Package com.google.cloud.chronicle.v1

Interface RuleOrBuilder

All Superinterfaces:
com.google.protobuf.MessageLiteOrBuilder, com.google.protobuf.MessageOrBuilder
All Known Implementing Classes:
Rule, Rule.Builder
@Generated public interface RuleOrBuilder extends com.google.protobuf.MessageOrBuilder

  • Method Details

    • getName

      String getName()
       Identifier. Full resource name for the rule.
 Format:
 `projects/{project}/locations/{location}/instances/{instance}/rules/{rule}`
      string name = 1 [(.google.api.field_behavior) = IDENTIFIER];
      Returns:
      The name.

    • getNameBytes

      com.google.protobuf.ByteString getNameBytes()
       Identifier. Full resource name for the rule.
 Format:
 `projects/{project}/locations/{location}/instances/{instance}/rules/{rule}`
      string name = 1 [(.google.api.field_behavior) = IDENTIFIER];
      Returns:
      The bytes for name.

    • getRevisionId

      String getRevisionId()
       Output only. The revision ID of the rule.
 A new revision is created whenever the rule text is changed in any way.
 Format: `v_{10 digits}_{9 digits}`
 Populated in REVISION_METADATA_ONLY view and FULL view.
      string revision_id = 2 [(.google.api.field_behavior) = OUTPUT_ONLY];
      Returns:
      The revisionId.

    • getRevisionIdBytes

      com.google.protobuf.ByteString getRevisionIdBytes()
       Output only. The revision ID of the rule.
 A new revision is created whenever the rule text is changed in any way.
 Format: `v_{10 digits}_{9 digits}`
 Populated in REVISION_METADATA_ONLY view and FULL view.
      string revision_id = 2 [(.google.api.field_behavior) = OUTPUT_ONLY];
      Returns:
      The bytes for revisionId.

    • getDisplayName

      String getDisplayName()
       Output only. Display name of the rule.
 Populated in BASIC view and FULL view.
      string display_name = 3 [(.google.api.field_behavior) = OUTPUT_ONLY];
      Returns:
      The displayName.

    • getDisplayNameBytes

      com.google.protobuf.ByteString getDisplayNameBytes()
       Output only. Display name of the rule.
 Populated in BASIC view and FULL view.
      string display_name = 3 [(.google.api.field_behavior) = OUTPUT_ONLY];
      Returns:
      The bytes for displayName.

    • getText

      String getText()
       The YARA-L content of the rule.
 Populated in FULL view.
      string text = 4;
      Returns:
      The text.

    • getTextBytes

      com.google.protobuf.ByteString getTextBytes()
       The YARA-L content of the rule.
 Populated in FULL view.
      string text = 4;
      Returns:
      The bytes for text.

    • getAuthor

      String getAuthor()
       Output only. The author of the rule. Extracted from the meta section of
 text. Populated in BASIC view and FULL view.
      string author = 5 [(.google.api.field_behavior) = OUTPUT_ONLY];
      Returns:
      The author.

    • getAuthorBytes

      com.google.protobuf.ByteString getAuthorBytes()
       Output only. The author of the rule. Extracted from the meta section of
 text. Populated in BASIC view and FULL view.
      string author = 5 [(.google.api.field_behavior) = OUTPUT_ONLY];
      Returns:
      The bytes for author.

    • hasSeverity

      boolean hasSeverity()
       Output only. The severity of the rule as specified in the meta section of
 text. Populated in BASIC view and FULL view.
      .google.cloud.chronicle.v1.Severity severity = 6 [(.google.api.field_behavior) = OUTPUT_ONLY];
      Returns:
      Whether the severity field is set.

    • getSeverity

      Severity getSeverity()
       Output only. The severity of the rule as specified in the meta section of
 text. Populated in BASIC view and FULL view.
      .google.cloud.chronicle.v1.Severity severity = 6 [(.google.api.field_behavior) = OUTPUT_ONLY];
      Returns:
      The severity.

    • getSeverityOrBuilder

      SeverityOrBuilder getSeverityOrBuilder()
       Output only. The severity of the rule as specified in the meta section of
 text. Populated in BASIC view and FULL view.
      .google.cloud.chronicle.v1.Severity severity = 6 [(.google.api.field_behavior) = OUTPUT_ONLY];

    • getMetadataCount

      int getMetadataCount()
       Output only. Additional metadata specified in the meta section of text.
 Populated in FULL view.
      map<string, string> metadata = 7 [(.google.api.field_behavior) = OUTPUT_ONLY];

    • containsMetadata

      boolean containsMetadata(String key)
       Output only. Additional metadata specified in the meta section of text.
 Populated in FULL view.
      map<string, string> metadata = 7 [(.google.api.field_behavior) = OUTPUT_ONLY];

    • getMetadata

      @Deprecated Map<String,String> getMetadata()
      Deprecated.
      Use getMetadataMap() instead.

    • getMetadataMap

      Map<String,String> getMetadataMap()
       Output only. Additional metadata specified in the meta section of text.
 Populated in FULL view.
      map<string, string> metadata = 7 [(.google.api.field_behavior) = OUTPUT_ONLY];

    • getMetadataOrDefault

      String getMetadataOrDefault(String key, String defaultValue)
       Output only. Additional metadata specified in the meta section of text.
 Populated in FULL view.
      map<string, string> metadata = 7 [(.google.api.field_behavior) = OUTPUT_ONLY];

    • getMetadataOrThrow

      String getMetadataOrThrow(String key)
       Output only. Additional metadata specified in the meta section of text.
 Populated in FULL view.
      map<string, string> metadata = 7 [(.google.api.field_behavior) = OUTPUT_ONLY];

    • hasCreateTime

      boolean hasCreateTime()
       Output only. The timestamp of when the rule was created.
 Populated in FULL view.
      .google.protobuf.Timestamp create_time = 8 [(.google.api.field_behavior) = OUTPUT_ONLY];
      Returns:
      Whether the createTime field is set.

    • getCreateTime

      com.google.protobuf.Timestamp getCreateTime()
       Output only. The timestamp of when the rule was created.
 Populated in FULL view.
      .google.protobuf.Timestamp create_time = 8 [(.google.api.field_behavior) = OUTPUT_ONLY];
      Returns:
      The createTime.

    • getCreateTimeOrBuilder

      com.google.protobuf.TimestampOrBuilder getCreateTimeOrBuilder()
       Output only. The timestamp of when the rule was created.
 Populated in FULL view.
      .google.protobuf.Timestamp create_time = 8 [(.google.api.field_behavior) = OUTPUT_ONLY];

    • hasRevisionCreateTime

      boolean hasRevisionCreateTime()
       Output only. The timestamp of when the rule revision was created.
 Populated in FULL, REVISION_METADATA_ONLY views.
      .google.protobuf.Timestamp revision_create_time = 9 [(.google.api.field_behavior) = OUTPUT_ONLY];
      Returns:
      Whether the revisionCreateTime field is set.

    • getRevisionCreateTime

      com.google.protobuf.Timestamp getRevisionCreateTime()
       Output only. The timestamp of when the rule revision was created.
 Populated in FULL, REVISION_METADATA_ONLY views.
      .google.protobuf.Timestamp revision_create_time = 9 [(.google.api.field_behavior) = OUTPUT_ONLY];
      Returns:
      The revisionCreateTime.

    • getRevisionCreateTimeOrBuilder

      com.google.protobuf.TimestampOrBuilder getRevisionCreateTimeOrBuilder()
       Output only. The timestamp of when the rule revision was created.
 Populated in FULL, REVISION_METADATA_ONLY views.
      .google.protobuf.Timestamp revision_create_time = 9 [(.google.api.field_behavior) = OUTPUT_ONLY];

    • getCompilationStateValue

      int getCompilationStateValue()
       Output only. The current compilation state of the rule.
 Populated in FULL view.
      .google.cloud.chronicle.v1.Rule.CompilationState compilation_state = 10 [(.google.api.field_behavior) = OUTPUT_ONLY];
      Returns:
      The enum numeric value on the wire for compilationState.

    • getCompilationState

      Rule.CompilationState getCompilationState()
       Output only. The current compilation state of the rule.
 Populated in FULL view.
      .google.cloud.chronicle.v1.Rule.CompilationState compilation_state = 10 [(.google.api.field_behavior) = OUTPUT_ONLY];
      Returns:
      The compilationState.

    • getTypeValue

      int getTypeValue()
       Output only. User-facing type of the rule. Extracted from the events
 section of rule text. Populated in BASIC view and FULL view.
      .google.cloud.chronicle.v1.RuleType type = 12 [(.google.api.field_behavior) = OUTPUT_ONLY];
      Returns:
      The enum numeric value on the wire for type.

    • getType

      RuleType getType()
       Output only. User-facing type of the rule. Extracted from the events
 section of rule text. Populated in BASIC view and FULL view.
      .google.cloud.chronicle.v1.RuleType type = 12 [(.google.api.field_behavior) = OUTPUT_ONLY];
      Returns:
      The type.

    • getReferenceListsList

      List<String> getReferenceListsList()
       Output only. Resource names of the reference lists used in this rule.
 Populated in FULL view.
      repeated string reference_lists = 13 [(.google.api.field_behavior) = OUTPUT_ONLY, (.google.api.resource_reference) = { ... }
      Returns:
      A list containing the referenceLists.

    • getReferenceListsCount

      int getReferenceListsCount()
       Output only. Resource names of the reference lists used in this rule.
 Populated in FULL view.
      repeated string reference_lists = 13 [(.google.api.field_behavior) = OUTPUT_ONLY, (.google.api.resource_reference) = { ... }
      Returns:
      The count of referenceLists.

    • getReferenceLists

      String getReferenceLists(int index)
       Output only. Resource names of the reference lists used in this rule.
 Populated in FULL view.
      repeated string reference_lists = 13 [(.google.api.field_behavior) = OUTPUT_ONLY, (.google.api.resource_reference) = { ... }
      Parameters:
      index - The index of the element to return.
      Returns:
      The referenceLists at the given index.

    • getReferenceListsBytes

      com.google.protobuf.ByteString getReferenceListsBytes(int index)
       Output only. Resource names of the reference lists used in this rule.
 Populated in FULL view.
      repeated string reference_lists = 13 [(.google.api.field_behavior) = OUTPUT_ONLY, (.google.api.resource_reference) = { ... }
      Parameters:
      index - The index of the value to return.
      Returns:
      The bytes of the referenceLists at the given index.

    • getAllowedRunFrequenciesList

      List<RunFrequency> getAllowedRunFrequenciesList()
       Output only. The run frequencies that are allowed for the rule.
 Populated in BASIC view and FULL view.
      repeated .google.cloud.chronicle.v1.RunFrequency allowed_run_frequencies = 14 [(.google.api.field_behavior) = OUTPUT_ONLY];
      Returns:
      A list containing the allowedRunFrequencies.

    • getAllowedRunFrequenciesCount

      int getAllowedRunFrequenciesCount()
       Output only. The run frequencies that are allowed for the rule.
 Populated in BASIC view and FULL view.
      repeated .google.cloud.chronicle.v1.RunFrequency allowed_run_frequencies = 14 [(.google.api.field_behavior) = OUTPUT_ONLY];
      Returns:
      The count of allowedRunFrequencies.

    • getAllowedRunFrequencies

      RunFrequency getAllowedRunFrequencies(int index)
       Output only. The run frequencies that are allowed for the rule.
 Populated in BASIC view and FULL view.
      repeated .google.cloud.chronicle.v1.RunFrequency allowed_run_frequencies = 14 [(.google.api.field_behavior) = OUTPUT_ONLY];
      Parameters:
      index - The index of the element to return.
      Returns:
      The allowedRunFrequencies at the given index.

    • getAllowedRunFrequenciesValueList

      List<Integer> getAllowedRunFrequenciesValueList()
       Output only. The run frequencies that are allowed for the rule.
 Populated in BASIC view and FULL view.
      repeated .google.cloud.chronicle.v1.RunFrequency allowed_run_frequencies = 14 [(.google.api.field_behavior) = OUTPUT_ONLY];
      Returns:
      A list containing the enum numeric values on the wire for allowedRunFrequencies.

    • getAllowedRunFrequenciesValue

      int getAllowedRunFrequenciesValue(int index)
       Output only. The run frequencies that are allowed for the rule.
 Populated in BASIC view and FULL view.
      repeated .google.cloud.chronicle.v1.RunFrequency allowed_run_frequencies = 14 [(.google.api.field_behavior) = OUTPUT_ONLY];
      Parameters:
      index - The index of the value to return.
      Returns:
      The enum numeric value on the wire of allowedRunFrequencies at the given index.

    • getEtag

      String getEtag()
       The etag for this rule.
 If this is provided on update, the request will succeed if and only if it
 matches the server-computed value, and will fail with an ABORTED error
 otherwise.
 Populated in BASIC view and FULL view.
      string etag = 15;
      Returns:
      The etag.

    • getEtagBytes

      com.google.protobuf.ByteString getEtagBytes()
       The etag for this rule.
 If this is provided on update, the request will succeed if and only if it
 matches the server-computed value, and will fail with an ABORTED error
 otherwise.
 Populated in BASIC view and FULL view.
      string etag = 15;
      Returns:
      The bytes for etag.

    • getScope

      String getScope()
       Resource name of the DataAccessScope bound to this rule.
 Populated in BASIC view and FULL view.
 If reference lists are used in the rule, validations will be performed
 against this scope to ensure that the reference lists are compatible with
 both the user's and the rule's scopes.
 The scope should be in the format:
 `projects/{project}/locations/{location}/instances/{instance}/dataAccessScopes/{scope}`.
      string scope = 16 [(.google.api.resource_reference) = { ... }
      Returns:
      The scope.

    • getScopeBytes

      com.google.protobuf.ByteString getScopeBytes()
       Resource name of the DataAccessScope bound to this rule.
 Populated in BASIC view and FULL view.
 If reference lists are used in the rule, validations will be performed
 against this scope to ensure that the reference lists are compatible with
 both the user's and the rule's scopes.
 The scope should be in the format:
 `projects/{project}/locations/{location}/instances/{instance}/dataAccessScopes/{scope}`.
      string scope = 16 [(.google.api.resource_reference) = { ... }
      Returns:
      The bytes for scope.

    • getCompilationDiagnosticsList

      List<CompilationDiagnostic> getCompilationDiagnosticsList()
       Output only. A list of a rule's corresponding compilation diagnostic
 messages such as compilation errors and compilation warnings. Populated in
 FULL view.
      repeated .google.cloud.chronicle.v1.CompilationDiagnostic compilation_diagnostics = 17 [(.google.api.field_behavior) = OUTPUT_ONLY];

    • getCompilationDiagnostics

      CompilationDiagnostic getCompilationDiagnostics(int index)
       Output only. A list of a rule's corresponding compilation diagnostic
 messages such as compilation errors and compilation warnings. Populated in
 FULL view.
      repeated .google.cloud.chronicle.v1.CompilationDiagnostic compilation_diagnostics = 17 [(.google.api.field_behavior) = OUTPUT_ONLY];

    • getCompilationDiagnosticsCount

      int getCompilationDiagnosticsCount()
       Output only. A list of a rule's corresponding compilation diagnostic
 messages such as compilation errors and compilation warnings. Populated in
 FULL view.
      repeated .google.cloud.chronicle.v1.CompilationDiagnostic compilation_diagnostics = 17 [(.google.api.field_behavior) = OUTPUT_ONLY];

    • getCompilationDiagnosticsOrBuilderList

      List<? extends CompilationDiagnosticOrBuilder> getCompilationDiagnosticsOrBuilderList()
       Output only. A list of a rule's corresponding compilation diagnostic
 messages such as compilation errors and compilation warnings. Populated in
 FULL view.
      repeated .google.cloud.chronicle.v1.CompilationDiagnostic compilation_diagnostics = 17 [(.google.api.field_behavior) = OUTPUT_ONLY];

    • getCompilationDiagnosticsOrBuilder

      CompilationDiagnosticOrBuilder getCompilationDiagnosticsOrBuilder(int index)
       Output only. A list of a rule's corresponding compilation diagnostic
 messages such as compilation errors and compilation warnings. Populated in
 FULL view.
      repeated .google.cloud.chronicle.v1.CompilationDiagnostic compilation_diagnostics = 17 [(.google.api.field_behavior) = OUTPUT_ONLY];

    • getNearRealTimeLiveRuleEligible

      boolean getNearRealTimeLiveRuleEligible()
       Output only. Indicate the rule can run in near real time live rule.
 If this is true, the rule uses the near real time live rule when the run
 frequency is set to LIVE.
      bool near_real_time_live_rule_eligible = 18 [(.google.api.field_behavior) = OUTPUT_ONLY];
      Returns:
      The nearRealTimeLiveRuleEligible.

    • hasInputsUsed

      boolean hasInputsUsed()
       Output only. The set of inputs used in the rule. For example, if the rule
 uses $e.principal.hostname, then the uses_udm field will be true.
      .google.cloud.chronicle.v1.InputsUsed inputs_used = 20 [(.google.api.field_behavior) = OUTPUT_ONLY];
      Returns:
      Whether the inputsUsed field is set.

    • getInputsUsed

      InputsUsed getInputsUsed()
       Output only. The set of inputs used in the rule. For example, if the rule
 uses $e.principal.hostname, then the uses_udm field will be true.
      .google.cloud.chronicle.v1.InputsUsed inputs_used = 20 [(.google.api.field_behavior) = OUTPUT_ONLY];
      Returns:
      The inputsUsed.

    • getInputsUsedOrBuilder

      InputsUsedOrBuilder getInputsUsedOrBuilder()
       Output only. The set of inputs used in the rule. For example, if the rule
 uses $e.principal.hostname, then the uses_udm field will be true.
      .google.cloud.chronicle.v1.InputsUsed inputs_used = 20 [(.google.api.field_behavior) = OUTPUT_ONLY];