An Entity provides additional context about an entity in a UDM event (asset, user, etc.). For example, a PROCESS_LAUNCH event describes that user 'abc@example.corp' launched process 'shady.exe'. The event does not include information that user 'abc@example.com' is a recently terminated employee who administers a server storing finance data. Information stored in one or more Entities can add this additional context.
| JSON representation |
|---|
{ "name" : string , "metadata" : { object ( |
| Fields | |
|---|---|
name
|
The resource name of the entity. Format: |
metadata
|
Entity metadata such as timestamp, product, etc. |
entity
|
Noun in the UDM event that this entity represents. |
additional
|
Important entity data that cannot be adequately represented within the formal sections of the Entity. |
riskScore
|
Represents the entity risk scores resource |
metric
|
Metric details of the entity. Used if EntityType is METRIC. |
relations[]
|
One or more relationships between the entity (a) and other entities, including the relationship type and related entity. |
