Noun

JSON representation 
{
  "hostname": string,
  "domain": {
    object (Domain)
  },
  "artifact": {
    object (Artifact)
  },
  "url_metadata": {
    object (Url)
  },
  "asset_id": string,
  "user": {
    object (User)
  },
  "user_management_chain": [
    {
      object (User)
    }
  ],
  "group": {
    object (Group)
  },
  "process": {
    object (Process)
  },
  "process_ancestors": [
    {
      object (Process)
    }
  ],
  "asset": {
    object (Asset)
  },
  "ip": [
    string
  ],
  "nat_ip": [
    string
  ],
  "port": integer,
  "nat_port": integer,
  "mac": [
    string
  ],
  "administrative_domain": string,
  "namespace": string,
  "url": string,
  "file": {
    object (File)
  },
  "email": string,
  "registry": {
    object (Registry)
  },
  "application": string,
  "platform": enum (Platform),
  "platform_version": string,
  "platform_patch_level": string,
  "cloud": {
    object (Cloud)
  },
  "location": {
    object (Location)
  },
  "ip_location": [
    {
      object (Location)
    }
  ],
  "ip_geo_artifact": [
    {
      object (Artifact)
    }
  ],
  "resource": {
    object (Resource)
  },
  "resource_ancestors": [
    {
      object (Resource)
    }
  ],
  "labels": [
    {
      object (Label)
    }
  ],
  "object_reference": {
    object (Id)
  },
  "investigation": {
    object (Investigation)
  },
  "network": {
    object (Network)
  },
  "security_result": [
    {
      object (SecurityResult)
    }
  ]
}
Fields
hostname

string
domain

object (Domain)
artifact

object (Artifact)
url_metadata

object (Url)
asset_id

string
user

object (User)
user_management_chain[]

object (User)
group

object (Group)
process

object (Process)
process_ancestors[]

object (Process)
asset

object (Asset)
ip[]

string
nat_ip[]

string
port

integer
nat_port

integer
mac[]

string
administrative_domain

string
namespace

string
url

string
file

object (File)
email

string
registry

object (Registry)
application

string
platform

enum (Platform)
platform_version

string
platform_patch_level

string
cloud
(deprecated)

object (Cloud)
location

object (Location)
ip_location[]
(deprecated)

object (Location)
ip_geo_artifact[]

object (Artifact)
resource

object (Resource)
resource_ancestors[]

object (Resource)
labels[]
(deprecated)

object (Label)
object_reference

object (Id)
investigation

object (Investigation)
network

object (Network)
security_result[]

object (SecurityResult)

Domain

JSON representation 
{
  "name": string,
  "prevalence": {
    object (Prevalence)
  },
  "first_seen_time": string,
  "last_seen_time": string,
  "registrar": string,
  "contact_email": string,
  "whois_server": string,
  "name_server": [
    string
  ],
  "creation_time": string,
  "update_time": string,
  "expiration_time": string,
  "audit_update_time": string,
  "status": string,
  "registrant": {
    object (User)
  },
  "admin": {
    object (User)
  },
  "tech": {
    object (User)
  },
  "billing": {
    object (User)
  },
  "zone": {
    object (User)
  },
  "whois_record_raw_text": string,
  "registry_data_raw_text": string,
  "iana_registrar_id": integer,
  "private_registration": boolean,
  "categories": [
    string
  ],
  "favicon": {
    object (Favicon)
  },
  "jarm": string,
  "last_dns_records": [
    {
      object (DNSRecord)
    }
  ],
  "last_dns_records_time": string,
  "last_https_certificate": {
    object (SSLCertificate)
  },
  "last_https_certificate_time": string,
  "popularity_ranks": [
    {
      object (PopularityRank)
    }
  ],
  "tags": [
    string
  ],
  "whois_time": string
}
Fields
name

string
prevalence

object (Prevalence)
first_seen_time

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
last_seen_time

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
registrar

string
contact_email

string
whois_server

string
name_server[]

string
creation_time

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
update_time

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
expiration_time

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
audit_update_time

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
status

string
registrant

object (User)
admin

object (User)
tech

object (User)
billing

object (User)
zone

object (User)
whois_record_raw_text

string (bytes format)

A base64-encoded string.
registry_data_raw_text

string (bytes format)

A base64-encoded string.
iana_registrar_id

integer
private_registration

boolean
categories[]

string
favicon

object (Favicon)
jarm

string
last_dns_records[]

object (DNSRecord)
last_dns_records_time

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
last_https_certificate

object (SSLCertificate)
last_https_certificate_time

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
popularity_ranks[]

object (PopularityRank)
tags[]

string
whois_time

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".

User

JSON representation 
{
  "product_object_id": string,
  "userid": string,
  "user_display_name": string,
  "first_name": string,
  "middle_name": string,
  "last_name": string,
  "phone_numbers": [
    string
  ],
  "personal_address": {
    object (Location)
  },
  "attribute": {
    object (Attribute)
  },
  "first_seen_time": string,
  "account_type": enum (AccountType),
  "groupid": string,
  "group_identifiers": [
    string
  ],
  "windows_sid": string,
  "email_addresses": [
    string
  ],
  "employee_id": string,
  "title": string,
  "company_name": string,
  "department": [
    string
  ],
  "office_address": {
    object (Location)
  },
  "managers": [
    {
      object (User)
    }
  ],
  "hire_date": string,
  "termination_date": string,
  "time_off": [
    {
      object (TimeOff)
    }
  ],
  "last_login_time": string,
  "last_password_change_time": string,
  "password_expiration_time": string,
  "account_expiration_time": string,
  "account_lockout_time": string,
  "last_bad_password_attempt_time": string,
  "user_authentication_status": enum (AuthenticationStatus),
  "role_name": string,
  "role_description": string,
  "user_role": enum (Role)
}
Fields
product_object_id

string
userid

string
user_display_name

string
first_name

string
middle_name

string
last_name

string
phone_numbers[]

string
personal_address

object (Location)
attribute

object (Attribute)
first_seen_time

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
account_type

enum (AccountType)
groupid
(deprecated)

string
group_identifiers[]

string
windows_sid

string
email_addresses[]

string
employee_id

string
title

string
company_name

string
department[]

string
office_address

object (Location)
managers[]

object (User)
hire_date

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
termination_date

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
time_off[]

object (TimeOff)
last_login_time

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
last_password_change_time

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
password_expiration_time

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
account_expiration_time

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
account_lockout_time

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
last_bad_password_attempt_time

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
user_authentication_status

enum (AuthenticationStatus)
role_name
(deprecated)

string
role_description
(deprecated)

string
user_role
(deprecated)

enum (Role)

Attribute

JSON representation 
{
  "cloud": {
    object (Cloud)
  },
  "labels": [
    {
      object (Label)
    }
  ],
  "permissions": [
    {
      object (Permission)
    }
  ],
  "roles": [
    {
      object (Role)
    }
  ],
  "creation_time": string,
  "last_update_time": string
}
Fields
cloud

object (Cloud)
labels[]

object (Label)
permissions[]

object (Permission)
roles[]

object (Role)
creation_time

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
last_update_time

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".

Cloud

JSON representation 
{
  "environment": enum (CloudEnvironment),
  "vpc": {
    object (Resource)
  },
  "project": {
    object (Resource)
  },
  "availability_zone": string
}
Fields
environment

enum (CloudEnvironment)
vpc
(deprecated)

object (Resource)
project
(deprecated)

object (Resource)
availability_zone

string

CloudEnvironment

Enums
UNSPECIFIED_CLOUD_ENVIRONMENT
GOOGLE_CLOUD_PLATFORM
AMAZON_WEB_SERVICES
MICROSOFT_AZURE

Resource

JSON representation 
{
  "type": string,
  "resource_type": enum (ResourceType),
  "resource_subtype": string,
  "id": string,
  "name": string,
  "parent": string,
  "product_object_id": string,
  "attribute": {
    object (Attribute)
  }
}
Fields
type
(deprecated)

string
resource_type

enum (ResourceType)
resource_subtype

string
id
(deprecated)

string
name

string
parent
(deprecated)

string
product_object_id

string
attribute

object (Attribute)

ResourceType

Enums
UNSPECIFIED
MUTEX
TASK
PIPE
DEVICE
FIREWALL_RULE
MAILBOX_FOLDER
VPC_NETWORK
VIRTUAL_MACHINE
STORAGE_BUCKET
STORAGE_OBJECT
DATABASE
TABLE
CLOUD_PROJECT
CLOUD_ORGANIZATION
SERVICE_ACCOUNT
ACCESS_POLICY
CLUSTER
SETTING
DATASET
BACKEND_SERVICE
POD
CONTAINER
FUNCTION
RUNTIME
IP_ADDRESS
DISK
VOLUME
IMAGE
SNAPSHOT
REPOSITORY
CREDENTIAL
LOAD_BALANCER
GATEWAY
SUBNET

Permission

JSON representation 
{
  "name": string,
  "description": string,
  "type": enum (PermissionType)
}
Fields
name

string
description

string
type

enum (PermissionType)

PermissionType

Enums
UNKNOWN_PERMISSION_TYPE
ADMIN_WRITE
ADMIN_READ
DATA_WRITE
DATA_READ

Role

JSON representation 
{
  "name": string,
  "description": string,
  "type": enum (Type)
}
Fields
name

string
description

string
type

enum (Type)

Type

Enums
TYPE_UNSPECIFIED
ADMINISTRATOR
SERVICE_ACCOUNT

AccountType

Enums
ACCOUNT_TYPE_UNSPECIFIED
DOMAIN_ACCOUNT_TYPE
LOCAL_ACCOUNT_TYPE
CLOUD_ACCOUNT_TYPE
SERVICE_ACCOUNT_TYPE
DEFAULT_ACCOUNT_TYPE

TimeOff

JSON representation 
{
  "interval": {
    object (Interval)
  },
  "description": string
}
Fields
interval

object (Interval)
description

string

AuthenticationStatus

Enums
UNKNOWN_AUTHENTICATION_STATUS
ACTIVE
SUSPENDED
NO_ACTIVE_CREDENTIALS
DELETED

Role

Enums
UNKNOWN_ROLE
ADMINISTRATOR
SERVICE_ACCOUNT

Favicon

JSON representation 
{
  "raw_md5": string,
  "dhash": string
}
Fields
raw_md5

string
dhash

string

DNSRecord

JSON representation 
{
  "type": string,
  "value": string,
  "ttl": string,
  "priority": string,
  "retry": string,
  "refresh": string,
  "minimum": string,
  "expire": string,
  "serial": string,
  "rname": string
}
Fields
type

string
value

string
ttl

string (Duration format)

A duration in seconds with up to nine fractional digits, ending with 's'. Example: "3.5s".
priority

string (int64 format)
retry

string (int64 format)
refresh

string (Duration format)

A duration in seconds with up to nine fractional digits, ending with 's'. Example: "3.5s".
minimum

string (Duration format)

A duration in seconds with up to nine fractional digits, ending with 's'. Example: "3.5s".
expire

string (Duration format)

A duration in seconds with up to nine fractional digits, ending with 's'. Example: "3.5s".
serial

string (int64 format)
rname

string

SSLCertificate

JSON representation 
{
  "cert_signature": {
    object (CertSignature)
  },
  "extension": {
    object (Extension)
  },
  "cert_extensions": {
    object
  },
  "first_seen_time": string,
  "issuer": {
    object (Subject)
  },
  "ec": {
    object (EC)
  },
  "serial_number": string,
  "signature_algorithm": string,
  "size": string,
  "subject": {
    object (Subject)
  },
  "thumbprint": string,
  "thumbprint_sha256": string,
  "validity": {
    object (Validity)
  },
  "version": string
}
Fields
cert_signature

object (CertSignature)
extension
(deprecated)

object (Extension)
cert_extensions

object (Struct format)
first_seen_time

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
issuer

object (Subject)
ec

object (EC)
serial_number

string
signature_algorithm

string
size

string (int64 format)
subject

object (Subject)
thumbprint

string
thumbprint_sha256

string
validity

object (Validity)
version

string

CertSignature

JSON representation 
{
  "signature": string,
  "signature_algorithm": string
}
Fields
signature

string
signature_algorithm

string

Extension

JSON representation 
{
  "ca": boolean,
  "subject_key_id": string,
  "authority_key_id": {
    object (AuthorityKeyId)
  },
  "key_usage": string,
  "ca_info_access": string,
  "crl_distribution_points": string,
  "extended_key_usage": string,
  "subject_alternative_name": string,
  "certificate_policies": string,
  "netscape_cert_comment": string,
  "cert_template_name_dc": string,
  "netscape_certificate": boolean,
  "pe_logotype": boolean,
  "old_authority_key_id": boolean
}
Fields
ca

boolean
subject_key_id

string
authority_key_id

object (AuthorityKeyId)
key_usage

string
ca_info_access

string
crl_distribution_points

string
extended_key_usage

string
subject_alternative_name

string
certificate_policies

string
netscape_cert_comment

string
cert_template_name_dc

string
netscape_certificate

boolean
pe_logotype

boolean
old_authority_key_id

boolean

AuthorityKeyId

JSON representation 
{
  "keyid": string,
  "serial_number": string
}
Fields
keyid

string
serial_number

string

Subject

JSON representation 
{
  "country_name": string,
  "common_name": string,
  "locality": string,
  "organization": string,
  "organizational_unit": string,
  "state_or_province_name": string
}
Fields
country_name

string
common_name

string
locality

string
organization

string
organizational_unit

string
state_or_province_name

string

EC

JSON representation 
{
  "oid": string,
  "pub": string
}
Fields
oid

string
pub

string

Validity

JSON representation 
{
  "expiry_time": string,
  "issue_time": string
}
Fields
expiry_time

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
issue_time

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".

PopularityRank

JSON representation 
{
  "giver": string,
  "rank": string,
  "ingestion_time": string
}
Fields
giver

string
rank

string (int64 format)
ingestion_time

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".

Artifact

JSON representation 
{
  "ip": string,
  "prevalence": {
    object (Prevalence)
  },
  "first_seen_time": string,
  "last_seen_time": string,
  "location": {
    object (Location)
  },
  "network": {
    object (Network)
  },
  "as_owner": string,
  "asn": string,
  "jarm": string,
  "last_https_certificate": {
    object (SSLCertificate)
  },
  "last_https_certificate_date": string,
  "regional_internet_registry": string,
  "tags": [
    string
  ],
  "whois": string,
  "whois_date": string
}
Fields
ip

string
prevalence

object (Prevalence)
first_seen_time

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
last_seen_time

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
location

object (Location)
network

object (Network)
as_owner

string
asn

string (int64 format)
jarm

string
last_https_certificate

object (SSLCertificate)
last_https_certificate_date

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
regional_internet_registry

string
tags[]

string
whois

string
whois_date

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".

Url

JSON representation 
{
  "url": string,
  "categories": [
    string
  ],
  "favicon": {
    object (Favicon)
  },
  "html_meta": {
    object
  },
  "last_final_url": string,
  "last_http_response_code": integer,
  "last_http_response_content_length": string,
  "last_http_response_content_sha256": string,
  "last_http_response_cookies": {
    object
  },
  "last_http_response_headers": {
    object
  },
  "tags": [
    string
  ],
  "title": string,
  "trackers": [
    {
      object (Tracker)
    }
  ]
}
Fields
url

string
categories[]

string
favicon

object (Favicon)
html_meta

object (Struct format)
last_final_url

string
last_http_response_code

integer
last_http_response_content_length

string (int64 format)
last_http_response_content_sha256

string
last_http_response_cookies

object (Struct format)
last_http_response_headers

object (Struct format)
tags[]

string
title

string
trackers[]

object (Tracker)

Tracker

JSON representation 
{
  "tracker": string,
  "id": string,
  "timestamp": string,
  "url": string
}
Fields
tracker

string
id

string
timestamp

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
url

string

Group

JSON representation 
{
  "product_object_id": string,
  "creation_time": string,
  "group_display_name": string,
  "attribute": {
    object (Attribute)
  },
  "email_addresses": [
    string
  ],
  "windows_sid": string
}
Fields
product_object_id

string
creation_time
(deprecated)

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
group_display_name

string
attribute

object (Attribute)
email_addresses[]

string
windows_sid

string

Process

JSON representation 
{
  "pid": string,
  "parent_pid": string,
  "parent_process": {
    object (Process)
  },
  "file": {
    object (File)
  },
  "command_line": string,
  "command_line_history": [
    string
  ],
  "product_specific_process_id": string,
  "access_mask": string,
  "integrity_level_rid": string,
  "token_elevation_type": enum (TokenElevationType),
  "product_specific_parent_process_id": string
}
Fields
pid

string
parent_pid
(deprecated)

string
parent_process

object (Process)
file

object (File)
command_line

string
command_line_history[]

string
product_specific_process_id

string
access_mask

string
integrity_level_rid

string
token_elevation_type

enum (TokenElevationType)
product_specific_parent_process_id
(deprecated)

string

File

JSON representation 
{
  "sha256": string,
  "md5": string,
  "sha1": string,
  "size": string,
  "full_path": string,
  "mime_type": string,
  "file_metadata": {
    object (FileMetadata)
  },
  "security_result": {
    object (SecurityResult)
  },
  "pe_file": {
    object (FileMetadataPE)
  },
  "ssdeep": string,
  "vhash": string,
  "ahash": string,
  "authentihash": string,
  "file_type": enum (FileType),
  "capabilities_tags": [
    string
  ],
  "names": [
    string
  ],
  "tags": [
    string
  ],
  "last_modification_time": string,
  "prevalence": {
    object (Prevalence)
  },
  "first_seen_time": string,
  "last_seen_time": string,
  "stat_mode": string,
  "stat_inode": string,
  "stat_dev": string,
  "stat_nlink": string,
  "stat_flags": integer,
  "last_analysis_time": string,
  "embedded_urls": [
    string
  ],
  "embedded_domains": [
    string
  ],
  "embedded_ips": [
    string
  ],
  "exif_info": {
    object (ExifInfo)
  },
  "signature_info": {
    object (SignatureInfo)
  },
  "pdf_info": {
    object (PDFInfo)
  },
  "first_submission_time": string,
  "last_submission_time": string,
  "main_icon": {
    object (Favicon)
  }
}
Fields
sha256

string
md5

string
sha1

string
size

string
full_path

string
mime_type

string
file_metadata
(deprecated)

object (FileMetadata)
security_result

object (SecurityResult)
pe_file

object (FileMetadataPE)
ssdeep

string
vhash

string
ahash
(deprecated)

string
authentihash

string
file_type

enum (FileType)
capabilities_tags[]

string
names[]

string
tags[]

string
last_modification_time

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
prevalence

object (Prevalence)
first_seen_time

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
last_seen_time

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
stat_mode

string
stat_inode

string
stat_dev

string
stat_flags

integer (uint32 format)
last_analysis_time

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
embedded_urls[]

string
embedded_domains[]

string
embedded_ips[]

string
exif_info

object (ExifInfo)
signature_info

object (SignatureInfo)
pdf_info

object (PDFInfo)
first_submission_time

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
last_submission_time

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
main_icon

object (Favicon)

FileMetadata

JSON representation 
{
  "pe": {
    object (PeFileMetadata)
  }
}
Fields
pe
(deprecated)

object (PeFileMetadata)

PeFileMetadata

JSON representation 
{
  "import_hash": string
}
Fields
import_hash

string

FileMetadataPE

JSON representation 
{
  "imphash": string,
  "entry_point": string,
  "entry_point_exiftool": string,
  "compilation_time": string,
  "compilation_exiftool_time": string,
  "section": [
    {
      object (FileMetadataSection)
    }
  ],
  "imports": [
    {
      object (FileMetadataImports)
    }
  ],
  "resource": [
    {
      object (FileMetadataPeResourceInfo)
    }
  ],
  "resources_type_count": [
    {
      object (StringToInt64MapEntry)
    }
  ],
  "resources_language_count": [
    {
      object (StringToInt64MapEntry)
    }
  ],
  "resources_type_count_str": [
    {
      object (Label)
    }
  ],
  "resources_language_count_str": [
    {
      object (Label)
    }
  ],
  "signature_info": {
    object (FileMetadataSignatureInfo)
  }
}
Fields
imphash

string
entry_point

string (int64 format)
entry_point_exiftool

string (int64 format)
compilation_time

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
compilation_exiftool_time

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
section[]

object (FileMetadataSection)
imports[]

object (FileMetadataImports)
resource[]

object (FileMetadataPeResourceInfo)
resources_type_count[]
(deprecated)

object (StringToInt64MapEntry)
resources_language_count[]
(deprecated)

object (StringToInt64MapEntry)
resources_type_count_str[]

object (Label)
resources_language_count_str[]

object (Label)
signature_info
(deprecated)

object (FileMetadataSignatureInfo)

FileMetadataSection

JSON representation 
{
  "name": string,
  "entropy": number,
  "raw_size_bytes": string,
  "virtual_size_bytes": string,
  "md5_hex": string
}
Fields
name

string
entropy

number
raw_size_bytes

string (int64 format)
virtual_size_bytes

string (int64 format)
md5_hex

string

FileMetadataImports

JSON representation 
{
  "library": string,
  "functions": [
    string
  ]
}
Fields
library

string
functions[]

string

FileMetadataPeResourceInfo

JSON representation 
{
  "sha256_hex": string,
  "filetype_magic": string,
  "language_code": string,
  "entropy": number,
  "file_type": string
}
Fields
sha256_hex

string
filetype_magic

string
language_code

string
entropy

number
file_type

string

StringToInt64MapEntry

JSON representation 
{
  "key": string,
  "value": string
}
Fields
key

string
value

string (int64 format)

FileMetadataSignatureInfo

JSON representation 
{
  "verification_message": string,
  "verified": boolean,
  "signer": [
    string
  ],
  "signers": [
    {
      object (SignerInfo)
    }
  ],
  "x509": [
    {
      object (X509)
    }
  ]
}
Fields
verification_message

string
verified

boolean
signer[]
(deprecated)

string
signers[]

object (SignerInfo)
x509[]

object (X509)

SignerInfo

JSON representation 
{
  "name": string,
  "status": string,
  "valid_usage": string,
  "cert_issuer": string
}
Fields
name

string
status

string
valid_usage

string
cert_issuer

string

X509

JSON representation 
{
  "name": string,
  "algorithm": string,
  "thumbprint": string,
  "cert_issuer": string,
  "serial_number": string
}
Fields
name

string
algorithm

string
thumbprint

string
cert_issuer

string
serial_number

string

FileType

Enums
FILE_TYPE_UNSPECIFIED
FILE_TYPE_PE_EXE
FILE_TYPE_PE_DLL
FILE_TYPE_MSI
FILE_TYPE_NE_EXE
FILE_TYPE_NE_DLL
FILE_TYPE_DOS_EXE
FILE_TYPE_DOS_COM
FILE_TYPE_COFF
FILE_TYPE_ELF
FILE_TYPE_LINUX_KERNEL
FILE_TYPE_RPM
FILE_TYPE_LINUX
FILE_TYPE_MACH_O
FILE_TYPE_JAVA_BYTECODE
FILE_TYPE_DMG
FILE_TYPE_DEB
FILE_TYPE_PKG
FILE_TYPE_PYC
FILE_TYPE_LNK
FILE_TYPE_JPEG
FILE_TYPE_TIFF
FILE_TYPE_GIF
FILE_TYPE_PNG
FILE_TYPE_BMP
FILE_TYPE_GIMP
FILE_TYPE_IN_DESIGN
FILE_TYPE_PSD
FILE_TYPE_TARGA
FILE_TYPE_XWD
FILE_TYPE_DIB
FILE_TYPE_JNG
FILE_TYPE_ICO
FILE_TYPE_FPX
FILE_TYPE_EPS
FILE_TYPE_SVG
FILE_TYPE_EMF
FILE_TYPE_WEBP
FILE_TYPE_DWG
FILE_TYPE_DXF
FILE_TYPE_THREEDS
FILE_TYPE_OGG
FILE_TYPE_FLC
FILE_TYPE_FLI
FILE_TYPE_MP3
FILE_TYPE_FLAC
FILE_TYPE_WAV
FILE_TYPE_MIDI
FILE_TYPE_AVI
FILE_TYPE_MPEG
FILE_TYPE_QUICKTIME
FILE_TYPE_ASF
FILE_TYPE_DIVX
FILE_TYPE_FLV
FILE_TYPE_WMA
FILE_TYPE_WMV
FILE_TYPE_RM
FILE_TYPE_MOV
FILE_TYPE_MP4
FILE_TYPE_T3GP
FILE_TYPE_WEBM
FILE_TYPE_MKV
FILE_TYPE_PDF
FILE_TYPE_PS
FILE_TYPE_DOC
FILE_TYPE_DOCX
FILE_TYPE_PPT
FILE_TYPE_PPTX
FILE_TYPE_PPSX
FILE_TYPE_XLS
FILE_TYPE_XLSX
FILE_TYPE_RTF
FILE_TYPE_ODP
FILE_TYPE_ODS
FILE_TYPE_ODT
FILE_TYPE_HWP
FILE_TYPE_GUL
FILE_TYPE_ODF
FILE_TYPE_ODG
FILE_TYPE_ONE_NOTE
FILE_TYPE_OOXML
FILE_TYPE_EBOOK
FILE_TYPE_LATEX
FILE_TYPE_TTF
FILE_TYPE_EOT
FILE_TYPE_WOFF
FILE_TYPE_CHM
FILE_TYPE_ZIP
FILE_TYPE_GZIP
FILE_TYPE_BZIP
FILE_TYPE_RZIP
FILE_TYPE_DZIP
FILE_TYPE_SEVENZIP
FILE_TYPE_CAB
FILE_TYPE_JAR
FILE_TYPE_RAR
FILE_TYPE_MSCOMPRESS
FILE_TYPE_ACE
FILE_TYPE_ARC
FILE_TYPE_ARJ
FILE_TYPE_ASD
FILE_TYPE_BLACKHOLE
FILE_TYPE_KGB
FILE_TYPE_ZLIB
FILE_TYPE_TAR
FILE_TYPE_ZST
FILE_TYPE_LZFSE
FILE_TYPE_PYTHON_WHL
FILE_TYPE_PYTHON_PKG
FILE_TYPE_TEXT
FILE_TYPE_SCRIPT
FILE_TYPE_PHP
FILE_TYPE_PYTHON
FILE_TYPE_PERL
FILE_TYPE_RUBY
FILE_TYPE_C
FILE_TYPE_CPP
FILE_TYPE_JAVA
FILE_TYPE_SHELLSCRIPT
FILE_TYPE_PASCAL
FILE_TYPE_AWK
FILE_TYPE_DYALOG
FILE_TYPE_FORTRAN
FILE_TYPE_JAVASCRIPT
FILE_TYPE_POWERSHELL
FILE_TYPE_VBA
FILE_TYPE_M4
FILE_TYPE_OBJETIVEC
FILE_TYPE_JMOD
FILE_TYPE_MAKEFILE
FILE_TYPE_INI
FILE_TYPE_CLJ
FILE_TYPE_PDB
FILE_TYPE_SQL
FILE_TYPE_NEKO
FILE_TYPE_WER
FILE_TYPE_GOLANG
FILE_TYPE_SYMBIAN
FILE_TYPE_PALMOS
FILE_TYPE_WINCE
FILE_TYPE_ANDROID
FILE_TYPE_IPHONE
FILE_TYPE_HTML
FILE_TYPE_XML
FILE_TYPE_SWF
FILE_TYPE_FLA
FILE_TYPE_TORRENT
FILE_TYPE_EMAIL_TYPE
FILE_TYPE_OUTLOOK
FILE_TYPE_SGML
FILE_TYPE_JSON
FILE_TYPE_CSV
FILE_TYPE_CAP
FILE_TYPE_ISOIMAGE
FILE_TYPE_SQUASHFS
FILE_TYPE_VHD
FILE_TYPE_APPLE
FILE_TYPE_MACINTOSH
FILE_TYPE_APPLESINGLE
FILE_TYPE_APPLEDOUBLE
FILE_TYPE_MACINTOSH_HFS
FILE_TYPE_APPLE_PLIST
FILE_TYPE_MACINTOSH_LIB
FILE_TYPE_APPLESCRIPT
FILE_TYPE_APPLESCRIPT_COMPILED
FILE_TYPE_CRX
FILE_TYPE_XPI
FILE_TYPE_ROM
FILE_TYPE_IPS
FILE_TYPE_PEM
FILE_TYPE_PGP
FILE_TYPE_CRT

ExifInfo

JSON representation 
{
  "original_file": string,
  "product": string,
  "company": string,
  "file_description": string,
  "entry_point": string,
  "compilation_time": string
}
Fields
original_file

string
product

string
company

string
file_description

string
entry_point

string (int64 format)
compilation_time

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".

SignatureInfo

JSON representation 
{
  "sigcheck": {
    object (FileMetadataSignatureInfo)
  },
  "codesign": {
    object (FileMetadataCodesign)
  }
}
Fields
sigcheck

object (FileMetadataSignatureInfo)
codesign

object (FileMetadataCodesign)

FileMetadataCodesign

JSON representation 
{
  "id": string,
  "format": string,
  "compilation_time": string
}
Fields
id

string
format

string
compilation_time

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".

PDFInfo

JSON representation 
{
  "js": string,
  "javascript": string,
  "launch_action_count": string,
  "object_stream_count": string,
  "endobj_count": string,
  "header": string,
  "acroform": string,
  "autoaction": string,
  "embedded_file": string,
  "encrypted": string,
  "flash": string,
  "jbig2_compression": string,
  "obj_count": string,
  "endstream_count": string,
  "page_count": string,
  "stream_count": string,
  "openaction": string,
  "startxref": string,
  "suspicious_colors": string,
  "trailer": string,
  "xfa": string,
  "xref": string
}
Fields
js

string (int64 format)
javascript

string (int64 format)
launch_action_count

string (int64 format)
object_stream_count

string (int64 format)
endobj_count

string (int64 format)
header

string
acroform

string (int64 format)
autoaction

string (int64 format)
embedded_file

string (int64 format)
encrypted

string (int64 format)
flash

string (int64 format)
jbig2_compression

string (int64 format)
obj_count

string (int64 format)
endstream_count

string (int64 format)
page_count

string (int64 format)
stream_count

string (int64 format)
openaction

string (int64 format)
startxref

string (int64 format)
suspicious_colors

string (int64 format)
trailer

string (int64 format)
xfa

string (int64 format)
xref

string (int64 format)

TokenElevationType

Enums
UNKNOWN
TYPE_1
TYPE_2
TYPE_3

Asset

JSON representation 
{
  "product_object_id": string,
  "hostname": string,
  "asset_id": string,
  "ip": [
    string
  ],
  "mac": [
    string
  ],
  "nat_ip": [
    string
  ],
  "first_seen_time": string,
  "hardware": [
    {
      object (Hardware)
    }
  ],
  "platform_software": {
    object (PlatformSoftware)
  },
  "software": [
    {
      object (Software)
    }
  ],
  "location": {
    object (Location)
  },
  "category": string,
  "type": enum (AssetType),
  "network_domain": string,
  "creation_time": string,
  "first_discover_time": string,
  "last_discover_time": string,
  "system_last_update_time": string,
  "last_boot_time": string,
  "labels": [
    {
      object (Label)
    }
  ],
  "deployment_status": enum (DeploymentStatus),
  "vulnerabilities": [
    {
      object (Vulnerability)
    }
  ],
  "attribute": {
    object (Attribute)
  }
}
Fields
product_object_id

string
hostname

string
asset_id

string
ip[]

string
mac[]

string
nat_ip[]

string
first_seen_time

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
hardware[]

object (Hardware)
platform_software

object (PlatformSoftware)
software[]

object (Software)
location

object (Location)
category

string
type

enum (AssetType)
network_domain

string
creation_time
(deprecated)

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
first_discover_time

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
last_discover_time

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
system_last_update_time

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
last_boot_time

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
labels[]
(deprecated)

object (Label)
deployment_status

enum (DeploymentStatus)
vulnerabilities[]

object (Vulnerability)
attribute

object (Attribute)

Hardware

JSON representation 
{
  "serial_number": string,
  "manufacturer": string,
  "model": string,
  "cpu_platform": string,
  "cpu_model": string,
  "cpu_clock_speed": string,
  "cpu_max_clock_speed": string,
  "cpu_number_cores": string,
  "ram": string
}
Fields
serial_number

string
manufacturer

string
model

string
cpu_platform

string
cpu_model

string
cpu_clock_speed

string
cpu_max_clock_speed

string
cpu_number_cores

string
ram

string

PlatformSoftware

JSON representation 
{
  "platform": enum (Platform),
  "platform_version": string,
  "platform_patch_level": string
}
Fields
platform

enum (Platform)
platform_version

string
platform_patch_level

string

Platform

Enums
UNKNOWN_PLATFORM
WINDOWS
MAC
LINUX
GCP
AWS
AZURE
IOS
ANDROID
CHROME_OS

Software

JSON representation 
{
  "name": string,
  "version": string,
  "permissions": [
    {
      object (Permission)
    }
  ],
  "description": string,
  "vendor_name": string
}
Fields
name

string
version

string
permissions[]

object (Permission)
description

string
vendor_name

string

AssetType

Enums
ROLE_UNSPECIFIED
WORKSTATION
LAPTOP
IOT
NETWORK_ATTACHED_STORAGE
PRINTER
SCANNER
SERVER
TAPE_LIBRARY
MOBILE

DeploymentStatus

Enums
DEPLOYMENT_STATUS_UNSPECIFIED
ACTIVE
PENDING_DECOMISSION
DECOMISSIONED

Registry

JSON representation 
{
  "registry_key": string,
  "registry_value_name": string,
  "registry_value_data": string
}
Fields
registry_key

string
registry_value_name

string
registry_value_data

string

Id

JSON representation 
{
  "namespace": enum (Namespace),
  "id": string
}
Fields
namespace

enum (Namespace)
id

string (bytes format)

A base64-encoded string.

Investigation

JSON representation 
{
  "comments": [
    string
  ],
  "verdict": enum (Verdict),
  "reputation": enum (Reputation),
  "severity_score": integer,
  "status": enum (Status),
  "priority": enum (Priority),
  "root_cause": string,
  "reason": enum (Reason),
  "risk_score": integer
}
Fields
comments[]

string
verdict

enum (Verdict)
reputation

enum (Reputation)
severity_score

integer (uint32 format)
status

enum (Status)
priority

enum (Priority)
root_cause

string
reason

enum (Reason)
risk_score

integer (uint32 format)

Verdict

Enums
VERDICT_UNSPECIFIED
TRUE_POSITIVE
FALSE_POSITIVE

Reputation

Enums
REPUTATION_UNSPECIFIED
USEFUL
NOT_USEFUL

Status

Enums
STATUS_UNSPECIFIED
NEW
REVIEWED
CLOSED
OPEN

Priority

Enums
PRIORITY_UNSPECIFIED
PRIORITY_INFO
PRIORITY_LOW
PRIORITY_MEDIUM
PRIORITY_HIGH
PRIORITY_CRITICAL

Reason

Enums
REASON_UNSPECIFIED
REASON_NOT_MALICIOUS
REASON_MALICIOUS
REASON_MAINTENANCE