [::Google::Type::Interval]
+        #     Required. Time range to search for [Inclusive start time, exclusive end
+        #     time).
+        # @!attribute [rw] dialect
+        #   @return [::Google::Cloud::Chronicle::V1::QueryDialect]
+        #     Optional. Specifies how to parse the 'query' string. If not specified, the
+        #     query will be parsed as YL2.
+        # @!attribute [rw] draft_data_access_scope
+        #   @return [::Google::Cloud::Chronicle::V1::DataAccessScope]
+        #     Optional. Data access scope used to filter events. This is intended to be
+        #     used by admins to preview in-development scopes. Should only be called by
+        #     users with global access.  If the caller does not have global access, the
+        #     request will fail.
+        # @!attribute [r] metadata
+        #   @return [::Google::Cloud::Chronicle::V1::SearchSessionMetadata]
+        #     Output only. Metadata about the search session.
+        class SearchSession
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+        end
+
+        # SearchedResult contains the results of a Search operation.
+        # @!attribute [rw] name
+        #   @return [::String]
+        #     Identifier. The resource name of the search results.
+        #     Format:
+        #     projects/\\{project}/locations/\\{location}/instances/\\{instance}/searchSessions/\\{search_session}/searchedResults/\\{searched_result}
+        # @!attribute [rw] result_row
+        #   @return [::Google::Cloud::Chronicle::V1::ResultRow]
+        #     Contains a flexible row which can support a standard UDM Event, Stats,
+        #     Entity Context, Join result, Data Table, etc.
+        class SearchedResult
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+        end
+
+        # Request message for the Search method.
+        # @!attribute [rw] parent
+        #   @return [::String]
+        #     Required. The resource name of the instance on which to perform the search.
+        #     Format: projects/\\{project}/locations/\\{location}/instances/\\{instance}
+        # @!attribute [rw] query
+        #   @return [::String]
+        #     Required. The search query, in the dialect set in `dialect`.
+        #     Example: 'ip=/172.*/ AND metadata.event_type!="NETWORK_CONNECTION" AND (
+        #     target.ip = "3.225.179.73" OR target.ip = "23.47.48.70")'
+        # @!attribute [rw] time_range
+        #   @return [::Google::Type::Interval]
+        #     Required. Time range to search for [Inclusive start time, exclusive end
+        #     time).
+        # @!attribute [rw] dialect
+        #   @return [::Google::Cloud::Chronicle::V1::QueryDialect]
+        #     Optional. Specifies the dialect the Search Query is written in. If not
+        #     specified, the query will be parsed as YL2.
+        # @!attribute [rw] draft_data_access_scope
+        #   @return [::Google::Cloud::Chronicle::V1::DataAccessScope]
+        #     Optional. Data access scope used to filter events. This is intended to be
+        #     used by admins to preview in-development scopes. Should only be called by
+        #     users with global access.  If the caller does not have global access, the
+        #     request will fail.
+        # @!attribute [rw] result_limit
+        #   @return [::Integer]
+        #     Optional. Requested maximum number of rows to materialize. The service may
+        #     return fewer. If unspecified, a server-side default of 10,000 is used. The
+        #     maximum value is 1,000,000. Some dialects have a lower maximum; see
+        #     `QueryDialect`.
+        # @!attribute [rw] simulated_data_visibility
+        #   @return [::Google::Cloud::Chronicle::V1::SimulatedDataVisibility]
+        #     Optional. Specifies visibility of simulated data to include in search
+        #     results.
+        class SearchRequest
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+        end
+
+        # Request message for the ListSearchedResults method.
+        # @!attribute [rw] parent
+        #   @return [::String]
+        #     Required. The parent SearchSession resource name.
+        #     Format:
+        #     projects/\\{project}/locations/\\{location}/instances/\\{instance}/searchSessions/\\{search_session}
+        # @!attribute [rw] page_size
+        #   @return [::Integer]
+        #     Optional. The maximum number of results to return. The service may return
+        #     fewer. If unspecified, at most 100 results will be returned. The maximum
+        #     value is 1000.
+        # @!attribute [rw] page_token
+        #   @return [::String]
+        #     Optional. A page token, received from a previous `ListSearchedResults`
+        #     call. Provide this to retrieve the subsequent page.
+        # @!attribute [rw] order_by
+        #   @return [::String]
+        #     Optional. The column to sort the results on. Example: "event_timestamp
+        #     desc", "principal.hostname asc". Multi-columnar sorting is not supported.
+        # @!attribute [rw] skip
+        #   @return [::Integer]
+        #     Optional. The number of results to skip before starting to return results.
+        #     This field should not be used in conjunction with page_token.
+        class ListSearchedResultsRequest
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+        end
+
+        # Response message for the ListSearchedResults method.
+        # @!attribute [rw] searched_results
+        #   @return [::Array<::Google::Cloud::Chronicle::V1::SearchedResult>]
+        #     List of Searched Results.
+        # @!attribute [rw] total_size
+        #   @return [::Integer]
+        #     Total number of rows in the result set of the search query.
+        # @!attribute [rw] column_names
+        #   @return [::Google::Cloud::Chronicle::V1::ColumnNames]
+        #     List of column names for the outcome section of the query result.
+        # @!attribute [rw] column_schema
+        #   @return [::Google::Cloud::Chronicle::V1::ColumnSchema]
+        #     Column schema for the results based on the query columns. Contains metadata
+        #     like data source, event_name etc.
+        # @!attribute [rw] next_page_token
+        #   @return [::String]
+        #     A token, which can be sent as `page_token` to retrieve the next page.
+        #     If this field is omitted, there are no subsequent pages.
+        class ListSearchedResultsResponse
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+        end
+
+        # Metadata about the search session.
+        # @!attribute [r] operation_id
+        #   @return [::String]
+        #     Output only. The operation id corresponding to the search session which can
+        #     be used to poll the operation resource to know its state and progress.
+        # @!attribute [r] start_time
+        #   @return [::Google::Protobuf::Timestamp]
+        #     Output only. The start time of the session.
+        # @!attribute [r] end_time
+        #   @return [::Google::Protobuf::Timestamp]
+        #     Output only. The end time of the session, if done.
+        # @!attribute [r] expire_time
+        #   @return [::Google::Protobuf::Timestamp]
+        #     Output only. The time when the search results expire.
+        # @!attribute [r] result_row_count
+        #   @return [::Integer]
+        #     Output only. Total number of rows returned in the search session.
+        # @!attribute [r] more_data_available
+        #   @return [::Boolean]
+        #     Output only. If true, there are more search results available than what can
+        #     be returned and have been omitted.
+        class SearchSessionMetadata
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+        end
+
+        # Metadata for the google.longrunning.Operation returned by the Search
+        # method.
+        # @!attribute [r] state
+        #   @return [::Google::Cloud::Chronicle::V1::SearchOperationMetadata::State]
+        #     Output only. State of the Search operation.
+        # @!attribute [r] start_time
+        #   @return [::Google::Protobuf::Timestamp]
+        #     Output only. The start time of the search.
+        # @!attribute [r] end_time
+        #   @return [::Google::Protobuf::Timestamp]
+        #     Output only. The end time of the search, if done.
+        # @!attribute [r] expire_time
+        #   @return [::Google::Protobuf::Timestamp]
+        #     Output only. The time when the search results expire.
+        # @!attribute [r] progress
+        #   @return [::Integer]
+        #     Output only. Progress Percentage of the search LRO, ranges from 0 to 100.
+        # @!attribute [r] datatable_export_metadata
+        #   @return [::Google::Cloud::Chronicle::V1::DataTableExportMetadata]
+        #     Output only. Metadata of the data table export operation if the search
+        #     results are written to a Data Table.
+        class SearchOperationMetadata
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+
+          # State of the Search operation.
+          module State
+            # Unspecified state.
+            STATE_UNSPECIFIED = 0
+
+            # Initial state, Search operation is running.
+            RUNNING = 1
+
+            # Search operation completed, results are available.
+            SUCCEEDED = 2
+
+            # Search operation failed.
+            FAILED = 3
+
+            # Search operation was cancelled.
+            CANCELLED = 4
+
+            # Search operation expired.
+            EXPIRED = 5
+          end
+        end
+
+        # Metadata about a DataTable export operation.
+        # @!attribute [rw] error
+        #   @return [::Google::Rpc::Status]
+        #     The error result of the export operation in case of failure.
+        #
+        #     Note: The following fields are mutually exclusive: `error`, `result_metadata`. If a field in that set is populated, all other fields in the set will automatically be cleared.
+        # @!attribute [rw] result_metadata
+        #   @return [::Google::Cloud::Chronicle::V1::DataTableExportMetadata::ResultMetadata]
+        #     Metadata about the export operation's result in case of success.
+        #
+        #     Note: The following fields are mutually exclusive: `result_metadata`, `error`. If a field in that set is populated, all other fields in the set will automatically be cleared.
+        # @!attribute [rw] data_table
+        #   @return [::String]
+        #     The name of the DataTable.
+        class DataTableExportMetadata
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+
+          # The result of the export operation.
+          # @!attribute [rw] datatable_export_operation_id
+          #   @return [::String]
+          #     The operation ID of the export operation.
+          # @!attribute [rw] rows_count
+          #   @return [::Integer]
+          #     The number of rows exported to the datatable.
+          class ResultMetadata
+            include ::Google::Protobuf::MessageExts
+            extend ::Google::Protobuf::MessageExts::ClassMethods
+          end
+        end
+
+        # Metadata about a table used in a query.
+        # @!attribute [rw] table
+        #   @return [::String]
+        #     The alias of the table in the query.
+        # @!attribute [rw] data_source
+        #   @return [::Google::Cloud::Chronicle::V1::TableMetadata::DataSource]
+        #     The type of data source.
+        # @!attribute [rw] index
+        #   @return [::Integer]
+        #     The index of the table in the query.
+        class TableMetadata
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+
+          # The type of data source.
+          module DataSource
+            # Unspecified data source.
+            DATA_SOURCE_UNSPECIFIED = 0
+
+            # UDM events.
+            EVENTS = 1
+
+            # Entity context.
+            ENTITY_CONTEXT = 2
+
+            # Data tables.
+            DATA_TABLES = 3
+
+            # Detections.
+            DETECTIONS = 4
+
+            # SOAR cases.
+            SOAR_CASE = 5
+
+            # SOAR case histories.
+            SOAR_CASE_HISTORY = 6
+          end
+        end
+
+        # Schema of the tables used in a query.
+        # @!attribute [rw] metadata
+        #   @return [::Array<::Google::Cloud::Chronicle::V1::TableMetadata>]
+        #     Metadata about the tables used in the query.
+        class ColumnSchema
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+        end
+
+        # List of column names for the outcome section of the query result.
+        # @!attribute [rw] names
+        #   @return [::Array<::String>]
+        #     List of column names.
+        class ColumnNames
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+        end
+
+        # ResultRow is a flexible collection that captures a search result row. It can
+        # currently support UDM Events, Entity Contexts, Data Tables, Join results,
+        # etc. and will support all other data sources in the future.
+        # @!attribute [rw] event_record
+        #   @return [::Google::Cloud::Chronicle::V1::EventRecord]
+        #     UDM event.
+        #
+        #     Note: The following fields are mutually exclusive: `event_record`, `stats_record`, `entity_context_record`, `join_record`, `detection_record`, `data_table_record`. If a field in that set is populated, all other fields in the set will automatically be cleared.
+        # @!attribute [rw] stats_record
+        #   @return [::Google::Cloud::Chronicle::V1::StatsRecord]
+        #     Stats record.
+        #
+        #     Note: The following fields are mutually exclusive: `stats_record`, `event_record`, `entity_context_record`, `join_record`, `detection_record`, `data_table_record`. If a field in that set is populated, all other fields in the set will automatically be cleared.
+        # @!attribute [rw] entity_context_record
+        #   @return [::Google::Cloud::Chronicle::V1::EntityContextRecord]
+        #     Entity context graph.
+        #
+        #     Note: The following fields are mutually exclusive: `entity_context_record`, `event_record`, `stats_record`, `join_record`, `detection_record`, `data_table_record`. If a field in that set is populated, all other fields in the set will automatically be cleared.
+        # @!attribute [rw] join_record
+        #   @return [::Google::Cloud::Chronicle::V1::JoinRecord]
+        #     Join results.
+        #
+        #     Note: The following fields are mutually exclusive: `join_record`, `event_record`, `stats_record`, `entity_context_record`, `detection_record`, `data_table_record`. If a field in that set is populated, all other fields in the set will automatically be cleared.
+        # @!attribute [rw] detection_record
+        #   @return [::Google::Cloud::Chronicle::V1::DetectionRecord]
+        #     Detection.
+        #
+        #     Note: The following fields are mutually exclusive: `detection_record`, `event_record`, `stats_record`, `entity_context_record`, `join_record`, `data_table_record`. If a field in that set is populated, all other fields in the set will automatically be cleared.
+        # @!attribute [rw] data_table_record
+        #   @return [::Google::Cloud::Chronicle::V1::DataTableRecord]
+        #     Data table.
+        #
+        #     Note: The following fields are mutually exclusive: `data_table_record`, `event_record`, `stats_record`, `entity_context_record`, `join_record`, `detection_record`. If a field in that set is populated, all other fields in the set will automatically be cleared.
+        # @!attribute [rw] outcomes
+        #   @return [::Array<::Google::Cloud::Chronicle::V1::ColumnType>]
+        #     Outcome fields for an event specified in query request.
+        class ResultRow
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+        end
+
+        # StatsRecord contains a row in the response of a stats query.
+        # @!attribute [rw] results
+        #   @return [::Array<::Google::Cloud::Chronicle::V1::StatsColumnData>]
+        #     Contains all columns resulting from a stats query and one row of values.
+        class StatsRecord
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+        end
+
+        # Represents a single column with a single cell in the set of columns
+        # returned as the stats query result.
+        # @!attribute [rw] column
+        #   @return [::String]
+        #     Used to store column names.
+        # @!attribute [rw] values
+        #   @return [::Google::Cloud::Chronicle::V1::ColumnType]
+        #     Store the values in a single column.
+        class StatsColumnData
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+        end
+
+        # Singular vs list of values in a single column.
+        # @!attribute [rw] value
+        #   @return [::Google::Cloud::Chronicle::V1::ColumnType::ColumnValue]
+        #     Single value in a column.
+        #
+        #     Note: The following fields are mutually exclusive: `value`, `list`. If a field in that set is populated, all other fields in the set will automatically be cleared.
+        # @!attribute [rw] list
+        #   @return [::Google::Cloud::Chronicle::V1::ColumnType::ColumnValueList]
+        #     List of values in a column e.g. IPs.
+        #
+        #     Note: The following fields are mutually exclusive: `list`, `value`. If a field in that set is populated, all other fields in the set will automatically be cleared.
+        class ColumnType
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+
+          # Represents a single value in the set of values returned as the query
+          # result.
+          # @!attribute [rw] null_val
+          #   @return [::Boolean]
+          #     True if the value is NULL.
+          #
+          #     Note: The following fields are mutually exclusive: `null_val`, `bool_val`, `bytes_val`, `double_val`, `int64_val`, `uint64_val`, `string_val`, `timestamp_val`, `date_val`, `proto_val`. If a field in that set is populated, all other fields in the set will automatically be cleared.
+          # @!attribute [rw] bool_val
+          #   @return [::Boolean]
+          #     Boolean value.
+          #
+          #     Note: The following fields are mutually exclusive: `bool_val`, `null_val`, `bytes_val`, `double_val`, `int64_val`, `uint64_val`, `string_val`, `timestamp_val`, `date_val`, `proto_val`. If a field in that set is populated, all other fields in the set will automatically be cleared.
+          # @!attribute [rw] bytes_val
+          #   @return [::String]
+          #     Bytes value.
+          #
+          #     Note: The following fields are mutually exclusive: `bytes_val`, `null_val`, `bool_val`, `double_val`, `int64_val`, `uint64_val`, `string_val`, `timestamp_val`, `date_val`, `proto_val`. If a field in that set is populated, all other fields in the set will automatically be cleared.
+          # @!attribute [rw] double_val
+          #   @return [::Float]
+          #     Double value.
+          #
+          #     Note: The following fields are mutually exclusive: `double_val`, `null_val`, `bool_val`, `bytes_val`, `int64_val`, `uint64_val`, `string_val`, `timestamp_val`, `date_val`, `proto_val`. If a field in that set is populated, all other fields in the set will automatically be cleared.
+          # @!attribute [rw] int64_val
+          #   @return [::Integer]
+          #     Integer value (signed).
+          #
+          #     Note: The following fields are mutually exclusive: `int64_val`, `null_val`, `bool_val`, `bytes_val`, `double_val`, `uint64_val`, `string_val`, `timestamp_val`, `date_val`, `proto_val`. If a field in that set is populated, all other fields in the set will automatically be cleared.
+          # @!attribute [rw] uint64_val
+          #   @return [::Integer]
+          #     Un-signed integer value.
+          #
+          #     Note: The following fields are mutually exclusive: `uint64_val`, `null_val`, `bool_val`, `bytes_val`, `double_val`, `int64_val`, `string_val`, `timestamp_val`, `date_val`, `proto_val`. If a field in that set is populated, all other fields in the set will automatically be cleared.
+          # @!attribute [rw] string_val
+          #   @return [::String]
+          #     String value. Enum values are returned as strings.
+          #
+          #     Note: The following fields are mutually exclusive: `string_val`, `null_val`, `bool_val`, `bytes_val`, `double_val`, `int64_val`, `uint64_val`, `timestamp_val`, `date_val`, `proto_val`. If a field in that set is populated, all other fields in the set will automatically be cleared.
+          # @!attribute [rw] timestamp_val
+          #   @return [::Google::Protobuf::Timestamp]
+          #     Timestamp values.
+          #
+          #     Note: The following fields are mutually exclusive: `timestamp_val`, `null_val`, `bool_val`, `bytes_val`, `double_val`, `int64_val`, `uint64_val`, `string_val`, `date_val`, `proto_val`. If a field in that set is populated, all other fields in the set will automatically be cleared.
+          # @!attribute [rw] date_val
+          #   @return [::Google::Type::Date]
+          #     Date values.
+          #
+          #     Note: The following fields are mutually exclusive: `date_val`, `null_val`, `bool_val`, `bytes_val`, `double_val`, `int64_val`, `uint64_val`, `string_val`, `timestamp_val`, `proto_val`. If a field in that set is populated, all other fields in the set will automatically be cleared.
+          # @!attribute [rw] proto_val
+          #   @return [::Google::Protobuf::Any]
+          #     For any proto values that are not any of the above.
+          #
+          #     Note: The following fields are mutually exclusive: `proto_val`, `null_val`, `bool_val`, `bytes_val`, `double_val`, `int64_val`, `uint64_val`, `string_val`, `timestamp_val`, `date_val`. If a field in that set is populated, all other fields in the set will automatically be cleared.
+          class ColumnValue
+            include ::Google::Protobuf::MessageExts
+            extend ::Google::Protobuf::MessageExts::ClassMethods
+          end
+
+          # Store list of values for a single column.
+          # @!attribute [rw] values
+          #   @return [::Array<::Google::Cloud::Chronicle::V1::ColumnType::ColumnValue>]
+          #     List of values in one cell of the column.
+          class ColumnValueList
+            include ::Google::Protobuf::MessageExts
+            extend ::Google::Protobuf::MessageExts::ClassMethods
+          end
+        end
+
+        # Contains a key-value pair of column name and its value. It represents a cell
+        # in the Data Table.
+        # @!attribute [rw] column
+        #   @return [::String]
+        #     The name of the column.
+        # @!attribute [rw] value
+        #   @return [::String]
+        #     The value of the column.
+        class SearchDataTableRowCell
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+        end
+
+        # DataTableRecord contains information about a Data table.
+        # @!attribute [rw] data_table
+        #   @return [::String]
+        #     The resource name of the Data table.
+        #     Format:
+        #     projects/\\{project_id}/locations/\\{location}/instances/\\{instances}/dataTables/\\{data_table}
+        # @!attribute [rw] cells
+        #   @return [::Array<::Google::Cloud::Chronicle::V1::SearchDataTableRowCell>]
+        #     Stores information about a single row of a Data table.
+        class DataTableRecord
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+        end
+
+        # EventRecord stores information about a UDM event.
+        # @!attribute [rw] event
+        #   @return [::Google::Cloud::Chronicle::V1::Event]
+        #     The UDM Event.
+        # @!attribute [rw] event_log_token
+        #   @return [::String]
+        #     Raw log tokens mapped to the event. Can be used to locate the raw log entry
+        #     that generated the event.
+        # @!attribute [rw] alert_number
+        #   @return [::Integer]
+        #     If the event should be treated as an alert, the unique identifier for the
+        #     alert.
+        # @!attribute [rw] alert_view_id
+        #   @return [::String]
+        #     Alert View specific Id. Helps create a link to Alert View.
+        # @!attribute [rw] annotations
+        #   @return [::Array<::Google::Cloud::Chronicle::V1::EventRecord::Annotation>]
+        #     Annotations added to an event.
+        # @!attribute [rw] detections
+        #   @return [::Array<::Google::Backstory::Collection>]
+        #     Detections associated with an event.
+        # @!attribute [rw] table
+        #   @return [::String]
+        #     User defined table name for the event in joins query.
+        class EventRecord
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+
+          # Annotation for an event.
+          module Annotation
+            # Unspecified - no annotation to display.
+            ANNOTATION_UNSPECIFIED = 0
+
+            # Event is associated with one or more alerts.
+            ANNOTATION_ALERT = 1
+          end
+        end
+
+        # EntityContextRecord stores information about a entity context graph.
+        # @!attribute [rw] entity
+        #   @return [::Google::Cloud::Chronicle::V1::Entity]
+        #     The entity information to be retrieved with UDM ECG search.
+        # @!attribute [rw] event_log_token
+        #   @return [::String]
+        #     Raw log tokens mapped to the event that created the entity. This is only
+        #     for entity context events.
+        # @!attribute [rw] timed
+        #   @return [::Boolean]
+        #     If the entity is timed or not.
+        # @!attribute [rw] table
+        #   @return [::String]
+        #     User defined table name for the entity in joins query.
+        class EntityContextRecord
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+        end
+
+        # JoinRecord stores information about a join result.
+        # @!attribute [rw] events
+        #   @return [::Array<::Google::Cloud::Chronicle::V1::EventRecord>]
+        #     The events that are joined.
+        # @!attribute [rw] entities
+        #   @return [::Array<::Google::Cloud::Chronicle::V1::EntityContextRecord>]
+        #     The entities that are joined.
+        # @!attribute [rw] data_tables
+        #   @return [::Array<::Google::Cloud::Chronicle::V1::DataTableRecord>]
+        #     The data tables that are joined.
+        class JoinRecord
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+        end
+
+        # DetectionRecord stores information about a detection.
+        # @!attribute [rw] id
+        #   @return [::String]
+        #     The ID of the detection.
+        # @!attribute [rw] collection
+        #   @return [::Google::Backstory::Collection]
+        #     The detection.
+        class DetectionRecord
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+        end
+
+        # Specifies the dialect the Search Query is written in.
+        module QueryDialect
+          # Defaults to YL2.
+          QUERY_DIALECT_UNSPECIFIED = 0
+
+          # YL2 query dialect.
+          YL2 = 1
+
+          # SQL query dialect.
+          SQL = 2
+        end
+      end
+    end
+  end
+end