Console
    Contact Us Start free

    Metadata

    General information associated with a UDM event.

    JSON representation 
     { 
 "id" 
 : 
 string 
 , 
 "productLogId" 
 : 
 string 
 , 
 "eventTimestamp" 
 : 
 string 
 , 
 "eventTimestampAttributes" 
 : 
 [ 
 enum (  EventTimestampAttribute 
 
) 
 ] 
 , 
 "collectedTimestamp" 
 : 
 string 
 , 
 "ingestedTimestamp" 
 : 
 string 
 , 
 "eventType" 
 : 
 enum (  EventType 
 
) 
 , 
 "vendorName" 
 : 
 string 
 , 
 "productName" 
 : 
 string 
 , 
 "productVersion" 
 : 
 string 
 , 
 "productEventType" 
 : 
 string 
 , 
 "productDeploymentId" 
 : 
 string 
 , 
 "description" 
 : 
 string 
 , 
 "urlBackToProduct" 
 : 
 string 
 , 
 "ingestionLabels" 
 : 
 [ 
 { 
 object (  Label 
 
) 
 } 
 ] 
 , 
 "tags" 
 : 
 { 
 object (  Tags 
 
) 
 } 
 , 
 "enrichmentState" 
 : 
 enum (  EnrichmentState 
 
) 
 , 
 "logType" 
 : 
 string 
 , 
 "baseLabels" 
 : 
 { 
 object (  DataAccessLabels 
 
) 
 } 
 , 
 "enrichmentLabels" 
 : 
 { 
 object (  DataAccessLabels 
 
) 
 } 
 , 
 "structuredFields" 
 : 
 { 
 object 
 } 
 , 
 "parserVersion" 
 : 
 string 
 }
    Fields
    id

    string ( bytes format)

    ID of the UDM event. Can be used for raw and normalized event retrieval.

    A base64-encoded string.
    productLogId

    string

    A vendor-specific event identifier to uniquely identify the event (e.g. a GUID).
    eventTimestamp

    string ( Timestamp format)

    The GMT timestamp when the event was generated.

    Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z" , "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30" .
    eventTimestampAttributes[]

    enum ( EventTimestampAttribute )

    Attributes associated with eventTimestamp. This field is used to distinguish between different types of timestamps that can be used to represent the eventTimestamp.
    collectedTimestamp

    string ( Timestamp format)

    The GMT timestamp when the event was collected by the vendor's local collection infrastructure.

    Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z" , "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30" .
    ingestedTimestamp

    string ( Timestamp format)

    The GMT timestamp when the event was ingested (received) by Chronicle.

    Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z" , "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30" .
    eventType

    enum ( EventType )

    The event type. If an event has multiple possible types, this specifies the most specific type.
    vendorName

    string

    The name of the product vendor.
    productName

    string

    The name of the product.
    productVersion

    string

    The version of the product.
    productEventType

    string

    A short, descriptive, human-readable, product-specific event name or type (e.g. "Scanned X", "User account created", "process_start").
    productDeploymentId

    string

    The deployment identifier assigned by the vendor for a product deployment.
    description

    string

    A human-readable unparsable description of the event.
    urlBackToProduct

    string

    A URL that takes the user to the source product console for this event.
    ingestionLabels[]

    object ( Label )

    User-configured ingestion metadata labels.
    tags

    object ( Tags )

    Tags added by Chronicle after an event is parsed. It is an error to populate this field from within a parser.
    enrichmentState

    enum ( EnrichmentState )

    The enrichment state.
    logType

    string

    The string value of log type.
    baseLabels

    object ( DataAccessLabels )

    Data access labels on the base event.
    enrichmentLabels

    object ( DataAccessLabels )

    Data access labels from all the contextual events used to enrich the base event.
    structuredFields
    (deprecated)

    object ( Struct format)

    Flattened fields extracted from the log.
    parserVersion

    string

    The version of the parser that generated this UDM event.

    EventTimestampAttribute

    Enum representing the type of timestamp that the eventTimestamp field represents.

    Enums
    EVENT_TIMESTAMP_ATTRIBUTE_UNSPECIFIED Default event timestamp attribute.
    FILE_LAST_ACCESS_TIME

    Deprecated. Use LAST_ACCESSED instead.
    FILE_LAST_MODIFIED_TIME

    Deprecated. Use LAST_MODIFIED instead.
    FILE_METADATA_LAST_CHANGE_TIME

    Deprecated. Use METADATA_LAST_CHANGED instead.
    FILE_CREATION_TIME

    Deprecated. Use CREATED instead.
    COLLECTED_TIME

    Deprecated. Use COLLECTED instead.
    COLLECTED The time when the event was collected by the vendor's local collection infrastructure.
    ACCESSED The time when the file was accessed.
    CHANGED The time when the file was changed.
    CREATED The time when the file was first created.
    FILE_NAME_ACCESSED The time when the file name was accessed.
    FILE_NAME_CHANGED The time when the file name was changed.
    FILE_NAME_CREATED The time when the file name was created.
    FILE_NAME_LAST_ACCESSED The time when the file name was last accessed.
    FILE_NAME_LAST_MODIFIED The time when the file name was last modified.
    FILE_NAME_METADATA_LAST_CHANGED The time when the file name metadata was last changed.
    FILE_NAME_MODIFIED The time when the file name was modified.
    LAST_ACCESSED The time when the file was last accessed.
    LAST_MODIFIED The time when the file was last modified.
    METADATA_LAST_CHANGED The time when the file metadata was last changed.
    MODIFIED The time when the file was modified.
    ADDED Added Timestamp.
    BACKED_UP Backed Up Timestamp.
    LAST_CONNECTED Last Connected timestamp.
    DELETED Deleted Timestamp.
    ENDED Ended Timestamp.
    EXITED Exited Timestamp.
    EXPIRED Expired Timestamp.
    FIRST_ACCESSED First Accessed Timestamp.
    APPEARED Appeared Timestamp.
    INSTALLED Installed Timestamp.
    LAST_ACTIVE Last Active Timestamp.
    LAST_LOGGED_IN Last Login Timestamp.
    LAST_PASSWORD_SET Last Password Set Timestamp.
    LAST_PRINTED Last Printed Timestamp.
    LAST_RESUMED Last Resumed Timestamp.
    LAST_EXECUTED Last Executed Timestamp.
    LAST_SEEN Last Seen Timestamp.
    LAST_SHUTDOWN Last Shutdown Timestamp.
    LAST_UPDATED Last Updated Timestamp.
    LAST_USED Last Used Timestamp.
    LAST_VISITED Last Visited Timestamp.
    LINKED Linked Timestamp.
    METADATA_MODIFIED Metadata Modified Timestamp.
    CONTENT_MODIFIED Modified Timestamp.
    PURCHASED Purchased Timestamp.
    RECORDED Recorded Timestamp.
    REQUEST_RECEIVED Request Received Timestamp.
    RESPONSE_SENT Response Sent Timestamp.
    SCHEDULED_TO_END Scheduled to End Timestamp.
    SCHEDULED_TO_START Scheduled to Start Timestamp.
    SENT Sent Timestamp.
    STARTED Started Timestamp.
    UPDATED Updated Timestamp.
    VALIDATED Validated Timestamp.
    MOST_RECENT_RUN Most Recent Run Timestamp.
    NEXT_RUN Next Run Timestamp.
    VISITED Visited Timestamp.
    TARGET_CREATED Target Created Timestamp.
    VOLUME_CREATED Volume Created Timestamp.
    POST_CHECKED Post Checked Timestamp.
    SYNCHRONIZED Synchronized Timestamp.
    ITEM_CREATED Item Created Timestamp.
    ITEM_MODIFIED Item Modified Timestamp.
    DOCUMENT_LAST_SAVED Document Last Saved Timestamp.
    LAST_REGISTERED Last Registered Timestamp.
    LAUNCHED Launched Timestamp.

    Tags

    Tags are event metadata which is set by examining event contents post-parsing. For example, a UDM event may be assigned a tenantId based on certain customer-defined parameters.

    JSON representation 
     { 
 "tenantId" 
 : 
 [ 
 string 
 ] 
 , 
 "dataTapConfigName" 
 : 
 [ 
 string 
 ] 
 }
    Fields
    tenantId[]

    string ( bytes format)

    A list of subtenant ids that this event belongs to.

    A base64-encoded string.
    dataTapConfigName[]

    string

    A list of sink name values defined in DataTap configurations.

    EnrichmentState

    An enrichment state.

    Enums
    ENRICHMENT_STATE_UNSPECIFIED Unspecified.
    ENRICHED The event has been enriched by Chronicle.
    UNENRICHED The event has not been enriched by Chronicle.

    DataAccessLabels

    JSON representation 
     { 
 "logTypes" 
 : 
 [ 
 string 
 ] 
 , 
 "ingestionLabels" 
 : 
 [ 
 string 
 ] 
 , 
 "namespaces" 
 : 
 [ 
 string 
 ] 
 , 
 "customLabels" 
 : 
 [ 
 string 
 ] 
 , 
 "ingestionKvLabels" 
 : 
 [ 
 { 
 object (  DataAccessIngestionLabel 
 
) 
 } 
 ] 
 , 
 "allowScopedAccess" 
 : 
 boolean 
 }
    Fields
    logTypes[]

    string

    All the LogType labels.
    ingestionLabels[]
    (deprecated)

    string

    All the ingestion labels.
    namespaces[]

    string

    All the namespaces.
    customLabels[]

    string

    All the complex labels (UDM search syntax based).
    ingestionKvLabels[]

    object ( DataAccessIngestionLabel )

    All the ingestion labels (key/value pairs).
    allowScopedAccess

    boolean

    Are the labels ready for scoped access

    DataAccessIngestionLabel

    JSON representation 
     { 
 "key" 
 : 
 string 
 , 
 "value" 
 : 
 string 
 }
    Fields
    key

    string

    The key.
    value

    string

    The value.
    Design a Mobile Site
    View Site in Mobile | Classic
    Share by: