Console
    Contact Us Start free

    EntityRisk

    Stores information related to the risk score of an entity. Next ID: 15

    JSON representation 
     { 
 "risk_version" 
 : 
 string 
 , 
 "risk_window" 
 : 
 { 
 object (  Interval 
 
) 
 } 
 , 
 "DEPRECATED_risk_score" 
 : 
 integer 
 , 
 "detections_count" 
 : 
 integer 
 , 
 "first_detection_time" 
 : 
 string 
 , 
 "last_detection_time" 
 : 
 string 
 , 
 "risk_score" 
 : 
 number 
 , 
 "normalized_risk_score" 
 : 
 integer 
 , 
 "risk_window_size" 
 : 
 string 
 , 
 "last_reset_time" 
 : 
 string 
 , 
 "detail_uri" 
 : 
 string 
 , 
 "risk_window_has_new_detections" 
 : 
 boolean 
 , 
 "risk_delta" 
 : 
 { 
 object (  RiskDelta 
 
) 
 } 
 , 
 "raw_risk_delta" 
 : 
 { 
 object (  RiskDelta 
 
) 
 } 
 }
    Fields
    risk_version

    string

    Version of the risk score calculation algorithm.
    risk_window

    object ( Interval )

    Time window used when computing the risk score for an entity, for example 24 hours or 7 days.
    DEPRECATED_risk_score
    (deprecated)

    integer

    Deprecated risk score.
    detections_count

    integer

    Number of detections that make up the risk score within the time window.
    first_detection_time

    string ( Timestamp format)

    Timestamp of the first detection within the specified time window. This field is empty when there are no detections.

    Uses RFC 3339, where generated output will always be Z-normalized and uses 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z" , "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30" .
    last_detection_time

    string ( Timestamp format)

    Timestamp of the last detection within the specified time window. This field is empty when there are no detections.

    Uses RFC 3339, where generated output will always be Z-normalized and uses 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z" , "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30" .
    risk_score

    number

    Raw risk score for the entity.
    normalized_risk_score

    integer

    Normalized risk score for the entity. This value is between 0-1000.
    risk_window_size

    string ( Duration format)

    Risk window duration for the entity.

    A duration in seconds with up to nine fractional digits, ending with ' s '. Example: "3.5s" .
    last_reset_time

    string ( Timestamp format)

    Timestamp for UEBA risk score reset based deduplication. Used specifically for risk based meta rules.

    Uses RFC 3339, where generated output will always be Z-normalized and uses 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z" , "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30" .
    detail_uri

    string

    Link to the Google Security Operations UI with information about the entity risk score. If the SecOps instance has multiple frontend paths configured, this will be a relative path that can be used to construct the full URL.
    risk_window_has_new_detections

    boolean

    Whether there are new detections for the risk window.
    risk_delta

    object ( RiskDelta )

    Represents the change in risk score for an entity between the end of the previous time window and the end of the current time window.
    raw_risk_delta

    object ( RiskDelta )

    Represents the change in raw risk score for an entity between the end of the previous time window and the end of the current time window.

    RiskDelta

    Describes the difference in risk score between two points in time.

    JSON representation 
     { 
 "previous_range_end_time" 
 : 
 string 
 , 
 "risk_score_delta" 
 : 
 integer 
 , 
 "previous_risk_score" 
 : 
 integer 
 , 
 "risk_score_numeric_delta" 
 : 
 integer 
 }
    Fields
    previous_range_end_time

    string ( Timestamp format)

    End time of the previous time window.

    Uses RFC 3339, where generated output will always be Z-normalized and uses 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z" , "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30" .
    risk_score_delta

    integer

    Difference in the normalized risk score from the previous recorded value.
    previous_risk_score

    integer

    Risk score from previous risk window
    risk_score_numeric_delta

    integer

    Numeric change between current and previous risk score
    Design a Mobile Site
    View Site in Mobile | Classic
    Share by: