Noun

JSON representation
{
  "hostname": string,
  "domain": {
    object (Domain)
  },
  "artifact": {
    object (Artifact)
  },
  "url_metadata": {
    object (Url)
  },
  "asset_id": string,
  "user": {
    object (User)
  },
  "user_management_chain": [
    {
      object (User)
    }
  ],
  "group": {
    object (Group)
  },
  "process": {
    object (Process)
  },
  "process_ancestors": [
    {
      object (Process)
    }
  ],
  "asset": {
    object (Asset)
  },
  "ip": [
    string
  ],
  "nat_ip": [
    string
  ],
  "port": integer,
  "nat_port": integer,
  "mac": [
    string
  ],
  "administrative_domain": string,
  "namespace": string,
  "url": string,
  "file": {
    object (File)
  },
  "email": string,
  "registry": {
    object (Registry)
  },
  "application": string,
  "platform": enum (Platform),
  "platform_version": string,
  "platform_patch_level": string,
  "cloud": {
    object (Cloud)
  },
  "location": {
    object (Location)
  },
  "ip_location": [
    {
      object (Location)
    }
  ],
  "ip_geo_artifact": [
    {
      object (Artifact)
    }
  ],
  "resource": {
    object (Resource)
  },
  "resource_ancestors": [
    {
      object (Resource)
    }
  ],
  "labels": [
    {
      object (Label)
    }
  ],
  "object_reference": {
    object (Id)
  },
  "investigation": {
    object (Investigation)
  },
  "network": {
    object (Network)
  },
  "security_result": [
    {
      object (SecurityResult)
    }
  ]
}
Fields
hostname

string

domain

object (Domain)

artifact

object (Artifact)

url_metadata

object (Url)

asset_id

string

user

object (User)

user_management_chain[]

object (User)

group

object (Group)

process

object (Process)

process_ancestors[]

object (Process)

asset

object (Asset)

ip[]

string

nat_ip[]

string

port

integer

nat_port

integer

mac[]

string

administrative_domain

string

namespace

string

url

string

file

object (File)

email

string

registry

object (Registry)

application

string

platform

enum (Platform)

platform_version

string

platform_patch_level

string

cloud
(deprecated)

object (Cloud)

location

object (Location)

ip_location[]
(deprecated)

object (Location)

ip_geo_artifact[]

object (Artifact)

resource

object (Resource)

resource_ancestors[]

object (Resource)

labels[]
(deprecated)

object (Label)

object_reference

object (Id)

investigation

object (Investigation)

network

object (Network)

security_result[]

object (SecurityResult)

Domain

JSON representation
{
  "name": string,
  "prevalence": {
    object (Prevalence)
  },
  "first_seen_time": string,
  "last_seen_time": string,
  "registrar": string,
  "contact_email": string,
  "whois_server": string,
  "name_server": [
    string
  ],
  "creation_time": string,
  "update_time": string,
  "expiration_time": string,
  "audit_update_time": string,
  "status": string,
  "registrant": {
    object (User)
  },
  "admin": {
    object (User)
  },
  "tech": {
    object (User)
  },
  "billing": {
    object (User)
  },
  "zone": {
    object (User)
  },
  "whois_record_raw_text": string,
  "registry_data_raw_text": string,
  "iana_registrar_id": integer,
  "private_registration": boolean,
  "categories": [
    string
  ],
  "favicon": {
    object (Favicon)
  },
  "jarm": string,
  "last_dns_records": [
    {
      object (DNSRecord)
    }
  ],
  "last_dns_records_time": string,
  "last_https_certificate": {
    object (SSLCertificate)
  },
  "last_https_certificate_time": string,
  "popularity_ranks": [
    {
      object (PopularityRank)
    }
  ],
  "tags": [
    string
  ],
  "whois_time": string
}
Fields
name

string

prevalence

object (Prevalence)

first_seen_time

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".

last_seen_time

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".

registrar

string

contact_email

string

whois_server

string

name_server[]

string

creation_time

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".

update_time

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".

expiration_time

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".

audit_update_time

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".

status

string

registrant

object (User)

admin

object (User)

tech

object (User)

billing

object (User)

zone

object (User)

whois_record_raw_text

string (bytes format)

A base64-encoded string.

registry_data_raw_text

string (bytes format)

A base64-encoded string.

iana_registrar_id

integer

private_registration

boolean

categories[]

string

favicon

object (Favicon)

jarm

string

last_dns_records[]

object (DNSRecord)

last_dns_records_time

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".

last_https_certificate

object (SSLCertificate)

last_https_certificate_time

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".

popularity_ranks[]

object (PopularityRank)

tags[]

string

whois_time

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".

User

JSON representation
{
  "product_object_id": string,
  "userid": string,
  "user_display_name": string,
  "first_name": string,
  "middle_name": string,
  "last_name": string,
  "phone_numbers": [
    string
  ],
  "personal_address": {
    object (Location)
  },
  "attribute": {
    object (Attribute)
  },
  "first_seen_time": string,
  "account_type": enum (AccountType),
  "groupid": string,
  "group_identifiers": [
    string
  ],
  "windows_sid": string,
  "email_addresses": [
    string
  ],
  "employee_id": string,
  "title": string,
  "company_name": string,
  "department": [
    string
  ],
  "office_address": {
    object (Location)
  },
  "managers": [
    {
      object (User)
    }
  ],
  "hire_date": string,
  "termination_date": string,
  "time_off": [
    {
      object (TimeOff)
    }
  ],
  "last_login_time": string,
  "last_password_change_time": string,
  "password_expiration_time": string,
  "account_expiration_time": string,
  "account_lockout_time": string,
  "last_bad_password_attempt_time": string,
  "user_authentication_status": enum (AuthenticationStatus),
  "role_name": string,
  "role_description": string,
  "user_role": enum (Role)
}
Fields
product_object_id

string

userid

string

user_display_name

string

first_name

string

middle_name

string

last_name

string

phone_numbers[]

string

personal_address

object (Location)

attribute

object (Attribute)

first_seen_time

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".

account_type

enum (AccountType)

groupid
(deprecated)

string

group_identifiers[]

string

windows_sid

string

email_addresses[]

string

employee_id

string

title

string

company_name

string

department[]

string

office_address

object (Location)

managers[]

object (User)

hire_date

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".

termination_date

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".

time_off[]

object (TimeOff)

last_login_time

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".

last_password_change_time

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".

password_expiration_time

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".

account_expiration_time

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".

account_lockout_time

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".

last_bad_password_attempt_time

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".

user_authentication_status

enum (AuthenticationStatus)

role_name
(deprecated)

string

role_description
(deprecated)

string

user_role
(deprecated)

enum (Role)

Attribute

JSON representation
{
  "cloud": {
    object (Cloud)
  },
  "labels": [
    {
      object (Label)
    }
  ],
  "permissions": [
    {
      object (Permission)
    }
  ],
  "roles": [
    {
      object (Role)
    }
  ],
  "creation_time": string,
  "last_update_time": string
}
Fields
cloud

object (Cloud)

labels[]

object (Label)

permissions[]

object (Permission)

roles[]

object (Role)

creation_time

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".

last_update_time

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".

Cloud

JSON representation
{
  "environment": enum (CloudEnvironment),
  "vpc": {
    object (Resource)
  },
  "project": {
    object (Resource)
  },
  "availability_zone": string
}
Fields
environment

enum (CloudEnvironment)

vpc
(deprecated)

object (Resource)

project
(deprecated)

object (Resource)

availability_zone

string

CloudEnvironment

Enums
UNSPECIFIED_CLOUD_ENVIRONMENT
GOOGLE_CLOUD_PLATFORM
AMAZON_WEB_SERVICES
MICROSOFT_AZURE

Resource

JSON representation
{
  "type": string,
  "resource_type": enum (ResourceType),
  "resource_subtype": string,
  "id": string,
  "name": string,
  "parent": string,
  "product_object_id": string,
  "attribute": {
    object (Attribute)
  }
}
Fields
type
(deprecated)

string

resource_type

enum (ResourceType)

resource_subtype

string

id
(deprecated)

string

name

string

parent
(deprecated)

string

product_object_id

string

attribute

object (Attribute)

ResourceType

Enums
UNSPECIFIED
MUTEX
TASK
PIPE
DEVICE
FIREWALL_RULE
MAILBOX_FOLDER
VPC_NETWORK
VIRTUAL_MACHINE
STORAGE_BUCKET
STORAGE_OBJECT
DATABASE
TABLE
CLOUD_PROJECT
CLOUD_ORGANIZATION
SERVICE_ACCOUNT
ACCESS_POLICY
CLUSTER
SETTING
DATASET
BACKEND_SERVICE
POD
CONTAINER
FUNCTION
RUNTIME
IP_ADDRESS
DISK
VOLUME
IMAGE
SNAPSHOT
REPOSITORY
CREDENTIAL
LOAD_BALANCER
GATEWAY
SUBNET

Permission

JSON representation
{
  "name": string,
  "description": string,
  "type": enum (PermissionType)
}
Fields
name

string

description

string

type

enum (PermissionType)

PermissionType

Enums
UNKNOWN_PERMISSION_TYPE
ADMIN_WRITE
ADMIN_READ
DATA_WRITE
DATA_READ

Role

JSON representation
{
  "name": string,
  "description": string,
  "type": enum (Type)
}
Fields
name

string

description

string

type

enum (Type)

Type

Enums
TYPE_UNSPECIFIED
ADMINISTRATOR
SERVICE_ACCOUNT

AccountType

Enums
ACCOUNT_TYPE_UNSPECIFIED
DOMAIN_ACCOUNT_TYPE
LOCAL_ACCOUNT_TYPE
CLOUD_ACCOUNT_TYPE
SERVICE_ACCOUNT_TYPE
DEFAULT_ACCOUNT_TYPE

TimeOff

JSON representation
{
  "interval": {
    object (Interval)
  },
  "description": string
}
Fields
interval

object (Interval)

description

string

AuthenticationStatus

Enums
UNKNOWN_AUTHENTICATION_STATUS
ACTIVE
SUSPENDED
NO_ACTIVE_CREDENTIALS
DELETED

Role

Enums
UNKNOWN_ROLE
ADMINISTRATOR
SERVICE_ACCOUNT

Favicon

JSON representation
{
  "raw_md5": string,
  "dhash": string
}
Fields
raw_md5

string

dhash

string

DNSRecord

JSON representation
{
  "type": string,
  "value": string,
  "ttl": string,
  "priority": string,
  "retry": string,
  "refresh": string,
  "minimum": string,
  "expire": string,
  "serial": string,
  "rname": string
}
Fields
type

string

value

string

ttl

string (Duration format)

A duration in seconds with up to nine fractional digits, ending with 's'. Example: "3.5s".

priority

string (int64 format)

retry

string (int64 format)

refresh

string (Duration format)

A duration in seconds with up to nine fractional digits, ending with 's'. Example: "3.5s".

minimum

string (Duration format)

A duration in seconds with up to nine fractional digits, ending with 's'. Example: "3.5s".

expire

string (Duration format)

A duration in seconds with up to nine fractional digits, ending with 's'. Example: "3.5s".

serial

string (int64 format)

rname

string

SSLCertificate

JSON representation
{
  "cert_signature": {
    object (CertSignature)
  },
  "extension": {
    object (Extension)
  },
  "cert_extensions": {
    object
  },
  "first_seen_time": string,
  "issuer": {
    object (Subject)
  },
  "ec": {
    object (EC)
  },
  "serial_number": string,
  "signature_algorithm": string,
  "size": string,
  "subject": {
    object (Subject)
  },
  "thumbprint": string,
  "thumbprint_sha256": string,
  "validity": {
    object (Validity)
  },
  "version": string
}
Fields
cert_signature

object (CertSignature)

extension
(deprecated)

object (Extension)

cert_extensions

object (Struct format)

first_seen_time

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".

issuer

object (Subject)

ec

object (EC)

serial_number

string

signature_algorithm

string

size

string (int64 format)

subject

object (Subject)

thumbprint

string

thumbprint_sha256

string

validity

object (Validity)

version

string

CertSignature

JSON representation
{
  "signature": string,
  "signature_algorithm": string
}
Fields
signature

string

signature_algorithm

string

Extension

JSON representation
{
  "ca": boolean,
  "subject_key_id": string,
  "authority_key_id": {
    object (AuthorityKeyId)
  },
  "key_usage": string,
  "ca_info_access": string,
  "crl_distribution_points": string,
  "extended_key_usage": string,
  "subject_alternative_name": string,
  "certificate_policies": string,
  "netscape_cert_comment": string,
  "cert_template_name_dc": string,
  "netscape_certificate": boolean,
  "pe_logotype": boolean,
  "old_authority_key_id": boolean
}
Fields
ca

boolean

subject_key_id

string

authority_key_id

object (AuthorityKeyId)

key_usage

string

ca_info_access

string

crl_distribution_points

string

extended_key_usage

string

subject_alternative_name

string

certificate_policies

string

netscape_cert_comment

string

cert_template_name_dc

string

netscape_certificate

boolean

pe_logotype

boolean

old_authority_key_id

boolean

AuthorityKeyId

JSON representation
{
  "keyid": string,
  "serial_number": string
}
Fields
keyid

string

serial_number

string

Subject

JSON representation
{
  "country_name": string,
  "common_name": string,
  "locality": string,
  "organization": string,
  "organizational_unit": string,
  "state_or_province_name": string
}
Fields
country_name

string

common_name

string

locality

string

organization

string

organizational_unit

string

state_or_province_name

string

EC

JSON representation
{
  "oid": string,
  "pub": string
}
Fields
oid

string

pub

string

Validity

JSON representation
{
  "expiry_time": string,
  "issue_time": string
}
Fields
expiry_time

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".

issue_time

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".

PopularityRank

JSON representation
{
  "giver": string,
  "rank": string,
  "ingestion_time": string
}
Fields
giver

string

rank

string (int64 format)

ingestion_time

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".

Artifact

JSON representation
{
  "ip": string,
  "prevalence": {
    object (Prevalence)
  },
  "first_seen_time": string,
  "last_seen_time": string,
  "location": {
    object (Location)
  },
  "network": {
    object (Network)
  },
  "as_owner": string,
  "asn": string,
  "jarm": string,
  "last_https_certificate": {
    object (SSLCertificate)
  },
  "last_https_certificate_date": string,
  "regional_internet_registry": string,
  "tags": [
    string
  ],
  "whois": string,
  "whois_date": string
}
Fields
ip

string

prevalence

object (Prevalence)

first_seen_time

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".

last_seen_time

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".

location

object (Location)

network

object (Network)

as_owner

string

asn

string (int64 format)

jarm

string

last_https_certificate

object (SSLCertificate)

last_https_certificate_date

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".

regional_internet_registry

string

tags[]

string

whois

string

whois_date

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".

Url

JSON representation
{
  "url": string,
  "categories": [
    string
  ],
  "favicon": {
    object (Favicon)
  },
  "html_meta": {
    object
  },
  "last_final_url": string,
  "last_http_response_code": integer,
  "last_http_response_content_length": string,
  "last_http_response_content_sha256": string,
  "last_http_response_cookies": {
    object
  },
  "last_http_response_headers": {
    object
  },
  "tags": [
    string
  ],
  "title": string,
  "trackers": [
    {
      object (Tracker)
    }
  ]
}
Fields
url

string

categories[]

string

favicon

object (Favicon)

html_meta

object (Struct format)

last_final_url

string

last_http_response_code

integer

last_http_response_content_length

string (int64 format)

last_http_response_content_sha256

string

last_http_response_cookies

object (Struct format)

last_http_response_headers

object (Struct format)

tags[]

string

title

string

trackers[]

object (Tracker)

Tracker

JSON representation
{
  "tracker": string,
  "id": string,
  "timestamp": string,
  "url": string
}
Fields
tracker

string

id

string

timestamp

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".

url

string

Group

JSON representation
{
  "product_object_id": string,
  "creation_time": string,
  "group_display_name": string,
  "attribute": {
    object (Attribute)
  },
  "email_addresses": [
    string
  ],
  "windows_sid": string
}
Fields
product_object_id

string

creation_time
(deprecated)

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".

group_display_name

string

attribute

object (Attribute)

email_addresses[]

string

windows_sid

string

Process

JSON representation
{
  "pid": string,
  "parent_pid": string,
  "parent_process": {
    object (Process)
  },
  "file": {
    object (File)
  },
  "command_line": string,
  "command_line_history": [
    string
  ],
  "product_specific_process_id": string,
  "access_mask": string,
  "integrity_level_rid": string,
  "token_elevation_type": enum (TokenElevationType),
  "product_specific_parent_process_id": string
}
Fields
pid

string

parent_pid
(deprecated)

string

parent_process

object (Process)

file

object (File)

command_line

string

command_line_history[]

string

product_specific_process_id

string

access_mask

string

integrity_level_rid

string

token_elevation_type

enum (TokenElevationType)

product_specific_parent_process_id
(deprecated)

string

File

JSON representation
{
  "sha256": string,
  "md5": string,
  "sha1": string,
  "size": string,
  "full_path": string,
  "mime_type": string,
  "file_metadata": {
    object (FileMetadata)
  },
  "security_result": {
    object (SecurityResult)
  },
  "pe_file": {
    object (FileMetadataPE)
  },
  "ssdeep": string,
  "vhash": string,
  "ahash": string,
  "authentihash": string,
  "file_type": enum (FileType),
  "capabilities_tags": [
    string
  ],
  "names": [
    string
  ],
  "tags": [
    string
  ],
  "last_modification_time": string,
  "prevalence": {
    object (Prevalence)
  },
  "first_seen_time": string,
  "last_seen_time": string,
  "stat_mode": string,
  "stat_inode": string,
  "stat_dev": string,
  "stat_nlink": string,
  "stat_flags": integer,
  "last_analysis_time": string,
  "embedded_urls": [
    string
  ],
  "embedded_domains": [
    string
  ],
  "embedded_ips": [
    string
  ],
  "exif_info": {
    object (ExifInfo)
  },
  "signature_info": {
    object (SignatureInfo)
  },
  "pdf_info": {
    object (PDFInfo)
  },
  "first_submission_time": string,
  "last_submission_time": string,
  "main_icon": {
    object (Favicon)
  }
}
Fields
sha256

string

md5

string

sha1

string

size

string

full_path

string

mime_type

string

file_metadata
(deprecated)

object (FileMetadata)

security_result

object (SecurityResult)

pe_file

object (FileMetadataPE)

ssdeep

string

vhash

string

ahash
(deprecated)

string

authentihash

string

file_type

enum (FileType)

capabilities_tags[]

string

names[]

string

tags[]

string

last_modification_time

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".

prevalence

object (Prevalence)

first_seen_time

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".

last_seen_time

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".

stat_mode

string

stat_inode

string

stat_dev

string

stat_flags

integer (uint32 format)

last_analysis_time

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".

embedded_urls[]

string

embedded_domains[]

string

embedded_ips[]

string

exif_info

object (ExifInfo)

signature_info

object (SignatureInfo)

pdf_info

object (PDFInfo)

first_submission_time

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".

last_submission_time

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".

main_icon

object (Favicon)

FileMetadata

JSON representation
{
  "pe": {
    object (PeFileMetadata)
  }
}
Fields
pe
(deprecated)

object (PeFileMetadata)

PeFileMetadata

JSON representation
{
  "import_hash": string
}
Fields
import_hash

string

FileMetadataPE

JSON representation
{
  "imphash": string,
  "entry_point": string,
  "entry_point_exiftool": string,
  "compilation_time": string,
  "compilation_exiftool_time": string,
  "section": [
    {
      object (FileMetadataSection)
    }
  ],
  "imports": [
    {
      object (FileMetadataImports)
    }
  ],
  "resource": [
    {
      object (FileMetadataPeResourceInfo)
    }
  ],
  "resources_type_count": [
    {
      object (StringToInt64MapEntry)
    }
  ],
  "resources_language_count": [
    {
      object (StringToInt64MapEntry)
    }
  ],
  "resources_type_count_str": [
    {
      object (Label)
    }
  ],
  "resources_language_count_str": [
    {
      object (Label)
    }
  ],
  "signature_info": {
    object (FileMetadataSignatureInfo)
  }
}
Fields
imphash

string

entry_point

string (int64 format)

entry_point_exiftool

string (int64 format)

compilation_time

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".

compilation_exiftool_time

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".

section[]

object (FileMetadataSection)

imports[]

object (FileMetadataImports)

resource[]

object (FileMetadataPeResourceInfo)

resources_type_count[]
(deprecated)

object (StringToInt64MapEntry)

resources_language_count[]
(deprecated)

object (StringToInt64MapEntry)

resources_type_count_str[]

object (Label)

resources_language_count_str[]

object (Label)

signature_info
(deprecated)

object (FileMetadataSignatureInfo)

FileMetadataSection

JSON representation
{
  "name": string,
  "entropy": number,
  "raw_size_bytes": string,
  "virtual_size_bytes": string,
  "md5_hex": string
}
Fields
name

string

entropy

number

raw_size_bytes

string (int64 format)

virtual_size_bytes

string (int64 format)

md5_hex

string

FileMetadataImports

JSON representation
{
  "library": string,
  "functions": [
    string
  ]
}
Fields
library

string

functions[]

string

FileMetadataPeResourceInfo

JSON representation
{
  "sha256_hex": string,
  "filetype_magic": string,
  "language_code": string,
  "entropy": number,
  "file_type": string
}
Fields
sha256_hex

string

filetype_magic

string

language_code

string

entropy

number

file_type

string

StringToInt64MapEntry

JSON representation
{
  "key": string,
  "value": string
}
Fields
key

string

value

string (int64 format)

FileMetadataSignatureInfo

JSON representation
{
  "verification_message": string,
  "verified": boolean,
  "signer": [
    string
  ],
  "signers": [
    {
      object (SignerInfo)
    }
  ],
  "x509": [
    {
      object (X509)
    }
  ]
}
Fields
verification_message

string

verified

boolean

signer[]
(deprecated)

string

signers[]

object (SignerInfo)

x509[]

object (X509)

SignerInfo

JSON representation
{
  "name": string,
  "status": string,
  "valid_usage": string,
  "cert_issuer": string
}
Fields
name

string

status

string

valid_usage

string

cert_issuer

string

X509

JSON representation
{
  "name": string,
  "algorithm": string,
  "thumbprint": string,
  "cert_issuer": string,
  "serial_number": string
}
Fields
name

string

algorithm

string

thumbprint

string

cert_issuer

string

serial_number

string

FileType

Enums
FILE_TYPE_UNSPECIFIED
FILE_TYPE_PE_EXE
FILE_TYPE_PE_DLL
FILE_TYPE_MSI
FILE_TYPE_NE_EXE
FILE_TYPE_NE_DLL
FILE_TYPE_DOS_EXE
FILE_TYPE_DOS_COM
FILE_TYPE_COFF
FILE_TYPE_ELF
FILE_TYPE_LINUX_KERNEL
FILE_TYPE_RPM
FILE_TYPE_LINUX
FILE_TYPE_MACH_O
FILE_TYPE_JAVA_BYTECODE
FILE_TYPE_DMG
FILE_TYPE_DEB
FILE_TYPE_PKG
FILE_TYPE_PYC
FILE_TYPE_LNK
FILE_TYPE_JPEG
FILE_TYPE_TIFF
FILE_TYPE_GIF
FILE_TYPE_PNG
FILE_TYPE_BMP
FILE_TYPE_GIMP
FILE_TYPE_IN_DESIGN
FILE_TYPE_PSD
FILE_TYPE_TARGA
FILE_TYPE_XWD
FILE_TYPE_DIB
FILE_TYPE_JNG
FILE_TYPE_ICO
FILE_TYPE_FPX
FILE_TYPE_EPS
FILE_TYPE_SVG
FILE_TYPE_EMF
FILE_TYPE_WEBP
FILE_TYPE_DWG
FILE_TYPE_DXF
FILE_TYPE_THREEDS
FILE_TYPE_OGG
FILE_TYPE_FLC
FILE_TYPE_FLI
FILE_TYPE_MP3
FILE_TYPE_FLAC
FILE_TYPE_WAV
FILE_TYPE_MIDI
FILE_TYPE_AVI
FILE_TYPE_MPEG
FILE_TYPE_QUICKTIME
FILE_TYPE_ASF
FILE_TYPE_DIVX
FILE_TYPE_FLV
FILE_TYPE_WMA
FILE_TYPE_WMV
FILE_TYPE_RM
FILE_TYPE_MOV
FILE_TYPE_MP4
FILE_TYPE_T3GP
FILE_TYPE_WEBM
FILE_TYPE_MKV
FILE_TYPE_PDF
FILE_TYPE_PS
FILE_TYPE_DOC
FILE_TYPE_DOCX
FILE_TYPE_PPT
FILE_TYPE_PPTX
FILE_TYPE_PPSX
FILE_TYPE_XLS
FILE_TYPE_XLSX
FILE_TYPE_RTF
FILE_TYPE_ODP
FILE_TYPE_ODS
FILE_TYPE_ODT
FILE_TYPE_HWP
FILE_TYPE_GUL
FILE_TYPE_ODF
FILE_TYPE_ODG
FILE_TYPE_ONE_NOTE
FILE_TYPE_OOXML
FILE_TYPE_EBOOK
FILE_TYPE_LATEX
FILE_TYPE_TTF
FILE_TYPE_EOT
FILE_TYPE_WOFF
FILE_TYPE_CHM
FILE_TYPE_ZIP
FILE_TYPE_GZIP
FILE_TYPE_BZIP
FILE_TYPE_RZIP
FILE_TYPE_DZIP
FILE_TYPE_SEVENZIP
FILE_TYPE_CAB
FILE_TYPE_JAR
FILE_TYPE_RAR
FILE_TYPE_MSCOMPRESS
FILE_TYPE_ACE
FILE_TYPE_ARC
FILE_TYPE_ARJ
FILE_TYPE_ASD
FILE_TYPE_BLACKHOLE
FILE_TYPE_KGB
FILE_TYPE_ZLIB
FILE_TYPE_TAR
FILE_TYPE_ZST
FILE_TYPE_LZFSE
FILE_TYPE_PYTHON_WHL
FILE_TYPE_PYTHON_PKG
FILE_TYPE_TEXT
FILE_TYPE_SCRIPT
FILE_TYPE_PHP
FILE_TYPE_PYTHON
FILE_TYPE_PERL
FILE_TYPE_RUBY
FILE_TYPE_C
FILE_TYPE_CPP
FILE_TYPE_JAVA
FILE_TYPE_SHELLSCRIPT
FILE_TYPE_PASCAL
FILE_TYPE_AWK
FILE_TYPE_DYALOG
FILE_TYPE_FORTRAN
FILE_TYPE_JAVASCRIPT
FILE_TYPE_POWERSHELL
FILE_TYPE_VBA
FILE_TYPE_M4
FILE_TYPE_OBJETIVEC
FILE_TYPE_JMOD
FILE_TYPE_MAKEFILE
FILE_TYPE_INI
FILE_TYPE_CLJ
FILE_TYPE_PDB
FILE_TYPE_SQL
FILE_TYPE_NEKO
FILE_TYPE_WER
FILE_TYPE_GOLANG
FILE_TYPE_SYMBIAN
FILE_TYPE_PALMOS
FILE_TYPE_WINCE
FILE_TYPE_ANDROID
FILE_TYPE_IPHONE
FILE_TYPE_HTML
FILE_TYPE_XML
FILE_TYPE_SWF
FILE_TYPE_FLA
FILE_TYPE_TORRENT
FILE_TYPE_EMAIL_TYPE
FILE_TYPE_OUTLOOK
FILE_TYPE_SGML
FILE_TYPE_JSON
FILE_TYPE_CSV
FILE_TYPE_CAP
FILE_TYPE_ISOIMAGE
FILE_TYPE_SQUASHFS
FILE_TYPE_VHD
FILE_TYPE_APPLE
FILE_TYPE_MACINTOSH
FILE_TYPE_APPLESINGLE
FILE_TYPE_APPLEDOUBLE
FILE_TYPE_MACINTOSH_HFS
FILE_TYPE_APPLE_PLIST
FILE_TYPE_MACINTOSH_LIB
FILE_TYPE_APPLESCRIPT
FILE_TYPE_APPLESCRIPT_COMPILED
FILE_TYPE_CRX
FILE_TYPE_XPI
FILE_TYPE_ROM
FILE_TYPE_IPS
FILE_TYPE_PEM
FILE_TYPE_PGP
FILE_TYPE_CRT

ExifInfo

JSON representation
{
  "original_file": string,
  "product": string,
  "company": string,
  "file_description": string,
  "entry_point": string,
  "compilation_time": string
}
Fields
original_file

string

product

string

company

string

file_description

string

entry_point

string (int64 format)

compilation_time

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".

SignatureInfo

JSON representation
{
  "sigcheck": {
    object (FileMetadataSignatureInfo)
  },
  "codesign": {
    object (FileMetadataCodesign)
  }
}
Fields
sigcheck

object (FileMetadataSignatureInfo)

codesign

object (FileMetadataCodesign)

FileMetadataCodesign

JSON representation
{
  "id": string,
  "format": string,
  "compilation_time": string
}
Fields
id

string

format

string

compilation_time

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".

PDFInfo

JSON representation
{
  "js": string,
  "javascript": string,
  "launch_action_count": string,
  "object_stream_count": string,
  "endobj_count": string,
  "header": string,
  "acroform": string,
  "autoaction": string,
  "embedded_file": string,
  "encrypted": string,
  "flash": string,
  "jbig2_compression": string,
  "obj_count": string,
  "endstream_count": string,
  "page_count": string,
  "stream_count": string,
  "openaction": string,
  "startxref": string,
  "suspicious_colors": string,
  "trailer": string,
  "xfa": string,
  "xref": string
}
Fields
js

string (int64 format)

javascript

string (int64 format)

launch_action_count

string (int64 format)

object_stream_count

string (int64 format)

endobj_count

string (int64 format)

header

string

acroform

string (int64 format)

autoaction

string (int64 format)

embedded_file

string (int64 format)

encrypted

string (int64 format)

flash

string (int64 format)

jbig2_compression

string (int64 format)

obj_count

string (int64 format)

endstream_count

string (int64 format)

page_count

string (int64 format)

stream_count

string (int64 format)

openaction

string (int64 format)

startxref

string (int64 format)

suspicious_colors

string (int64 format)

trailer

string (int64 format)

xfa

string (int64 format)

xref

string (int64 format)

TokenElevationType

Enums
UNKNOWN
TYPE_1
TYPE_2
TYPE_3

Asset

JSON representation
{
  "product_object_id": string,
  "hostname": string,
  "asset_id": string,
  "ip": [
    string
  ],
  "mac": [
    string
  ],
  "nat_ip": [
    string
  ],
  "first_seen_time": string,
  "hardware": [
    {
      object (Hardware)
    }
  ],
  "platform_software": {
    object (PlatformSoftware)
  },
  "software": [
    {
      object (Software)
    }
  ],
  "location": {
    object (Location)
  },
  "category": string,
  "type": enum (AssetType),
  "network_domain": string,
  "creation_time": string,
  "first_discover_time": string,
  "last_discover_time": string,
  "system_last_update_time": string,
  "last_boot_time": string,
  "labels": [
    {
      object (Label)
    }
  ],
  "deployment_status": enum (DeploymentStatus),
  "vulnerabilities": [
    {
      object (Vulnerability)
    }
  ],
  "attribute": {
    object (Attribute)
  }
}
Fields
product_object_id

string

hostname

string

asset_id

string

ip[]

string

mac[]

string

nat_ip[]

string

first_seen_time

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".

hardware[]

object (Hardware)

platform_software

object (PlatformSoftware)

software[]

object (Software)

location

object (Location)

category

string

type

enum (AssetType)

network_domain

string

creation_time
(deprecated)

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".

first_discover_time

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".

last_discover_time

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".

system_last_update_time

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".

last_boot_time

string (Timestamp format)

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".

labels[]
(deprecated)

object (Label)

deployment_status

enum (DeploymentStatus)

vulnerabilities[]

object (Vulnerability)

attribute

object (Attribute)

Hardware

JSON representation
{
  "serial_number": string,
  "manufacturer": string,
  "model": string,
  "cpu_platform": string,
  "cpu_model": string,
  "cpu_clock_speed": string,
  "cpu_max_clock_speed": string,
  "cpu_number_cores": string,
  "ram": string
}
Fields
serial_number

string

manufacturer

string

model

string

cpu_platform

string

cpu_model

string

cpu_clock_speed

string

cpu_max_clock_speed

string

cpu_number_cores

string

ram

string

PlatformSoftware

JSON representation
{
  "platform": enum (Platform),
  "platform_version": string,
  "platform_patch_level": string
}
Fields
platform

enum (Platform)

platform_version

string

platform_patch_level

string

Platform

Enums
UNKNOWN_PLATFORM
WINDOWS
MAC
LINUX
GCP
AWS
AZURE
IOS
ANDROID
CHROME_OS

Software

JSON representation
{
  "name": string,
  "version": string,
  "permissions": [
    {
      object (Permission)
    }
  ],
  "description": string,
  "vendor_name": string
}
Fields
name

string

version

string

permissions[]

object (Permission)

description

string

vendor_name

string

AssetType

Enums
ROLE_UNSPECIFIED
WORKSTATION
LAPTOP
IOT
NETWORK_ATTACHED_STORAGE
PRINTER
SCANNER
SERVER
TAPE_LIBRARY
MOBILE

DeploymentStatus

Enums
DEPLOYMENT_STATUS_UNSPECIFIED
ACTIVE
PENDING_DECOMISSION
DECOMISSIONED

Registry

JSON representation
{
  "registry_key": string,
  "registry_value_name": string,
  "registry_value_data": string
}
Fields
registry_key

string

registry_value_name

string

registry_value_data

string

Id

JSON representation
{
  "namespace": enum (Namespace),
  "id": string
}
Fields
namespace

enum (Namespace)

id

string (bytes format)

A base64-encoded string.

Investigation

JSON representation
{
  "comments": [
    string
  ],
  "verdict": enum (Verdict),
  "reputation": enum (Reputation),
  "severity_score": integer,
  "status": enum (Status),
  "priority": enum (Priority),
  "root_cause": string,
  "reason": enum (Reason),
  "risk_score": integer
}
Fields
comments[]

string

verdict

enum (Verdict)

reputation

enum (Reputation)

severity_score

integer (uint32 format)

status

enum (Status)

priority

enum (Priority)

root_cause

string

reason

enum (Reason)

risk_score

integer (uint32 format)

Verdict

Enums
VERDICT_UNSPECIFIED
TRUE_POSITIVE
FALSE_POSITIVE

Reputation

Enums
REPUTATION_UNSPECIFIED
USEFUL
NOT_USEFUL

Status

Enums
STATUS_UNSPECIFIED
NEW
REVIEWED
CLOSED
OPEN

Priority

Enums
PRIORITY_UNSPECIFIED
PRIORITY_INFO
PRIORITY_LOW
PRIORITY_MEDIUM
PRIORITY_HIGH
PRIORITY_CRITICAL

Reason

Enums
REASON_UNSPECIFIED
REASON_NOT_MALICIOUS
REASON_MALICIOUS
REASON_MAINTENANCE