Metadata

General information associated with a UDM event.

JSON representation 
{
  "id": string,
  "productLogId": string,
  "eventTimestamp": string,
  "eventTimestampAttributes": [
    enum (EventTimestampAttribute)
  ],
  "collectedTimestamp": string,
  "ingestedTimestamp": string,
  "eventType": enum (EventType),
  "vendorName": string,
  "productName": string,
  "productVersion": string,
  "productEventType": string,
  "productDeploymentId": string,
  "description": string,
  "urlBackToProduct": string,
  "ingestionLabels": [
    {
      object (Label)
    }
  ],
  "tags": {
    object (Tags)
  },
  "enrichmentState": enum (EnrichmentState),
  "logType": string,
  "baseLabels": {
    object (DataAccessLabels)
  },
  "enrichmentLabels": {
    object (DataAccessLabels)
  },
  "structuredFields": {
    object
  },
  "parserVersion": string
}
Fields
id

string (bytes format)

ID of the UDM event. Can be used for raw and normalized event retrieval.

A base64-encoded string.
productLogId

string

A vendor-specific event identifier to uniquely identify the event (e.g. a GUID).
eventTimestamp

string (Timestamp format)

The GMT timestamp when the event was generated.

Uses RFC 3339, where generated output will always be Z-normalized and uses 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
eventTimestampAttributes[]

enum (EventTimestampAttribute)

Attributes associated with eventTimestamp. This field is used to distinguish between different types of timestamps that can be used to represent the eventTimestamp.
collectedTimestamp

string (Timestamp format)

The GMT timestamp when the event was collected by the vendor's local collection infrastructure.

Uses RFC 3339, where generated output will always be Z-normalized and uses 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
ingestedTimestamp

string (Timestamp format)

The GMT timestamp when the event was ingested (received) by Chronicle.

Uses RFC 3339, where generated output will always be Z-normalized and uses 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
eventType

enum (EventType)

The event type. If an event has multiple possible types, this specifies the most specific type.
vendorName

string

The name of the product vendor.
productName

string

The name of the product.
productVersion

string

The version of the product.
productEventType

string

A short, descriptive, human-readable, product-specific event name or type (e.g. "Scanned X", "User account created", "process_start").
productDeploymentId

string

The deployment identifier assigned by the vendor for a product deployment.
description

string

A human-readable unparsable description of the event.
urlBackToProduct

string

A URL that takes the user to the source product console for this event.
ingestionLabels[]

object (Label)

User-configured ingestion metadata labels.
tags

object (Tags)

Tags added by Chronicle after an event is parsed. It is an error to populate this field from within a parser.
enrichmentState

enum (EnrichmentState)

The enrichment state.
logType

string

The string value of log type.
baseLabels

object (DataAccessLabels)

Data access labels on the base event.
enrichmentLabels

object (DataAccessLabels)

Data access labels from all the contextual events used to enrich the base event.
structuredFields
(deprecated)

object (Struct format)

Flattened fields extracted from the log.
parserVersion

string

The version of the parser that generated this UDM event.

EventTimestampAttribute

Enum representing the type of timestamp that the eventTimestamp field represents.

Enums
EVENT_TIMESTAMP_ATTRIBUTE_UNSPECIFIED Default event timestamp attribute.
FILE_LAST_ACCESS_TIME

Deprecated. Use LAST_ACCESSED instead.
FILE_LAST_MODIFIED_TIME

Deprecated. Use LAST_MODIFIED instead.
FILE_METADATA_LAST_CHANGE_TIME

Deprecated. Use METADATA_LAST_CHANGED instead.
FILE_CREATION_TIME

Deprecated. Use CREATED instead.
COLLECTED_TIME

Deprecated. Use COLLECTED instead.
COLLECTED The time when the event was collected by the vendor's local collection infrastructure.
ACCESSED The time when the file was accessed.
CHANGED The time when the file was changed.
CREATED The time when the file was first created.
FILE_NAME_ACCESSED The time when the file name was accessed.
FILE_NAME_CHANGED The time when the file name was changed.
FILE_NAME_CREATED The time when the file name was created.
FILE_NAME_LAST_ACCESSED The time when the file name was last accessed.
FILE_NAME_LAST_MODIFIED The time when the file name was last modified.
FILE_NAME_METADATA_LAST_CHANGED The time when the file name metadata was last changed.
FILE_NAME_MODIFIED The time when the file name was modified.
LAST_ACCESSED The time when the file was last accessed.
LAST_MODIFIED The time when the file was last modified.
METADATA_LAST_CHANGED The time when the file metadata was last changed.
MODIFIED The time when the file was modified.

Tags

Tags are event metadata which is set by examining event contents post-parsing. For example, a UDM event may be assigned a tenantId based on certain customer-defined parameters.

JSON representation 
{
  "tenantId": [
    string
  ],
  "dataTapConfigName": [
    string
  ]
}
Fields
tenantId[]

string (bytes format)

A list of subtenant ids that this event belongs to.

A base64-encoded string.
dataTapConfigName[]

string

A list of sink name values defined in DataTap configurations.

EnrichmentState

An enrichment state.

Enums
ENRICHMENT_STATE_UNSPECIFIED Unspecified.
ENRICHED The event has been enriched by Chronicle.
UNENRICHED The event has not been enriched by Chronicle.

DataAccessLabels

JSON representation 
{
  "logTypes": [
    string
  ],
  "ingestionLabels": [
    string
  ],
  "namespaces": [
    string
  ],
  "customLabels": [
    string
  ],
  "ingestionKvLabels": [
    {
      object (DataAccessIngestionLabel)
    }
  ],
  "allowScopedAccess": boolean
}
Fields
logTypes[]

string

All the LogType labels.
ingestionLabels[]
(deprecated)

string

All the ingestion labels.
namespaces[]

string

All the namespaces.
customLabels[]

string

All the complex labels (UDM search syntax based).
ingestionKvLabels[]

object (DataAccessIngestionLabel)

All the ingestion labels (key/value pairs).
allowScopedAccess

boolean

Are the labels ready for scoped access

DataAccessIngestionLabel

JSON representation 
{
  "key": string,
  "value": string
}
Fields
key

string

The key.
value

string

The value.