Console
    Contact Us Start free

    YaraL2Detection

    JSON representation 
     { 
 "id" 
 : 
 string 
 , 
 "ruleType" 
 : 
 enum (  RuleType 
 
) 
 , 
 "fields" 
 : 
 [ 
 { 
 object (  Value 
 
) 
 } 
 ] 
 , 
 "outcomes" 
 : 
 [ 
 { 
 object (  Value 
 
) 
 } 
 ] 
 , 
 "timeWindow" 
 : 
 { 
 object (  Interval 
 
) 
 } 
 , 
 "resultEvents" 
 : 
 { 
 string 
 : 
 { 
 object (  EventSampleList 
 
) 
 } 
 , 
 ... 
 } 
 , 
 "resultEntityEvents" 
 : 
 { 
 string 
 : 
 { 
 object (  EventSampleList 
 
) 
 } 
 , 
 ... 
 } 
 , 
 "detectionTimestamp" 
 : 
 string 
 , 
 "commitTimestamp" 
 : 
 string 
 , 
 "alertingType" 
 : 
 enum (  AlertingType 
 
) 
 }
    Fields
    id

    string

    ruleType

    enum ( RuleType )

    fields[]

    object ( Value )

    outcomes[]

    object ( Value )

    timeWindow

    object ( Interval )

    resultEvents

    map (key: string, value: object ( EventSampleList ))

    An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" } .
    resultEntityEvents

    map (key: string, value: object ( EventSampleList ))

    An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" } .
    detectionTimestamp

    string ( Timestamp format)

    Uses RFC 3339, where generated output will always be Z-normalized and uses 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z" , "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30" .
    commitTimestamp

    string ( Timestamp format)

    Uses RFC 3339, where generated output will always be Z-normalized and uses 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z" , "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30" .
    alertingType

    enum ( AlertingType )

    RuleType

    Enums
    UNKNOWN
    SINGLE_EVENT
    MULTI_EVENT
    WINDOWED_SINGLE_EVENT

    Value

    JSON representation 
     { 
 "name" 
 : 
 string 
 , 
 "fieldPath" 
 : 
 string 
 , 
 // Union field value 
can be only one of the following: 
 "boolVal" 
 : 
 boolean 
 , 
 "bytesVal" 
 : 
 string 
 , 
 "doubleVal" 
 : 
 number 
 , 
 "int64Val" 
 : 
 string 
 , 
 "uint64Val" 
 : 
 string 
 , 
 "stringVal" 
 : 
 string 
 , 
 "nullVal" 
 : 
 boolean 
 , 
 "boolList" 
 : 
 { 
 object (  BoolList 
 
) 
 } 
 , 
 "bytesList" 
 : 
 { 
 object (  BytesList 
 
) 
 } 
 , 
 "doubleList" 
 : 
 { 
 object (  DoubleList 
 
) 
 } 
 , 
 "int64List" 
 : 
 { 
 object (  Int64List 
 
) 
 } 
 , 
 "uint64List" 
 : 
 { 
 object (  Uint64List 
 
) 
 } 
 , 
 "stringList" 
 : 
 { 
 object (  StringList 
 
) 
 } 
 , 
 "boolSeq" 
 : 
 { 
 object (  BoolSequence 
 
) 
 } 
 , 
 "bytesSeq" 
 : 
 { 
 object (  BytesSequence 
 
) 
 } 
 , 
 "doubleSeq" 
 : 
 { 
 object (  DoubleSequence 
 
) 
 } 
 , 
 "int64Seq" 
 : 
 { 
 object (  Int64Sequence 
 
) 
 } 
 , 
 "uint64Seq" 
 : 
 { 
 object (  Uint64Sequence 
 
) 
 } 
 , 
 "stringSeq" 
 : 
 { 
 object (  StringSequence 
 
) 
 } 
 , 
 "timestampVal" 
 : 
 string 
 // End of list of possible types for union field value 
. 
 }
    Fields
    name

    string

    fieldPath

    string

    Union field value .

    value can be only one of the following:

    boolVal

    boolean

    bytesVal

    string ( bytes format)

    A base64-encoded string.

    doubleVal

    number

    int64Val

    string ( int64 format)

    uint64Val

    string

    stringVal

    string

    nullVal

    boolean

    boolList
    (deprecated)

    object ( BoolList )

    bytesList
    (deprecated)

    object ( BytesList )

    doubleList
    (deprecated)

    object ( DoubleList )

    int64List
    (deprecated)

    object ( Int64List )

    uint64List
    (deprecated)

    object ( Uint64List )

    stringList
    (deprecated)

    object ( StringList )

    boolSeq

    object ( BoolSequence )

    bytesSeq

    object ( BytesSequence )

    doubleSeq

    object ( DoubleSequence )

    int64Seq

    object ( Int64Sequence )

    uint64Seq

    object ( Uint64Sequence )

    stringSeq

    object ( StringSequence )

    timestampVal

    string ( Timestamp format)

    Uses RFC 3339, where generated output will always be Z-normalized and uses 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z" , "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30" .

    BoolList

    JSON representation 
     { 
 "boolVals" 
 : 
 [ 
 boolean 
 ] 
 }
    Fields
    boolVals[]

    boolean

    BytesList

    JSON representation 
     { 
 "bytesVals" 
 : 
 [ 
 string 
 ] 
 }
    Fields
    bytesVals[]

    string ( bytes format)

    A base64-encoded string.

    DoubleList

    JSON representation 
     { 
 "doubleVals" 
 : 
 [ 
 number 
 ] 
 }
    Fields
    doubleVals[]

    number

    Int64List

    JSON representation 
     { 
 "int64Vals" 
 : 
 [ 
 string 
 ] 
 }
    Fields
    int64Vals[]

    string ( int64 format)

    Uint64List

    JSON representation 
     { 
 "uint64Vals" 
 : 
 [ 
 string 
 ] 
 }
    Fields
    uint64Vals[]

    string

    StringList

    JSON representation 
     { 
 "stringVals" 
 : 
 [ 
 string 
 ] 
 }
    Fields
    stringVals[]

    string

    EventSampleList

    JSON representation 
     { 
 "eventSamples" 
 : 
 [ 
 { 
 object (  EventSample 
 
) 
 } 
 ] 
 , 
 "tooManyEventSamples" 
 : 
 boolean 
 }
    Fields
    eventSamples[]

    object ( EventSample )

    tooManyEventSamples

    boolean

    EventSample

    JSON representation 
     { 
 "rawLogToken" 
 : 
 string 
 , 
 "joinedDataTableRows" 
 : 
 [ 
 { 
 object (  DataTableRowDetails 
 
) 
 } 
 ] 
 , 
 // Union field event_sample 
can be only one of the following: 
 "event" 
 : 
 { 
 object (  UDM 
 
) 
 } 
 , 
 "entity" 
 : 
 { 
 object (  Entity 
 
) 
 } 
 // End of list of possible types for union field event_sample 
. 
 }
    Fields
    rawLogToken

    string

    joinedDataTableRows[]

    object ( DataTableRowDetails )

    Union field event_sample .

    event_sample can be only one of the following:

    event

    object ( UDM )

    entity

    object ( Entity )

    AlertingType

    Enums
    UNSPECIFIED
    NOT_ALERTING
    ALERTING
    Create a Mobile Website
    View Site in Mobile | Classic
    Share by: