LegacyFederatedUdmSearchViewResponse

Response to a Federated UDM Search query. This will be used by StreamSearchOperation RPC to return the results of a federated search operation.

JSON representation
{
  "operation": string,
  "progress": number,
  "too_many_events": boolean,
  "too_large_response": boolean,
  "complete": boolean,
  "valid_baseline_query": boolean,
  "baseline_events_count": integer,
  "valid_snapshot_query": boolean,
  "query_validation_errors": [
    {
      object (ErrorMessage)
    }
  ],
  "runtime_errors": [
    {
      object (RuntimeError)
    }
  ],
  "filtered_events_count": integer,
  "data_sources": [
    enum (SearchDataSource)
  ],
  "instance_udm_search_responses": [
    {
      object (InstanceUdmSearchResponse)
    }
  ],
  "events": {
    object (UdmEventList)
  },
  "field_aggregations": {
    object (UdmFieldAggregations)
  },
  "grouped_field_aggregations": {
    object (UdmFieldAggregations)
  },
  "stats_function_response": {
    object (FunctionResponse)
  },
  "stats_function_parameter_validation_error_message": string,
  "stats": {
    object (Stats)
  },
  "ai_overview": {
    object (AIOverview)
  },
  "activity_timeline": {
    object (EventCountTimeline)
  },
  "timeline": {
    object (EventCountTimeline)
  },
  "instance_aggregations": {
    object (UdmFieldAggregations)
  },
  "detection_field_aggregations": {
    object (AlertFieldAggregations)
  },
  "detection_instance_aggregations": {
    object (AlertFieldAggregations)
  }
}
Fields
operation

string

The name of the operation resource representing the UDM Search operation. This can be passed to StreamSearchOperation to fetch stored results or stream the results of an in-progress operation.

The metadata type of the operation is UdmSearchMetadata. The response type is LegacyFetchUdmSearchViewResponse.

Format: projects/{project}/locations/{location}/instances/{instance}/operations/{operation}

progress

number

Progress of the query represented as a double between 0 and 1.

too_many_events

boolean

If true, there are too many events to return and some have been omitted.

too_large_response

boolean

If true, the response to be returned to the UI is too large and some events have been omitted.

complete

boolean

Streaming for this response is done. There will be no additional updates.

valid_baseline_query

boolean

Indicates whether the request baseline_query is a valid structured query or not. If not, query_validation_errors will include the parse error.

baseline_events_count

integer

The number of events in the baseline query.

valid_snapshot_query

boolean

Indicates whether the request baseline and snapshot queries are valid. If not, query_validation_errors will include the parse error.

query_validation_errors[]

object (ErrorMessage)

Parse error for the baseline_query and/or the snapshot_query.

runtime_errors[]

object (RuntimeError)

Runtime errors.

filtered_events_count

integer

The number of events in the snapshot that match the snapshot_query. This is <= baseline_events_count. If the snapshot query is empty this will be equivalent to baseline_events_count.

data_sources[]

enum (SearchDataSource)

Datasource of the query and results in case of a statistics query

instance_udm_search_responses[]

object (InstanceUdmSearchResponse)

All the instance specific UDM search responses.

events

object (UdmEventList)

List of UDM events. NOTE: After complete is set to true, the UdmEventList message will be omitted from the response. The latest message should be used as reference. If the UdmEventList message is returned again, then it should replace the previous value.

field_aggregations

object (UdmFieldAggregations)

List of UDM fields with aggregated values.

grouped_field_aggregations

object (UdmFieldAggregations)

List of grouped fields with aggregated values.

stats_function_response

object (FunctionResponse)

Result for statistical function.

stats_function_parameter_validation_error_message

string

If the request's stats_function_parameter` is invalid, this field will contain the detailed error message.

stats

object (Stats)

Stats results when the query is for statistics

ai_overview

object (AIOverview)

LINT.ThenChange( //depot/google3/google/cloud/chronicle/v1main/dashboard_query.proto:data_sources, //depot/google3/googlex/security/malachite/proto/udm_search.proto:data_sources ) AI generated overview for the search results. Only populated if the AI features are enabled for the customer and generate_ai_overview is set to true in the request.

activity_timeline

object (EventCountTimeline)

Timeline of event counts broken into hourly/daily buckets to identify activity.

timeline

object (EventCountTimeline)

Timeline of event counts broken into buckets. This populates the trend-over-time chart in the UI.

instance_aggregations

object (UdmFieldAggregations)

Instance aggregations for the search results. Provides information on the number of events per instance for the aggregations panel in the UI. This allows users to easily drill-down into the individual instances.

detection_field_aggregations

object (AlertFieldAggregations)

List of detection fields with aggregated values. This enabled filtering in the Alerts panel for federated search.

detection_instance_aggregations

object (AlertFieldAggregations)

Instance aggregations for the detection search results. Provides information on the number of detections per instance for the detections aggregations panel in the UI. This allows users to easily drill-down into the individual instances.

ErrorMessage

JSON representation
{
  "type": enum (ErrorType),
  "error_text": string
}
Fields
type

enum (ErrorType)

error_text

string

RuntimeError

JSON representation
{
  "time_range": {
    object (Interval)
  },
  "error_text": string
}
Fields
time_range

object (Interval)

error_text

string

UdmEventList

JSON representation
{
  "events": [
    {
      object (UdmEventInfo)
    }
  ],
  "column_names": {
    object (ColumnNames)
  },
  "progress": number,
  "too_many_events": boolean,
  "complete": boolean,
  "datatable_info": [
    {
      object (SearchDataTableInfo)
    }
  ]
}
Fields
events[]

object (UdmEventInfo)

column_names

object (ColumnNames)

progress

number

too_many_events

boolean

complete

boolean

datatable_info[]

object (SearchDataTableInfo)

UdmEventInfo

JSON representation
{
  "event": {
    object (UDM)
  },
  "entity": {
    object (Entity)
  },
  "datatable_row_info": [
    {
      object (SearchDataTableRowInfo)
    }
  ],
  "filter_properties": {
    object (FilterProperties)
  },
  "event_log_token": string,
  "alert_number": integer,
  "display_name": string,
  "chip": {
    object (Chip)
  },
  "uid": string,
  "annotations": [
    enum (Annotation)
  ],
  "detections": [
    {
      object (Collection)
    }
  ],
  "outcomes": [
    {
      object (UdmColumnType)
    }
  ],
  "connected_component_label": string,
  "tenant_id": string
}
Fields
event

object (UDM)

entity

object (Entity)

datatable_row_info[]

object (SearchDataTableRowInfo)

filter_properties
(deprecated)

object (FilterProperties)

event_log_token

string

alert_number

integer

display_name
(deprecated)

string

chip
(deprecated)

object (Chip)

uid

string (bytes format)

A base64-encoded string.

annotations[]

enum (Annotation)

detections[]

object (Collection)

outcomes[]

object (UdmColumnType)

connected_component_label

string (bytes format)

Optional.

A base64-encoded string.

tenant_id

string

Optional.

SearchDataTableRowInfo

JSON representation
{
  "data_table": string,
  "rows": [
    {
      object (SearchDataTableRow)
    }
  ]
}
Fields
data_table

string

rows[]

object (SearchDataTableRow)

SearchDataTableRow

JSON representation
{
  "column": string,
  "value": string
}
Fields
column

string

value

string

FilterProperties

JSON representation
{
  "string_properties": {
    string: {
      object (StringValues)
    },
    ...
  },
  "hidden": boolean
}
Fields
string_properties

map (key: string, value: object (StringValues))

An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.

hidden

boolean

StringValues

JSON representation
{
  "values": [
    {
      object (StringValue)
    }
  ]
}
Fields
values[]

object (StringValue)

StringValue

JSON representation
{
  "raw_value": string,
  "display_value": string
}
Fields
raw_value

string

display_value

string

Chip

JSON representation
{
  "type": enum (ChipType),
  "text": string
}
Fields
type

enum (ChipType)

text

string

UdmColumnType

JSON representation
{

  // Union field type can be only one of the following:
  "value": {
    object (UdmColumnValue)
  },
  "list": {
    object (UdmColumnList)
  }
  // End of list of possible types for union field type.
}
Fields

Union field type.

type can be only one of the following:

value

object (UdmColumnValue)

list

object (UdmColumnList)

UdmColumnValue

JSON representation
{

  // Union field value can be only one of the following:
  "null_val": boolean,
  "bool_val": boolean,
  "bytes_val": string,
  "double_val": number,
  "int64_val": string,
  "uint64_val": string,
  "string_val": string,
  "timestamp_val": string,
  "date_val": {
    object (Date)
  },
  "proto_val": {
    "@type": string,
    field1: ...,
    ...
  }
  // End of list of possible types for union field value.
}
Fields

Union field value.

value can be only one of the following:

null_val

boolean

bool_val

boolean

bytes_val

string (bytes format)

A base64-encoded string.

double_val

number

int64_val

string (int64 format)

uint64_val

string

string_val

string

timestamp_val

string (Timestamp format)

Uses RFC 3339, where generated output will always be Z-normalized and uses 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".

date_val

object (Date)

proto_val

object

An object containing fields of an arbitrary type. An additional field "@type" contains a URI identifying the type. Example: { "id": 1234, "@type": "types.example.com/standard/id" }.

Date

Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following:

  • A full date, with non-zero year, month, and day values.
  • A month and day, with a zero year (for example, an anniversary).
  • A year on its own, with a zero month and a zero day.
  • A year and month, with a zero day (for example, a credit card expiration date).

Related types:

JSON representation
{
  "year": integer,
  "month": integer,
  "day": integer
}
Fields
year

integer

Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

month

integer

Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

day

integer

Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

UdmColumnList

JSON representation
{
  "values": [
    {
      object (UdmColumnValue)
    }
  ]
}
Fields
values[]

object (UdmColumnValue)

ColumnNames

JSON representation
{
  "names": [
    string
  ]
}
Fields
names[]

string

SearchDataTableInfo

JSON representation
{
  "data_table": string,
  "column_info": [
    {
      object (SearchDataTableColumnInfo)
    }
  ]
}
Fields
data_table

string

column_info[]

object (SearchDataTableColumnInfo)

SearchDataTableColumnInfo

JSON representation
{
  "original_column": string,
  "is_default": boolean
}
Fields
original_column

string

is_default

boolean

UdmFieldAggregations

JSON representation
{
  "fields": [
    {
      object (UdmFieldAggregation)
    }
  ],
  "group_by_fields": [
    {
      object (GroupAggregationByField)
    }
  ],
  "complete": boolean
}
Fields
fields[]

object (UdmFieldAggregation)

group_by_fields[]

object (GroupAggregationByField)

complete

boolean

UdmFieldAggregation

JSON representation
{
  "field_name": string,
  "baseline_event_count": integer,
  "event_count": integer,
  "too_many_values": boolean,
  "value_count": integer,
  "all_values": [
    {
      object (UdmValueCount)
    }
  ],
  "top_values": [
    {
      object (UdmValueCount)
    }
  ],
  "bottom_values": [
    {
      object (UdmValueCount)
    }
  ],
  "aggregation_type": enum (UdmFieldAggregationType)
}
Fields
field_name

string

baseline_event_count

integer

event_count

integer

too_many_values

boolean

value_count

integer

all_values[]

object (UdmValueCount)

top_values[]

object (UdmValueCount)

bottom_values[]

object (UdmValueCount)

aggregation_type

enum (UdmFieldAggregationType)

UdmValueCount

JSON representation
{
  "value": {
    object (UdmFieldValue)
  },
  "baseline_event_count": integer,
  "event_count": integer
}
Fields
value

object (UdmFieldValue)

baseline_event_count

integer

event_count

integer

UdmFieldValue

JSON representation
{

  // Union field value can be only one of the following:
  "string_value": string,
  "int32_value": integer,
  "uint32_value": integer,
  "int64_value": string,
  "uint64_value": string,
  "float_value": number,
  "double_value": number,
  "enum_value": string,
  "bool_value": boolean,
  "bytes_value": string,
  "is_null": boolean,
  "timestamp_value": string
  // End of list of possible types for union field value.
}
Fields

Union field value.

value can be only one of the following:

string_value

string

int32_value

integer

uint32_value

integer (uint32 format)

int64_value

string (int64 format)

uint64_value

string

float_value

number

double_value

number

enum_value

string

bool_value

boolean

bytes_value

string (bytes format)

A base64-encoded string.

is_null

boolean

timestamp_value

string (Timestamp format)

Uses RFC 3339, where generated output will always be Z-normalized and uses 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".

GroupAggregationByField

JSON representation
{
  "field_name": string,
  "field_value": {
    object (UdmFieldValue)
  },
  "fields": [
    {
      object (UdmFieldAggregation)
    }
  ],
  "baseline_event_count": integer,
  "event_count": integer,
  "value_count": integer
}
Fields
field_name

string

field_value

object (UdmFieldValue)

fields[]

object (UdmFieldAggregation)

baseline_event_count

integer

event_count

integer

value_count

integer

FunctionResponse

JSON representation
{
  "rows": [
    {
      object (FunctionResponseRow)
    }
  ],
  "too_many_rows": boolean
}
Fields
rows[]

object (FunctionResponseRow)

too_many_rows

boolean

FunctionResponseRow

JSON representation
{
  "values": [
    {
      object (UdmFieldValue)
    }
  ]
}
Fields
values[]

object (UdmFieldValue)

Stats

LINT.IfChange(stats_data) Stats results when the query is for statistics NEXT TAG = 6;

JSON representation
{
  "results": [
    {
      object (ColumnData)
    }
  ],
  "data_query_expression": string,
  "too_many_results": boolean,
  "total_results": integer,
  "sort_order": [
    {
      object (ColumnSort)
    }
  ]
}
Fields
results[]

object (ColumnData)

Result rows that are queried.

data_query_expression

string

Expression that represent the subset of the requested query used to filter data. The expression will be used to enable features such as drill-down from stats results to UDM events. In that case, the new query will be composed by this expression and the expression related to a stats result.

too_many_results

boolean

If true, there are too many results to return and some have been omitted.

total_results

integer

The total number of results returned.

sort_order[]

object (ColumnSort)

Indicates the columns used for sorting and the order in which they are sorted. If no ORDER section is specified in the query, this will be empty.

ColumnData

Represents a single column in the set of columns returned as the stats query result.

JSON representation
{
  "column": string,
  "values": [
    {
      object (ColumnType)
    }
  ],
  "filterable": boolean,
  "filter_expression": string
}
Fields
column

string

Used to store column names.

values[]

object (ColumnType)

To store store column data.

filterable

boolean

To identify if the column can be used for filtering/drill-downs.

filter_expression

string

Expression used to compose a query for filtering/drill-downs related to the data in this column.

ColumnType

Singular vs list of values in a column.

JSON representation
{

  // Union field type can be only one of the following:
  "value": {
    object (ColumnValue)
  },
  "list": {
    object (List)
  }
  // End of list of possible types for union field type.
}
Fields
Union field type. Store single value or list of values in a column. type can be only one of the following:
value

object (ColumnValue)

Single value in a column.

list

object (List)

List of values in a column e.g. IPs

ColumnValue

Value of the column based on data type

JSON representation
{

  // Union field value can be only one of the following:
  "null_val": boolean,
  "bool_val": boolean,
  "bytes_val": string,
  "double_val": number,
  "int64_val": string,
  "uint64_val": string,
  "string_val": string,
  "timestamp_val": string,
  "date_val": {
    object (Date)
  },
  "proto_val": {
    "@type": string,
    field1: ...,
    ...
  }
  // End of list of possible types for union field value.
}
Fields
Union field value. Value of the column based on data type value can be only one of the following:
null_val

boolean

True if the value is NULL.

bool_val

boolean

Boolean value.

bytes_val

string (bytes format)

Bytes value.

A base64-encoded string.

double_val

number

Double value.

int64_val

string (int64 format)

Integer value (signed).

uint64_val

string

Un-signed integer value.

string_val

string

String value. Enum values are returned as strings.

timestamp_val

string (Timestamp format)

Timestamp values.

Uses RFC 3339, where generated output will always be Z-normalized and uses 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".

date_val

object (Date)

Date values.

proto_val

object

For any proto values that are not any of the above.

An object containing fields of an arbitrary type. An additional field "@type" contains a URI identifying the type. Example: { "id": 1234, "@type": "types.example.com/standard/id" }.

List

Store list of values in a column.

JSON representation
{
  "values": [
    {
      object (ColumnValue)
    }
  ]
}
Fields
values[]

object (ColumnValue)

List of values in one cell of the column.

ColumnSort

Contains the column name and which direction the column is sorted (ascending or descenging).

JSON representation
{
  "name": string,
  "descending": boolean
}
Fields
name

string

Name of the column.

descending

boolean

Whether the column is sorted in descending order (ascending by default);

EventCountTimeline

JSON representation
{
  "buckets": [
    {
      object (EventCountTimelineBucket)
    }
  ],
  "size_of_bucket_ms": string
}
Fields
buckets[]

object (EventCountTimelineBucket)

size_of_bucket_ms

string (int64 format)

EventCountTimelineBucket

JSON representation
{
  "baseline_event_count": integer,
  "event_count": integer,
  "baseline_alert_count": integer,
  "alert_count": integer,
  "baseline_timed_entity_count": integer,
  "filtered_timed_entity_count": integer,
  "entity_changed_count": {
    object (EntityChangedCountTimelineBucket)
  }
}
Fields
baseline_event_count

integer

event_count

integer

baseline_alert_count

integer

alert_count

integer

baseline_timed_entity_count

integer

filtered_timed_entity_count

integer

entity_changed_count

object (EntityChangedCountTimelineBucket)

EntityChangedCountTimelineBucket

JSON representation
{
  "total_changed_entities_count": integer,
  "entity_changed_info": [
    {
      object (EntityChangedInfo)
    }
  ]
}
Fields
total_changed_entities_count

integer

entity_changed_info[]

object (EntityChangedInfo)

EntityChangedInfo

JSON representation
{
  "artifacts": {
    object (FieldAndValue)
  },
  "entity_count": integer
}
Fields
artifacts

object (FieldAndValue)

entity_count

integer

FieldAndValue

JSON representation
{
  "value": string,
  "entity_namespace": string,

  // Union field type can be only one of the following:
  "field_path": string,
  "kvalue_type": enum (KValueType)
  // End of list of possible types for union field type.
}
Fields
value

string

entity_namespace

string

Union field type.

type can be only one of the following:

field_path

string

kvalue_type

enum (KValueType)

InstanceUdmSearchResponse

JSON representation
{
  "progress": number,
  "too_many_events": boolean,
  "complete": boolean,
  "baseline_events_count": integer,
  "filtered_events_count": integer,
  "instance_id": string,
  "timeline": {
    object (EventCountTimeline)
  },
  "detections": {
    object (Detections)
  },
  "prevalence": {
    object (UdmPrevalenceResponse)
  },
  "runtime_errors": {
    object (RuntimeError)
  }
}
Fields
progress

number

too_many_events

boolean

complete

boolean

baseline_events_count

integer

filtered_events_count

integer

instance_id

string

timeline

object (EventCountTimeline)

detections

object (Detections)

prevalence

object (UdmPrevalenceResponse)

runtime_errors

object (RuntimeError)

Detections

JSON representation
{
  "detections": [
    {
      object (Collection)
    }
  ],
  "complete": boolean,
  "too_many_detections": boolean,
  "valid_snapshot_query": boolean,
  "baseline_alerts_count": integer,
  "filtered_alerts_count": integer,
  "detection_field_aggregations": {
    object (AlertFieldAggregations)
  }
}
Fields
detections[]

object (Collection)

complete

boolean

too_many_detections

boolean

valid_snapshot_query

boolean

baseline_alerts_count

integer

filtered_alerts_count

integer

detection_field_aggregations

object (AlertFieldAggregations)

AlertFieldAggregations

JSON representation
{
  "fields": [
    {
      object (AlertFieldAggregation)
    }
  ]
}
Fields
fields[]

object (AlertFieldAggregation)

AlertFieldAggregation

JSON representation
{
  "field_name": string,
  "baseline_alert_count": integer,
  "alert_count": integer,
  "too_many_values": boolean,
  "value_count": integer,
  "all_values": [
    {
      object (AlertFieldValueCount)
    }
  ],
  "top_values": [
    {
      object (AlertFieldValueCount)
    }
  ],
  "bottom_values": [
    {
      object (AlertFieldValueCount)
    }
  ]
}
Fields
field_name

string

baseline_alert_count

integer

alert_count

integer

too_many_values

boolean

value_count

integer

all_values[]

object (AlertFieldValueCount)

top_values[]

object (AlertFieldValueCount)

bottom_values[]

object (AlertFieldValueCount)

AlertFieldValueCount

JSON representation
{
  "value": {
    object (AlertFieldValue)
  },
  "baseline_alert_count": integer,
  "alert_count": integer
}
Fields
value

object (AlertFieldValue)

baseline_alert_count

integer

alert_count

integer

AlertFieldValue

JSON representation
{

  // Union field value can be only one of the following:
  "string_value": string,
  "int32_value": integer,
  "uint32_value": integer,
  "int64_value": string,
  "uint64_value": string,
  "float_value": number,
  "double_value": number,
  "enum_value": string,
  "bool_value": boolean,
  "bytes_value": string
  // End of list of possible types for union field value.
}
Fields

Union field value.

value can be only one of the following:

string_value

string

int32_value

integer

uint32_value

integer (uint32 format)

int64_value

string (int64 format)

uint64_value

string

float_value

number

double_value

number

enum_value

string

bool_value

boolean

bytes_value

string (bytes format)

A base64-encoded string.

UdmPrevalenceResponse

JSON representation
{
  "buckets": [
    {
      object (UdmPrevalenceBucket)
    }
  ],
  "partial_prevalence": boolean
}
Fields
buckets[]

object (UdmPrevalenceBucket)

partial_prevalence

boolean

UdmPrevalenceBucket

JSON representation
{
  "prevalence": [
    {
      object (UdmPrevalence)
    }
  ]
}
Fields
prevalence[]

object (UdmPrevalence)

UdmPrevalence

JSON representation
{
  "artifacts": [
    {
      object (FieldAndValue)
    }
  ],
  "prevalence": integer
}
Fields
artifacts[]

object (FieldAndValue)

prevalence

integer