diff --git a/google-backstory/lib/backstory/collection_pb.rb b/google-backstory/lib/backstory/collection_pb.rb
index 3fe9d93..0be5f59 100644
--- a/google-backstory/lib/backstory/collection_pb.rb
+++ b/google-backstory/lib/backstory/collection_pb.rb
@@ -13,7 +13,7 @@
 require 'google/type/interval_pb'
 
 
-descriptor_data = "\n\x1a\x62\x61\x63kstory/collection.proto\x12\x10google.backstory\x1a\x16\x62\x61\x63kstory/entity.proto\x1a\x12\x62\x61\x63kstory/id.proto\x1a\x13\x62\x61\x63kstory/udm.proto\x1a\x1egoogle/protobuf/duration.proto\x1a\x1cgoogle/protobuf/struct.proto\x1a\x1fgoogle/protobuf/timestamp.proto\x1a\x1agoogle/type/interval.proto\"\xc2\x0b\n\nCollection\x12\n\n\x02id\x18\x07 \x01(\t\x12\x39\n\x04type\x18\x01 \x01(\x0e\x32+.google.backstory.Collection.CollectionType\x12\x34\n\x0cid_namespace\x18\x0c \x01(\x0e\x32\x1e.google.backstory.Id.Namespace\x12\x30\n\x0c\x63reated_time\x18\x05 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x35\n\x11last_updated_time\x18\x06 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12*\n\x0btime_window\x18\x08 \x01(\x0b\x32\x15.google.type.Interval\x12\x36\n\x13\x63ollection_elements\x18\t \x03(\x0b\x32\x19.google.backstory.Element\x12\x33\n\tdetection\x18\x03 \x03(\x0b\x32 .google.backstory.SecurityResult\x12\x32\n\x0e\x64\x65tection_time\x18\n \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x36\n\rinvestigation\x18\x04 \x01(\x0b\x32\x1f.google.backstory.Investigation\x12\x0c\n\x04tags\x18\x0b \x03(\t\x12\x46\n\x16response_platform_info\x18\r \x01(\x0b\x32&.google.backstory.ResponsePlatformInfo\x12\x11\n\tcase_name\x18\x0e \x01(\t\x12\x12\n\nsoar_alert\x18\x11 \x01(\x08\x12@\n\x13soar_alert_metadata\x18\x12 \x01(\x0b\x32#.google.backstory.SoarAlertMetadata\x12\x19\n\x11\x64\x61ta_access_scope\x18\x13 \x01(\t\x12U\n\x18\x64\x65tection_timing_details\x18\x14 \x03(\x0e\x32\x33.google.backstory.Collection.DetectionTimingDetails\x12\x39\n\x0flatency_metrics\x18\x15 \x01(\x0b\x32 .google.backstory.LatencyMetrics\x12\x45\n\x12rule_run_frequency\x18\x16 \x01(\x0e\x32).google.backstory.Collection.RunFrequency\x12\x1d\n\x15simulated_event_count\x18\x17 \x01(\x03\x12\x1d\n\x15simulated_event_names\x18\x18 \x03(\t\"\xb5\x01\n\x0e\x43ollectionType\x12\x1f\n\x1b\x43OLLECTION_TYPE_UNSPECIFIED\x10\x00\x12\x13\n\x0fTELEMETRY_ALERT\x10\x01\x12\x10\n\x0cGCTI_FINDING\x10\x02\x12\x13\n\x0fUPPERCASE_ALERT\x10\x02\x12\x12\n\x0eRULE_DETECTION\x10\x03\x12\x1e\n\x1aMACHINE_INTELLIGENCE_ALERT\x10\x04\x12\x0e\n\nSOAR_ALERT\x10\x05\x1a\x02\x10\x01\"\x95\x01\n\x16\x44\x65tectionTimingDetails\x12(\n$DETECTION_TIMING_DETAILS_UNSPECIFIED\x10\x00\x12)\n%DETECTION_TIMING_DETAILS_REPROCESSING\x10\x01\x12&\n\"DETECTION_TIMING_DETAILS_RETROHUNT\x10\x02\"|\n\x0cRunFrequency\x12\x1d\n\x19RUN_FREQUENCY_UNSPECIFIED\x10\x00\x12\x1a\n\x16RUN_FREQUENCY_REALTIME\x10\x01\x12\x18\n\x14RUN_FREQUENCY_HOURLY\x10\x02\x12\x17\n\x13RUN_FREQUENCY_DAILY\x10\x03J\x04\x08\x0f\x10\x10J\x04\x08\x10\x10\x11\"\xfe\x01\n\x15\x45ntityGraphEnrichment\x12\x12\n\ndata_table\x18\x01 \x01(\t\x12O\n\x0f\x65nrichment_type\x18\x03 \x01(\x0e\x32\x36.google.backstory.EntityGraphEnrichment.EnrichmentType\x12\x33\n\x11overridden_entity\x18\x02 \x01(\x0b\x32\x18.google.backstory.Entity\"K\n\x0e\x45nrichmentType\x12\x1f\n\x1b\x45NRICHMENT_TYPE_UNSPECIFIED\x10\x00\x12\n\n\x06\x41PPEND\x10\x01\x12\x0c\n\x08OVERRIDE\x10\x02\"\\\n\x10\x44\x61taTableRowInfo\x12\x12\n\ndata_table\x18\x01 \x01(\t\x12$\n\x03row\x18\x02 \x01(\x0b\x32\x17.google.protobuf.Struct\x12\x0e\n\x06row_id\x18\x03 \x01(\t\"\xaa\x02\n\x0eLatencyMetrics\x12\x39\n\x15oldest_ingestion_time\x18\x01 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x39\n\x15newest_ingestion_time\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x35\n\x11oldest_event_time\x18\x03 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x35\n\x11newest_event_time\x18\x04 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x34\n\x11ingestion_latency\x18\x05 \x01(\x0b\x32\x19.google.protobuf.Duration\"\x9d\x02\n\tReference\x12$\n\x05\x65vent\x18\x01 \x01(\x0b\x32\x15.google.backstory.UDM\x12(\n\x06\x65ntity\x18\x02 \x01(\x0b\x32\x18.google.backstory.Entity\x12\x42\n\x16joined_data_table_rows\x18\x04 \x03(\x0b\x32\".google.backstory.DataTableRowInfo\x12\x41\n\x10graph_enrichment\x18\x05 \x01(\x0b\x32\'.google.backstory.EntityGraphEnrichment\x12 \n\x02id\x18\x03 \x01(\x0b\x32\x14.google.backstory.Id\x12\x17\n\x0flog_batch_token\x18\x06 \x01(\t\"\xd7\x01\n\x07\x45lement\x12\x35\n\x0b\x61ssociation\x18\x01 \x01(\x0b\x32 .google.backstory.SecurityResult\x12/\n\nreferences\x18\x02 \x03(\x0b\x32\x1b.google.backstory.Reference\x12\r\n\x05label\x18\x03 \x01(\t\x12\x1a\n\x12references_sampled\x18\x04 \x01(\x08\x12\x39\n\x0flatency_metrics\x18\x05 \x01(\x0b\x32 .google.backstory.LatencyMetrics\"\xeb\x01\n\x14ResponsePlatformInfo\x12\x10\n\x08\x61lert_id\x18\x02 \x01(\t\x12[\n\x16response_platform_type\x18\x03 \x01(\x0e\x32;.google.backstory.ResponsePlatformInfo.ResponsePlatformType\"d\n\x14ResponsePlatformType\x12&\n\"RESPONSE_PLATFORM_TYPE_UNSPECIFIED\x10\x00\x12$\n RESPONSE_PLATFORM_TYPE_SIEMPLIFY\x10\x01\"\xae\x01\n\x11SoarAlertMetadata\x12\x10\n\x08\x61lert_id\x18\x01 \x01(\t\x12\x13\n\x0bsource_rule\x18\x02 \x01(\t\x12\x0e\n\x06vendor\x18\x03 \x01(\t\x12\x15\n\rsource_system\x18\x04 \x01(\t\x12\x0f\n\x07product\x18\x05 \x01(\t\x12\x1f\n\x17source_system_ticket_id\x18\x06 \x01(\t\x12\x19\n\x11source_system_uri\x18\x07 \x01(\tB\x8d\x01\n\x14\x63om.google.backstoryP\x01Z9google.golang.org/genproto/googleapis/backstory;backstory\xaa\x02\x10Google.Backstory\xca\x02\x10Google\\Backstory\xea\x02\x11Google::Backstoryb\x06proto3"
+descriptor_data = "\n\x1a\x62\x61\x63kstory/collection.proto\x12\x10google.backstory\x1a\x16\x62\x61\x63kstory/entity.proto\x1a\x12\x62\x61\x63kstory/id.proto\x1a\x13\x62\x61\x63kstory/udm.proto\x1a\x1egoogle/protobuf/duration.proto\x1a\x1cgoogle/protobuf/struct.proto\x1a\x1fgoogle/protobuf/timestamp.proto\x1a\x1agoogle/type/interval.proto\"\xc2\x0b\n\nCollection\x12\n\n\x02id\x18\x07 \x01(\t\x12\x39\n\x04type\x18\x01 \x01(\x0e\x32+.google.backstory.Collection.CollectionType\x12\x34\n\x0cid_namespace\x18\x0c \x01(\x0e\x32\x1e.google.backstory.Id.Namespace\x12\x30\n\x0c\x63reated_time\x18\x05 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x35\n\x11last_updated_time\x18\x06 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12*\n\x0btime_window\x18\x08 \x01(\x0b\x32\x15.google.type.Interval\x12\x36\n\x13\x63ollection_elements\x18\t \x03(\x0b\x32\x19.google.backstory.Element\x12\x33\n\tdetection\x18\x03 \x03(\x0b\x32 .google.backstory.SecurityResult\x12\x32\n\x0e\x64\x65tection_time\x18\n \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x36\n\rinvestigation\x18\x04 \x01(\x0b\x32\x1f.google.backstory.Investigation\x12\x0c\n\x04tags\x18\x0b \x03(\t\x12\x46\n\x16response_platform_info\x18\r \x01(\x0b\x32&.google.backstory.ResponsePlatformInfo\x12\x11\n\tcase_name\x18\x0e \x01(\t\x12\x12\n\nsoar_alert\x18\x11 \x01(\x08\x12@\n\x13soar_alert_metadata\x18\x12 \x01(\x0b\x32#.google.backstory.SoarAlertMetadata\x12\x19\n\x11\x64\x61ta_access_scope\x18\x13 \x01(\t\x12U\n\x18\x64\x65tection_timing_details\x18\x14 \x03(\x0e\x32\x33.google.backstory.Collection.DetectionTimingDetails\x12\x39\n\x0flatency_metrics\x18\x15 \x01(\x0b\x32 .google.backstory.LatencyMetrics\x12\x45\n\x12rule_run_frequency\x18\x16 \x01(\x0e\x32).google.backstory.Collection.RunFrequency\x12\x1d\n\x15simulated_event_count\x18\x17 \x01(\x03\x12\x1d\n\x15simulated_event_names\x18\x18 \x03(\t\"\xb5\x01\n\x0e\x43ollectionType\x12\x1f\n\x1b\x43OLLECTION_TYPE_UNSPECIFIED\x10\x00\x12\x13\n\x0fTELEMETRY_ALERT\x10\x01\x12\x10\n\x0cGCTI_FINDING\x10\x02\x12\x13\n\x0fUPPERCASE_ALERT\x10\x02\x12\x12\n\x0eRULE_DETECTION\x10\x03\x12\x1e\n\x1aMACHINE_INTELLIGENCE_ALERT\x10\x04\x12\x0e\n\nSOAR_ALERT\x10\x05\x1a\x02\x10\x01\"\x95\x01\n\x16\x44\x65tectionTimingDetails\x12(\n$DETECTION_TIMING_DETAILS_UNSPECIFIED\x10\x00\x12)\n%DETECTION_TIMING_DETAILS_REPROCESSING\x10\x01\x12&\n\"DETECTION_TIMING_DETAILS_RETROHUNT\x10\x02\"|\n\x0cRunFrequency\x12\x1d\n\x19RUN_FREQUENCY_UNSPECIFIED\x10\x00\x12\x1a\n\x16RUN_FREQUENCY_REALTIME\x10\x01\x12\x18\n\x14RUN_FREQUENCY_HOURLY\x10\x02\x12\x17\n\x13RUN_FREQUENCY_DAILY\x10\x03J\x04\x08\x0f\x10\x10J\x04\x08\x10\x10\x11\"\xfe\x01\n\x15\x45ntityGraphEnrichment\x12\x12\n\ndata_table\x18\x01 \x01(\t\x12O\n\x0f\x65nrichment_type\x18\x03 \x01(\x0e\x32\x36.google.backstory.EntityGraphEnrichment.EnrichmentType\x12\x33\n\x11overridden_entity\x18\x02 \x01(\x0b\x32\x18.google.backstory.Entity\"K\n\x0e\x45nrichmentType\x12\x1f\n\x1b\x45NRICHMENT_TYPE_UNSPECIFIED\x10\x00\x12\n\n\x06\x41PPEND\x10\x01\x12\x0c\n\x08OVERRIDE\x10\x02\"\\\n\x10\x44\x61taTableRowInfo\x12\x12\n\ndata_table\x18\x01 \x01(\t\x12$\n\x03row\x18\x02 \x01(\x0b\x32\x17.google.protobuf.Struct\x12\x0e\n\x06row_id\x18\x03 \x01(\t\"\xaa\x02\n\x0eLatencyMetrics\x12\x39\n\x15oldest_ingestion_time\x18\x01 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x39\n\x15newest_ingestion_time\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x35\n\x11oldest_event_time\x18\x03 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x35\n\x11newest_event_time\x18\x04 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x34\n\x11ingestion_latency\x18\x05 \x01(\x0b\x32\x19.google.protobuf.Duration\"\x9d\x02\n\tReference\x12$\n\x05\x65vent\x18\x01 \x01(\x0b\x32\x15.google.backstory.UDM\x12(\n\x06\x65ntity\x18\x02 \x01(\x0b\x32\x18.google.backstory.Entity\x12\x42\n\x16joined_data_table_rows\x18\x04 \x03(\x0b\x32\".google.backstory.DataTableRowInfo\x12\x41\n\x10graph_enrichment\x18\x05 \x01(\x0b\x32\'.google.backstory.EntityGraphEnrichment\x12 \n\x02id\x18\x03 \x01(\x0b\x32\x14.google.backstory.Id\x12\x17\n\x0flog_batch_token\x18\x06 \x01(\t\"\xd7\x01\n\x07\x45lement\x12\x35\n\x0b\x61ssociation\x18\x01 \x01(\x0b\x32 .google.backstory.SecurityResult\x12/\n\nreferences\x18\x02 \x03(\x0b\x32\x1b.google.backstory.Reference\x12\r\n\x05label\x18\x03 \x01(\t\x12\x1a\n\x12references_sampled\x18\x04 \x01(\x08\x12\x39\n\x0flatency_metrics\x18\x05 \x01(\x0b\x32 .google.backstory.LatencyMetrics\"\xeb\x01\n\x14ResponsePlatformInfo\x12\x10\n\x08\x61lert_id\x18\x02 \x01(\t\x12[\n\x16response_platform_type\x18\x03 \x01(\x0e\x32;.google.backstory.ResponsePlatformInfo.ResponsePlatformType\"d\n\x14ResponsePlatformType\x12&\n\"RESPONSE_PLATFORM_TYPE_UNSPECIFIED\x10\x00\x12$\n RESPONSE_PLATFORM_TYPE_SIEMPLIFY\x10\x01\"\xae\x01\n\x11SoarAlertMetadata\x12\x10\n\x08\x61lert_id\x18\x01 \x01(\t\x12\x13\n\x0bsource_rule\x18\x02 \x01(\t\x12\x0e\n\x06vendor\x18\x03 \x01(\t\x12\x15\n\rsource_system\x18\x04 \x01(\t\x12\x0f\n\x07product\x18\x05 \x01(\t\x12\x1f\n\x17source_system_ticket_id\x18\x06 \x01(\t\x12\x19\n\x11source_system_uri\x18\x07 \x01(\tB\x89\x01\n\x14\x63om.google.backstoryP\x01Z5cloud.google.com/go/backstory/backstorypb;backstorypb\xaa\x02\x10Google.Backstory\xca\x02\x10Google\\Backstory\xea\x02\x11Google::Backstoryb\x06proto3"
 
 pool = Google::Protobuf::DescriptorPool.generated_pool
 
@@ -93,7 +93,7 @@ module Backstory
 # import "google/type/interval.proto";
 #
 # option csharp_namespace = "Google.Backstory";
-# option go_package = "google.golang.org/genproto/googleapis/backstory;backstory";
+# option go_package = "cloud.google.com/go/backstory/backstorypb;backstorypb";
 # option java_multiple_files = true;
 # option java_package = "com.google.backstory";
 # option php_namespace = "Google\\Backstory";
diff --git a/google-backstory/lib/backstory/data_access_pb.rb b/google-backstory/lib/backstory/data_access_pb.rb
index 298efd9..7f9bd9c 100644
--- a/google-backstory/lib/backstory/data_access_pb.rb
+++ b/google-backstory/lib/backstory/data_access_pb.rb
@@ -5,7 +5,7 @@
 require 'google/protobuf'
 
 
-descriptor_data = "\n\x1b\x62\x61\x63kstory/data_access.proto\x12\x10google.backstory\"6\n\x18\x44\x61taAccessIngestionLabel\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t\"\xd4\x01\n\x10\x44\x61taAccessLabels\x12\x11\n\tlog_types\x18\x01 \x03(\t\x12\x1c\n\x10ingestion_labels\x18\x02 \x03(\tB\x02\x18\x01\x12\x12\n\nnamespaces\x18\x03 \x03(\t\x12\x15\n\rcustom_labels\x18\x04 \x03(\t\x12G\n\x13ingestion_kv_labels\x18\x05 \x03(\x0b\x32*.google.backstory.DataAccessIngestionLabel\x12\x1b\n\x13\x61llow_scoped_access\x18\x06 \x01(\x08\x42\x8d\x01\n\x14\x63om.google.backstoryP\x01Z9google.golang.org/genproto/googleapis/backstory;backstory\xaa\x02\x10Google.Backstory\xca\x02\x10Google\\Backstory\xea\x02\x11Google::Backstoryb\x06proto3"
+descriptor_data = "\n\x1b\x62\x61\x63kstory/data_access.proto\x12\x10google.backstory\"6\n\x18\x44\x61taAccessIngestionLabel\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t\"\xd4\x01\n\x10\x44\x61taAccessLabels\x12\x11\n\tlog_types\x18\x01 \x03(\t\x12\x1c\n\x10ingestion_labels\x18\x02 \x03(\tB\x02\x18\x01\x12\x12\n\nnamespaces\x18\x03 \x03(\t\x12\x15\n\rcustom_labels\x18\x04 \x03(\t\x12G\n\x13ingestion_kv_labels\x18\x05 \x03(\x0b\x32*.google.backstory.DataAccessIngestionLabel\x12\x1b\n\x13\x61llow_scoped_access\x18\x06 \x01(\x08\x42\x89\x01\n\x14\x63om.google.backstoryP\x01Z5cloud.google.com/go/backstory/backstorypb;backstorypb\xaa\x02\x10Google.Backstory\xca\x02\x10Google\\Backstory\xea\x02\x11Google::Backstoryb\x06proto3"
 
 pool = Google::Protobuf::DescriptorPool.generated_pool
 
@@ -59,7 +59,7 @@ module Backstory
 # package google.backstory;
 #
 # option csharp_namespace = "Google.Backstory";
-# option go_package = "google.golang.org/genproto/googleapis/backstory;backstory";
+# option go_package = "cloud.google.com/go/backstory/backstorypb;backstorypb";
 # option java_multiple_files = true;
 # option java_package = "com.google.backstory";
 # option php_namespace = "Google\\Backstory";
diff --git a/google-backstory/lib/backstory/entity_pb.rb b/google-backstory/lib/backstory/entity_pb.rb
index 94b6e85..92ff5e5 100644
--- a/google-backstory/lib/backstory/entity_pb.rb
+++ b/google-backstory/lib/backstory/entity_pb.rb
@@ -11,7 +11,7 @@
 require 'google/type/interval_pb'
 
 
-descriptor_data = "\n\x16\x62\x61\x63kstory/entity.proto\x12\x10google.backstory\x1a\x1b\x62\x61\x63kstory/entity_risk.proto\x1a\x13\x62\x61\x63kstory/udm.proto\x1a\x1cgoogle/protobuf/struct.proto\x1a\x1fgoogle/protobuf/timestamp.proto\x1a\x1agoogle/type/interval.proto\"\x85\x08\n\x0e\x45ntityMetadata\x12\x19\n\x11product_entity_id\x18\x01 \x01(\t\x12\x37\n\x13\x63ollected_timestamp\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x36\n\x12\x63reation_timestamp\x18\x08 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\'\n\x08interval\x18\t \x01(\x0b\x32\x15.google.type.Interval\x12\x13\n\x0bvendor_name\x18\x03 \x01(\t\x12\x14\n\x0cproduct_name\x18\x04 \x01(\t\x12\x0c\n\x04\x66\x65\x65\x64\x18\x0e \x01(\t\x12\x17\n\x0fproduct_version\x18\x05 \x01(\t\x12@\n\x0b\x65ntity_type\x18\x06 \x01(\x0e\x32+.google.backstory.EntityMetadata.EntityType\x12\x13\n\x0b\x64\x65scription\x18\x07 \x01(\t\x12\x30\n\x06threat\x18\n \x03(\x0b\x32 .google.backstory.SecurityResult\x12@\n\x0bsource_type\x18\x0b \x01(\x0e\x32+.google.backstory.EntityMetadata.SourceType\x12.\n\rsource_labels\x18\x0c \x03(\x0b\x32\x17.google.backstory.Label\x12\x32\n\x0e\x65vent_metadata\x18\r \x01(\x0b\x32\x1a.google.backstory.Metadata\x12\x36\n\x11structured_fields\x18\x0f \x01(\x0b\x32\x17.google.protobuf.StructB\x02\x18\x01\x12*\n\textracted\x18\x10 \x01(\x0b\x32\x17.google.protobuf.Struct\x12?\n\x12\x61ti_prioritization\x18\x11 \x01(\x0b\x32#.google.backstory.AtiPrioritization\"\xaf\x01\n\nEntityType\x12\x16\n\x12UNKNOWN_ENTITYTYPE\x10\x00\x12\t\n\x05\x41SSET\x10\x01\x12\t\n\x04USER\x10\x90N\x12\n\n\x05GROUP\x10\x91N\x12\x0c\n\x08RESOURCE\x10\x02\x12\x0e\n\nIP_ADDRESS\x10\x03\x12\x0e\n\nCIDR_BLOCK\x10\t\x12\x08\n\x04\x46ILE\x10\x04\x12\x0f\n\x0b\x44OMAIN_NAME\x10\x05\x12\x07\n\x03URL\x10\x06\x12\t\n\x05MUTEX\x10\x07\x12\n\n\x06METRIC\x10\x08\"f\n\nSourceType\x12\x1b\n\x17SOURCE_TYPE_UNSPECIFIED\x10\x00\x12\x12\n\x0e\x45NTITY_CONTEXT\x10\x01\x12\x13\n\x0f\x44\x45RIVED_CONTEXT\x10\x02\x12\x12\n\x0eGLOBAL_CONTEXT\x10\x03\"\x9e\x04\n\x11\x41tiPrioritization\x12\x13\n\x0bgti_verdict\x18\x01 \x01(\x05\x12\x14\n\x0cgti_severity\x18\x02 \x01(\x05\x12\x18\n\x10gti_threat_score\x18\x03 \x01(\x05\x12#\n\x1bmandiant_analyst_confidence\x18\x04 \x01(\x05\x12\x33\n\x0fgti_update_time\x18\x05 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x11\n\tactive_ir\x18\x06 \x01(\x08\x12?\n\x1b\x61\x63tive_ir_first_tagged_time\x18\x07 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x1d\n\x15global_customer_count\x18\x08 \x01(\x03\x12\x18\n\x10global_hit_count\x18\t \x01(\x03\x12\x11\n\texclusive\x18\n \x01(\x08\x12\r\n\x05osint\x18\x0b \x01(\x08\x12\x0f\n\x07scanner\x18\x0c \x01(\x08\x12\x10\n\x08reviewed\x18\r \x01(\x08\x12H\n\x12\x61ttributed_malware\x18\x0e \x03(\x0b\x32,.google.backstory.SecurityResult.Association\x12N\n\x18\x61ttributed_threat_actors\x18\x0f \x03(\x0b\x32,.google.backstory.SecurityResult.Association\"\xb0\x02\n\x06\x45ntity\x12\x32\n\x08metadata\x18\x01 \x01(\x0b\x32 .google.backstory.EntityMetadata\x12&\n\x06\x65ntity\x18\x02 \x01(\x0b\x32\x16.google.backstory.Noun\x12-\n\trelations\x18\x04 \x03(\x0b\x32\x1a.google.backstory.Relation\x12+\n\nadditional\x18\x03 \x01(\x0b\x32\x17.google.protobuf.Struct\x12\x35\n\nrisk_score\x18\x05 \x01(\x0b\x32\x1c.google.backstory.EntityRiskH\x00\x88\x01\x01\x12(\n\x06metric\x18\x06 \x01(\x0b\x32\x18.google.backstory.MetricB\r\n\x0b_risk_score\"\xb0\x05\n\x08Relation\x12&\n\x06\x65ntity\x18\x01 \x01(\x0b\x32\x16.google.backstory.Noun\x12@\n\x0b\x65ntity_type\x18\x02 \x01(\x0e\x32+.google.backstory.EntityMetadata.EntityType\x12=\n\x0crelationship\x18\x03 \x01(\x0e\x32\'.google.backstory.Relation.Relationship\x12<\n\tdirection\x18\x04 \x01(\x0e\x32).google.backstory.Relation.Directionality\x12\x0b\n\x03uid\x18\x05 \x01(\x0c\x12<\n\x0c\x65ntity_label\x18\x06 \x01(\x0e\x32&.google.backstory.Relation.EntityLabel\"\x84\x01\n\x0cRelationship\x12\x1c\n\x18RELATIONSHIP_UNSPECIFIED\x10\x00\x12\x08\n\x04OWNS\x10\x01\x12\x0f\n\x0b\x41\x44MINISTERS\x10\x02\x12\n\n\x06MEMBER\x10\x03\x12\x0c\n\x08\x45XECUTES\x10\x04\x12\x13\n\x0f\x44OWNLOADED_FROM\x10\x05\x12\x0c\n\x08\x43ONTACTS\x10\x06\"W\n\x0e\x44irectionality\x12\x1e\n\x1a\x44IRECTIONALITY_UNSPECIFIED\x10\x00\x12\x11\n\rBIDIRECTIONAL\x10\x01\x12\x12\n\x0eUNIDIRECTIONAL\x10\x02\"\x91\x01\n\x0b\x45ntityLabel\x12\x1c\n\x18\x45NTITY_LABEL_UNSPECIFIED\x10\x00\x12\r\n\tPRINCIPAL\x10\x01\x12\n\n\x06TARGET\x10\x02\x12\x0c\n\x08OBSERVER\x10\x03\x12\x07\n\x03SRC\x10\x04\x12\x0b\n\x07NETWORK\x10\x05\x12\x13\n\x0fSECURITY_RESULT\x10\x06\x12\x10\n\x0cINTERMEDIARY\x10\x07\"\xc4\x15\n\x06Metric\x12.\n\nfirst_seen\x18\x01 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12-\n\tlast_seen\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x35\n\x0bsum_measure\x18\x03 \x01(\x0b\x32 .google.backstory.Metric.Measure\x12\x14\n\x0ctotal_events\x18\x04 \x01(\x03\x12\x38\n\x0bmetric_name\x18\x05 \x01(\x0e\x32#.google.backstory.Metric.MetricName\x12\x36\n\ndimensions\x18\x06 \x03(\x0e\x32\".google.backstory.Metric.Dimension\x12\x15\n\rexport_window\x18\x07 \x01(\x03\x12\x14\n\x0c\x64isplay_name\x18\x08 \x01(\t\x12<\n\x11outcome_variables\x18\t \x03(\x0b\x32!.google.backstory.FindingVariable\x12:\n\x0fmatch_variables\x18\n \x03(\x0b\x32!.google.backstory.FindingVariable\x12)\n\ntime_range\x18\x0b \x01(\x0b\x32\x15.google.type.Interval\x1a`\n\x07Measure\x12\r\n\x05value\x18\x01 \x01(\x01\x12\x46\n\x12\x61ggregate_function\x18\x02 \x01(\x0e\x32*.google.backstory.Metric.AggregateFunction\"r\n\x11\x41ggregateFunction\x12\"\n\x1e\x41GGREGATE_FUNCTION_UNSPECIFIED\x10\x00\x12\x07\n\x03MIN\x10\x01\x12\x07\n\x03MAX\x10\x02\x12\t\n\x05\x43OUNT\x10\x03\x12\x07\n\x03SUM\x10\x04\x12\x07\n\x03\x41VG\x10\x05\x12\n\n\x06STDDEV\x10\x06\"\xf1\x08\n\nMetricName\x12\x1b\n\x17METRIC_NAME_UNSPECIFIED\x10\x00\x12\x19\n\x15NETWORK_BYTES_INBOUND\x10\x01\x12\x1a\n\x16NETWORK_BYTES_OUTBOUND\x10\x02\x12\x17\n\x13NETWORK_BYTES_TOTAL\x10\x03\x12\x19\n\x15\x41UTH_ATTEMPTS_SUCCESS\x10\x04\x12\x16\n\x12\x41UTH_ATTEMPTS_FAIL\x10\x05\x12\x17\n\x13\x41UTH_ATTEMPTS_TOTAL\x10\x06\x12\x16\n\x12\x44NS_BYTES_OUTBOUND\x10\x07\x12\x19\n\x15NETWORK_FLOWS_INBOUND\x10\x08\x12\x1a\n\x16NETWORK_FLOWS_OUTBOUND\x10\t\x12\x17\n\x13NETWORK_FLOWS_TOTAL\x10\n\x12\x17\n\x13\x44NS_QUERIES_SUCCESS\x10\x0b\x12\x14\n\x10\x44NS_QUERIES_FAIL\x10\x0c\x12\x15\n\x11\x44NS_QUERIES_TOTAL\x10\r\x12\x1b\n\x17\x46ILE_EXECUTIONS_SUCCESS\x10\x0e\x12\x18\n\x14\x46ILE_EXECUTIONS_FAIL\x10\x0f\x12\x19\n\x15\x46ILE_EXECUTIONS_TOTAL\x10\x10\x12\x18\n\x14HTTP_QUERIES_SUCCESS\x10\x11\x12\x15\n\x11HTTP_QUERIES_FAIL\x10\x12\x12\x16\n\x12HTTP_QUERIES_TOTAL\x10\x13\x12\x1f\n\x1bWORKSPACE_EMAILS_SENT_TOTAL\x10\x14\x12$\n WORKSPACE_TOTAL_DOWNLOAD_ACTIONS\x10\x15\x12\"\n\x1eWORKSPACE_TOTAL_CHANGE_ACTIONS\x10\x16\x12!\n\x1dWORKSPACE_AUTH_ATTEMPTS_TOTAL\x10\x17\x12$\n WORKSPACE_NETWORK_BYTES_OUTBOUND\x10\x18\x12!\n\x1dWORKSPACE_NETWORK_BYTES_TOTAL\x10\x19\x12\x1a\n\x16\x41LERT_EVENT_NAME_COUNT\x10\x1a\x12\x1b\n\x17RESOURCE_CREATION_TOTAL\x10\x1b\x12\x1d\n\x19RESOURCE_CREATION_SUCCESS\x10\x1c\x12\x19\n\x15RESOURCE_READ_SUCCESS\x10\x1d\x12\x16\n\x12RESOURCE_READ_FAIL\x10\x1e\x12\x1d\n\x19RESOURCE_DELETION_SUCCESS\x10\x1f\x12\x1a\n\x16RESOURCE_CREATION_FAIL\x10 \x12\x1a\n\x16RESOURCE_DELETION_FAIL\x10!\x12\x1b\n\x17RESOURCE_DELETION_TOTAL\x10\"\x12\x17\n\x13RESOURCE_READ_TOTAL\x10#\x12\x19\n\x15RESOURCE_WRITTEN_FAIL\x10$\x12\x1c\n\x18RESOURCE_WRITTEN_SUCCESS\x10%\x12\x1a\n\x16RESOURCE_WRITTEN_TOTAL\x10&\x12\x1d\n\x19UDM_DATA_PRESENCE_SUMMARY\x10\'\"\xff\x06\n\tDimension\x12\x19\n\x15\x44IMENSION_UNSPECIFIED\x10\x00\x12\x14\n\x10PRINCIPAL_DEVICE\x10\x01\x12\x0f\n\x0bTARGET_USER\x10\x02\x12\x11\n\rTARGET_DEVICE\x10\x03\x12\x12\n\x0ePRINCIPAL_USER\x10\x04\x12\r\n\tTARGET_IP\x10\x05\x12\x17\n\x13PRINCIPAL_FILE_HASH\x10\x06\x12\x15\n\x11PRINCIPAL_COUNTRY\x10\x07\x12\x15\n\x11SECURITY_CATEGORY\x10\x08\x12\x0f\n\x0bNETWORK_ASN\x10\t\x12\x1b\n\x17\x43LIENT_CERTIFICATE_HASH\x10\n\x12\x12\n\x0e\x44NS_QUERY_TYPE\x10\x0b\x12\x0e\n\nDNS_DOMAIN\x10\x0c\x12\x13\n\x0fHTTP_USER_AGENT\x10\r\x12\x0e\n\nEVENT_TYPE\x10\x0e\x12\x10\n\x0cPRODUCT_NAME\x10\x0f\x12\x16\n\x12PRODUCT_EVENT_TYPE\x10\x10\x12\x16\n\x12PARENT_FOLDER_PATH\x10\x11\x12\x18\n\x14TARGET_RESOURCE_NAME\x10\x12\x12\x19\n\x15PRINCIPAL_APPLICATION\x10\x13\x12\x16\n\x12TARGET_APPLICATION\x10\x14\x12\x14\n\x10\x45MAIL_TO_ADDRESS\x10\x15\x12\x16\n\x12\x45MAIL_FROM_ADDRESS\x10\x16\x12\x0b\n\x07MAIL_ID\x10\x17\x12\x10\n\x0cPRINCIPAL_IP\x10\x18\x12\x13\n\x0fSECURITY_ACTION\x10\x19\x12\x14\n\x10SECURITY_RULE_ID\x10\x1c\x12$\n TARGET_NETWORK_ORGANIZATION_NAME\x10\x1d\x12\'\n#PRINCIPAL_NETWORK_ORGANIZATION_NAME\x10\x1e\x12\x1f\n\x1bPRINCIPAL_PROCESS_FILE_PATH\x10\x1f\x12\x1f\n\x1bPRINCIPAL_PROCESS_FILE_HASH\x10 \x12\x1d\n\x19SECURITY_RESULT_RULE_NAME\x10!\x12\x1d\n\x19TARGET_RESOURCE_LABEL_KEY\x10\"\x12\x0f\n\x0bVENDOR_NAME\x10#\x12\x18\n\x14TARGET_RESOURCE_TYPE\x10$\x12\x18\n\x14TARGET_LOCATION_NAME\x10%\x12\x0c\n\x08LOG_TYPE\x10&\x12\x13\n\x0fTARGET_HOSTNAME\x10\'B\x9a\x01\n\x14\x63om.google.backstoryB\x0b\x45ntityProtoP\x01Z9google.golang.org/genproto/googleapis/backstory;backstory\xaa\x02\x10Google.Backstory\xca\x02\x10Google\\Backstory\xea\x02\x11Google::Backstoryb\x06proto3"
+descriptor_data = "\n\x16\x62\x61\x63kstory/entity.proto\x12\x10google.backstory\x1a\x1b\x62\x61\x63kstory/entity_risk.proto\x1a\x13\x62\x61\x63kstory/udm.proto\x1a\x1cgoogle/protobuf/struct.proto\x1a\x1fgoogle/protobuf/timestamp.proto\x1a\x1agoogle/type/interval.proto\"\x85\x08\n\x0e\x45ntityMetadata\x12\x19\n\x11product_entity_id\x18\x01 \x01(\t\x12\x37\n\x13\x63ollected_timestamp\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x36\n\x12\x63reation_timestamp\x18\x08 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\'\n\x08interval\x18\t \x01(\x0b\x32\x15.google.type.Interval\x12\x13\n\x0bvendor_name\x18\x03 \x01(\t\x12\x14\n\x0cproduct_name\x18\x04 \x01(\t\x12\x0c\n\x04\x66\x65\x65\x64\x18\x0e \x01(\t\x12\x17\n\x0fproduct_version\x18\x05 \x01(\t\x12@\n\x0b\x65ntity_type\x18\x06 \x01(\x0e\x32+.google.backstory.EntityMetadata.EntityType\x12\x13\n\x0b\x64\x65scription\x18\x07 \x01(\t\x12\x30\n\x06threat\x18\n \x03(\x0b\x32 .google.backstory.SecurityResult\x12@\n\x0bsource_type\x18\x0b \x01(\x0e\x32+.google.backstory.EntityMetadata.SourceType\x12.\n\rsource_labels\x18\x0c \x03(\x0b\x32\x17.google.backstory.Label\x12\x32\n\x0e\x65vent_metadata\x18\r \x01(\x0b\x32\x1a.google.backstory.Metadata\x12\x36\n\x11structured_fields\x18\x0f \x01(\x0b\x32\x17.google.protobuf.StructB\x02\x18\x01\x12*\n\textracted\x18\x10 \x01(\x0b\x32\x17.google.protobuf.Struct\x12?\n\x12\x61ti_prioritization\x18\x11 \x01(\x0b\x32#.google.backstory.AtiPrioritization\"\xaf\x01\n\nEntityType\x12\x16\n\x12UNKNOWN_ENTITYTYPE\x10\x00\x12\t\n\x05\x41SSET\x10\x01\x12\t\n\x04USER\x10\x90N\x12\n\n\x05GROUP\x10\x91N\x12\x0c\n\x08RESOURCE\x10\x02\x12\x0e\n\nIP_ADDRESS\x10\x03\x12\x0e\n\nCIDR_BLOCK\x10\t\x12\x08\n\x04\x46ILE\x10\x04\x12\x0f\n\x0b\x44OMAIN_NAME\x10\x05\x12\x07\n\x03URL\x10\x06\x12\t\n\x05MUTEX\x10\x07\x12\n\n\x06METRIC\x10\x08\"f\n\nSourceType\x12\x1b\n\x17SOURCE_TYPE_UNSPECIFIED\x10\x00\x12\x12\n\x0e\x45NTITY_CONTEXT\x10\x01\x12\x13\n\x0f\x44\x45RIVED_CONTEXT\x10\x02\x12\x12\n\x0eGLOBAL_CONTEXT\x10\x03\"\x9e\x04\n\x11\x41tiPrioritization\x12\x13\n\x0bgti_verdict\x18\x01 \x01(\x05\x12\x14\n\x0cgti_severity\x18\x02 \x01(\x05\x12\x18\n\x10gti_threat_score\x18\x03 \x01(\x05\x12#\n\x1bmandiant_analyst_confidence\x18\x04 \x01(\x05\x12\x33\n\x0fgti_update_time\x18\x05 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x11\n\tactive_ir\x18\x06 \x01(\x08\x12?\n\x1b\x61\x63tive_ir_first_tagged_time\x18\x07 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x1d\n\x15global_customer_count\x18\x08 \x01(\x03\x12\x18\n\x10global_hit_count\x18\t \x01(\x03\x12\x11\n\texclusive\x18\n \x01(\x08\x12\r\n\x05osint\x18\x0b \x01(\x08\x12\x0f\n\x07scanner\x18\x0c \x01(\x08\x12\x10\n\x08reviewed\x18\r \x01(\x08\x12H\n\x12\x61ttributed_malware\x18\x0e \x03(\x0b\x32,.google.backstory.SecurityResult.Association\x12N\n\x18\x61ttributed_threat_actors\x18\x0f \x03(\x0b\x32,.google.backstory.SecurityResult.Association\"\xb0\x02\n\x06\x45ntity\x12\x32\n\x08metadata\x18\x01 \x01(\x0b\x32 .google.backstory.EntityMetadata\x12&\n\x06\x65ntity\x18\x02 \x01(\x0b\x32\x16.google.backstory.Noun\x12-\n\trelations\x18\x04 \x03(\x0b\x32\x1a.google.backstory.Relation\x12+\n\nadditional\x18\x03 \x01(\x0b\x32\x17.google.protobuf.Struct\x12\x35\n\nrisk_score\x18\x05 \x01(\x0b\x32\x1c.google.backstory.EntityRiskH\x00\x88\x01\x01\x12(\n\x06metric\x18\x06 \x01(\x0b\x32\x18.google.backstory.MetricB\r\n\x0b_risk_score\"\xb0\x05\n\x08Relation\x12&\n\x06\x65ntity\x18\x01 \x01(\x0b\x32\x16.google.backstory.Noun\x12@\n\x0b\x65ntity_type\x18\x02 \x01(\x0e\x32+.google.backstory.EntityMetadata.EntityType\x12=\n\x0crelationship\x18\x03 \x01(\x0e\x32\'.google.backstory.Relation.Relationship\x12<\n\tdirection\x18\x04 \x01(\x0e\x32).google.backstory.Relation.Directionality\x12\x0b\n\x03uid\x18\x05 \x01(\x0c\x12<\n\x0c\x65ntity_label\x18\x06 \x01(\x0e\x32&.google.backstory.Relation.EntityLabel\"\x84\x01\n\x0cRelationship\x12\x1c\n\x18RELATIONSHIP_UNSPECIFIED\x10\x00\x12\x08\n\x04OWNS\x10\x01\x12\x0f\n\x0b\x41\x44MINISTERS\x10\x02\x12\n\n\x06MEMBER\x10\x03\x12\x0c\n\x08\x45XECUTES\x10\x04\x12\x13\n\x0f\x44OWNLOADED_FROM\x10\x05\x12\x0c\n\x08\x43ONTACTS\x10\x06\"W\n\x0e\x44irectionality\x12\x1e\n\x1a\x44IRECTIONALITY_UNSPECIFIED\x10\x00\x12\x11\n\rBIDIRECTIONAL\x10\x01\x12\x12\n\x0eUNIDIRECTIONAL\x10\x02\"\x91\x01\n\x0b\x45ntityLabel\x12\x1c\n\x18\x45NTITY_LABEL_UNSPECIFIED\x10\x00\x12\r\n\tPRINCIPAL\x10\x01\x12\n\n\x06TARGET\x10\x02\x12\x0c\n\x08OBSERVER\x10\x03\x12\x07\n\x03SRC\x10\x04\x12\x0b\n\x07NETWORK\x10\x05\x12\x13\n\x0fSECURITY_RESULT\x10\x06\x12\x10\n\x0cINTERMEDIARY\x10\x07\"\xc4\x15\n\x06Metric\x12.\n\nfirst_seen\x18\x01 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12-\n\tlast_seen\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x35\n\x0bsum_measure\x18\x03 \x01(\x0b\x32 .google.backstory.Metric.Measure\x12\x14\n\x0ctotal_events\x18\x04 \x01(\x03\x12\x38\n\x0bmetric_name\x18\x05 \x01(\x0e\x32#.google.backstory.Metric.MetricName\x12\x36\n\ndimensions\x18\x06 \x03(\x0e\x32\".google.backstory.Metric.Dimension\x12\x15\n\rexport_window\x18\x07 \x01(\x03\x12\x14\n\x0c\x64isplay_name\x18\x08 \x01(\t\x12<\n\x11outcome_variables\x18\t \x03(\x0b\x32!.google.backstory.FindingVariable\x12:\n\x0fmatch_variables\x18\n \x03(\x0b\x32!.google.backstory.FindingVariable\x12)\n\ntime_range\x18\x0b \x01(\x0b\x32\x15.google.type.Interval\x1a`\n\x07Measure\x12\r\n\x05value\x18\x01 \x01(\x01\x12\x46\n\x12\x61ggregate_function\x18\x02 \x01(\x0e\x32*.google.backstory.Metric.AggregateFunction\"r\n\x11\x41ggregateFunction\x12\"\n\x1e\x41GGREGATE_FUNCTION_UNSPECIFIED\x10\x00\x12\x07\n\x03MIN\x10\x01\x12\x07\n\x03MAX\x10\x02\x12\t\n\x05\x43OUNT\x10\x03\x12\x07\n\x03SUM\x10\x04\x12\x07\n\x03\x41VG\x10\x05\x12\n\n\x06STDDEV\x10\x06\"\xf1\x08\n\nMetricName\x12\x1b\n\x17METRIC_NAME_UNSPECIFIED\x10\x00\x12\x19\n\x15NETWORK_BYTES_INBOUND\x10\x01\x12\x1a\n\x16NETWORK_BYTES_OUTBOUND\x10\x02\x12\x17\n\x13NETWORK_BYTES_TOTAL\x10\x03\x12\x19\n\x15\x41UTH_ATTEMPTS_SUCCESS\x10\x04\x12\x16\n\x12\x41UTH_ATTEMPTS_FAIL\x10\x05\x12\x17\n\x13\x41UTH_ATTEMPTS_TOTAL\x10\x06\x12\x16\n\x12\x44NS_BYTES_OUTBOUND\x10\x07\x12\x19\n\x15NETWORK_FLOWS_INBOUND\x10\x08\x12\x1a\n\x16NETWORK_FLOWS_OUTBOUND\x10\t\x12\x17\n\x13NETWORK_FLOWS_TOTAL\x10\n\x12\x17\n\x13\x44NS_QUERIES_SUCCESS\x10\x0b\x12\x14\n\x10\x44NS_QUERIES_FAIL\x10\x0c\x12\x15\n\x11\x44NS_QUERIES_TOTAL\x10\r\x12\x1b\n\x17\x46ILE_EXECUTIONS_SUCCESS\x10\x0e\x12\x18\n\x14\x46ILE_EXECUTIONS_FAIL\x10\x0f\x12\x19\n\x15\x46ILE_EXECUTIONS_TOTAL\x10\x10\x12\x18\n\x14HTTP_QUERIES_SUCCESS\x10\x11\x12\x15\n\x11HTTP_QUERIES_FAIL\x10\x12\x12\x16\n\x12HTTP_QUERIES_TOTAL\x10\x13\x12\x1f\n\x1bWORKSPACE_EMAILS_SENT_TOTAL\x10\x14\x12$\n WORKSPACE_TOTAL_DOWNLOAD_ACTIONS\x10\x15\x12\"\n\x1eWORKSPACE_TOTAL_CHANGE_ACTIONS\x10\x16\x12!\n\x1dWORKSPACE_AUTH_ATTEMPTS_TOTAL\x10\x17\x12$\n WORKSPACE_NETWORK_BYTES_OUTBOUND\x10\x18\x12!\n\x1dWORKSPACE_NETWORK_BYTES_TOTAL\x10\x19\x12\x1a\n\x16\x41LERT_EVENT_NAME_COUNT\x10\x1a\x12\x1b\n\x17RESOURCE_CREATION_TOTAL\x10\x1b\x12\x1d\n\x19RESOURCE_CREATION_SUCCESS\x10\x1c\x12\x19\n\x15RESOURCE_READ_SUCCESS\x10\x1d\x12\x16\n\x12RESOURCE_READ_FAIL\x10\x1e\x12\x1d\n\x19RESOURCE_DELETION_SUCCESS\x10\x1f\x12\x1a\n\x16RESOURCE_CREATION_FAIL\x10 \x12\x1a\n\x16RESOURCE_DELETION_FAIL\x10!\x12\x1b\n\x17RESOURCE_DELETION_TOTAL\x10\"\x12\x17\n\x13RESOURCE_READ_TOTAL\x10#\x12\x19\n\x15RESOURCE_WRITTEN_FAIL\x10$\x12\x1c\n\x18RESOURCE_WRITTEN_SUCCESS\x10%\x12\x1a\n\x16RESOURCE_WRITTEN_TOTAL\x10&\x12\x1d\n\x19UDM_DATA_PRESENCE_SUMMARY\x10\'\"\xff\x06\n\tDimension\x12\x19\n\x15\x44IMENSION_UNSPECIFIED\x10\x00\x12\x14\n\x10PRINCIPAL_DEVICE\x10\x01\x12\x0f\n\x0bTARGET_USER\x10\x02\x12\x11\n\rTARGET_DEVICE\x10\x03\x12\x12\n\x0ePRINCIPAL_USER\x10\x04\x12\r\n\tTARGET_IP\x10\x05\x12\x17\n\x13PRINCIPAL_FILE_HASH\x10\x06\x12\x15\n\x11PRINCIPAL_COUNTRY\x10\x07\x12\x15\n\x11SECURITY_CATEGORY\x10\x08\x12\x0f\n\x0bNETWORK_ASN\x10\t\x12\x1b\n\x17\x43LIENT_CERTIFICATE_HASH\x10\n\x12\x12\n\x0e\x44NS_QUERY_TYPE\x10\x0b\x12\x0e\n\nDNS_DOMAIN\x10\x0c\x12\x13\n\x0fHTTP_USER_AGENT\x10\r\x12\x0e\n\nEVENT_TYPE\x10\x0e\x12\x10\n\x0cPRODUCT_NAME\x10\x0f\x12\x16\n\x12PRODUCT_EVENT_TYPE\x10\x10\x12\x16\n\x12PARENT_FOLDER_PATH\x10\x11\x12\x18\n\x14TARGET_RESOURCE_NAME\x10\x12\x12\x19\n\x15PRINCIPAL_APPLICATION\x10\x13\x12\x16\n\x12TARGET_APPLICATION\x10\x14\x12\x14\n\x10\x45MAIL_TO_ADDRESS\x10\x15\x12\x16\n\x12\x45MAIL_FROM_ADDRESS\x10\x16\x12\x0b\n\x07MAIL_ID\x10\x17\x12\x10\n\x0cPRINCIPAL_IP\x10\x18\x12\x13\n\x0fSECURITY_ACTION\x10\x19\x12\x14\n\x10SECURITY_RULE_ID\x10\x1c\x12$\n TARGET_NETWORK_ORGANIZATION_NAME\x10\x1d\x12\'\n#PRINCIPAL_NETWORK_ORGANIZATION_NAME\x10\x1e\x12\x1f\n\x1bPRINCIPAL_PROCESS_FILE_PATH\x10\x1f\x12\x1f\n\x1bPRINCIPAL_PROCESS_FILE_HASH\x10 \x12\x1d\n\x19SECURITY_RESULT_RULE_NAME\x10!\x12\x1d\n\x19TARGET_RESOURCE_LABEL_KEY\x10\"\x12\x0f\n\x0bVENDOR_NAME\x10#\x12\x18\n\x14TARGET_RESOURCE_TYPE\x10$\x12\x18\n\x14TARGET_LOCATION_NAME\x10%\x12\x0c\n\x08LOG_TYPE\x10&\x12\x13\n\x0fTARGET_HOSTNAME\x10\'B\x96\x01\n\x14\x63om.google.backstoryB\x0b\x45ntityProtoP\x01Z5cloud.google.com/go/backstory/backstorypb;backstorypb\xaa\x02\x10Google.Backstory\xca\x02\x10Google\\Backstory\xea\x02\x11Google::Backstoryb\x06proto3"
 
 pool = Google::Protobuf::DescriptorPool.generated_pool
 
@@ -88,7 +88,7 @@ module Backstory
 # import "google/type/interval.proto";
 #
 # option csharp_namespace = "Google.Backstory";
-# option go_package = "google.golang.org/genproto/googleapis/backstory;backstory";
+# option go_package = "cloud.google.com/go/backstory/backstorypb;backstorypb";
 # option java_multiple_files = true;
 # option java_outer_classname = "EntityProto";
 # option java_package = "com.google.backstory";
diff --git a/google-backstory/lib/backstory/entity_risk_pb.rb b/google-backstory/lib/backstory/entity_risk_pb.rb
index 2753b7c..8b7b4f8 100644
--- a/google-backstory/lib/backstory/entity_risk_pb.rb
+++ b/google-backstory/lib/backstory/entity_risk_pb.rb
@@ -9,7 +9,7 @@
 require 'google/type/interval_pb'
 
 
-descriptor_data = "\n\x1b\x62\x61\x63kstory/entity_risk.proto\x12\x10google.backstory\x1a\x1egoogle/protobuf/duration.proto\x1a\x1fgoogle/protobuf/timestamp.proto\x1a\x1agoogle/type/interval.proto\"\xfe\x04\n\nEntityRisk\x12\x14\n\x0crisk_version\x18\x01 \x01(\t\x12*\n\x0brisk_window\x18\x02 \x01(\x0b\x32\x15.google.type.Interval\x12\x36\n\x15\x44\x45PRECATED_risk_score\x18\x03 \x01(\x05\x42\x02\x18\x01R\x13\x44\x45PRECATEDRiskScore\x12\x34\n\nrisk_delta\x18\x04 \x01(\x0b\x32\x1b.google.backstory.RiskDeltaH\x00\x88\x01\x01\x12\x18\n\x10\x64\x65tections_count\x18\x05 \x01(\x05\x12\x38\n\x14\x66irst_detection_time\x18\x06 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x37\n\x13last_detection_time\x18\x07 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x12\n\nrisk_score\x18\x08 \x01(\x02\x12\x1d\n\x15normalized_risk_score\x18\t \x01(\x05\x12\x33\n\x10risk_window_size\x18\n \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x38\n\x0eraw_risk_delta\x18\x0b \x01(\x0b\x32\x1b.google.backstory.RiskDeltaH\x01\x88\x01\x01\x12\x33\n\x0flast_reset_time\x18\x0c \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x12\n\ndetail_uri\x18\r \x01(\t\x12&\n\x1erisk_window_has_new_detections\x18\x0e \x01(\x08\x42\r\n\x0b_risk_deltaB\x11\n\x0f_raw_risk_delta\"\xa1\x01\n\tRiskDelta\x12;\n\x17previous_range_end_time\x18\x01 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x18\n\x10risk_score_delta\x18\x02 \x01(\x05\x12\x1b\n\x13previous_risk_score\x18\x03 \x01(\x05\x12 \n\x18risk_score_numeric_delta\x18\x04 \x01(\x05\x42\x9e\x01\n\x14\x63om.google.backstoryB\x0f\x45ntityRiskProtoP\x01Z9google.golang.org/genproto/googleapis/backstory;backstory\xaa\x02\x10Google.Backstory\xca\x02\x10Google\\Backstory\xea\x02\x11Google::Backstoryb\x06proto3"
+descriptor_data = "\n\x1b\x62\x61\x63kstory/entity_risk.proto\x12\x10google.backstory\x1a\x1egoogle/protobuf/duration.proto\x1a\x1fgoogle/protobuf/timestamp.proto\x1a\x1agoogle/type/interval.proto\"\xfe\x04\n\nEntityRisk\x12\x14\n\x0crisk_version\x18\x01 \x01(\t\x12*\n\x0brisk_window\x18\x02 \x01(\x0b\x32\x15.google.type.Interval\x12\x36\n\x15\x44\x45PRECATED_risk_score\x18\x03 \x01(\x05\x42\x02\x18\x01R\x13\x44\x45PRECATEDRiskScore\x12\x34\n\nrisk_delta\x18\x04 \x01(\x0b\x32\x1b.google.backstory.RiskDeltaH\x00\x88\x01\x01\x12\x18\n\x10\x64\x65tections_count\x18\x05 \x01(\x05\x12\x38\n\x14\x66irst_detection_time\x18\x06 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x37\n\x13last_detection_time\x18\x07 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x12\n\nrisk_score\x18\x08 \x01(\x02\x12\x1d\n\x15normalized_risk_score\x18\t \x01(\x05\x12\x33\n\x10risk_window_size\x18\n \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x38\n\x0eraw_risk_delta\x18\x0b \x01(\x0b\x32\x1b.google.backstory.RiskDeltaH\x01\x88\x01\x01\x12\x33\n\x0flast_reset_time\x18\x0c \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x12\n\ndetail_uri\x18\r \x01(\t\x12&\n\x1erisk_window_has_new_detections\x18\x0e \x01(\x08\x42\r\n\x0b_risk_deltaB\x11\n\x0f_raw_risk_delta\"\xa1\x01\n\tRiskDelta\x12;\n\x17previous_range_end_time\x18\x01 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x18\n\x10risk_score_delta\x18\x02 \x01(\x05\x12\x1b\n\x13previous_risk_score\x18\x03 \x01(\x05\x12 \n\x18risk_score_numeric_delta\x18\x04 \x01(\x05\x42\x9a\x01\n\x14\x63om.google.backstoryB\x0f\x45ntityRiskProtoP\x01Z5cloud.google.com/go/backstory/backstorypb;backstorypb\xaa\x02\x10Google.Backstory\xca\x02\x10Google\\Backstory\xea\x02\x11Google::Backstoryb\x06proto3"
 
 pool = Google::Protobuf::DescriptorPool.generated_pool
 
@@ -70,7 +70,7 @@ module Backstory
 # import "google/type/interval.proto";
 #
 # option csharp_namespace = "Google.Backstory";
-# option go_package = "google.golang.org/genproto/googleapis/backstory;backstory";
+# option go_package = "cloud.google.com/go/backstory/backstorypb;backstorypb";
 # option java_multiple_files = true;
 # option java_outer_classname = "EntityRiskProto";
 # option java_package = "com.google.backstory";
diff --git a/google-backstory/lib/backstory/id_pb.rb b/google-backstory/lib/backstory/id_pb.rb
index 7290918..f73dd48 100644
--- a/google-backstory/lib/backstory/id_pb.rb
+++ b/google-backstory/lib/backstory/id_pb.rb
@@ -5,7 +5,7 @@
 require 'google/protobuf'
 
 
-descriptor_data = "\n\x12\x62\x61\x63kstory/id.proto\x12\x10google.backstory\"\x9e\x02\n\x02Id\x12\x31\n\tnamespace\x18\x01 \x01(\x0e\x32\x1e.google.backstory.Id.Namespace\x12\n\n\x02id\x18\x02 \x01(\x0c\x12\x11\n\tstring_id\x18\x03 \x01(\t\"\xc5\x01\n\tNamespace\x12\x18\n\x14NORMALIZED_TELEMETRY\x10\x00\x12\x11\n\rRAW_TELEMETRY\x10\x01\x12\x13\n\x0fRULE_DETECTIONS\x10\x02\x12\r\n\tUPPERCASE\x10\x03\x12\x18\n\x14MACHINE_INTELLIGENCE\x10\x04\x12\x1b\n\x17SECURITY_COMMAND_CENTER\x10\x05\x12\x0f\n\x0bUNSPECIFIED\x10\x06\x12\x0e\n\nSOAR_ALERT\x10\x07\x12\x0f\n\x0bVIRUS_TOTAL\x10\x08\x42\x8d\x01\n\x14\x63om.google.backstoryP\x01Z9google.golang.org/genproto/googleapis/backstory;backstory\xaa\x02\x10Google.Backstory\xca\x02\x10Google\\Backstory\xea\x02\x11Google::Backstoryb\x06proto3"
+descriptor_data = "\n\x12\x62\x61\x63kstory/id.proto\x12\x10google.backstory\"\x9e\x02\n\x02Id\x12\x31\n\tnamespace\x18\x01 \x01(\x0e\x32\x1e.google.backstory.Id.Namespace\x12\n\n\x02id\x18\x02 \x01(\x0c\x12\x11\n\tstring_id\x18\x03 \x01(\t\"\xc5\x01\n\tNamespace\x12\x18\n\x14NORMALIZED_TELEMETRY\x10\x00\x12\x11\n\rRAW_TELEMETRY\x10\x01\x12\x13\n\x0fRULE_DETECTIONS\x10\x02\x12\r\n\tUPPERCASE\x10\x03\x12\x18\n\x14MACHINE_INTELLIGENCE\x10\x04\x12\x1b\n\x17SECURITY_COMMAND_CENTER\x10\x05\x12\x0f\n\x0bUNSPECIFIED\x10\x06\x12\x0e\n\nSOAR_ALERT\x10\x07\x12\x0f\n\x0bVIRUS_TOTAL\x10\x08\x42\x89\x01\n\x14\x63om.google.backstoryP\x01Z5cloud.google.com/go/backstory/backstorypb;backstorypb\xaa\x02\x10Google.Backstory\xca\x02\x10Google\\Backstory\xea\x02\x11Google::Backstoryb\x06proto3"
 
 pool = Google::Protobuf::DescriptorPool.generated_pool
 
@@ -59,7 +59,7 @@ module Backstory
 # package google.backstory;
 #
 # option csharp_namespace = "Google.Backstory";
-# option go_package = "google.golang.org/genproto/googleapis/backstory;backstory";
+# option go_package = "cloud.google.com/go/backstory/backstorypb;backstorypb";
 # option java_multiple_files = true;
 # option java_package = "com.google.backstory";
 # option php_namespace = "Google\\Backstory";
diff --git a/google-backstory/lib/backstory/udm_pb.rb b/google-backstory/lib/backstory/udm_pb.rb
index a2902b4..05132d4 100644
--- a/google-backstory/lib/backstory/udm_pb.rb
+++ b/google-backstory/lib/backstory/udm_pb.rb
@@ -14,7 +14,7 @@
 require 'google/type/latlng_pb'
 
 
-descriptor_data = "\n\x13\x62\x61\x63kstory/udm.proto\x12\x10google.backstory\x1a\x1b\x62\x61\x63kstory/data_access.proto\x1a\x1b\x62\x61\x63kstory/entity_risk.proto\x1a\x12\x62\x61\x63kstory/id.proto\x1a\x1egoogle/protobuf/duration.proto\x1a\x1cgoogle/protobuf/struct.proto\x1a\x1fgoogle/protobuf/timestamp.proto\x1a\x1agoogle/type/interval.proto\x1a\x18google/type/latlng.proto\"\xf3\x04\n\x03UDM\x12,\n\x08metadata\x18\x01 \x01(\x0b\x32\x1a.google.backstory.Metadata\x12+\n\nadditional\x18\x02 \x01(\x0b\x32\x17.google.protobuf.Struct\x12)\n\tprincipal\x18\x03 \x01(\x0b\x32\x16.google.backstory.Noun\x12#\n\x03src\x18\x04 \x01(\x0b\x32\x16.google.backstory.Noun\x12&\n\x06target\x18\x05 \x01(\x0b\x32\x16.google.backstory.Noun\x12,\n\x0cintermediary\x18\x06 \x03(\x0b\x32\x16.google.backstory.Noun\x12(\n\x08observer\x18\x07 \x01(\x0b\x32\x16.google.backstory.Noun\x12%\n\x05\x61\x62out\x18\x08 \x03(\x0b\x32\x16.google.backstory.Noun\x12\x39\n\x0fsecurity_result\x18\t \x03(\x0b\x32 .google.backstory.SecurityResult\x12*\n\x07network\x18\n \x01(\x0b\x32\x19.google.backstory.Network\x12\x30\n\nextensions\x18\x0b \x01(\x0b\x32\x1c.google.backstory.Extensions\x12*\n\textracted\x18\x0c \x01(\x0b\x32\x17.google.protobuf.Struct\x12\x35\n\x07grouped\x18\r \x01(\x0b\x32\x1f.google.backstory.GroupedFieldsH\x00\x88\x01\x01\x42\n\n\x08_groupedR\x03udmR\x06\x65ntityR\x05graph\"\xdc\'\n\x08Metadata\x12\n\n\x02id\x18\x0f \x01(\x0c\x12\x16\n\x0eproduct_log_id\x18\x01 \x01(\t\x12\x33\n\x0f\x65vent_timestamp\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12V\n\x1a\x65vent_timestamp_attributes\x18\x15 \x03(\x0e\x32\x32.google.backstory.Metadata.EventTimestampAttribute\x12\x37\n\x13\x63ollected_timestamp\x18\x03 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x36\n\x12ingested_timestamp\x18\x0b \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x38\n\nevent_type\x18\x04 \x01(\x0e\x32$.google.backstory.Metadata.EventType\x12\x13\n\x0bvendor_name\x18\x05 \x01(\t\x12\x14\n\x0cproduct_name\x18\x06 \x01(\t\x12\x17\n\x0fproduct_version\x18\x07 \x01(\t\x12\x1a\n\x12product_event_type\x18\x08 \x01(\t\x12\x1d\n\x15product_deployment_id\x18\x0e \x01(\t\x12\x13\n\x0b\x64\x65scription\x18\t \x01(\t\x12\x1b\n\x13url_back_to_product\x18\n \x01(\t\x12\x31\n\x10ingestion_labels\x18\x0c \x03(\x0b\x32\x17.google.backstory.Label\x12$\n\x04tags\x18\r \x01(\x0b\x32\x16.google.backstory.Tags\x12\x44\n\x10\x65nrichment_state\x18\x10 \x01(\x0e\x32*.google.backstory.Metadata.EnrichmentState\x12\x10\n\x08log_type\x18\x11 \x01(\t\x12\x37\n\x0b\x62\x61se_labels\x18\x12 \x01(\x0b\x32\".google.backstory.DataAccessLabels\x12=\n\x11\x65nrichment_labels\x18\x13 \x01(\x0b\x32\".google.backstory.DataAccessLabels\x12\x36\n\x11structured_fields\x18\x14 \x01(\x0b\x32\x17.google.protobuf.StructB\x02\x18\x01\x12\x16\n\x0eparser_version\x18\x16 \x01(\t\"\x83\x0b\n\x17\x45ventTimestampAttribute\x12)\n%EVENT_TIMESTAMP_ATTRIBUTE_UNSPECIFIED\x10\x00\x12\x1d\n\x15\x46ILE_LAST_ACCESS_TIME\x10\x01\x1a\x02\x08\x01\x12\x1f\n\x17\x46ILE_LAST_MODIFIED_TIME\x10\x02\x1a\x02\x08\x01\x12&\n\x1e\x46ILE_METADATA_LAST_CHANGE_TIME\x10\x03\x1a\x02\x08\x01\x12\x1a\n\x12\x46ILE_CREATION_TIME\x10\x04\x1a\x02\x08\x01\x12\x16\n\x0e\x43OLLECTED_TIME\x10\x05\x1a\x02\x08\x01\x12\r\n\tCOLLECTED\x10\x06\x12\x0c\n\x08\x41\x43\x43\x45SSED\x10\x07\x12\x0b\n\x07\x43HANGED\x10\x08\x12\x0b\n\x07\x43REATED\x10\t\x12\x16\n\x12\x46ILE_NAME_ACCESSED\x10\n\x12\x15\n\x11\x46ILE_NAME_CHANGED\x10\x0b\x12\x15\n\x11\x46ILE_NAME_CREATED\x10\x0c\x12\x1b\n\x17\x46ILE_NAME_LAST_ACCESSED\x10\r\x12\x1b\n\x17\x46ILE_NAME_LAST_MODIFIED\x10\x0e\x12#\n\x1f\x46ILE_NAME_METADATA_LAST_CHANGED\x10\x0f\x12\x16\n\x12\x46ILE_NAME_MODIFIED\x10\x10\x12\x11\n\rLAST_ACCESSED\x10\x11\x12\x11\n\rLAST_MODIFIED\x10\x12\x12\x19\n\x15METADATA_LAST_CHANGED\x10\x13\x12\x0c\n\x08MODIFIED\x10\x14\x12\t\n\x05\x41\x44\x44\x45\x44\x10\x15\x12\r\n\tBACKED_UP\x10\x16\x12\x12\n\x0eLAST_CONNECTED\x10\x17\x12\x0b\n\x07\x44\x45LETED\x10\x18\x12\t\n\x05\x45NDED\x10\x19\x12\n\n\x06\x45XITED\x10\x1a\x12\x0b\n\x07\x45XPIRED\x10\x1b\x12\x12\n\x0e\x46IRST_ACCESSED\x10\x1c\x12\x0c\n\x08\x41PPEARED\x10\x1d\x12\r\n\tINSTALLED\x10\x1e\x12\x0f\n\x0bLAST_ACTIVE\x10\x1f\x12\x12\n\x0eLAST_LOGGED_IN\x10 \x12\x16\n\x12LAST_LOGIN_ATTEMPT\x10!\x12\x15\n\x11LAST_PASSWORD_SET\x10\"\x12\x10\n\x0cLAST_PRINTED\x10#\x12\x10\n\x0cLAST_RESUMED\x10$\x12\x11\n\rLAST_EXECUTED\x10%\x12\r\n\tLAST_SEEN\x10&\x12\x11\n\rLAST_SHUTDOWN\x10\'\x12\x10\n\x0cLAST_UPDATED\x10(\x12\r\n\tLAST_USED\x10)\x12\x10\n\x0cLAST_VISITED\x10*\x12\n\n\x06LINKED\x10+\x12\x15\n\x11METADATA_MODIFIED\x10,\x12\x14\n\x10\x43ONTENT_MODIFIED\x10-\x12\r\n\tPURCHASED\x10.\x12\x0c\n\x08RECORDED\x10/\x12\x14\n\x10REQUEST_RECEIVED\x10\x30\x12\x11\n\rRESPONSE_SENT\x10\x31\x12\x14\n\x10SCHEDULED_TO_END\x10\x32\x12\x16\n\x12SCHEDULED_TO_START\x10\x33\x12\x08\n\x04SENT\x10\x34\x12\x0b\n\x07STARTED\x10\x35\x12\x0b\n\x07UPDATED\x10\x36\x12\r\n\tVALIDATED\x10\x37\x12\x13\n\x0fMOST_RECENT_RUN\x10\x38\x12\x0c\n\x08NEXT_RUN\x10\x39\x12\x0b\n\x07VISITED\x10:\x12\x12\n\x0eTARGET_CREATED\x10;\x12\x12\n\x0eVOLUME_CREATED\x10<\x12\x10\n\x0cPOST_CHECKED\x10=\x12\x10\n\x0cSYNCHRONIZED\x10>\x12\x10\n\x0cITEM_CREATED\x10?\x12\x11\n\rITEM_MODIFIED\x10@\x12\x17\n\x13\x44OCUMENT_LAST_SAVED\x10\x41\x12\x13\n\x0fLAST_REGISTERED\x10\x42\x12\x0c\n\x08LAUNCHED\x10\x43\x12\x11\n\rFIRST_VISITED\x10\x44\x12\x0e\n\nFIRST_SEEN\x10\x45\x12\x0e\n\nDOWNLOADED\x10\x46\"\xf0\x14\n\tEventType\x12\x19\n\x15\x45VENTTYPE_UNSPECIFIED\x10\x00\x12\x1a\n\x15PROCESS_UNCATEGORIZED\x10\x90N\x12\x13\n\x0ePROCESS_LAUNCH\x10\x91N\x12\x16\n\x11PROCESS_INJECTION\x10\x92N\x12!\n\x1cPROCESS_PRIVILEGE_ESCALATION\x10\x93N\x12\x18\n\x13PROCESS_TERMINATION\x10\x94N\x12\x11\n\x0cPROCESS_OPEN\x10\x95N\x12\x18\n\x13PROCESS_MODULE_LOAD\x10\x96N\x12\x1b\n\x16REGISTRY_UNCATEGORIZED\x10\xf8U\x12\x16\n\x11REGISTRY_CREATION\x10\xf9U\x12\x1a\n\x15REGISTRY_MODIFICATION\x10\xfaU\x12\x16\n\x11REGISTRY_DELETION\x10\xfbU\x12\x1a\n\x15SETTING_UNCATEGORIZED\x10\xe0]\x12\x15\n\x10SETTING_CREATION\x10\xe1]\x12\x19\n\x14SETTING_MODIFICATION\x10\xe2]\x12\x15\n\x10SETTING_DELETION\x10\xe3]\x12\x18\n\x13MUTEX_UNCATEGORIZED\x10\xc8\x65\x12\x13\n\x0eMUTEX_CREATION\x10\xc9\x65\x12\x17\n\x12\x46ILE_UNCATEGORIZED\x10\xb0m\x12\x12\n\rFILE_CREATION\x10\xb1m\x12\x12\n\rFILE_DELETION\x10\xb2m\x12\x16\n\x11\x46ILE_MODIFICATION\x10\xb3m\x12\x0e\n\tFILE_READ\x10\xb4m\x12\x0e\n\tFILE_COPY\x10\xb5m\x12\x0e\n\tFILE_OPEN\x10\xb6m\x12\x0e\n\tFILE_MOVE\x10\xb7m\x12\x0e\n\tFILE_SYNC\x10\xb8m\x12\x17\n\x12USER_UNCATEGORIZED\x10\x98u\x12\x0f\n\nUSER_LOGIN\x10\x99u\x12\x10\n\x0bUSER_LOGOUT\x10\x9au\x12\x12\n\rUSER_CREATION\x10\x9bu\x12\x19\n\x14USER_CHANGE_PASSWORD\x10\x9cu\x12\x1c\n\x17USER_CHANGE_PERMISSIONS\x10\x9du\x12\x13\n\nUSER_STATS\x10\x9eu\x1a\x02\x08\x01\x12\x12\n\rUSER_BADGE_IN\x10\x9fu\x12\x12\n\rUSER_DELETION\x10\xa0u\x12\x1b\n\x16USER_RESOURCE_CREATION\x10\xa1u\x12!\n\x1cUSER_RESOURCE_UPDATE_CONTENT\x10\xa2u\x12%\n USER_RESOURCE_UPDATE_PERMISSIONS\x10\xa3u\x12\x17\n\x12USER_COMMUNICATION\x10\xa4u\x12\x19\n\x14USER_RESOURCE_ACCESS\x10\xa5u\x12\x1b\n\x16USER_RESOURCE_DELETION\x10\xa6u\x12\x19\n\x13GROUP_UNCATEGORIZED\x10\xd8\xb3\x01\x12\x14\n\x0eGROUP_CREATION\x10\xd9\xb3\x01\x12\x14\n\x0eGROUP_DELETION\x10\xda\xb3\x01\x12\x18\n\x12GROUP_MODIFICATION\x10\xdb\xb3\x01\x12\x19\n\x13\x45MAIL_UNCATEGORIZED\x10\xb8\x94\x01\x12\x17\n\x11\x45MAIL_TRANSACTION\x10\xb9\x94\x01\x12\x19\n\x0f\x45MAIL_URL_CLICK\x10\xba\x94\x01\x1a\x02\x08\x01\x12\x1a\n\x15NETWORK_UNCATEGORIZED\x10\x80}\x12\x11\n\x0cNETWORK_FLOW\x10\x81}\x12\x17\n\x12NETWORK_CONNECTION\x10\x82}\x12\x10\n\x0bNETWORK_FTP\x10\x83}\x12\x11\n\x0cNETWORK_DHCP\x10\x84}\x12\x10\n\x0bNETWORK_DNS\x10\x85}\x12\x11\n\x0cNETWORK_HTTP\x10\x86}\x12\x11\n\x0cNETWORK_SMTP\x10\x87}\x12\x1a\n\x14STATUS_UNCATEGORIZED\x10\xe8\x84\x01\x12\x16\n\x10STATUS_HEARTBEAT\x10\xe9\x84\x01\x12\x14\n\x0eSTATUS_STARTUP\x10\xea\x84\x01\x12\x15\n\x0fSTATUS_SHUTDOWN\x10\xeb\x84\x01\x12\x13\n\rSTATUS_UPDATE\x10\xec\x84\x01\x12\x18\n\x12SCAN_UNCATEGORIZED\x10\xd0\x8c\x01\x12\x0f\n\tSCAN_FILE\x10\xd1\x8c\x01\x12 \n\x16SCAN_PROCESS_BEHAVIORS\x10\xd2\x8c\x01\x1a\x02\x08\x01\x12\x12\n\x0cSCAN_PROCESS\x10\xd3\x8c\x01\x12\x0f\n\tSCAN_HOST\x10\xd4\x8c\x01\x12\x14\n\x0eSCAN_VULN_HOST\x10\xd5\x8c\x01\x12\x17\n\x11SCAN_VULN_NETWORK\x10\xd6\x8c\x01\x12\x12\n\x0cSCAN_NETWORK\x10\xd7\x8c\x01\x12\"\n\x1cSCHEDULED_TASK_UNCATEGORIZED\x10\xa0\x9c\x01\x12\x1d\n\x17SCHEDULED_TASK_CREATION\x10\xa1\x9c\x01\x12\x1d\n\x17SCHEDULED_TASK_DELETION\x10\xa2\x9c\x01\x12\x1b\n\x15SCHEDULED_TASK_ENABLE\x10\xa3\x9c\x01\x12\x1c\n\x16SCHEDULED_TASK_DISABLE\x10\xa4\x9c\x01\x12!\n\x1bSCHEDULED_TASK_MODIFICATION\x10\xa5\x9c\x01\x12$\n\x1eSYSTEM_AUDIT_LOG_UNCATEGORIZED\x10\x88\xa4\x01\x12\x1b\n\x15SYSTEM_AUDIT_LOG_WIPE\x10\x89\xa4\x01\x12\x19\n\x13SERVICE_UNSPECIFIED\x10\xf0\xab\x01\x12\x16\n\x10SERVICE_CREATION\x10\xf1\xab\x01\x12\x16\n\x10SERVICE_DELETION\x10\xf2\xab\x01\x12\x13\n\rSERVICE_START\x10\xf3\xab\x01\x12\x12\n\x0cSERVICE_STOP\x10\xf4\xab\x01\x12\x1a\n\x14SERVICE_MODIFICATION\x10\xf5\xab\x01\x12\x13\n\rGENERIC_EVENT\x10\xa0\x8d\x06\x12\x15\n\x11RESOURCE_CREATION\x10\x01\x12\x15\n\x11RESOURCE_DELETION\x10\x02\x12\x1f\n\x1bRESOURCE_PERMISSIONS_CHANGE\x10\x03\x12\x11\n\rRESOURCE_READ\x10\x04\x12\x14\n\x10RESOURCE_WRITTEN\x10\x05\x12\x1c\n\x16\x44\x45VICE_FIRMWARE_UPDATE\x10\xa8\xc3\x01\x12\x1a\n\x14\x44\x45VICE_CONFIG_UPDATE\x10\xa9\xc3\x01\x12\x1b\n\x15\x44\x45VICE_PROGRAM_UPLOAD\x10\xaa\xc3\x01\x12\x1d\n\x17\x44\x45VICE_PROGRAM_DOWNLOAD\x10\xab\xc3\x01\x12\x1c\n\x16\x41NALYST_UPDATE_VERDICT\x10\xc0\xbb\x01\x12\x1f\n\x19\x41NALYST_UPDATE_REPUTATION\x10\xc1\xbb\x01\x12#\n\x1d\x41NALYST_UPDATE_SEVERITY_SCORE\x10\xc2\xbb\x01\x12\x1b\n\x15\x41NALYST_UPDATE_STATUS\x10\xc7\xbb\x01\x12\x19\n\x13\x41NALYST_ADD_COMMENT\x10\xc8\xbb\x01\x12\x1d\n\x17\x41NALYST_UPDATE_PRIORITY\x10\xc9\xbb\x01\x12\x1f\n\x19\x41NALYST_UPDATE_ROOT_CAUSE\x10\xca\xbb\x01\x12\x1b\n\x15\x41NALYST_UPDATE_REASON\x10\xcb\xbb\x01\x12\x1f\n\x19\x41NALYST_UPDATE_RISK_SCORE\x10\xcc\xbb\x01\x12\x18\n\x12\x45NTITY_RISK_CHANGE\x10\x90\xcb\x01\x12\'\n!TRIAGE_AGENT_UPDATE_INVESTIGATION\x10\xf8\xd2\x01\"Q\n\x0f\x45nrichmentState\x12 \n\x1c\x45NRICHMENT_STATE_UNSPECIFIED\x10\x00\x12\x0c\n\x08\x45NRICHED\x10\x01\x12\x0e\n\nUNENRICHED\x10\x02\"\xa0\x02\n\tAttribute\x12&\n\x05\x63loud\x18\x01 \x01(\x0b\x32\x17.google.backstory.Cloud\x12\'\n\x06labels\x18\x02 \x03(\x0b\x32\x17.google.backstory.Label\x12\x32\n\x0bpermissions\x18\xc1\x05 \x03(\x0b\x32\x1c.google.backstory.Permission\x12%\n\x05roles\x18\x03 \x03(\x0b\x32\x16.google.backstory.Role\x12\x31\n\rcreation_time\x18\x04 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x34\n\x10last_update_time\x18\x05 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\"\xc3\x12\n\x07Network\x12\x12\n\nsent_bytes\x18\x01 \x01(\x04\x12\x16\n\x0ereceived_bytes\x18\x02 \x01(\x04\x12\x13\n\x0btotal_bytes\x18\x1b \x01(\x03\x12\x14\n\x0csent_packets\x18\x16 \x01(\x03\x12\x18\n\x10received_packets\x18\x17 \x01(\x03\x12\x33\n\x10session_duration\x18\r \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x12\n\nsession_id\x18\x0e \x01(\t\x12\x19\n\x11parent_session_id\x18\x14 \x01(\t\x12$\n\x1c\x61pplication_protocol_version\x18\x15 \x01(\t\x12\x14\n\x0c\x63ommunity_id\x18\x0f \x01(\t\x12\x36\n\tdirection\x18\x0c \x01(\x0e\x32#.google.backstory.Network.Direction\x12\x39\n\x0bip_protocol\x18\x03 \x01(\x0e\x32$.google.backstory.Network.IpProtocol\x12\x0c\n\x04ipv6\x18\x1d \x01(\x08\x12K\n\x14\x61pplication_protocol\x18\x04 \x01(\x0e\x32-.google.backstory.Network.ApplicationProtocol\x12\"\n\x03\x66tp\x18\x05 \x01(\x0b\x32\x15.google.backstory.Ftp\x12&\n\x05\x65mail\x18\x06 \x01(\x0b\x32\x17.google.backstory.Email\x12\"\n\x03\x64ns\x18\x07 \x01(\x0b\x32\x15.google.backstory.Dns\x12$\n\x04\x64hcp\x18\x08 \x01(\x0b\x32\x16.google.backstory.Dhcp\x12$\n\x04http\x18\t \x01(\x0b\x32\x16.google.backstory.Http\x12\"\n\x03tls\x18\n \x01(\x0b\x32\x15.google.backstory.Tls\x12$\n\x04smtp\x18\x0b \x01(\x0b\x32\x16.google.backstory.Smtp\x12\x0b\n\x03\x61sn\x18\x10 \x01(\t\x12\x12\n\ndns_domain\x18\x11 \x01(\t\x12\x14\n\x0c\x63\x61rrier_name\x18\x12 \x01(\t\x12\x19\n\x11organization_name\x18\x13 \x01(\t\x12\x17\n\x0fip_subnet_range\x18\x18 \x01(\t\x12\x10\n\x08is_proxy\x18\x19 \x01(\x08\x12/\n\nproxy_info\x18\x1a \x01(\x0b\x32\x1b.google.backstory.ProxyInfo\x12\x43\n\x10\x63onnection_state\x18\x1c \x01(\x0e\x32).google.backstory.Network.ConnectionState\"L\n\tDirection\x12\x15\n\x11UNKNOWN_DIRECTION\x10\x00\x12\x0b\n\x07INBOUND\x10\x01\x12\x0c\n\x08OUTBOUND\x10\x02\x12\r\n\tBROADCAST\x10\x03\"\xaa\x01\n\nIpProtocol\x12\x17\n\x13UNKNOWN_IP_PROTOCOL\x10\x00\x12\x08\n\x04ICMP\x10\x01\x12\x08\n\x04IGMP\x10\x02\x12\x07\n\x03TCP\x10\x06\x12\x07\n\x03UDP\x10\x11\x12\n\n\x06IP6IN4\x10)\x12\x07\n\x03GRE\x10/\x12\x07\n\x03\x45SP\x10\x32\x12\t\n\x05ICMP6\x10:\x12\t\n\x05\x45IGRP\x10X\x12\x0b\n\x07\x45THERIP\x10\x61\x12\x07\n\x03PIM\x10g\x12\x08\n\x04VRRP\x10p\x12\t\n\x04SCTP\x10\x84\x01\"\x97\x07\n\x13\x41pplicationProtocol\x12 \n\x1cUNKNOWN_APPLICATION_PROTOCOL\x10\x00\x12\x07\n\x03\x41\x46P\x10\x01\x12\x08\n\x04\x41PPC\x10\x02\x12\x08\n\x04\x41MQP\x10\x03\x12\x08\n\x04\x41TOM\x10\x04\x12\x08\n\x04\x42\x45\x45P\x10\x05\x12\x0b\n\x07\x42ITCOIN\x10\x06\x12\x0f\n\x0b\x42IT_TORRENT\x10\x07\x12\x08\n\x04\x43\x46\x44P\x10\x08\x12\x07\n\x03\x43IP\x10\x43\x12\x08\n\x04\x43OAP\x10\t\x12\x08\n\x04\x43OTP\x10\x44\x12\n\n\x06\x44\x43\x45RPC\x10\x42\x12\x07\n\x03\x44\x44S\x10\n\x12\x0e\n\nDEVICE_NET\x10\x0b\x12\t\n\x04\x44HCP\x10\xa0\x1f\x12\t\n\x05\x44ICOM\x10\x45\x12\x08\n\x04\x44NP3\x10\x46\x12\x08\n\x03\x44NS\x10\xb8\x17\x12\x0c\n\x08\x45_DONKEY\x10\x0c\x12\x08\n\x04\x45NRP\x10\r\x12\x0e\n\nFAST_TRACK\x10\x0e\x12\n\n\x06\x46INGER\x10\x0f\x12\x0b\n\x07\x46REENET\x10\x10\x12\x08\n\x04\x46TAM\x10\x11\x12\t\n\x05GOOSE\x10G\x12\n\n\x06GOPHER\x10\x12\x12\x08\n\x04GRPC\x10M\x12\x07\n\x03HL7\x10\x13\x12\x08\n\x04H323\x10\x14\x12\t\n\x04HTTP\x10\xd0\x0f\x12\n\n\x05HTTPS\x10\xd1\x0f\x12\n\n\x06IEC104\x10H\x12\x08\n\x04IRCP\x10\x15\x12\x0c\n\x08KADEMLIA\x10\x16\x12\x08\n\x04KRB5\x10\x41\x12\x08\n\x04LDAP\x10\x17\x12\x07\n\x03LPD\x10\x18\x12\x08\n\x04MIME\x10\x19\x12\x07\n\x03MMS\x10I\x12\n\n\x06MODBUS\x10\x1a\x12\x08\n\x04MQTT\x10\x1b\x12\x0b\n\x07NETCONF\x10\x1c\x12\x07\n\x03NFS\x10\x1d\x12\x07\n\x03NIS\x10\x1e\x12\x08\n\x04NNTP\x10\x1f\x12\t\n\x05NTCIP\x10 \x12\x07\n\x03NTP\x10!\x12\t\n\x05OSCAR\x10\"\x12\x08\n\x04PNRP\x10#\x12\x07\n\x03PTP\x10J\x12\t\n\x04QUIC\x10\xe8\x07\x12\x07\n\x03RDP\x10$\x12\x08\n\x04RELP\x10%\x12\x07\n\x03RIP\x10&\x12\n\n\x06RLOGIN\x10\'\x12\x07\n\x03RPC\x10(\x12\x08\n\x04RTMP\x10)\x12\x07\n\x03RTP\x10*\x12\x08\n\x04RTPS\x10+\x12\x08\n\x04RTSP\x10,\x12\x07\n\x03SAP\x10-\x12\x07\n\x03SDP\x10.\x12\x07\n\x03SIP\x10/\x12\x07\n\x03SLP\x10\x30\x12\x07\n\x03SMB\x10\x31\x12\x08\n\x04SMTP\x10\x32\x12\x08\n\x04SNMP\x10K\x12\x08\n\x04SNTP\x10\x33\x12\x07\n\x03SSH\x10\x34\x12\x08\n\x04SSMS\x10\x35\x12\x08\n\x04STYX\x10\x36\x12\x06\n\x02SV\x10L\x12\x08\n\x04TCAP\x10\x37\x12\x07\n\x03TDS\x10\x38\x12\x07\n\x03TOR\x10\x39\x12\x07\n\x03TSP\x10:\x12\x07\n\x03VTP\x10;\x12\t\n\x05WHOIS\x10<\x12\x0b\n\x07WEB_DAV\x10=\x12\x08\n\x04X400\x10>\x12\x08\n\x04X500\x10?\x12\x08\n\x04XMPP\x10@\x12\x07\n\x03\x46TP\x10N\"\xca\x01\n\x0f\x43onnectionState\x12 \n\x1c\x43ONNECTION_STATE_UNSPECIFIED\x10\x00\x12\r\n\tLISTENING\x10\x01\x12\x0f\n\x0b\x45STABLISHED\x10\x02\x12\r\n\tTIME_WAIT\x10\x03\x12\x0e\n\nCLOSE_WAIT\x10\x04\x12\n\n\x06\x43LOSED\x10\x05\x12\x0c\n\x08SYN_SENT\x10\x06\x12\x10\n\x0cSYN_RECEIVED\x10\x07\x12\r\n\tFIN_WAIT1\x10\x08\x12\r\n\tFIN_WAIT2\x10\t\x12\x0c\n\x08LAST_ACK\x10\n\"\x8f\x02\n\tProxyInfo\x12\x11\n\tanonymous\x18\x01 \x01(\x08\x12\x15\n\ranonymous_vpn\x18\x02 \x01(\x08\x12\x14\n\x0cpublic_proxy\x18\x03 \x01(\x08\x12\x15\n\rtor_exit_node\x18\x04 \x01(\x08\x12\x17\n\x0fsmart_dns_proxy\x18\x05 \x01(\x08\x12\x18\n\x10hosting_provider\x18\x06 \x01(\x08\x12\x16\n\x0evpn_datacenter\x18\x07 \x01(\x08\x12\x19\n\x11residential_proxy\x18\x08 \x01(\x08\x12\x18\n\x10vpn_service_name\x18\t \x01(\t\x12\x16\n\x0eproxy_over_vpn\x18\n \x01(\x08\x12\x13\n\x0brelay_proxy\x18\x0b \x01(\x08\"\xa3\x04\n\nExtensions\x12.\n\x04\x61uth\x18\x01 \x01(\x0b\x32 .google.backstory.Authentication\x12\x30\n\x05vulns\x18\x02 \x01(\x0b\x32!.google.backstory.Vulnerabilities\x12\x31\n\x0b\x65ntity_risk\x18\x03 \x01(\x0b\x32\x1c.google.backstory.EntityRisk\x12/\n\nlinux_utmp\x18\x04 \x01(\x0b\x32\x1b.google.backstory.LinuxUtmp\x12<\n\x11windows_event_log\x18\x05 \x01(\x0b\x32!.google.backstory.WindowsEventLog\x12\x37\n\x0eresource_usage\x18\x06 \x01(\x0b\x32\x1f.google.backstory.ResourceUsage\x12\x42\n\x14system_event_details\x18\x07 \x01(\x0b\x32$.google.backstory.SystemEventDetails\x12;\n\x10outlook_metadata\x18\x08 \x01(\x0b\x32!.google.backstory.OutlookMetadata\x12$\n\x04srum\x18\t \x01(\x0b\x32\x16.google.backstory.Srum\x12\x31\n\x0buser_assist\x18\n \x01(\x0b\x32\x1c.google.backstory.UserAssist\"\xfb\x06\n\x0e\x41uthentication\x12\x37\n\x04type\x18\x01 \x01(\x0e\x32).google.backstory.Authentication.AuthType\x12=\n\tmechanism\x18\x02 \x03(\x0e\x32*.google.backstory.Authentication.Mechanism\x12\x14\n\x0c\x61uth_details\x18\x03 \x01(\t\x12\x39\n\x07outcome\x18\x04 \x01(\x0e\x32(.google.backstory.Authentication.Outcome\"]\n\x08\x41uthType\x12\x18\n\x14\x41UTHTYPE_UNSPECIFIED\x10\x00\x12\x0b\n\x07MACHINE\x10\x01\x12\x07\n\x03SSO\x10\x02\x12\x07\n\x03VPN\x10\x03\x12\x0c\n\x08PHYSICAL\x10\x04\x12\n\n\x06TACACS\x10\x05\"\x84\x03\n\tMechanism\x12\x19\n\x15MECHANISM_UNSPECIFIED\x10\x00\x12\x15\n\x11USERNAME_PASSWORD\x10\x01\x12\x07\n\x03OTP\x10\x02\x12\x10\n\x0cHARDWARE_KEY\x10\x03\x12\t\n\x05LOCAL\x10\x04\x12\n\n\x06REMOTE\x10\x05\x12\x16\n\x12REMOTE_INTERACTIVE\x10\x06\x12\x13\n\x0fMECHANISM_OTHER\x10\x07\x12\x10\n\x0c\x42\x41\x44GE_READER\x10\x08\x12\x0b\n\x07NETWORK\x10\t\x12\t\n\x05\x42\x41TCH\x10\n\x12\x0b\n\x07SERVICE\x10\x0b\x12\n\n\x06UNLOCK\x10\x0c\x12\x16\n\x12NETWORK_CLEAR_TEXT\x10\r\x12\x13\n\x0fNEW_CREDENTIALS\x10\x0e\x12\x0f\n\x0bINTERACTIVE\x10\x0f\x12\x16\n\x12\x43\x41\x43HED_INTERACTIVE\x10\x10\x12\x1d\n\x19\x43\x41\x43HED_REMOTE_INTERACTIVE\x10\x11\x12\x11\n\rCACHED_UNLOCK\x10\x12\x12\r\n\tBIOMETRIC\x10\x13\x12\x0c\n\x08WEARABLE\x10\x14\"|\n\x14\x41uthenticationStatus\x12!\n\x1dUNKNOWN_AUTHENTICATION_STATUS\x10\x00\x12\n\n\x06\x41\x43TIVE\x10\x01\x12\r\n\tSUSPENDED\x10\x02\x12\x19\n\x15NO_ACTIVE_CREDENTIALS\x10\x03\x12\x0b\n\x07\x44\x45LETED\x10\x04\"<\n\x07Outcome\x12\x17\n\x13OUTCOME_UNSPECIFIED\x10\x00\x12\x0b\n\x07SUCCESS\x10\x01\x12\x0b\n\x07\x46\x41ILURE\x10\x02\"\x85\x02\n\tLinuxUtmp\x12;\n\x0brecord_type\x18\x01 \x01(\x0e\x32&.google.backstory.LinuxUtmp.RecordType\"\xba\x01\n\nRecordType\x12\x1b\n\x17RECORD_TYPE_UNSPECIFIED\x10\x00\x12\x0b\n\x07RUN_LVL\x10\x01\x12\r\n\tBOOT_TIME\x10\x02\x12\x0c\n\x08NEW_TIME\x10\x03\x12\x0c\n\x08OLD_TIME\x10\x04\x12\x10\n\x0cINIT_PROCESS\x10\x05\x12\x11\n\rLOGIN_PROCESS\x10\x06\x12\x10\n\x0cUSER_PROCESS\x10\x07\x12\x10\n\x0c\x44\x45\x41\x44_PROCESS\x10\x08\x12\x0e\n\nACCOUNTING\x10\t\"\xef\x01\n\x0fWindowsEventLog\x12:\n\x07\x63hannel\x18\x01 \x01(\x0e\x32).google.backstory.WindowsEventLog.Channel\x12\x10\n\x08\x65vent_id\x18\x02 \x01(\t\x12\x13\n\x0b\x61\x63tivity_id\x18\x03 \x01(\t\"y\n\x07\x43hannel\x12\x17\n\x13\x43HANNEL_UNSPECIFIED\x10\x00\x12\x0c\n\x08SECURITY\x10\x01\x12\n\n\x06SYSTEM\x10\x02\x12\x0f\n\x0b\x41PPLICATION\x10\x03\x12\t\n\x05SETUP\x10\x04\x12\x14\n\x10\x46ORWARDED_EVENTS\x10\x05\x12\t\n\x05OTHER\x10\x06\"<\n\rResourceUsage\x12\x13\n\x0bused_entity\x18\x01 \x01(\t\x12\x16\n\x0eused_entity_id\x18\x02 \x01(\t\"V\n\x12SystemEventDetails\x12\x14\n\x0cmessage_type\x18\x01 \x01(\t\x12\x17\n\x0fsender_image_id\x18\x02 \x01(\t\x12\x11\n\tsubsystem\x18\x03 \x01(\t\"a\n\x0fOutlookMetadata\x12\x0f\n\x07\x63omment\x18\x01 \x01(\t\x12\x10\n\x08template\x18\x02 \x01(\t\x12\r\n\x05title\x18\x03 \x01(\t\x12\x1c\n\x14security_flags_count\x18\x04 \x01(\x05\"\x9b\x02\n\x04Srum\x12\n\n\x02id\x18\x01 \x01(\t\x12\x1d\n\x15\x62\x61\x63kground_bytes_read\x18\x02 \x01(\x03\x12 \n\x18\x62\x61\x63kground_bytes_written\x18\x03 \x01(\x03\x12#\n\x1b\x62\x61\x63kground_context_switches\x18\x04 \x01(\x03\x12\x1e\n\x16\x62\x61\x63kground_cycle_count\x18\x05 \x01(\x03\x12 \n\x18\x62\x61\x63kground_flushes_count\x18\x06 \x01(\x03\x12\"\n\x1a\x62\x61\x63kground_read_operations\x18\x07 \x01(\x03\x12#\n\x1b\x62\x61\x63kground_write_operations\x18\x08 \x01(\x03\x12\x16\n\x0einterface_luid\x18\t \x01(\t\"\x9b\x01\n\nUserAssist\x12\x1f\n\x17\x61pplication_focus_count\x18\x01 \x01(\x03\x12=\n\x1a\x61pplication_focus_duration\x18\x02 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x18\n\x10\x65xecutions_count\x18\x03 \x01(\x03\x12\x13\n\x0b\x65ntry_index\x18\x04 \x01(\x03\"O\n\x0fVulnerabilities\x12<\n\x0fvulnerabilities\x18\x01 \x03(\x0b\x32\x1f.google.backstory.VulnerabilityB\x02\x10\x00\"\x8f\x05\n\rVulnerability\x12%\n\x05\x61\x62out\x18\x01 \x01(\x0b\x32\x16.google.backstory.Noun\x12\x0c\n\x04name\x18\x02 \x01(\t\x12\x13\n\x0b\x64\x65scription\x18\x03 \x01(\t\x12\x0e\n\x06vendor\x18\r \x01(\t\x12\x33\n\x0fscan_start_time\x18\x04 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x31\n\rscan_end_time\x18\x05 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12/\n\x0b\x66irst_found\x18\x06 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12.\n\nlast_found\x18\x07 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12:\n\x08severity\x18\x08 \x01(\x0e\x32(.google.backstory.Vulnerability.Severity\x12\x18\n\x10severity_details\x18\t \x01(\t\x12\x17\n\x0f\x63vss_base_score\x18\n \x01(\x02\x12\x13\n\x0b\x63vss_vector\x18\x0b \x01(\t\x12\x14\n\x0c\x63vss_version\x18\x0c \x01(\t\x12\x0e\n\x06\x63ve_id\x18\x0e \x01(\t\x12\x17\n\x0f\x63ve_description\x18\x0f \x01(\t\x12\x1f\n\x17vendor_vulnerability_id\x18\x10 \x01(\t\x12(\n vendor_knowledge_base_article_id\x18\x11 \x01(\t\"M\n\x08Severity\x12\x14\n\x10UNKNOWN_SEVERITY\x10\x00\x12\x07\n\x03LOW\x10\x01\x12\n\n\x06MEDIUM\x10\x02\x12\x08\n\x04HIGH\x10\x03\x12\x0c\n\x08\x43RITICAL\x10\x04\"\x16\n\x03\x46tp\x12\x0f\n\x07\x63ommand\x18\x01 \x01(\t\"\x8b\x01\n\x04Smtp\x12\x0c\n\x04helo\x18\x01 \x01(\t\x12\x11\n\tmail_from\x18\x02 \x01(\t\x12\x0f\n\x07rcpt_to\x18\x03 \x03(\t\x12\x17\n\x0fserver_response\x18\x04 \x03(\t\x12\x14\n\x0cmessage_path\x18\x05 \x01(\t\x12\x12\n\nis_webmail\x18\x06 \x01(\x08\x12\x0e\n\x06is_tls\x18\x07 \x01(\x08\"\x86\x01\n\x05\x45mail\x12\x0c\n\x04\x66rom\x18\x01 \x01(\t\x12\x10\n\x08reply_to\x18\x02 \x01(\t\x12\n\n\x02to\x18\x03 \x03(\t\x12\n\n\x02\x63\x63\x18\x04 \x03(\t\x12\x0b\n\x03\x62\x63\x63\x18\x05 \x03(\t\x12\x0f\n\x07mail_id\x18\x06 \x01(\t\x12\x0f\n\x07subject\x18\x07 \x03(\t\x12\x16\n\x0e\x62ounce_address\x18\x08 \x01(\t\"\xf4\x07\n\x07Process\x12\x0b\n\x03pid\x18\x01 \x01(\t\x12\x16\n\nparent_pid\x18\x02 \x01(\tB\x02\x18\x01\x12\x31\n\x0eparent_process\x18\x07 \x01(\x0b\x32\x19.google.backstory.Process\x12$\n\x04\x66ile\x18\x03 \x01(\x0b\x32\x16.google.backstory.File\x12\x14\n\x0c\x63ommand_line\x18\x04 \x01(\t\x12\x1c\n\x14\x63ommand_line_history\x18\t \x03(\t\x12#\n\x1bproduct_specific_process_id\x18\x05 \x01(\t\x12\x13\n\x0b\x61\x63\x63\x65ss_mask\x18\x08 \x01(\x04\x12\x1b\n\x13integrity_level_rid\x18\x0b \x01(\x04\x12\x0c\n\x04\x65uid\x18\x0c \x01(\t\x12\x0c\n\x04ruid\x18\r \x01(\t\x12\x0c\n\x04\x65gid\x18\x0e \x01(\t\x12\x0c\n\x04rgid\x18\x0f \x01(\t\x12\x0c\n\x04pgid\x18\x10 \x01(\t\x12\x1a\n\x12session_leader_pid\x18\x11 \x01(\t\x12\x0b\n\x03tty\x18\x12 \x01(\t\x12J\n\x14token_elevation_type\x18\n \x01(\x0e\x32,.google.backstory.Process.TokenElevationType\x12.\n\"product_specific_parent_process_id\x18\x06 \x01(\tB\x02\x18\x01\x12\x0c\n\x04ipv6\x18\x13 \x01(\x08\x12\x32\n\x0fkernel_duration\x18\x14 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x30\n\ruser_duration\x18\x15 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x30\n\rreal_duration\x18\x16 \x01(\x0b\x32\x19.google.protobuf.Duration\x12.\n\x05state\x18\x17 \x01(\x0e\x32\x1f.google.backstory.Process.State\"E\n\x12TokenElevationType\x12\x0b\n\x07UNKNOWN\x10\x00\x12\n\n\x06TYPE_1\x10\x01\x12\n\n\x06TYPE_2\x10\x02\x12\n\n\x06TYPE_3\x10\x03\"\xd7\x01\n\x05State\x12\x15\n\x11STATE_UNSPECIFIED\x10\x00\x12\x0b\n\x07RUNNING\x10\x01\x12\x0c\n\x08SLEEPING\x10\x02\x12\x0e\n\nDISK_SLEEP\x10\x03\x12\x0b\n\x07STOPPED\x10\x04\x12\x10\n\x0cTRACING_STOP\x10\x05\x12\n\n\x06ZOMBIE\x10\x06\x12\x08\n\x04\x44\x45\x41\x44\x10\x07\x12\r\n\tWAKE_KILL\x10\x08\x12\n\n\x06WAKING\x10\t\x12\n\n\x06PARKED\x10\n\x12\x08\n\x04IDLE\x10\x0b\x12\n\n\x06LOCKED\x10\x0c\x12\x0b\n\x07WAITING\x10\r\x12\r\n\tSUSPENDED\x10\x0e\"%\n\x11\x41nalyticsMetadata\x12\x10\n\x08\x61nalytic\x18\x01 \x01(\t\"\xc2\x05\n\x0f\x46indingVariable\x12\x34\n\x04type\x18\x01 \x01(\x0e\x32&.google.backstory.FindingVariable.Type\x12\r\n\x05value\x18\x02 \x01(\t\x12\x13\n\x0bsource_path\x18\x03 \x01(\t\x12\x12\n\x08\x62ool_val\x18\x04 \x01(\x08H\x00\x12\x13\n\tbytes_val\x18\x05 \x01(\x0cH\x00\x12\x14\n\ndouble_val\x18\x06 \x01(\x01H\x00\x12\x13\n\tint64_val\x18\x07 \x01(\x03H\x00\x12\x14\n\nuint64_val\x18\x08 \x01(\x04H\x00\x12\x14\n\nstring_val\x18\t \x01(\tH\x00\x12\x34\n\x0etimestamp_time\x18\x11 \x01(\x0b\x32\x1a.google.protobuf.TimestampH\x00\x12\x12\n\x08null_val\x18\n \x01(\x08H\x00\x12\x32\n\x08\x62ool_seq\x18\x0b \x01(\x0b\x32\x1e.google.backstory.BoolSequenceH\x00\x12\x34\n\tbytes_seq\x18\x0c \x01(\x0b\x32\x1f.google.backstory.BytesSequenceH\x00\x12\x36\n\ndouble_seq\x18\r \x01(\x0b\x32 .google.backstory.DoubleSequenceH\x00\x12\x34\n\tint64_seq\x18\x0e \x01(\x0b\x32\x1f.google.backstory.Int64SequenceH\x00\x12\x36\n\nuint64_seq\x18\x0f \x01(\x0b\x32 .google.backstory.Uint64SequenceH\x00\x12\x36\n\nstring_seq\x18\x10 \x01(\x0b\x32 .google.backstory.StringSequenceH\x00\"4\n\x04Type\x12\x14\n\x10TYPE_UNSPECIFIED\x10\x00\x12\t\n\x05MATCH\x10\x01\x12\x0b\n\x07OUTCOME\x10\x02\x42\r\n\x0btyped_value\"\xb5\x32\n\x0eSecurityResult\x12%\n\x05\x61\x62out\x18\x01 \x01(\x0b\x32\x16.google.backstory.Noun\x12\x43\n\x08\x63\x61tegory\x18\x02 \x03(\x0e\x32\x31.google.backstory.SecurityResult.SecurityCategory\x12\x18\n\x10\x63\x61tegory_details\x18\x03 \x03(\t\x12\x13\n\x0bthreat_name\x18\x04 \x01(\t\x12\x10\n\x08rule_set\x18\x1d \x01(\t\x12\x1d\n\x15rule_set_display_name\x18\x1e \x01(\t\x12%\n\x1druleset_category_display_name\x18) \x01(\t\x12\x0f\n\x07rule_id\x18\x10 \x01(\t\x12\x11\n\trule_name\x18\x05 \x01(\t\x12\x14\n\x0c\x64isplay_name\x18\x31 \x01(\t\x12\x14\n\x0crule_version\x18\x14 \x01(\t\x12\x11\n\trule_type\x18\x16 \x01(\t\x12\x13\n\x0brule_author\x18\x19 \x01(\t\x12,\n\x0brule_labels\x18\x1a \x03(\x0b\x32\x17.google.backstory.Label\x12@\n\x0b\x61lert_state\x18\x15 \x01(\x0e\x32+.google.backstory.SecurityResult.AlertState\x12\x31\n\x10\x64\x65tection_fields\x18\x17 \x03(\x0b\x32\x17.google.backstory.Label\x12-\n\x08outcomes\x18\x1c \x03(\x0b\x32\x17.google.backstory.LabelB\x02\x18\x01\x12\x42\n\tvariables\x18, \x03(\x0b\x32/.google.backstory.SecurityResult.VariablesEntry\x12\x0f\n\x07summary\x18\x06 \x01(\t\x12\x13\n\x0b\x64\x65scription\x18\x07 \x01(\t\x12\x37\n\x06\x61\x63tion\x18\x08 \x03(\x0e\x32\'.google.backstory.SecurityResult.Action\x12\x16\n\x0e\x61\x63tion_details\x18\x13 \x01(\t\x12\x42\n\x08severity\x18\t \x01(\x0e\x32\x30.google.backstory.SecurityResult.ProductSeverity\x12\x46\n\nconfidence\x18\n \x01(\x0e\x32\x32.google.backstory.SecurityResult.ProductConfidence\x12\x42\n\x08priority\x18\x0b \x01(\x0e\x32\x30.google.backstory.SecurityResult.ProductPriority\x12\x12\n\nrisk_score\x18\x1f \x01(\x02\x12\x18\n\x10\x63onfidence_score\x18* \x01(\x02\x12?\n\x12\x61nalytics_metadata\x18+ \x03(\x0b\x32#.google.backstory.AnalyticsMetadata\x12\x18\n\x10severity_details\x18\x0c \x01(\t\x12\x1a\n\x12\x63onfidence_details\x18\r \x01(\t\x12\x18\n\x10priority_details\x18\x0e \x01(\t\x12\x1b\n\x13url_back_to_product\x18\x0f \x01(\t\x12\x11\n\tthreat_id\x18\x11 \x01(\t\x12\x18\n\x10threat_feed_name\x18\x1b \x01(\t\x12;\n\x13threat_id_namespace\x18\x18 \x01(\x0e\x32\x1e.google.backstory.Id.Namespace\x12\x44\n\rthreat_status\x18\x12 \x01(\x0e\x32-.google.backstory.SecurityResult.ThreatStatus\x12\x37\n\x0e\x61ttack_details\x18  \x01(\x0b\x32\x1f.google.backstory.AttackDetails\x12\x39\n\x15\x66irst_discovered_time\x18! \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x42\n\x0c\x61ssociations\x18\" \x03(\x0b\x32,.google.backstory.SecurityResult.Association\x12\x15\n\tcampaigns\x18# \x03(\tB\x02\x18\x01\x12\x13\n\x07reports\x18. \x03(\tB\x02\x18\x01\x12=\n\x07verdict\x18$ \x01(\x0b\x32(.google.backstory.SecurityResult.VerdictB\x02\x18\x01\x12\x35\n\x11last_updated_time\x18% \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x42\n\x0cverdict_info\x18& \x03(\x0b\x32,.google.backstory.SecurityResult.VerdictInfo\x12\x37\n\x0ethreat_verdict\x18\' \x01(\x0e\x32\x1f.google.backstory.ThreatVerdict\x12\x38\n\x14last_discovered_time\x18( \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x17\n\x0f\x64\x65tection_depth\x18/ \x01(\x03\x12Q\n\x12threat_collections\x18\x30 \x03(\x0b\x32\x35.google.backstory.SecurityResult.ThreatCollectionItem\x1a\xb5\x06\n\x0b\x41ssociation\x12\n\n\x02id\x18\x01 \x01(\t\x12\x14\n\x0c\x63ountry_code\x18\x02 \x03(\t\x12J\n\x04type\x18\x03 \x01(\x0e\x32<.google.backstory.SecurityResult.Association.AssociationType\x12\x0c\n\x04name\x18\x04 \x01(\t\x12\x13\n\x0b\x64\x65scription\x18\x05 \x01(\t\x12\x0c\n\x04role\x18\x06 \x01(\t\x12\x1a\n\x0esource_country\x18\x07 \x01(\tB\x02\x18\x01\x12L\n\x05\x61lias\x18\x08 \x03(\x0b\x32=.google.backstory.SecurityResult.Association.AssociationAlias\x12\x38\n\x14\x66irst_reference_time\x18\t \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x37\n\x13last_reference_time\x18\n \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x1b\n\x13industries_affected\x18\x0b \x03(\t\x12G\n\x11\x61ssociated_actors\x18\x0c \x03(\x0b\x32,.google.backstory.SecurityResult.Association\x12/\n\x0bregion_code\x18\r \x01(\x0b\x32\x1a.google.backstory.Location\x12\x32\n\x0esponsor_region\x18\x0e \x01(\x0b\x32\x1a.google.backstory.Location\x12\x34\n\x10targeted_regions\x18\x0f \x03(\x0b\x32\x1a.google.backstory.Location\x12\x0c\n\x04tags\x18\x10 \x03(\t\x1a\x31\n\x10\x41ssociationAlias\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x0f\n\x07\x63ompany\x18\x02 \x01(\t\"h\n\x0f\x41ssociationType\x12 \n\x1c\x41SSOCIATION_TYPE_UNSPECIFIED\x10\x00\x12\x10\n\x0cTHREAT_ACTOR\x10\x01\x12\x0b\n\x07MALWARE\x10\x02\x12\x14\n\x10SOFTWARE_TOOLKIT\x10\x03\x1a\x86\x02\n\x06Source\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x14\n\x0c\x62\x65nign_count\x18\x02 \x01(\x05\x12\x17\n\x0fmalicious_count\x18\x03 \x01(\x05\x12\x43\n\x07quality\x18\x04 \x01(\x0e\x32\x32.google.backstory.SecurityResult.ProductConfidence\x12\x16\n\x0eresponse_count\x18\x05 \x01(\x05\x12\x14\n\x0csource_count\x18\x06 \x01(\x05\x12L\n\x1bthreat_intelligence_sources\x18\x07 \x03(\x0b\x32\'.google.backstory.SecurityResult.Source\x1a\xfe\x01\n\x11ProviderMLVerdict\x12\x17\n\x0fsource_provider\x18\x01 \x01(\t\x12\x14\n\x0c\x62\x65nign_count\x18\x02 \x01(\x05\x12\x17\n\x0fmalicious_count\x18\x03 \x01(\x05\x12\x18\n\x10\x63onfidence_score\x18\x04 \x01(\x05\x12\x41\n\x10mandiant_sources\x18\x05 \x03(\x0b\x32\'.google.backstory.SecurityResult.Source\x12\x44\n\x13third_party_sources\x18\x06 \x03(\x0b\x32\'.google.backstory.SecurityResult.Source\x1a\xa8\x01\n\x0e\x41nalystVerdict\x12\x18\n\x10\x63onfidence_score\x18\x01 \x01(\x05\x12\x30\n\x0cverdict_time\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12J\n\x10verdict_response\x18\x03 \x01(\x0e\x32\x30.google.backstory.SecurityResult.VerdictResponse\x1a\xac\x02\n\x08IoCStats\x12\x45\n\x0eioc_stats_type\x18\x01 \x01(\x0e\x32-.google.backstory.SecurityResult.IoCStatsType\x12\x1a\n\x12\x66irst_level_source\x18\x02 \x01(\t\x12\x1b\n\x13second_level_source\x18\x03 \x01(\t\x12\x14\n\x0c\x62\x65nign_count\x18\x04 \x01(\x05\x12\x43\n\x07quality\x18\x05 \x01(\x0e\x32\x32.google.backstory.SecurityResult.ProductConfidence\x12\x17\n\x0fmalicious_count\x18\x06 \x01(\x05\x12\x16\n\x0eresponse_count\x18\x07 \x01(\x05\x12\x14\n\x0csource_count\x18\x08 \x01(\x05\x1a\xd6\x04\n\x0bVerdictInfo\x12\x14\n\x0csource_count\x18\x01 \x01(\x05\x12\x16\n\x0eresponse_count\x18\x02 \x01(\x05\x12\x1b\n\x13neighbour_influence\x18\x03 \x01(\t\x12\x42\n\x0cverdict_type\x18\x04 \x01(\x0e\x32,.google.backstory.SecurityResult.VerdictType\x12\x17\n\x0fsource_provider\x18\x05 \x01(\t\x12\x14\n\x0c\x62\x65nign_count\x18\x06 \x01(\x05\x12\x17\n\x0fmalicious_count\x18\x07 \x01(\x05\x12\x18\n\x10\x63onfidence_score\x18\x08 \x01(\x05\x12<\n\tioc_stats\x18\t \x03(\x0b\x32).google.backstory.SecurityResult.IoCStats\x12\x30\n\x0cverdict_time\x18\x0b \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12J\n\x10verdict_response\x18\x0c \x01(\x0e\x32\x30.google.backstory.SecurityResult.VerdictResponse\x12\x1d\n\x15global_customer_count\x18\r \x01(\x05\x12\x19\n\x11global_hits_count\x18\x0e \x01(\x05\x12\x0b\n\x03pwn\x18\x0f \x01(\x08\x12\x18\n\x10\x63\x61tegory_details\x18\x10 \x01(\t\x12\x39\n\x15pwn_first_tagged_time\x18\x11 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x1a\xe3\x01\n\x07Verdict\x12\x14\n\x0csource_count\x18\x01 \x01(\x05\x12\x16\n\x0eresponse_count\x18\x02 \x01(\x05\x12\x1b\n\x13neighbour_influence\x18\x03 \x01(\t\x12\x43\n\x07verdict\x18\x04 \x01(\x0b\x32\x32.google.backstory.SecurityResult.ProviderMLVerdict\x12H\n\x0f\x61nalyst_verdict\x18\x05 \x01(\x0b\x32/.google.backstory.SecurityResult.AnalystVerdict\x1az\n\x14ThreatCollectionItem\x12\n\n\x02id\x18\x01 \x01(\t\x12\x43\n\x04type\x18\x02 \x01(\x0e\x32\x35.google.backstory.SecurityResult.ThreatCollectionType\x12\x11\n\talt_names\x18\x03 \x03(\t\x1aS\n\x0eVariablesEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\x30\n\x05value\x18\x02 \x01(\x0b\x32!.google.backstory.FindingVariable:\x02\x38\x01\"N\n\x0fVerdictResponse\x12 \n\x1cVERDICT_RESPONSE_UNSPECIFIED\x10\x00\x12\r\n\tMALICIOUS\x10\x01\x12\n\n\x06\x42\x45NIGN\x10\x02\"\x80\x01\n\x0cIoCStatsType\x12\x1e\n\x1aUNSPECIFIED_IOC_STATS_TYPE\x10\x00\x12\x14\n\x10MANDIANT_SOURCES\x10\x01\x12\x17\n\x13THIRD_PARTY_SOURCES\x10\x02\x12!\n\x1dTHREAT_INTELLIGENCE_IOC_STATS\x10\x03\"Y\n\x0bVerdictType\x12\x1c\n\x18VERDICT_TYPE_UNSPECIFIED\x10\x00\x12\x17\n\x13PROVIDER_ML_VERDICT\x10\x01\x12\x13\n\x0f\x41NALYST_VERDICT\x10\x02\"\xae\x04\n\x10SecurityCategory\x12\x14\n\x10UNKNOWN_CATEGORY\x10\x00\x12\x17\n\x12SOFTWARE_MALICIOUS\x10\x90N\x12\x18\n\x13SOFTWARE_SUSPICIOUS\x10\xf4N\x12\x11\n\x0cSOFTWARE_PUA\x10\xd8O\x12\x17\n\x11NETWORK_MALICIOUS\x10\xa0\x9c\x01\x12\x18\n\x12NETWORK_SUSPICIOUS\x10\x84\x9d\x01\x12!\n\x1bNETWORK_CATEGORIZED_CONTENT\x10\xe8\x9d\x01\x12\x1f\n\x19NETWORK_DENIAL_OF_SERVICE\x10\xcc\x9e\x01\x12\x13\n\rNETWORK_RECON\x10\xb0\x9f\x01\x12!\n\x1bNETWORK_COMMAND_AND_CONTROL\x10\x94\xa0\x01\x12\x13\n\rACL_VIOLATION\x10\xb0\xea\x01\x12\x14\n\x0e\x41UTH_VIOLATION\x10\xc0\xb8\x02\x12\r\n\x07\x45XPLOIT\x10\xd0\x86\x03\x12\x17\n\x11\x44\x41TA_EXFILTRATION\x10\xe0\xd4\x03\x12\x12\n\x0c\x44\x41TA_AT_REST\x10\xc4\xd5\x03\x12\x16\n\x10\x44\x41TA_DESTRUCTION\x10\xa8\xd6\x03\x12\x13\n\rTOR_EXIT_NODE\x10\x8c\xd7\x03\x12\x0f\n\tMAIL_SPAM\x10\xf0\xa2\x04\x12\x13\n\rMAIL_PHISHING\x10\xd4\xa3\x04\x12\x13\n\rMAIL_SPOOFING\x10\xb8\xa4\x04\x12\x16\n\x10POLICY_VIOLATION\x10\x80\xf1\x04\x12\x18\n\x12SOCIAL_ENGINEERING\x10\x91\xbf\x05\x12\x0e\n\x08PHISHING\x10\x92\xbf\x05\"=\n\nAlertState\x12\x0f\n\x0bUNSPECIFIED\x10\x00\x12\x10\n\x0cNOT_ALERTING\x10\x01\x12\x0c\n\x08\x41LERTING\x10\x02\"x\n\x06\x41\x63tion\x12\x12\n\x0eUNKNOWN_ACTION\x10\x00\x12\t\n\x05\x41LLOW\x10\x01\x12\t\n\x05\x42LOCK\x10\x02\x12\x1b\n\x17\x41LLOW_WITH_MODIFICATION\x10\x03\x12\x0e\n\nQUARANTINE\x10\x04\x12\x08\n\x04\x46\x41IL\x10\x05\x12\r\n\tCHALLENGE\x10\x06\"\x81\x01\n\x0fProductSeverity\x12\x14\n\x10UNKNOWN_SEVERITY\x10\x00\x12\x11\n\rINFORMATIONAL\x10\x64\x12\n\n\x05\x45RROR\x10\x96\x01\x12\x08\n\x04NONE\x10\x65\x12\x08\n\x03LOW\x10\xc8\x01\x12\x0b\n\x06MEDIUM\x10\xac\x02\x12\t\n\x04HIGH\x10\x90\x03\x12\r\n\x08\x43RITICAL\x10\xf4\x03\"n\n\x11ProductConfidence\x12\x16\n\x12UNKNOWN_CONFIDENCE\x10\x00\x12\x13\n\x0eLOW_CONFIDENCE\x10\xc8\x01\x12\x16\n\x11MEDIUM_CONFIDENCE\x10\xac\x02\x12\x14\n\x0fHIGH_CONFIDENCE\x10\x90\x03\"d\n\x0fProductPriority\x12\x14\n\x10UNKNOWN_PRIORITY\x10\x00\x12\x11\n\x0cLOW_PRIORITY\x10\xc8\x01\x12\x14\n\x0fMEDIUM_PRIORITY\x10\xac\x02\x12\x12\n\rHIGH_PRIORITY\x10\x90\x03\"Z\n\x0cThreatStatus\x12\x1d\n\x19THREAT_STATUS_UNSPECIFIED\x10\x00\x12\n\n\x06\x41\x43TIVE\x10\x01\x12\x0b\n\x07\x43LEARED\x10\x02\x12\x12\n\x0e\x46\x41LSE_POSITIVE\x10\x03\"X\n\x14ThreatCollectionType\x12&\n\"THREAT_COLLECTION_TYPE_UNSPECIFIED\x10\x00\x12\x0c\n\x08\x43\x41MPAIGN\x10\x01\x12\n\n\x06REPORT\x10\x02\"%\n\x0ePeFileMetadata\x12\x13\n\x0bimport_hash\x18\x01 \x01(\t\"@\n\x0c\x46ileMetadata\x12\x30\n\x02pe\x18\x01 \x01(\x0b\x32 .google.backstory.PeFileMetadataB\x02\x18\x01\"\xcf*\n\x04\x46ile\x12\x0e\n\x06sha256\x18\x01 \x01(\t\x12\x0b\n\x03md5\x18\x02 \x01(\t\x12\x0c\n\x04sha1\x18\x03 \x01(\t\x12\x0c\n\x04size\x18\x04 \x01(\x04\x12\x11\n\tfull_path\x18\x05 \x01(\t\x12\x11\n\tmime_type\x18\x06 \x01(\t\x12\x39\n\rfile_metadata\x18\x07 \x01(\x0b\x32\x1e.google.backstory.FileMetadataB\x02\x18\x01\x12\x39\n\x0fsecurity_result\x18$ \x01(\x0b\x32 .google.backstory.SecurityResult\x12\x31\n\x07pe_file\x18\x08 \x01(\x0b\x32 .google.backstory.FileMetadataPE\x12\x0e\n\x06ssdeep\x18\t \x01(\t\x12\r\n\x05vhash\x18\n \x01(\t\x12\x11\n\x05\x61hash\x18\x0b \x01(\tB\x02\x18\x01\x12\x14\n\x0c\x61uthentihash\x18\x14 \x01(\t\x12\x0f\n\x07symhash\x18) \x01(\t\x12\x46\n\x16prefetch_file_metadata\x18+ \x01(\x0b\x32&.google.backstory.PrefetchFileMetadata\x12\x32\n\tfile_type\x18\x0c \x01(\x0e\x32\x1f.google.backstory.File.FileType\x12\x19\n\x11\x63\x61pabilities_tags\x18\r \x03(\t\x12\r\n\x05names\x18\x0e \x03(\t\x12\x0c\n\x04tags\x18\x1b \x03(\t\x12:\n\x16last_modification_time\x18\x0f \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12/\n\x0b\x63reate_time\x18\' \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x34\n\x10last_access_time\x18( \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x30\n\nprevalence\x18\x10 \x01(\x0b\x32\x1c.google.backstory.Prevalence\x12\x33\n\x0f\x66irst_seen_time\x18\x11 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x32\n\x0elast_seen_time\x18\x12 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x11\n\tstat_mode\x18\x15 \x01(\x04\x12\x12\n\nstat_inode\x18\x16 \x01(\x04\x12\x10\n\x08stat_dev\x18\x17 \x01(\x04\x12\x12\n\nstat_nlink\x18\x18 \x01(\x04\x12\x12\n\nstat_flags\x18\x19 \x01(\r\x12\x36\n\x12last_analysis_time\x18\x1a \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x15\n\rembedded_urls\x18\x1c \x03(\t\x12\x18\n\x10\x65mbedded_domains\x18\x1d \x03(\t\x12\x14\n\x0c\x65mbedded_ips\x18\x1e \x03(\t\x12-\n\texif_info\x18\x1f \x01(\x0b\x32\x1a.google.backstory.ExifInfo\x12\x37\n\x0esignature_info\x18  \x01(\x0b\x32\x1f.google.backstory.SignatureInfo\x12+\n\x08pdf_info\x18! \x01(\x0b\x32\x19.google.backstory.PDFInfo\x12\x39\n\x15\x66irst_submission_time\x18\" \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x38\n\x14last_submission_time\x18# \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12,\n\tmain_icon\x18% \x01(\x0b\x32\x19.google.backstory.Favicon\x12\x30\n\x04ntfs\x18& \x01(\x0b\x32\".google.backstory.NtfsFileMetadata\x12=\n\x10\x61pp_compat_cache\x18* \x01(\x0b\x32#.google.backstory.AppCompatMetadata\"\xea\x1e\n\x08\x46ileType\x12\x19\n\x15\x46ILE_TYPE_UNSPECIFIED\x10\x00\x12\x14\n\x10\x46ILE_TYPE_PE_EXE\x10\x01\x12\x14\n\x10\x46ILE_TYPE_PE_DLL\x10\x02\x12\x11\n\rFILE_TYPE_MSI\x10\x03\x12\x14\n\x10\x46ILE_TYPE_NE_EXE\x10\n\x12\x14\n\x10\x46ILE_TYPE_NE_DLL\x10\x0b\x12\x15\n\x11\x46ILE_TYPE_DOS_EXE\x10\x14\x12\x15\n\x11\x46ILE_TYPE_DOS_COM\x10\x15\x12\x12\n\x0e\x46ILE_TYPE_COFF\x10\x1e\x12\x11\n\rFILE_TYPE_ELF\x10\x1f\x12\x1a\n\x16\x46ILE_TYPE_LINUX_KERNEL\x10 \x12\x11\n\rFILE_TYPE_RPM\x10!\x12\x13\n\x0f\x46ILE_TYPE_LINUX\x10\"\x12\x14\n\x10\x46ILE_TYPE_MACH_O\x10#\x12\x1b\n\x17\x46ILE_TYPE_JAVA_BYTECODE\x10$\x12\x11\n\rFILE_TYPE_DMG\x10%\x12\x11\n\rFILE_TYPE_DEB\x10&\x12\x11\n\rFILE_TYPE_PKG\x10\'\x12\x11\n\rFILE_TYPE_PYC\x10(\x12\x11\n\rFILE_TYPE_LNK\x10\x32\x12\x1b\n\x17\x46ILE_TYPE_DESKTOP_ENTRY\x10\x33\x12\x12\n\x0e\x46ILE_TYPE_JPEG\x10\x64\x12\x12\n\x0e\x46ILE_TYPE_TIFF\x10\x65\x12\x11\n\rFILE_TYPE_GIF\x10\x66\x12\x11\n\rFILE_TYPE_PNG\x10g\x12\x11\n\rFILE_TYPE_BMP\x10h\x12\x12\n\x0e\x46ILE_TYPE_GIMP\x10i\x12\x17\n\x13\x46ILE_TYPE_IN_DESIGN\x10j\x12\x11\n\rFILE_TYPE_PSD\x10k\x12\x13\n\x0f\x46ILE_TYPE_TARGA\x10l\x12\x11\n\rFILE_TYPE_XWD\x10m\x12\x11\n\rFILE_TYPE_DIB\x10n\x12\x11\n\rFILE_TYPE_JNG\x10o\x12\x11\n\rFILE_TYPE_ICO\x10p\x12\x11\n\rFILE_TYPE_FPX\x10q\x12\x11\n\rFILE_TYPE_EPS\x10r\x12\x11\n\rFILE_TYPE_SVG\x10s\x12\x11\n\rFILE_TYPE_EMF\x10t\x12\x12\n\x0e\x46ILE_TYPE_WEBP\x10u\x12\x11\n\rFILE_TYPE_DWG\x10v\x12\x11\n\rFILE_TYPE_DXF\x10w\x12\x15\n\x11\x46ILE_TYPE_THREEDS\x10x\x12\x12\n\rFILE_TYPE_OGG\x10\x96\x01\x12\x12\n\rFILE_TYPE_FLC\x10\x97\x01\x12\x12\n\rFILE_TYPE_FLI\x10\x98\x01\x12\x12\n\rFILE_TYPE_MP3\x10\x99\x01\x12\x13\n\x0e\x46ILE_TYPE_FLAC\x10\x9a\x01\x12\x12\n\rFILE_TYPE_WAV\x10\x9b\x01\x12\x13\n\x0e\x46ILE_TYPE_MIDI\x10\x9c\x01\x12\x12\n\rFILE_TYPE_AVI\x10\x9d\x01\x12\x13\n\x0e\x46ILE_TYPE_MPEG\x10\x9e\x01\x12\x18\n\x13\x46ILE_TYPE_QUICKTIME\x10\x9f\x01\x12\x12\n\rFILE_TYPE_ASF\x10\xa0\x01\x12\x13\n\x0e\x46ILE_TYPE_DIVX\x10\xa1\x01\x12\x12\n\rFILE_TYPE_FLV\x10\xa2\x01\x12\x12\n\rFILE_TYPE_WMA\x10\xa3\x01\x12\x12\n\rFILE_TYPE_WMV\x10\xa4\x01\x12\x11\n\x0c\x46ILE_TYPE_RM\x10\xa5\x01\x12\x12\n\rFILE_TYPE_MOV\x10\xa6\x01\x12\x12\n\rFILE_TYPE_MP4\x10\xa7\x01\x12\x13\n\x0e\x46ILE_TYPE_T3GP\x10\xa8\x01\x12\x13\n\x0e\x46ILE_TYPE_WEBM\x10\xa9\x01\x12\x12\n\rFILE_TYPE_MKV\x10\xaa\x01\x12\x12\n\rFILE_TYPE_PDF\x10\xc8\x01\x12\x11\n\x0c\x46ILE_TYPE_PS\x10\xc9\x01\x12\x12\n\rFILE_TYPE_DOC\x10\xca\x01\x12\x13\n\x0e\x46ILE_TYPE_DOCX\x10\xcb\x01\x12\x12\n\rFILE_TYPE_PPT\x10\xcc\x01\x12\x13\n\x0e\x46ILE_TYPE_PPTX\x10\xcd\x01\x12\x12\n\rFILE_TYPE_XLS\x10\xce\x01\x12\x13\n\x0e\x46ILE_TYPE_XLSX\x10\xcf\x01\x12\x12\n\rFILE_TYPE_RTF\x10\xd0\x01\x12\x13\n\x0e\x46ILE_TYPE_PPSX\x10\xd1\x01\x12\x12\n\rFILE_TYPE_ODP\x10\xfa\x01\x12\x12\n\rFILE_TYPE_ODS\x10\xfb\x01\x12\x12\n\rFILE_TYPE_ODT\x10\xfc\x01\x12\x12\n\rFILE_TYPE_HWP\x10\xfd\x01\x12\x12\n\rFILE_TYPE_GUL\x10\xfe\x01\x12\x12\n\rFILE_TYPE_ODF\x10\xff\x01\x12\x12\n\rFILE_TYPE_ODG\x10\x80\x02\x12\x17\n\x12\x46ILE_TYPE_ONE_NOTE\x10\x81\x02\x12\x14\n\x0f\x46ILE_TYPE_OOXML\x10\x82\x02\x12\x12\n\rFILE_TYPE_SLK\x10\x83\x02\x12\x14\n\x0f\x46ILE_TYPE_EBOOK\x10\x84\x02\x12\x14\n\x0f\x46ILE_TYPE_LATEX\x10\x85\x02\x12\x12\n\rFILE_TYPE_TTF\x10\x86\x02\x12\x12\n\rFILE_TYPE_EOT\x10\x87\x02\x12\x13\n\x0e\x46ILE_TYPE_WOFF\x10\x88\x02\x12\x12\n\rFILE_TYPE_CHM\x10\x89\x02\x12\x12\n\rFILE_TYPE_ZIP\x10\xac\x02\x12\x13\n\x0e\x46ILE_TYPE_GZIP\x10\xad\x02\x12\x13\n\x0e\x46ILE_TYPE_BZIP\x10\xae\x02\x12\x13\n\x0e\x46ILE_TYPE_RZIP\x10\xaf\x02\x12\x13\n\x0e\x46ILE_TYPE_DZIP\x10\xb0\x02\x12\x17\n\x12\x46ILE_TYPE_SEVENZIP\x10\xb1\x02\x12\x12\n\rFILE_TYPE_CAB\x10\xb2\x02\x12\x12\n\rFILE_TYPE_JAR\x10\xb3\x02\x12\x12\n\rFILE_TYPE_RAR\x10\xb4\x02\x12\x19\n\x14\x46ILE_TYPE_MSCOMPRESS\x10\xb5\x02\x12\x12\n\rFILE_TYPE_ACE\x10\xb6\x02\x12\x12\n\rFILE_TYPE_ARC\x10\xb7\x02\x12\x12\n\rFILE_TYPE_ARJ\x10\xb8\x02\x12\x12\n\rFILE_TYPE_ASD\x10\xb9\x02\x12\x18\n\x13\x46ILE_TYPE_BLACKHOLE\x10\xba\x02\x12\x12\n\rFILE_TYPE_KGB\x10\xbb\x02\x12\x13\n\x0e\x46ILE_TYPE_ZLIB\x10\xbc\x02\x12\x12\n\rFILE_TYPE_TAR\x10\xbd\x02\x12\x12\n\rFILE_TYPE_ZST\x10\xbe\x02\x12\x14\n\x0f\x46ILE_TYPE_LZFSE\x10\xbf\x02\x12\x19\n\x14\x46ILE_TYPE_PYTHON_WHL\x10\xc0\x02\x12\x19\n\x14\x46ILE_TYPE_PYTHON_PKG\x10\xc1\x02\x12\x13\n\x0e\x46ILE_TYPE_MSIX\x10\xc2\x02\x12\x13\n\x0e\x46ILE_TYPE_TEXT\x10\x90\x03\x12\x15\n\x10\x46ILE_TYPE_SCRIPT\x10\x91\x03\x12\x12\n\rFILE_TYPE_PHP\x10\x92\x03\x12\x15\n\x10\x46ILE_TYPE_PYTHON\x10\x93\x03\x12\x13\n\x0e\x46ILE_TYPE_PERL\x10\x94\x03\x12\x13\n\x0e\x46ILE_TYPE_RUBY\x10\x95\x03\x12\x10\n\x0b\x46ILE_TYPE_C\x10\x96\x03\x12\x12\n\rFILE_TYPE_CPP\x10\x97\x03\x12\x13\n\x0e\x46ILE_TYPE_JAVA\x10\x98\x03\x12\x1a\n\x15\x46ILE_TYPE_SHELLSCRIPT\x10\x99\x03\x12\x15\n\x10\x46ILE_TYPE_PASCAL\x10\x9a\x03\x12\x12\n\rFILE_TYPE_AWK\x10\x9b\x03\x12\x15\n\x10\x46ILE_TYPE_DYALOG\x10\x9c\x03\x12\x16\n\x11\x46ILE_TYPE_FORTRAN\x10\x9d\x03\x12\x19\n\x14\x46ILE_TYPE_JAVASCRIPT\x10\x9e\x03\x12\x19\n\x14\x46ILE_TYPE_POWERSHELL\x10\x9f\x03\x12\x12\n\rFILE_TYPE_VBA\x10\xa0\x03\x12\x11\n\x0c\x46ILE_TYPE_M4\x10\xa1\x03\x12\x18\n\x13\x46ILE_TYPE_OBJETIVEC\x10\xa2\x03\x12\x13\n\x0e\x46ILE_TYPE_JMOD\x10\xa3\x03\x12\x17\n\x12\x46ILE_TYPE_MAKEFILE\x10\xa4\x03\x12\x12\n\rFILE_TYPE_INI\x10\xa5\x03\x12\x12\n\rFILE_TYPE_CLJ\x10\xa6\x03\x12\x12\n\rFILE_TYPE_PDB\x10\xa9\x03\x12\x12\n\rFILE_TYPE_SQL\x10\xaa\x03\x12\x13\n\x0e\x46ILE_TYPE_NEKO\x10\xab\x03\x12\x12\n\rFILE_TYPE_WER\x10\xac\x03\x12\x15\n\x10\x46ILE_TYPE_GOLANG\x10\xad\x03\x12\x12\n\rFILE_TYPE_M3U\x10\xae\x03\x12\x12\n\rFILE_TYPE_BAT\x10\xaf\x03\x12\x12\n\rFILE_TYPE_MSC\x10\xb0\x03\x12\x12\n\rFILE_TYPE_RDP\x10\xb1\x03\x12\x16\n\x11\x46ILE_TYPE_SYMBIAN\x10\xf4\x03\x12\x15\n\x10\x46ILE_TYPE_PALMOS\x10\xf5\x03\x12\x14\n\x0f\x46ILE_TYPE_WINCE\x10\xf6\x03\x12\x16\n\x11\x46ILE_TYPE_ANDROID\x10\xf7\x03\x12\x15\n\x10\x46ILE_TYPE_IPHONE\x10\xf8\x03\x12\x13\n\x0e\x46ILE_TYPE_HTML\x10\xd8\x04\x12\x12\n\rFILE_TYPE_XML\x10\xd9\x04\x12\x12\n\rFILE_TYPE_SWF\x10\xda\x04\x12\x12\n\rFILE_TYPE_FLA\x10\xdb\x04\x12\x15\n\x10\x46ILE_TYPE_COOKIE\x10\xdc\x04\x12\x16\n\x11\x46ILE_TYPE_TORRENT\x10\xdd\x04\x12\x19\n\x14\x46ILE_TYPE_EMAIL_TYPE\x10\xde\x04\x12\x16\n\x11\x46ILE_TYPE_OUTLOOK\x10\xdf\x04\x12\x13\n\x0e\x46ILE_TYPE_SGML\x10\xe0\x04\x12\x13\n\x0e\x46ILE_TYPE_JSON\x10\xe1\x04\x12\x12\n\rFILE_TYPE_CSV\x10\xe2\x04\x12\x12\n\rFILE_TYPE_HTA\x10\xe3\x04\x12 \n\x1b\x46ILE_TYPE_INTERNET_SHORTCUT\x10\xe4\x04\x12\x12\n\rFILE_TYPE_CAP\x10\xbc\x05\x12\x17\n\x12\x46ILE_TYPE_ISOIMAGE\x10\xa0\x06\x12\x17\n\x12\x46ILE_TYPE_SQUASHFS\x10\xa1\x06\x12\x12\n\rFILE_TYPE_VHD\x10\xa2\x06\x12\x14\n\x0f\x46ILE_TYPE_APPLE\x10\xe8\x07\x12\x18\n\x13\x46ILE_TYPE_MACINTOSH\x10\xe9\x07\x12\x1a\n\x15\x46ILE_TYPE_APPLESINGLE\x10\xea\x07\x12\x1a\n\x15\x46ILE_TYPE_APPLEDOUBLE\x10\xeb\x07\x12\x1c\n\x17\x46ILE_TYPE_MACINTOSH_HFS\x10\xec\x07\x12\x1a\n\x15\x46ILE_TYPE_APPLE_PLIST\x10\xed\x07\x12\x1c\n\x17\x46ILE_TYPE_MACINTOSH_LIB\x10\xee\x07\x12\x1a\n\x15\x46ILE_TYPE_APPLESCRIPT\x10\xef\x07\x12#\n\x1e\x46ILE_TYPE_APPLESCRIPT_COMPILED\x10\xf0\x07\x12\x12\n\rFILE_TYPE_CRX\x10\xcc\x08\x12\x12\n\rFILE_TYPE_XPI\x10\xcd\x08\x12\x12\n\rFILE_TYPE_ROM\x10\xb0\t\x12\x12\n\rFILE_TYPE_IPS\x10\xb1\t\x12\x12\n\rFILE_TYPE_PEM\x10\x94\n\x12\x12\n\rFILE_TYPE_PGP\x10\x95\n\x12\x12\n\rFILE_TYPE_CRT\x10\x96\n\"\xde\x02\n\x10NtfsFileMetadata\x12/\n\x0b\x63hange_time\x18\x01 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x38\n\x14\x66ilename_create_time\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x38\n\x14\x66ilename_modify_time\x18\x03 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x38\n\x14\x66ilename_access_time\x18\x04 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x38\n\x14\x66ilename_change_time\x18\x05 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x31\n\x0busn_journal\x18\x06 \x03(\x0b\x32\x1c.google.backstory.UsnJournal\"@\n\x14PrefetchFileMetadata\x12\x11\n\trun_count\x18\x01 \x01(\x03\x12\x15\n\rprefetch_hash\x18\x02 \x01(\t\"\xbc\t\n\nUsnJournal\x12\x17\n\x0f\x61ttributes_flag\x18\x01 \x01(\t\x12>\n\nattributes\x18\x02 \x01(\x0e\x32&.google.backstory.UsnJournal.AttributeB\x02\x18\x01\x12?\n\x0f\x66ile_attributes\x18\x05 \x03(\x0e\x32&.google.backstory.UsnJournal.Attribute\x12\x11\n\tallocated\x18\x03 \x01(\x08\x12\x37\n\x06reason\x18\x04 \x01(\x0e\x32#.google.backstory.UsnJournal.ReasonB\x02\x18\x01\x12\x34\n\x07reasons\x18\x06 \x03(\x0e\x32#.google.backstory.UsnJournal.Reason\"\xa1\x03\n\tAttribute\x12\x19\n\x15\x41TTRIBUTE_UNSPECIFIED\x10\x00\x12\r\n\tREAD_ONLY\x10\x01\x12\n\n\x06HIDDEN\x10\x02\x12\n\n\x06SYSTEM\x10\x03\x12\x0b\n\x07\x41RCHIVE\x10\x04\x12\x0e\n\nCOMPRESSED\x10\x05\x12\r\n\tENCRYPTED\x10\x06\x12\r\n\tDIRECTORY\x10\x07\x12\n\n\x06\x44\x45VICE\x10\x08\x12\n\n\x06NORMAL\x10\t\x12\r\n\tTEMPORARY\x10\n\x12\x0f\n\x0bSPARSE_FILE\x10\x0b\x12\x11\n\rREPARSE_POINT\x10\x0c\x12\x0b\n\x07OFFLINE\x10\r\x12\x17\n\x13NOT_CONTENT_INDEXED\x10\x0e\x12\x1b\n\x13NON_CONTENT_INDEXED\x10\x0e\x1a\x02\x08\x01\x12\x14\n\x10INTEGRITY_STREAM\x10\x0f\x12\x0b\n\x07VIRTUAL\x10\x10\x12\x11\n\rNO_SCRUB_DATA\x10\x11\x12\x06\n\x02\x45\x41\x10\x12\x12\n\n\x06PINNED\x10\x13\x12\x0c\n\x08UNPINNED\x10\x14\x12\x12\n\x0eRECALL_ON_OPEN\x10\x15\x12\x19\n\x15RECALL_ON_DATA_ACCESS\x10\x16\x1a\x02\x10\x01\"\xed\x03\n\x06Reason\x12\x16\n\x12REASON_UNSPECIFIED\x10\x00\x12\x12\n\x0e\x44\x41TA_OVERWRITE\x10\x01\x12\x0f\n\x0b\x44\x41TA_EXTEND\x10\x02\x12\x13\n\x0f\x44\x41TA_TRUNCATION\x10\x03\x12\x18\n\x14NAMED_DATA_OVERWRITE\x10\x04\x12\x15\n\x11NAMED_DATA_EXTEND\x10\x05\x12\x19\n\x15NAMED_DATA_TRUNCATION\x10\x06\x12\x0f\n\x0b\x46ILE_CREATE\x10\x07\x12\x0f\n\x0b\x46ILE_DELETE\x10\x08\x12\r\n\tEA_CHANGE\x10\t\x12\x13\n\x0fSECURITY_CHANGE\x10\n\x12\x13\n\x0fRENAME_OLD_NAME\x10\x0b\x12\x13\n\x0fRENAME_NEW_NAME\x10\x0c\x12\x14\n\x10INDEXABLE_CHANGE\x10\r\x12\x15\n\x11\x42\x41SIC_INFO_CHANGE\x10\x0e\x12\x14\n\x10HARD_LINK_CHANGE\x10\x0f\x12\x16\n\x12\x43OMPRESSION_CHANGE\x10\x10\x12\x15\n\x11\x45NCRYPTION_CHANGE\x10\x11\x12\x14\n\x10OBJECT_ID_CHANGE\x10\x12\x12\x18\n\x14REPARSE_POINT_CHANGE\x10\x13\x12\x11\n\rSTREAM_CHANGE\x10\x14\x12\x15\n\x11TRANSACTED_CHANGE\x10\x15\x12\t\n\x05\x43LOSE\x10\x16\"L\n\x11\x41ppCompatMetadata\x12\x10\n\x08sequence\x18\x01 \x01(\x05\x12\x10\n\x08\x65xecuted\x18\x02 \x01(\x08\x12\x13\n\x0b\x63ontrol_set\x18\x03 \x01(\t\"\xd6\x05\n\x0e\x46ileMetadataPE\x12\x0f\n\x07imphash\x18\x01 \x01(\t\x12\x13\n\x0b\x65ntry_point\x18\x02 \x01(\x03\x12\x1c\n\x14\x65ntry_point_exiftool\x18\t \x01(\x03\x12\x34\n\x10\x63ompilation_time\x18\n \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12=\n\x19\x63ompilation_exiftool_time\x18\x0b \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x36\n\x07section\x18\x03 \x03(\x0b\x32%.google.backstory.FileMetadataSection\x12\x36\n\x07imports\x18\x04 \x03(\x0b\x32%.google.backstory.FileMetadataImports\x12>\n\x08resource\x18\x05 \x03(\x0b\x32,.google.backstory.FileMetadataPeResourceInfo\x12I\n\x14resources_type_count\x18\x06 \x03(\x0b\x32\'.google.backstory.StringToInt64MapEntryB\x02\x18\x01\x12M\n\x18resources_language_count\x18\x07 \x03(\x0b\x32\'.google.backstory.StringToInt64MapEntryB\x02\x18\x01\x12\x39\n\x18resources_type_count_str\x18\x0c \x03(\x0b\x32\x17.google.backstory.Label\x12=\n\x1cresources_language_count_str\x18\r \x03(\x0b\x32\x17.google.backstory.Label\x12G\n\x0esignature_info\x18\x08 \x01(\x0b\x32+.google.backstory.FileMetadataSignatureInfoB\x02\x18\x01\"\x83\x01\n\x1a\x46ileMetadataPeResourceInfo\x12\x12\n\nsha256_hex\x18\x01 \x01(\t\x12\x16\n\x0e\x66iletype_magic\x18\x02 \x01(\t\x12\x15\n\rlanguage_code\x18\x04 \x01(\t\x12\x0f\n\x07\x65ntropy\x18\x05 \x01(\x01\x12\x11\n\tfile_type\x18\x06 \x01(\t\"\x88\x01\n\rSignatureInfo\x12=\n\x08sigcheck\x18\x01 \x01(\x0b\x32+.google.backstory.FileMetadataSignatureInfo\x12\x38\n\x08\x63odesign\x18\x02 \x01(\x0b\x32&.google.backstory.FileMetadataCodesign\"\xb4\x01\n\x19\x46ileMetadataSignatureInfo\x12\x1c\n\x14verification_message\x18\x01 \x01(\t\x12\x10\n\x08verified\x18\x02 \x01(\x08\x12\x12\n\x06signer\x18\x03 \x03(\tB\x02\x18\x01\x12-\n\x07signers\x18\x04 \x03(\x0b\x32\x1c.google.backstory.SignerInfo\x12$\n\x04x509\x18\x05 \x03(\x0b\x32\x16.google.backstory.X509\"\x9c\x01\n\nSignerInfo\x12\x11\n\x04name\x18\x01 \x01(\tH\x00\x88\x01\x01\x12\x13\n\x06status\x18\x02 \x01(\tH\x01\x88\x01\x01\x12\x18\n\x0bvalid_usage\x18\x03 \x01(\tH\x02\x88\x01\x01\x12\x18\n\x0b\x63\x65rt_issuer\x18\x04 \x01(\tH\x03\x88\x01\x01\x42\x07\n\x05_nameB\t\n\x07_statusB\x0e\n\x0c_valid_usageB\x0e\n\x0c_cert_issuer\"y\n\x14\x46ileMetadataCodesign\x12\n\n\x02id\x18\x01 \x01(\t\x12\x0e\n\x06\x66ormat\x18\x02 \x01(\t\x12\x34\n\x10\x63ompilation_time\x18\x03 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x0f\n\x07team_id\x18\x04 \x01(\t\"g\n\x04X509\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x11\n\talgorithm\x18\x02 \x01(\t\x12\x12\n\nthumbprint\x18\x03 \x01(\t\x12\x13\n\x0b\x63\x65rt_issuer\x18\x04 \x01(\t\x12\x15\n\rserial_number\x18\x05 \x01(\t\"\xc7\x03\n\x07PDFInfo\x12\n\n\x02js\x18\x01 \x01(\x03\x12\x12\n\njavascript\x18\x02 \x01(\x03\x12\x1b\n\x13launch_action_count\x18\x03 \x01(\x03\x12\x1b\n\x13object_stream_count\x18\x04 \x01(\x03\x12\x14\n\x0c\x65ndobj_count\x18\x05 \x01(\x03\x12\x0e\n\x06header\x18\x06 \x01(\t\x12\x10\n\x08\x61\x63roform\x18\x07 \x01(\x03\x12\x12\n\nautoaction\x18\x08 \x01(\x03\x12\x15\n\rembedded_file\x18\t \x01(\x03\x12\x11\n\tencrypted\x18\n \x01(\x03\x12\r\n\x05\x66lash\x18\x0b \x01(\x03\x12\x19\n\x11jbig2_compression\x18\x0c \x01(\x03\x12\x11\n\tobj_count\x18\r \x01(\x03\x12\x17\n\x0f\x65ndstream_count\x18\x0e \x01(\x03\x12\x12\n\npage_count\x18\x0f \x01(\x03\x12\x14\n\x0cstream_count\x18\x10 \x01(\x03\x12\x12\n\nopenaction\x18\x11 \x01(\x03\x12\x11\n\tstartxref\x18\x12 \x01(\x03\x12\x19\n\x11suspicious_colors\x18\x13 \x01(\x03\x12\x0f\n\x07trailer\x18\x14 \x01(\x03\x12\x0b\n\x03xfa\x18\x15 \x01(\x03\x12\x0c\n\x04xref\x18\x16 \x01(\x03\"O\n\x15StringToInt64MapEntry\x12\x10\n\x03key\x18\x01 \x01(\tH\x00\x88\x01\x01\x12\x12\n\x05value\x18\x02 \x01(\x03H\x01\x88\x01\x01\x42\x06\n\x04_keyB\x08\n\x06_value\"y\n\x13\x46ileMetadataSection\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x0f\n\x07\x65ntropy\x18\x02 \x01(\x01\x12\x16\n\x0eraw_size_bytes\x18\x03 \x01(\x03\x12\x1a\n\x12virtual_size_bytes\x18\x04 \x01(\x03\x12\x0f\n\x07md5_hex\x18\x05 \x01(\t\"9\n\x13\x46ileMetadataImports\x12\x0f\n\x07library\x18\x01 \x01(\t\x12\x11\n\tfunctions\x18\x02 \x03(\t\"\xa8\x01\n\x08\x45xifInfo\x12\x15\n\roriginal_file\x18\x01 \x01(\t\x12\x0f\n\x07product\x18\x02 \x01(\t\x12\x0f\n\x07\x63ompany\x18\x03 \x01(\t\x12\x18\n\x10\x66ile_description\x18\x04 \x01(\t\x12\x13\n\x0b\x65ntry_point\x18\x05 \x01(\x03\x12\x34\n\x10\x63ompilation_time\x18\x06 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\"\x83\x01\n\nPrevalence\x12\x13\n\x0brolling_max\x18\x01 \x01(\x05\x12\x11\n\tday_count\x18\x02 \x01(\x05\x12\x1f\n\x17rolling_max_sub_domains\x18\x03 \x01(\x05\x12\x0f\n\x07\x64\x61y_max\x18\x04 \x01(\x05\x12\x1b\n\x13\x64\x61y_max_sub_domains\x18\x05 \x01(\x05\"\xdf\x04\n\x03\x44ns\x12\n\n\x02id\x18\x06 \x01(\r\x12\x10\n\x08response\x18\x07 \x01(\x08\x12\x0e\n\x06opcode\x18\x08 \x01(\r\x12\x15\n\rauthoritative\x18\t \x01(\x08\x12\x11\n\ttruncated\x18\n \x01(\x08\x12\x19\n\x11recursion_desired\x18\x0b \x01(\x08\x12\x1b\n\x13recursion_available\x18\x0c \x01(\x08\x12\x15\n\rresponse_code\x18\r \x01(\r\x12\x31\n\tquestions\x18\x01 \x03(\x0b\x32\x1e.google.backstory.Dns.Question\x12\x35\n\x07\x61nswers\x18\x02 \x03(\x0b\x32$.google.backstory.Dns.ResourceRecord\x12\x37\n\tauthority\x18\x03 \x03(\x0b\x32$.google.backstory.Dns.ResourceRecord\x12\x38\n\nadditional\x18\x04 \x03(\x0b\x32$.google.backstory.Dns.ResourceRecord\x1ag\n\x08Question\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x0c\n\x04type\x18\x02 \x01(\r\x12\r\n\x05\x63lass\x18\x03 \x01(\r\x12\x30\n\nprevalence\x18\x04 \x01(\x0b\x32\x1c.google.backstory.Prevalence\x1ak\n\x0eResourceRecord\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x0c\n\x04type\x18\x02 \x01(\r\x12\r\n\x05\x63lass\x18\x03 \x01(\r\x12\x0b\n\x03ttl\x18\x04 \x01(\r\x12\x0c\n\x04\x64\x61ta\x18\x05 \x01(\t\x12\x13\n\x0b\x62inary_data\x18\x06 \x01(\x0c\"\x82\x06\n\x04\x44hcp\x12-\n\x06opcode\x18\x01 \x01(\x0e\x32\x1d.google.backstory.Dhcp.OpCode\x12\r\n\x05htype\x18\x02 \x01(\r\x12\x0c\n\x04hlen\x18\x03 \x01(\r\x12\x0c\n\x04hops\x18\x04 \x01(\r\x12\x16\n\x0etransaction_id\x18\x05 \x01(\r\x12\x0f\n\x07seconds\x18\x06 \x01(\r\x12\r\n\x05\x66lags\x18\x07 \x01(\r\x12\x0e\n\x06\x63iaddr\x18\x08 \x01(\t\x12\x0e\n\x06yiaddr\x18\t \x01(\t\x12\x0e\n\x06siaddr\x18\n \x01(\t\x12\x0e\n\x06giaddr\x18\x0b \x01(\t\x12\x0e\n\x06\x63haddr\x18\x0c \x01(\t\x12\r\n\x05sname\x18\r \x01(\t\x12\x0c\n\x04\x66ile\x18\x0e \x01(\t\x12.\n\x07options\x18\x0f \x03(\x0b\x32\x1d.google.backstory.Dhcp.Option\x12\x30\n\x04type\x18\x10 \x01(\x0e\x32\".google.backstory.Dhcp.MessageType\x12\x1a\n\x12lease_time_seconds\x18\x11 \x01(\r\x12\x17\n\x0f\x63lient_hostname\x18\x12 \x01(\t\x12\x19\n\x11\x63lient_identifier\x18\x13 \x01(\x0c\x12\x19\n\x11requested_address\x18\x14 \x01(\t\x12 \n\x18\x63lient_identifier_string\x18\x15 \x01(\t\x1a$\n\x06Option\x12\x0c\n\x04\x63ode\x18\x01 \x01(\r\x12\x0c\n\x04\x64\x61ta\x18\x02 \x01(\x0c\"<\n\x06OpCode\x12\x12\n\x0eUNKNOWN_OPCODE\x10\x00\x12\x0f\n\x0b\x42OOTREQUEST\x10\x01\x12\r\n\tBOOTREPLY\x10\x02\"\xa7\x01\n\x0bMessageType\x12\x18\n\x14UNKNOWN_MESSAGE_TYPE\x10\x00\x12\x0c\n\x08\x44ISCOVER\x10\x01\x12\t\n\x05OFFER\x10\x02\x12\x0b\n\x07REQUEST\x10\x03\x12\x0b\n\x07\x44\x45\x43LINE\x10\x04\x12\x07\n\x03\x41\x43K\x10\x05\x12\x07\n\x03NAK\x10\x06\x12\x0b\n\x07RELEASE\x10\x07\x12\n\n\x06INFORM\x10\x08\x12\x0f\n\x0bWIN_DELETED\x10\x64\x12\x0f\n\x0bWIN_EXPIRED\x10\x65\"\xd9\x01\n\x0b\x43\x65rtificate\x12\x0f\n\x07version\x18\x01 \x01(\t\x12\x0e\n\x06serial\x18\x02 \x01(\t\x12\x0f\n\x07subject\x18\x03 \x01(\t\x12\x0e\n\x06issuer\x18\x04 \x01(\t\x12\x0b\n\x03md5\x18\x05 \x01(\t\x12\x0c\n\x04sha1\x18\x06 \x01(\t\x12\x0e\n\x06sha256\x18\x07 \x01(\t\x12.\n\nnot_before\x18\x08 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12-\n\tnot_after\x18\t \x01(\x0b\x32\x1a.google.protobuf.Timestamp\"\xcb\x03\n\x03Tls\x12,\n\x06\x63lient\x18\x01 \x01(\x0b\x32\x1c.google.backstory.Tls.Client\x12,\n\x06server\x18\x02 \x01(\x0b\x32\x1c.google.backstory.Tls.Server\x12\x0e\n\x06\x63ipher\x18\x03 \x01(\t\x12\r\n\x05\x63urve\x18\x04 \x01(\t\x12\x0f\n\x07version\x18\x05 \x01(\t\x12\x18\n\x10version_protocol\x18\x06 \x01(\t\x12\x13\n\x0b\x65stablished\x18\x07 \x01(\x08\x12\x15\n\rnext_protocol\x18\x08 \x01(\t\x12\x0f\n\x07resumed\x18\t \x01(\x08\x1a\x86\x01\n\x06\x43lient\x12\x32\n\x0b\x63\x65rtificate\x18\x01 \x01(\x0b\x32\x1d.google.backstory.Certificate\x12\x0b\n\x03ja3\x18\x02 \x01(\t\x12\x13\n\x0bserver_name\x18\x03 \x01(\t\x12\x19\n\x11supported_ciphers\x18\x04 \x03(\t\x12\x0b\n\x03ja4\x18\x05 \x01(\t\x1aX\n\x06Server\x12\x32\n\x0b\x63\x65rtificate\x18\x01 \x01(\x0b\x32\x1d.google.backstory.Certificate\x12\x0c\n\x04ja3s\x18\x02 \x01(\t\x12\x0c\n\x04ja4s\x18\x03 \x01(\t\"]\n\x04Http\x12\x0e\n\x06method\x18\x01 \x01(\t\x12\x14\n\x0creferral_url\x18\x02 \x01(\t\x12\x12\n\nuser_agent\x18\x03 \x01(\t\x12\x15\n\rresponse_code\x18\x04 \x01(\x05J\x04\x08\x05\x10\x06\"\x9d\x0b\n\x07\x42rowser\x12;\n\x0c\x62rowser_type\x18\x01 \x01(\x0e\x32%.google.backstory.Browser.BrowserType\x12\x17\n\x0f\x62rowser_version\x18\x02 \x01(\t\x12\x34\n\x10\x66irst_visit_time\x18\x03 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x33\n\x0flast_visit_time\x18\x04 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x0f\n\x07profile\x18\x05 \x01(\t\x12\r\n\x05typed\x18\x06 \x01(\x08\x12:\n\nvisit_type\x18\x07 \x01(\x0e\x32&.google.backstory.Browser.UrlVisitType\x12\x0e\n\x06hidden\x18\x08 \x01(\x08\x12\x1a\n\x12request_origin_uri\x18\t \x01(\t\x12\x13\n\x0bvisit_count\x18\n \x01(\x03\x12\x1c\n\x14visit_count_criteria\x18\x0b \x01(\t\x12\x17\n\x0findexed_content\x18\x0c \x01(\t\x12\x39\n\x15\x66irst_bookmarked_time\x18\r \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x31\n\x07\x63ookies\x18\x0e \x03(\x0b\x32 .google.backstory.Browser.Cookie\x12\x13\n\x0btyped_count\x18\x0f \x01(\x03\x12;\n\x0cvisit_source\x18\x10 \x01(\x0e\x32%.google.backstory.Browser.VisitSource\x1a\xe9\x02\n\x06\x43ookie\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t\x12\x0e\n\x06\x64omain\x18\x03 \x01(\t\x12\x0c\n\x04path\x18\x04 \x01(\t\x12\x33\n\x0f\x65xpiration_time\x18\x05 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x11\n\thttp_only\x18\x06 \x01(\x08\x12\x0e\n\x06secure\x18\x07 \x01(\x08\x12\x0f\n\x07max_age\x18\x08 \x01(\x03\x12\x42\n\tsame_site\x18\t \x01(\x0e\x32/.google.backstory.Browser.Cookie.CookieSameSite\x12\x0f\n\x07session\x18\n \x01(\x08\x12\x13\n\x0bpartitioned\x18\x0b \x01(\x08\"Q\n\x0e\x43ookieSameSite\x12 \n\x1c\x43OOKIE_SAME_SITE_UNSPECIFIED\x10\x00\x12\n\n\x06STRICT\x10\x01\x12\x07\n\x03LAX\x10\x02\x12\x08\n\x04NONE\x10\x03\"|\n\x0b\x42rowserType\x12\x1c\n\x18\x42ROWSER_TYPE_UNSPECIFIED\x10\x00\x12\n\n\x06\x43HROME\x10\x01\x12\x0b\n\x07\x46IREFOX\x10\x02\x12\n\n\x06SAFARI\x10\x03\x12\x15\n\x11INTERNET_EXPLORER\x10\x04\x12\x08\n\x04\x45\x44GE\x10\x05\x12\t\n\x05OPERA\x10\x06\"\xef\x01\n\x0cUrlVisitType\x12\x1e\n\x1aURL_VISIT_TYPE_UNSPECIFIED\x10\x00\x12\x08\n\x04LINK\x10\x01\x12\t\n\x05TYPED\x10\x02\x12\x11\n\rAUTO_BOOKMARK\x10\x03\x12\x11\n\rAUTO_SUBFRAME\x10\x04\x12\x13\n\x0fMANUAL_SUBFRAME\x10\x05\x12\r\n\tGENERATED\x10\x06\x12\x11\n\rAUTO_TOPLEVEL\x10\x07\x12\x0f\n\x0b\x46ORM_SUBMIT\x10\x08\x12\n\n\x06RELOAD\x10\t\x12\x0b\n\x07KEYWORD\x10\n\x12\x15\n\x11KEYWORD_GENERATED\x10\x0b\x12\x0c\n\x08REDIRECT\x10\x0c\"a\n\x0bVisitSource\x12\x1c\n\x18VISIT_SOURCE_UNSPECIFIED\x10\x00\x12\n\n\x06SYNCED\x10\x01\x12\x0b\n\x07\x42ROWSER\x10\x02\x12\r\n\tEXTENSION\x10\x03\x12\x0c\n\x08IMPORTED\x10\x04\"\xcc\x01\n\x08Hardware\x12\x15\n\rserial_number\x18\x01 \x01(\t\x12\x14\n\x0cmanufacturer\x18\x02 \x01(\t\x12\r\n\x05model\x18\x03 \x01(\t\x12\x14\n\x0c\x63pu_platform\x18\x04 \x01(\t\x12\x11\n\tcpu_model\x18\x05 \x01(\t\x12\x17\n\x0f\x63pu_clock_speed\x18\x06 \x01(\x04\x12\x1b\n\x13\x63pu_max_clock_speed\x18\x07 \x01(\x04\x12\x18\n\x10\x63pu_number_cores\x18\x08 \x01(\x04\x12\x0b\n\x03ram\x18\t \x01(\x04\"}\n\x10PlatformSoftware\x12\x31\n\x08platform\x18\x01 \x01(\x0e\x32\x1f.google.backstory.Noun.Platform\x12\x18\n\x10platform_version\x18\x02 \x01(\t\x12\x1c\n\x14platform_patch_level\x18\x03 \x01(\t\"\x86\x01\n\x08Software\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x0f\n\x07version\x18\x02 \x01(\t\x12\x31\n\x0bpermissions\x18\x03 \x03(\x0b\x32\x1c.google.backstory.Permission\x12\x13\n\x0b\x64\x65scription\x18\x04 \x01(\t\x12\x13\n\x0bvendor_name\x18\x05 \x01(\t\"\x9c\n\n\x05\x41sset\x12\x19\n\x11product_object_id\x18\x01 \x01(\t\x12\x10\n\x08hostname\x18\x02 \x01(\t\x12\x10\n\x08\x61sset_id\x18\x03 \x01(\t\x12\n\n\x02ip\x18\x04 \x03(\t\x12\x0b\n\x03mac\x18\x05 \x03(\t\x12\x0e\n\x06nat_ip\x18\x16 \x03(\t\x12\x33\n\x0f\x66irst_seen_time\x18\x17 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12,\n\x08hardware\x18\x06 \x03(\x0b\x32\x1a.google.backstory.Hardware\x12=\n\x11platform_software\x18\x07 \x01(\x0b\x32\".google.backstory.PlatformSoftware\x12,\n\x08software\x18\x11 \x03(\x0b\x32\x1a.google.backstory.Software\x12,\n\x08location\x18\x08 \x01(\x0b\x32\x1a.google.backstory.Location\x12\x10\n\x08\x63\x61tegory\x18\t \x01(\t\x12/\n\x04type\x18\x12 \x01(\x0e\x32!.google.backstory.Asset.AssetType\x12\x16\n\x0enetwork_domain\x18\n \x01(\t\x12\x35\n\rcreation_time\x18\x0b \x01(\x0b\x32\x1a.google.protobuf.TimestampB\x02\x18\x01\x12\x37\n\x13\x66irst_discover_time\x18\x0c \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x36\n\x12last_discover_time\x18\r \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12;\n\x17system_last_update_time\x18\x0e \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x32\n\x0elast_boot_time\x18\x0f \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12+\n\x06labels\x18\x10 \x03(\x0b\x32\x17.google.backstory.LabelB\x02\x18\x01\x12\x43\n\x11\x64\x65ployment_status\x18\x13 \x01(\x0e\x32(.google.backstory.Asset.DeploymentStatus\x12\x38\n\x0fvulnerabilities\x18\x15 \x03(\x0b\x32\x1f.google.backstory.Vulnerability\x12.\n\tattribute\x18\x14 \x01(\x0b\x32\x1b.google.backstory.Attribute\x12\x42\n\x14wmi_persistence_item\x18\x18 \x01(\x0b\x32$.google.backstory.WmiPersistenceItem\"\xa9\x01\n\tAssetType\x12\x14\n\x10ROLE_UNSPECIFIED\x10\x00\x12\x0f\n\x0bWORKSTATION\x10\x01\x12\n\n\x06LAPTOP\x10\x02\x12\x07\n\x03IOT\x10\x03\x12\x1c\n\x18NETWORK_ATTACHED_STORAGE\x10\x04\x12\x0b\n\x07PRINTER\x10\x05\x12\x0b\n\x07SCANNER\x10\x06\x12\n\n\x06SERVER\x10\x07\x12\x10\n\x0cTAPE_LIBRARY\x10\x08\x12\n\n\x06MOBILE\x10\t\"m\n\x10\x44\x65ploymentStatus\x12!\n\x1d\x44\x45PLOYMENT_STATUS_UNSPECIFIED\x10\x00\x12\n\n\x06\x41\x43TIVE\x10\x01\x12\x17\n\x13PENDING_DECOMISSION\x10\x02\x12\x11\n\rDECOMISSIONED\x10\x03\"\xc5\x0c\n\x04User\x12\x19\n\x11product_object_id\x18\x07 \x01(\t\x12\x0e\n\x06userid\x18\x01 \x01(\t\x12\x19\n\x11user_display_name\x18\x03 \x01(\t\x12\x12\n\nfirst_name\x18\x64 \x01(\t\x12\x13\n\x0bmiddle_name\x18\x65 \x01(\t\x12\x11\n\tlast_name\x18\x66 \x01(\t\x12\x15\n\rphone_numbers\x18g \x03(\t\x12\x34\n\x10personal_address\x18h \x01(\x0b\x32\x1a.google.backstory.Location\x12.\n\tattribute\x18\x08 \x01(\x0b\x32\x1b.google.backstory.Attribute\x12\x33\n\x0f\x66irst_seen_time\x18\n \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x38\n\x0c\x61\x63\x63ount_type\x18\t \x01(\x0e\x32\".google.backstory.User.AccountType\x12\x13\n\x07groupid\x18\x02 \x01(\tB\x02\x18\x01\x12\x1a\n\x11group_identifiers\x18\xc8\x01 \x03(\t\x12\x13\n\x0bwindows_sid\x18\x04 \x01(\t\x12\x17\n\x0f\x65mail_addresses\x18\x05 \x03(\t\x12\x13\n\x0b\x65mployee_id\x18\x06 \x01(\t\x12\x0e\n\x05title\x18\xd9\x04 \x01(\t\x12\x15\n\x0c\x63ompany_name\x18\xda\x04 \x01(\t\x12\x13\n\ndepartment\x18\xdb\x04 \x03(\t\x12\x33\n\x0eoffice_address\x18\xdc\x04 \x01(\x0b\x32\x1a.google.backstory.Location\x12)\n\x08managers\x18\xdd\x04 \x03(\x0b\x32\x16.google.backstory.User\x12.\n\thire_date\x18\xde\x04 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x35\n\x10termination_date\x18\xdf\x04 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12,\n\x08time_off\x18\xe0\x04 \x03(\x0b\x32\x19.google.backstory.TimeOff\x12\x34\n\x0flast_login_time\x18\xe1\x04 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12>\n\x19last_password_change_time\x18\xe2\x04 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12=\n\x18password_expiration_time\x18\xe3\x04 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12<\n\x17\x61\x63\x63ount_expiration_time\x18\xe4\x04 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x39\n\x14\x61\x63\x63ount_lockout_time\x18\xe5\x04 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x43\n\x1elast_bad_password_attempt_time\x18\xe6\x04 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12Z\n\x1auser_authentication_status\x18\xbd\x05 \x01(\x0e\x32\x35.google.backstory.Authentication.AuthenticationStatus\x12\x16\n\trole_name\x18\xbe\x05 \x01(\tB\x02\x18\x01\x12\x1d\n\x10role_description\x18\xbf\x05 \x01(\tB\x02\x18\x01\x12\x33\n\tuser_role\x18\xc0\x05 \x01(\x0e\x32\x1b.google.backstory.User.RoleB\x02\x18\x01\"\xa8\x01\n\x0b\x41\x63\x63ountType\x12\x1c\n\x18\x41\x43\x43OUNT_TYPE_UNSPECIFIED\x10\x00\x12\x17\n\x13\x44OMAIN_ACCOUNT_TYPE\x10\x01\x12\x16\n\x12LOCAL_ACCOUNT_TYPE\x10\x02\x12\x16\n\x12\x43LOUD_ACCOUNT_TYPE\x10\x03\x12\x18\n\x14SERVICE_ACCOUNT_TYPE\x10\x04\x12\x18\n\x14\x44\x45\x46\x41ULT_ACCOUNT_TYPE\x10\x05\"D\n\x04Role\x12\x10\n\x0cUNKNOWN_ROLE\x10\x00\x12\x11\n\rADMINISTRATOR\x10\x01\x12\x17\n\x0fSERVICE_ACCOUNT\x10\x02\x1a\x02\x08\x01\"G\n\x07TimeOff\x12\'\n\x08interval\x18\x01 \x01(\x0b\x32\x15.google.type.Interval\x12\x13\n\x0b\x64\x65scription\x18\x02 \x01(\t\"\xd9\x01\n\nPermission\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x13\n\x0b\x64\x65scription\x18\x02 \x01(\t\x12\x39\n\x04type\x18\x03 \x01(\x0e\x32+.google.backstory.Permission.PermissionType\"m\n\x0ePermissionType\x12\x1b\n\x17UNKNOWN_PERMISSION_TYPE\x10\x00\x12\x0f\n\x0b\x41\x44MIN_WRITE\x10\x01\x12\x0e\n\nADMIN_READ\x10\x02\x12\x0e\n\nDATA_WRITE\x10\x03\x12\r\n\tDATA_READ\x10\x04\"\x9a\x01\n\x04Role\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x13\n\x0b\x64\x65scription\x18\x02 \x01(\t\x12)\n\x04type\x18\x03 \x01(\x0e\x32\x1b.google.backstory.Role.Type\"D\n\x04Type\x12\x14\n\x10TYPE_UNSPECIFIED\x10\x00\x12\x11\n\rADMINISTRATOR\x10\x01\x12\x13\n\x0fSERVICE_ACCOUNT\x10\x02\"\xd3\x01\n\x05Group\x12\x19\n\x11product_object_id\x18\x01 \x01(\t\x12\x35\n\rcreation_time\x18\x64 \x01(\x0b\x32\x1a.google.protobuf.TimestampB\x02\x18\x01\x12\x1a\n\x12group_display_name\x18\x65 \x01(\t\x12.\n\tattribute\x18\x04 \x01(\x0b\x32\x1b.google.backstory.Attribute\x12\x17\n\x0f\x65mail_addresses\x18\x02 \x03(\t\x12\x13\n\x0bwindows_sid\x18\x03 \x01(\t\"\x91\x03\n\x08Registry\x12\x14\n\x0cregistry_key\x18\x01 \x01(\t\x12\x1b\n\x13registry_value_name\x18\x02 \x01(\t\x12\x1b\n\x13registry_value_data\x18\x03 \x01(\t\x12<\n\x13registry_value_type\x18\x04 \x01(\x0e\x32\x1f.google.backstory.Registry.Type\x12\"\n\x1aregistry_value_binary_data\x18\x05 \x01(\x0c\"\xd2\x01\n\x04Type\x12\x14\n\x10TYPE_UNSPECIFIED\x10\x00\x12\x08\n\x04NONE\x10\x01\x12\x06\n\x02SZ\x10\x02\x12\r\n\tEXPAND_SZ\x10\x03\x12\n\n\x06\x42INARY\x10\x04\x12\t\n\x05\x44WORD\x10\x05\x12\x17\n\x13\x44WORD_LITTLE_ENDIAN\x10\x06\x12\x14\n\x10\x44WORD_BIG_ENDIAN\x10\x07\x12\x08\n\x04LINK\x10\x08\x12\x0c\n\x08MULTI_SZ\x10\t\x12\x11\n\rRESOURCE_LIST\x10\n\x12\t\n\x05QWORD\x10\x0b\x12\x17\n\x13QWORD_LITTLE_ENDIAN\x10\x0c\"\xd1\x01\n\x12WmiPersistenceItem\x12\x0f\n\x07\x63\x61ption\x18\x01 \x01(\t\x12\x0c\n\x04name\x18\x02 \x01(\t\x12\x12\n\nsetting_id\x18\x03 \x01(\t\x12\x12\n\nderivation\x18\x04 \x01(\t\x12\x16\n\x0eproperty_count\x18\x05 \x01(\x03\x12\x10\n\x08rel_path\x18\x06 \x01(\t\x12\x0f\n\x07\x64ynasty\x18\x07 \x01(\t\x12\x17\n\x0fwmi_super_class\x18\x08 \x01(\t\x12\x11\n\twmi_class\x18\t \x01(\t\x12\r\n\x05genus\x18\n \x01(\x03\"\xe3\x01\n\x08Location\x12\x0c\n\x04\x63ity\x18\x01 \x01(\t\x12\r\n\x05state\x18\x02 \x01(\t\x12\x19\n\x11\x63ountry_or_region\x18\x03 \x01(\t\x12\x0c\n\x04name\x18\x04 \x01(\t\x12\x11\n\tdesk_name\x18\x05 \x01(\t\x12\x12\n\nfloor_name\x18\x06 \x01(\t\x12\x1b\n\x0fregion_latitude\x18\x07 \x01(\x02\x42\x02\x18\x01\x12\x1c\n\x10region_longitude\x18\x08 \x01(\x02\x42\x02\x18\x01\x12/\n\x12region_coordinates\x18\t \x01(\x0b\x32\x13.google.type.LatLng\"\x86\x01\n\rScheduledTask\x12\x0e\n\x06minute\x18\x01 \x01(\x05\x12\x0c\n\x04hour\x18\x02 \x01(\x05\x12\x11\n\tmonth_day\x18\x03 \x01(\x05\x12\r\n\x05month\x18\x04 \x01(\x05\x12\x10\n\x08week_day\x18\x05 \x01(\x05\x12\x0f\n\x07\x63omment\x18\x06 \x01(\t\x12\x0e\n\x06\x61uthor\x18\x07 \x01(\t:\x02\x18\x01\"\xa6\n\n\x14WindowsScheduledTask\x12\x0e\n\x06\x61uthor\x18\x01 \x01(\t\x12\x14\n\x0cvirtual_path\x18\x02 \x01(\t\x12\x11\n\texit_code\x18\x03 \x01(\x05\x12?\n\x05state\x18\x04 \x01(\x0e\x32\x30.google.backstory.WindowsScheduledTask.TaskState\x12H\n\nlogon_type\x18\x05 \x01(\x0e\x32\x34.google.backstory.WindowsScheduledTask.TaskLogonType\x12G\n\x0ctask_actions\x18\x06 \x03(\x0b\x32\x31.google.backstory.WindowsScheduledTask.TaskAction\x12I\n\rtask_triggers\x18\x07 \x03(\x0b\x32\x32.google.backstory.WindowsScheduledTask.TaskTrigger\x1a\xa7\x02\n\nTaskAction\x12Q\n\x0b\x61\x63tion_type\x18\x01 \x01(\x0e\x32<.google.backstory.WindowsScheduledTask.TaskAction.ActionType\x12\x16\n\x0e\x65xec_arguments\x18\x02 \x03(\t\x12\x1e\n\x16\x65xec_working_directory\x18\x03 \x01(\t\x12\x14\n\x0c\x63om_class_id\x18\x04 \x01(\t\x12\x10\n\x08\x63om_data\x18\x05 \x01(\t\"f\n\nActionType\x12\x1b\n\x17\x41\x43TION_TYPE_UNSPECIFIED\x10\x00\x12\x08\n\x04\x45XEC\x10\x01\x12\x0f\n\x0b\x43OM_HANDLER\x10\x02\x12\x0e\n\nSEND_EMAIL\x10\x03\x12\x10\n\x0cSHOW_MESSAGE\x10\x04\x1a\x8b\x03\n\x0bTaskTrigger\x12\x0f\n\x07\x65nabled\x18\x01 \x01(\x08\x12+\n\x08\x64uration\x18\x02 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x10\n\x08interval\x18\x03 \x01(\t\x12T\n\x0ctrigger_type\x18\x04 \x01(\x0e\x32>.google.backstory.WindowsScheduledTask.TaskTrigger.TriggerType\"\xd5\x01\n\x0bTriggerType\x12\x1c\n\x18TRIGGER_TYPE_UNSPECIFIED\x10\x00\x12\t\n\x05\x45VENT\x10\x01\x12\x08\n\x04TIME\x10\x02\x12\t\n\x05\x44\x41ILY\x10\x03\x12\n\n\x06WEEKLY\x10\x04\x12\x0b\n\x07MONTHLY\x10\x05\x12\x0e\n\nMONTHLYDOW\x10\x06\x12\x08\n\x04IDLE\x10\x07\x12\x10\n\x0cREGISTRATION\x10\x08\x12\x08\n\x04\x42OOT\x10\t\x12\t\n\x05LOGON\x10\n\x12\x18\n\x14SESSION_STATE_CHANGE\x10\x0b\x12\x14\n\x10\x43USTOM_TRIGGER01\x10\x0c\"Z\n\tTaskState\x12\x1a\n\x16TASK_STATE_UNSPECIFIED\x10\x00\x12\x0c\n\x08\x44ISABLED\x10\x01\x12\n\n\x06QUEUED\x10\x02\x12\n\n\x06\x41\x43TIVE\x10\x03\x12\x0b\n\x07RUNNING\x10\x04\"\xa1\x01\n\rTaskLogonType\x12\x1f\n\x1bTASK_LOGON_TYPE_UNSPECIFIED\x10\x00\x12\x0c\n\x08PASSWORD\x10\x01\x12\x07\n\x03S4U\x10\x02\x12\x15\n\x11INTERACTIVE_TOKEN\x10\x03\x12\t\n\x05GROUP\x10\x04\x12\x13\n\x0fSERVICE_ACCOUNT\x10\x05\x12!\n\x1dINTERACTIVE_TOKEN_OR_PASSWORD\x10\x06\"\xa3\x01\n\x11ScheduledCronTask\x12\x0e\n\x06minute\x18\x01 \x01(\t\x12\x0c\n\x04hour\x18\x02 \x01(\t\x12\x11\n\tmonth_day\x18\x03 \x01(\t\x12\r\n\x05month\x18\x04 \x01(\t\x12\x10\n\x08week_day\x18\x05 \x01(\t\x12\x0f\n\x07\x63omment\x18\x06 \x01(\t\x12\x0e\n\x06\x61uthor\x18\x07 \x01(\t\x12\r\n\x05\x65vent\x18\x08 \x01(\t\x12\x0c\n\x04path\x18\t \x01(\t\"p\n\x14ScheduledAnacronTask\x12\x0e\n\x06period\x18\x01 \x01(\t\x12\x15\n\rdelay_minutes\x18\x02 \x01(\x03\x12\x0e\n\x06job_id\x18\x03 \x01(\t\x12\x0c\n\x04path\x18\x04 \x01(\t\x12\x13\n\x0bsource_line\x18\x05 \x01(\t\"\x7f\n\x06Volume\x12\x13\n\x0b\x66ile_system\x18\x01 \x01(\t\x12\x13\n\x0bmount_point\x18\x02 \x01(\t\x12\x13\n\x0b\x64\x65vice_path\x18\x03 \x01(\t\x12\x12\n\nis_mounted\x18\x04 \x01(\x08\x12\x14\n\x0cis_read_only\x18\x05 \x01(\x08\x12\x0c\n\x04name\x18\x06 \x01(\t\"\xcb\x05\n\x07Service\x12\x14\n\x0c\x64isplay_name\x18\x01 \x01(\t\x12?\n\x0cservice_type\x18\x03 \x01(\x0e\x32%.google.backstory.Service.ServiceTypeB\x02\x18\x01\x12<\n\rservice_types\x18\x06 \x03(\x0e\x32%.google.backstory.Service.ServiceType\x12;\n\x0cstartup_type\x18\x04 \x01(\x0e\x32%.google.backstory.Service.StartupType\x12.\n\x05state\x18\x05 \x01(\x0e\x32\x1f.google.backstory.Service.State\"\xc3\x01\n\x0bServiceType\x12\x1c\n\x18SERVICE_TYPE_UNSPECIFIED\x10\x00\x12\x11\n\rKERNEL_DRIVER\x10\x01\x12\x16\n\x12\x46ILE_SYSTEM_DRIVER\x10\x02\x12\x15\n\x11WIN32_OWN_PROCESS\x10\x03\x12\x17\n\x13WIN32_SHARE_PROCESS\x10\x04\x12\x0b\n\x07\x41\x44\x41PTER\x10\x05\x12\x15\n\x11RECOGNIZER_DRIVER\x10\x06\x12\x17\n\x13INTERACTIVE_PROCESS\x10\x07\"T\n\x0bStartupType\x12\x1c\n\x18STARTUP_TYPE_UNSPECIFIED\x10\x00\x12\r\n\tAUTOMATIC\x10\x01\x12\n\n\x06MANUAL\x10\x02\x12\x0c\n\x08\x44ISABLED\x10\x03\"\xa1\x01\n\x05State\x12\x15\n\x11STATE_UNSPECIFIED\x10\x00\x12\x0b\n\x07RUNNING\x10\x01\x12\x0b\n\x07STOPPED\x10\x02\x12\n\n\x06PAUSED\x10\x03\x12\r\n\tCOMPLETED\x10\x04\x12\x11\n\rSTART_PENDING\x10\x05\x12\x10\n\x0cSTOP_PENDING\x10\x06\x12\x11\n\rPAUSE_PENDING\x10\x07\x12\x14\n\x10\x43ONTINUE_PENDING\x10\x08\"\x97\t\n\x08Resource\x12\x10\n\x04type\x18\x01 \x01(\tB\x02\x18\x01\x12>\n\rresource_type\x18\x05 \x01(\x0e\x32\'.google.backstory.Resource.ResourceType\x12\x18\n\x10resource_subtype\x18\x06 \x01(\t\x12\x0e\n\x02id\x18\x02 \x01(\tB\x02\x18\x01\x12\x0c\n\x04name\x18\x03 \x01(\t\x12\x12\n\x06parent\x18\x04 \x01(\tB\x02\x18\x01\x12\x19\n\x11product_object_id\x18\x08 \x01(\t\x12.\n\tattribute\x18\x07 \x01(\x0b\x32\x1b.google.backstory.Attribute\x12;\n\x0escheduled_task\x18\t \x01(\x0b\x32\x1f.google.backstory.ScheduledTaskB\x02\x18\x01\x12@\n\x13scheduled_cron_task\x18\x0c \x01(\x0b\x32#.google.backstory.ScheduledCronTask\x12\x46\n\x16scheduled_anacron_task\x18\r \x01(\x0b\x32&.google.backstory.ScheduledAnacronTask\x12\x46\n\x16windows_scheduled_task\x18\x0e \x01(\x0b\x32&.google.backstory.WindowsScheduledTask\x12(\n\x06volume\x18\n \x01(\x0b\x32\x18.google.backstory.Volume\x12*\n\x07service\x18\x0b \x01(\x0b\x32\x19.google.backstory.Service\"\xbc\x04\n\x0cResourceType\x12\x0f\n\x0bUNSPECIFIED\x10\x00\x12\t\n\x05MUTEX\x10\x01\x12\x08\n\x04TASK\x10\x02\x12\x08\n\x04PIPE\x10\x03\x12\n\n\x06\x44\x45VICE\x10\x04\x12\x11\n\rFIREWALL_RULE\x10\x05\x12\x12\n\x0eMAILBOX_FOLDER\x10\x06\x12\x0f\n\x0bVPC_NETWORK\x10\x07\x12\x13\n\x0fVIRTUAL_MACHINE\x10\x08\x12\x12\n\x0eSTORAGE_BUCKET\x10\t\x12\x12\n\x0eSTORAGE_OBJECT\x10\n\x12\x0c\n\x08\x44\x41TABASE\x10\x0b\x12\t\n\x05TABLE\x10\x0c\x12\x11\n\rCLOUD_PROJECT\x10\r\x12\x16\n\x12\x43LOUD_ORGANIZATION\x10\x0e\x12\x13\n\x0fSERVICE_ACCOUNT\x10\x0f\x12\x11\n\rACCESS_POLICY\x10\x10\x12\x0b\n\x07\x43LUSTER\x10\x11\x12\x0b\n\x07SETTING\x10\x12\x12\x0b\n\x07\x44\x41TASET\x10\x13\x12\x13\n\x0f\x42\x41\x43KEND_SERVICE\x10\x14\x12\x07\n\x03POD\x10\x15\x12\r\n\tCONTAINER\x10\x16\x12\x0c\n\x08\x46UNCTION\x10\x17\x12\x0b\n\x07RUNTIME\x10\x18\x12\x0e\n\nIP_ADDRESS\x10\x19\x12\x08\n\x04\x44ISK\x10\x1a\x12\n\n\x06VOLUME\x10\x1b\x12\t\n\x05IMAGE\x10\x1c\x12\x0c\n\x08SNAPSHOT\x10\x1d\x12\x0e\n\nREPOSITORY\x10\x1e\x12\x0e\n\nCREDENTIAL\x10\x1f\x12\x11\n\rLOAD_BALANCER\x10 \x12\x0b\n\x07GATEWAY\x10!\x12\n\n\x06SUBNET\x10\"\x12\x08\n\x04USER\x10#\x12\x0b\n\x07SERVICE\x10$\"I\n\x05Label\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t\x12\x0e\n\x06source\x18\x03 \x01(\t\x12\x14\n\x0crbac_enabled\x18\x04 \x01(\x08\"\xbf\x02\n\x05\x43loud\x12=\n\x0b\x65nvironment\x18\x01 \x01(\x0e\x32(.google.backstory.Cloud.CloudEnvironment\x12+\n\x03vpc\x18\x02 \x01(\x0b\x32\x1a.google.backstory.ResourceB\x02\x18\x01\x12/\n\x07project\x18\x03 \x01(\x0b\x32\x1a.google.backstory.ResourceB\x02\x18\x01\x12\x19\n\x11\x61vailability_zone\x18\x04 \x01(\t\"~\n\x10\x43loudEnvironment\x12!\n\x1dUNSPECIFIED_CLOUD_ENVIRONMENT\x10\x00\x12\x19\n\x15GOOGLE_CLOUD_PLATFORM\x10\x01\x12\x17\n\x13\x41MAZON_WEB_SERVICES\x10\x02\x12\x13\n\x0fMICROSOFT_AZURE\x10\x03\"\xb5\x05\n\x08\x41rtifact\x12\n\n\x02ip\x18\x01 \x01(\t\x12\x30\n\nprevalence\x18\x02 \x01(\x0b\x32\x1c.google.backstory.Prevalence\x12\x33\n\x0f\x66irst_seen_time\x18\x03 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x32\n\x0elast_seen_time\x18\x04 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12,\n\x08location\x18\x05 \x01(\x0b\x32\x1a.google.backstory.Location\x12*\n\x07network\x18\x06 \x01(\x0b\x32\x19.google.backstory.Network\x12\x10\n\x08\x61s_owner\x18\x07 \x01(\t\x12\x0b\n\x03\x61sn\x18\x08 \x01(\x03\x12\x0c\n\x04jarm\x18\t \x01(\t\x12@\n\x16last_https_certificate\x18\n \x01(\x0b\x32 .google.backstory.SSLCertificate\x12?\n\x1blast_https_certificate_date\x18\x0b \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\"\n\x1aregional_internet_registry\x18\x0c \x01(\t\x12\x0c\n\x04tags\x18\r \x03(\t\x12\r\n\x05whois\x18\x0e \x01(\t\x12.\n\nwhois_date\x18\x0f \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12*\n\x07tunnels\x18\x10 \x03(\x0b\x32\x19.google.backstory.Tunnels\x12\x11\n\tanonymous\x18\x11 \x01(\x08\x12\x39\n\x0f\x61rtifact_client\x18\x12 \x01(\x0b\x32 .google.backstory.ArtifactClient\x12\r\n\x05risks\x18\x13 \x03(\t\")\n\x07Tunnels\x12\x10\n\x08provider\x18\x01 \x01(\t\x12\x0c\n\x04type\x18\x02 \x01(\t\"4\n\x0e\x41rtifactClient\x12\x11\n\tbehaviors\x18\x01 \x03(\t\x12\x0f\n\x07proxies\x18\x02 \x03(\t\")\n\x07\x46\x61vicon\x12\x0f\n\x07raw_md5\x18\x01 \x01(\t\x12\r\n\x05\x64hash\x18\x02 \x01(\t\"\x93\x02\n\tDNSRecord\x12\x0c\n\x04type\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t\x12&\n\x03ttl\x18\x03 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x10\n\x08priority\x18\x04 \x01(\x03\x12\r\n\x05retry\x18\x05 \x01(\x03\x12*\n\x07refresh\x18\x06 \x01(\x0b\x32\x19.google.protobuf.Duration\x12*\n\x07minimum\x18\x07 \x01(\x0b\x32\x19.google.protobuf.Duration\x12)\n\x06\x65xpire\x18\x08 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x0e\n\x06serial\x18\t \x01(\x03\x12\r\n\x05rname\x18\n \x01(\t\"\x8c\r\n\x0eSSLCertificate\x12\x46\n\x0e\x63\x65rt_signature\x18\x01 \x01(\x0b\x32..google.backstory.SSLCertificate.CertSignature\x12\x41\n\textension\x18\x02 \x01(\x0b\x32*.google.backstory.SSLCertificate.ExtensionB\x02\x18\x01\x12\x30\n\x0f\x63\x65rt_extensions\x18\x0e \x01(\x0b\x32\x17.google.protobuf.Struct\x12\x33\n\x0f\x66irst_seen_time\x18\x03 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x38\n\x06issuer\x18\x04 \x01(\x0b\x32(.google.backstory.SSLCertificate.Subject\x12/\n\x02\x65\x63\x18\x05 \x01(\x0b\x32#.google.backstory.SSLCertificate.EC\x12\x15\n\rserial_number\x18\x06 \x01(\t\x12\x1b\n\x13signature_algorithm\x18\x07 \x01(\t\x12\x0c\n\x04size\x18\x08 \x01(\x03\x12\x39\n\x07subject\x18\t \x01(\x0b\x32(.google.backstory.SSLCertificate.Subject\x12\x12\n\nthumbprint\x18\n \x01(\t\x12\x19\n\x11thumbprint_sha256\x18\x0b \x01(\t\x12;\n\x08validity\x18\x0c \x01(\x0b\x32).google.backstory.SSLCertificate.Validity\x12\x0f\n\x07version\x18\r \x01(\t\x12>\n\npublic_key\x18\x0f \x01(\x0b\x32*.google.backstory.SSLCertificate.PublicKey\x1a?\n\rCertSignature\x12\x11\n\tsignature\x18\x01 \x01(\t\x12\x1b\n\x13signature_algorithm\x18\x02 \x01(\t\x1a\x36\n\x0e\x41uthorityKeyId\x12\r\n\x05keyid\x18\x01 \x01(\t\x12\x15\n\rserial_number\x18\x02 \x01(\t\x1a\xb1\x03\n\tExtension\x12\n\n\x02\x63\x61\x18\x01 \x01(\x08\x12\x16\n\x0esubject_key_id\x18\x02 \x01(\t\x12I\n\x10\x61uthority_key_id\x18\x03 \x01(\x0b\x32/.google.backstory.SSLCertificate.AuthorityKeyId\x12\x11\n\tkey_usage\x18\x06 \x01(\t\x12\x16\n\x0e\x63\x61_info_access\x18\x07 \x01(\t\x12\x1f\n\x17\x63rl_distribution_points\x18\x08 \x01(\t\x12\x1a\n\x12\x65xtended_key_usage\x18\t \x01(\t\x12 \n\x18subject_alternative_name\x18\n \x01(\t\x12\x1c\n\x14\x63\x65rtificate_policies\x18\x0b \x01(\t\x12\x1d\n\x15netscape_cert_comment\x18\x0c \x01(\t\x12\x1d\n\x15\x63\x65rt_template_name_dc\x18\r \x01(\t\x12\x1c\n\x14netscape_certificate\x18\x0e \x01(\x08\x12\x13\n\x0bpe_logotype\x18\x0f \x01(\x08\x12\x1c\n\x14old_authority_key_id\x18\x10 \x01(\x08\x1a\x99\x01\n\x07Subject\x12\x14\n\x0c\x63ountry_name\x18\x01 \x01(\t\x12\x13\n\x0b\x63ommon_name\x18\x02 \x01(\t\x12\x10\n\x08locality\x18\x03 \x01(\t\x12\x14\n\x0corganization\x18\x04 \x01(\t\x12\x1b\n\x13organizational_unit\x18\x05 \x01(\t\x12\x1e\n\x16state_or_province_name\x18\x06 \x01(\t\x1a:\n\x03RSA\x12\x10\n\x08key_size\x18\x01 \x01(\x03\x12\x0f\n\x07modulus\x18\x02 \x01(\t\x12\x10\n\x08\x65xponent\x18\x03 \x01(\t\x1a\x1e\n\x02\x45\x43\x12\x0b\n\x03oid\x18\x01 \x01(\t\x12\x0b\n\x03pub\x18\x02 \x01(\t\x1aQ\n\tPublicKey\x12\x11\n\talgorithm\x18\x01 \x01(\t\x12\x31\n\x03rsa\x18\x02 \x01(\x0b\x32$.google.backstory.SSLCertificate.RSA\x1ak\n\x08Validity\x12/\n\x0b\x65xpiry_time\x18\x01 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12.\n\nissue_time\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\"a\n\x0ePopularityRank\x12\r\n\x05giver\x18\x01 \x01(\t\x12\x0c\n\x04rank\x18\x02 \x01(\x03\x12\x32\n\x0eingestion_time\x18\x03 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\"b\n\x07Tracker\x12\x0f\n\x07tracker\x18\x01 \x01(\t\x12\n\n\x02id\x18\x02 \x01(\t\x12-\n\ttimestamp\x18\x03 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x0b\n\x03url\x18\x04 \x01(\t\"\xd1\x03\n\x03Url\x12\x0b\n\x03url\x18\x01 \x01(\t\x12\x12\n\ncategories\x18\x02 \x03(\t\x12*\n\x07\x66\x61vicon\x18\x03 \x01(\x0b\x32\x19.google.backstory.Favicon\x12*\n\thtml_meta\x18\x04 \x01(\x0b\x32\x17.google.protobuf.Struct\x12\x16\n\x0elast_final_url\x18\x05 \x01(\t\x12\x1f\n\x17last_http_response_code\x18\x06 \x01(\x05\x12)\n!last_http_response_content_length\x18\x07 \x01(\x03\x12)\n!last_http_response_content_sha256\x18\x08 \x01(\t\x12;\n\x1alast_http_response_cookies\x18\t \x01(\x0b\x32\x17.google.protobuf.Struct\x12;\n\x1alast_http_response_headers\x18\n \x01(\x0b\x32\x17.google.protobuf.Struct\x12\x0c\n\x04tags\x18\x0b \x03(\t\x12\r\n\x05title\x18\x0c \x01(\t\x12+\n\x08trackers\x18\r \x03(\x0b\x32\x19.google.backstory.Tracker\"\xe3\t\n\x06\x44omain\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x30\n\nprevalence\x18\x02 \x01(\x0b\x32\x1c.google.backstory.Prevalence\x12\x33\n\x0f\x66irst_seen_time\x18\x03 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x32\n\x0elast_seen_time\x18\x04 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x11\n\tregistrar\x18\x05 \x01(\t\x12\x15\n\rcontact_email\x18\x06 \x01(\t\x12\x14\n\x0cwhois_server\x18\x07 \x01(\t\x12\x13\n\x0bname_server\x18\x08 \x03(\t\x12\x31\n\rcreation_time\x18\t \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12/\n\x0bupdate_time\x18\n \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x33\n\x0f\x65xpiration_time\x18\x0b \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x35\n\x11\x61udit_update_time\x18\x0c \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x0e\n\x06status\x18\r \x01(\t\x12*\n\nregistrant\x18\x0e \x01(\x0b\x32\x16.google.backstory.User\x12%\n\x05\x61\x64min\x18\x0f \x01(\x0b\x32\x16.google.backstory.User\x12$\n\x04tech\x18\x10 \x01(\x0b\x32\x16.google.backstory.User\x12\'\n\x07\x62illing\x18\x11 \x01(\x0b\x32\x16.google.backstory.User\x12$\n\x04zone\x18\x12 \x01(\x0b\x32\x16.google.backstory.User\x12\x1d\n\x15whois_record_raw_text\x18\x13 \x01(\x0c\x12\x1e\n\x16registry_data_raw_text\x18\x14 \x01(\x0c\x12\x19\n\x11iana_registrar_id\x18\x15 \x01(\x05\x12\x1c\n\x14private_registration\x18\x16 \x01(\x08\x12\x12\n\ncategories\x18\x17 \x03(\t\x12*\n\x07\x66\x61vicon\x18\x18 \x01(\x0b\x32\x19.google.backstory.Favicon\x12\x0c\n\x04jarm\x18\x19 \x01(\t\x12\x35\n\x10last_dns_records\x18\x1a \x03(\x0b\x32\x1b.google.backstory.DNSRecord\x12\x39\n\x15last_dns_records_time\x18\x1b \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12@\n\x16last_https_certificate\x18\x1c \x01(\x0b\x32 .google.backstory.SSLCertificate\x12?\n\x1blast_https_certificate_time\x18\x1d \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12:\n\x10popularity_ranks\x18\x1e \x03(\x0b\x32 .google.backstory.PopularityRank\x12\x0c\n\x04tags\x18\x1f \x03(\t\x12.\n\nwhois_time\x18  \x01(\x0b\x32\x1a.google.protobuf.Timestamp\"\x8d\x0c\n\x04Noun\x12\x10\n\x08hostname\x18\x01 \x01(\t\x12(\n\x06\x64omain\x18\x1e \x01(\x0b\x32\x18.google.backstory.Domain\x12,\n\x08\x61rtifact\x18  \x01(\x0b\x32\x1a.google.backstory.Artifact\x12+\n\x0curl_metadata\x18% \x01(\x0b\x32\x15.google.backstory.Url\x12*\n\x07\x62rowser\x18& \x01(\x0b\x32\x19.google.backstory.Browser\x12\x10\n\x08\x61sset_id\x18\x02 \x01(\t\x12$\n\x04user\x18\x03 \x01(\x0b\x32\x16.google.backstory.User\x12\x35\n\x15user_management_chain\x18\x1d \x03(\x0b\x32\x16.google.backstory.User\x12&\n\x05group\x18\x14 \x01(\x0b\x32\x17.google.backstory.Group\x12*\n\x07process\x18\x04 \x01(\x0b\x32\x19.google.backstory.Process\x12\x34\n\x11process_ancestors\x18\x1c \x03(\x0b\x32\x19.google.backstory.Process\x12&\n\x05\x61sset\x18\x1b \x01(\x0b\x32\x17.google.backstory.Asset\x12\n\n\x02ip\x18\x06 \x03(\t\x12\x0e\n\x06nat_ip\x18\x15 \x03(\t\x12\x0c\n\x04port\x18\x07 \x01(\x05\x12\x10\n\x08nat_port\x18\x16 \x01(\x05\x12\x0b\n\x03mac\x18\x08 \x03(\t\x12\x1d\n\x15\x61\x64ministrative_domain\x18\t \x01(\t\x12\x11\n\tnamespace\x18\x13 \x01(\t\x12\x0b\n\x03url\x18\n \x01(\t\x12$\n\x04\x66ile\x18\x0b \x01(\x0b\x32\x16.google.backstory.File\x12\r\n\x05\x65mail\x18\x0c \x01(\t\x12,\n\x08registry\x18\r \x01(\x0b\x32\x1a.google.backstory.Registry\x12\x13\n\x0b\x61pplication\x18\x0e \x01(\t\x12\x31\n\x08platform\x18\x05 \x01(\x0e\x32\x1f.google.backstory.Noun.Platform\x12\x18\n\x10platform_version\x18\x0f \x01(\t\x12\x1c\n\x14platform_patch_level\x18\x10 \x01(\t\x12*\n\x05\x63loud\x18\x18 \x01(\x0b\x32\x17.google.backstory.CloudB\x02\x18\x01\x12,\n\x08location\x18\x11 \x01(\x0b\x32\x1a.google.backstory.Location\x12\x33\n\x0bip_location\x18\" \x03(\x0b\x32\x1a.google.backstory.LocationB\x02\x18\x01\x12\x33\n\x0fip_geo_artifact\x18# \x03(\x0b\x32\x1a.google.backstory.Artifact\x12,\n\x08resource\x18\x12 \x01(\x0b\x32\x1a.google.backstory.Resource\x12\x36\n\x12resource_ancestors\x18\x1f \x03(\x0b\x32\x1a.google.backstory.Resource\x12+\n\x06labels\x18\x17 \x03(\x0b\x32\x17.google.backstory.LabelB\x02\x18\x01\x12.\n\x10object_reference\x18\x19 \x01(\x0b\x32\x14.google.backstory.Id\x12\x36\n\rinvestigation\x18\x1a \x01(\x0b\x32\x1f.google.backstory.Investigation\x12*\n\x07network\x18! \x01(\x0b\x32\x19.google.backstory.Network\x12\x39\n\x0fsecurity_result\x18$ \x03(\x0b\x32 .google.backstory.SecurityResult\"\x8f\x01\n\x08Platform\x12\x14\n\x10UNKNOWN_PLATFORM\x10\x00\x12\x0b\n\x07WINDOWS\x10\x01\x12\x07\n\x03MAC\x10\x02\x12\t\n\x05LINUX\x10\x03\x12\x0b\n\x03GCP\x10\x04\x1a\x02\x08\x01\x12\x0b\n\x03\x41WS\x10\x05\x1a\x02\x08\x01\x12\r\n\x05\x41ZURE\x10\x06\x1a\x02\x08\x01\x12\x07\n\x03IOS\x10\x07\x12\x0b\n\x07\x41NDROID\x10\x08\x12\r\n\tCHROME_OS\x10\t\"\xf0\x03\n\rInvestigation\x12/\n\x07verdict\x18\x02 \x01(\x0e\x32\x19.google.backstory.VerdictH\x00\x88\x01\x01\x12\x35\n\nreputation\x18\x03 \x01(\x0e\x32\x1c.google.backstory.ReputationH\x01\x88\x01\x01\x12\x1b\n\x0eseverity_score\x18\x04 \x01(\rH\x02\x88\x01\x01\x12-\n\x06status\x18\x05 \x01(\x0e\x32\x18.google.backstory.StatusH\x03\x88\x01\x01\x12\x10\n\x08\x63omments\x18\x06 \x03(\t\x12\x31\n\x08priority\x18\x07 \x01(\x0e\x32\x1a.google.backstory.PriorityH\x04\x88\x01\x01\x12\x17\n\nroot_cause\x18\x08 \x01(\tH\x05\x88\x01\x01\x12-\n\x06reason\x18\t \x01(\x0e\x32\x18.google.backstory.ReasonH\x06\x88\x01\x01\x12\x17\n\nrisk_score\x18\n \x01(\rH\x07\x88\x01\x01\x12\x0f\n\x02id\x18\x0b \x01(\tH\x08\x88\x01\x01\x42\n\n\x08_verdictB\r\n\x0b_reputationB\x11\n\x0f_severity_scoreB\t\n\x07_statusB\x0b\n\t_priorityB\r\n\x0b_root_causeB\t\n\x07_reasonB\r\n\x0b_risk_scoreB\x05\n\x03_id\"7\n\x04Tags\x12\x11\n\ttenant_id\x18\x01 \x03(\x0c\x12\x1c\n\x14\x64\x61ta_tap_config_name\x18\x02 \x03(\t\"\x97\x02\n\rAttackDetails\x12\x0f\n\x07version\x18\x01 \x01(\t\x12\x37\n\x07tactics\x18\x02 \x03(\x0b\x32&.google.backstory.AttackDetails.Tactic\x12=\n\ntechniques\x18\x03 \x03(\x0b\x32).google.backstory.AttackDetails.Technique\x1a\"\n\x06Tactic\x12\n\n\x02id\x18\x01 \x01(\t\x12\x0c\n\x04name\x18\x02 \x01(\t\x1aY\n\tTechnique\x12\n\n\x02id\x18\x01 \x01(\t\x12\x0c\n\x04name\x18\x02 \x01(\t\x12\x17\n\x0fsubtechnique_id\x18\x03 \x01(\t\x12\x19\n\x11subtechnique_name\x18\x04 \x01(\t\"!\n\x0c\x42oolSequence\x12\x11\n\tbool_vals\x18\x01 \x03(\x08\"#\n\rBytesSequence\x12\x12\n\nbytes_vals\x18\x01 \x03(\x0c\"%\n\x0e\x44oubleSequence\x12\x13\n\x0b\x64ouble_vals\x18\x01 \x03(\x01\"#\n\rInt64Sequence\x12\x12\n\nint64_vals\x18\x01 \x03(\x03\"%\n\x0eUint64Sequence\x12\x13\n\x0buint64_vals\x18\x01 \x03(\x04\"%\n\x0eStringSequence\x12\x13\n\x0bstring_vals\x18\x01 \x03(\t\"\x8f\x01\n\rGroupedFields\x12\n\n\x02ip\x18\x01 \x03(\t\x12\x0e\n\x06\x64omain\x18\x02 \x03(\t\x12\x10\n\x08hostname\x18\x03 \x03(\t\x12\x0c\n\x04user\x18\x04 \x03(\t\x12\r\n\x05\x65mail\x18\x05 \x03(\t\x12\x11\n\tfile_path\x18\x06 \x03(\t\x12\x0c\n\x04hash\x18\x07 \x03(\t\x12\x12\n\nprocess_id\x18\x08 \x03(\t*I\n\x07Verdict\x12\x17\n\x13VERDICT_UNSPECIFIED\x10\x00\x12\x11\n\rTRUE_POSITIVE\x10\x01\x12\x12\n\x0e\x46\x41LSE_POSITIVE\x10\x02*D\n\nReputation\x12\x1a\n\x16REPUTATION_UNSPECIFIED\x10\x00\x12\n\n\x06USEFUL\x10\x01\x12\x0e\n\nNOT_USEFUL\x10\x02*M\n\x06Status\x12\x16\n\x12STATUS_UNSPECIFIED\x10\x00\x12\x07\n\x03NEW\x10\x01\x12\x0c\n\x08REVIEWED\x10\x02\x12\n\n\x06\x43LOSED\x10\x03\x12\x08\n\x04OPEN\x10\x04*\x8c\x01\n\x08Priority\x12\x18\n\x14PRIORITY_UNSPECIFIED\x10\x00\x12\x11\n\rPRIORITY_INFO\x10\x64\x12\x11\n\x0cPRIORITY_LOW\x10\xc8\x01\x12\x14\n\x0fPRIORITY_MEDIUM\x10\xac\x02\x12\x12\n\rPRIORITY_HIGH\x10\x90\x03\x12\x16\n\x11PRIORITY_CRITICAL\x10\xf4\x03*h\n\x06Reason\x12\x16\n\x12REASON_UNSPECIFIED\x10\x00\x12\x18\n\x14REASON_NOT_MALICIOUS\x10\x01\x12\x14\n\x10REASON_MALICIOUS\x10\x02\x12\x16\n\x12REASON_MAINTENANCE\x10\x03*^\n\rThreatVerdict\x12\x1e\n\x1aTHREAT_VERDICT_UNSPECIFIED\x10\x00\x12\x0e\n\nUNDETECTED\x10\x01\x12\x0e\n\nSUSPICIOUS\x10\x02\x12\r\n\tMALICIOUS\x10\x03\x42\x8d\x01\n\x14\x63om.google.backstoryP\x01Z9google.golang.org/genproto/googleapis/backstory;backstory\xaa\x02\x10Google.Backstory\xca\x02\x10Google\\Backstory\xea\x02\x11Google::Backstoryb\x06proto3"
+descriptor_data = "\n\x13\x62\x61\x63kstory/udm.proto\x12\x10google.backstory\x1a\x1b\x62\x61\x63kstory/data_access.proto\x1a\x1b\x62\x61\x63kstory/entity_risk.proto\x1a\x12\x62\x61\x63kstory/id.proto\x1a\x1egoogle/protobuf/duration.proto\x1a\x1cgoogle/protobuf/struct.proto\x1a\x1fgoogle/protobuf/timestamp.proto\x1a\x1agoogle/type/interval.proto\x1a\x18google/type/latlng.proto\"\xf3\x04\n\x03UDM\x12,\n\x08metadata\x18\x01 \x01(\x0b\x32\x1a.google.backstory.Metadata\x12+\n\nadditional\x18\x02 \x01(\x0b\x32\x17.google.protobuf.Struct\x12)\n\tprincipal\x18\x03 \x01(\x0b\x32\x16.google.backstory.Noun\x12#\n\x03src\x18\x04 \x01(\x0b\x32\x16.google.backstory.Noun\x12&\n\x06target\x18\x05 \x01(\x0b\x32\x16.google.backstory.Noun\x12,\n\x0cintermediary\x18\x06 \x03(\x0b\x32\x16.google.backstory.Noun\x12(\n\x08observer\x18\x07 \x01(\x0b\x32\x16.google.backstory.Noun\x12%\n\x05\x61\x62out\x18\x08 \x03(\x0b\x32\x16.google.backstory.Noun\x12\x39\n\x0fsecurity_result\x18\t \x03(\x0b\x32 .google.backstory.SecurityResult\x12*\n\x07network\x18\n \x01(\x0b\x32\x19.google.backstory.Network\x12\x30\n\nextensions\x18\x0b \x01(\x0b\x32\x1c.google.backstory.Extensions\x12*\n\textracted\x18\x0c \x01(\x0b\x32\x17.google.protobuf.Struct\x12\x35\n\x07grouped\x18\r \x01(\x0b\x32\x1f.google.backstory.GroupedFieldsH\x00\x88\x01\x01\x42\n\n\x08_groupedR\x03udmR\x06\x65ntityR\x05graph\"\xdc\'\n\x08Metadata\x12\n\n\x02id\x18\x0f \x01(\x0c\x12\x16\n\x0eproduct_log_id\x18\x01 \x01(\t\x12\x33\n\x0f\x65vent_timestamp\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12V\n\x1a\x65vent_timestamp_attributes\x18\x15 \x03(\x0e\x32\x32.google.backstory.Metadata.EventTimestampAttribute\x12\x37\n\x13\x63ollected_timestamp\x18\x03 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x36\n\x12ingested_timestamp\x18\x0b \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x38\n\nevent_type\x18\x04 \x01(\x0e\x32$.google.backstory.Metadata.EventType\x12\x13\n\x0bvendor_name\x18\x05 \x01(\t\x12\x14\n\x0cproduct_name\x18\x06 \x01(\t\x12\x17\n\x0fproduct_version\x18\x07 \x01(\t\x12\x1a\n\x12product_event_type\x18\x08 \x01(\t\x12\x1d\n\x15product_deployment_id\x18\x0e \x01(\t\x12\x13\n\x0b\x64\x65scription\x18\t \x01(\t\x12\x1b\n\x13url_back_to_product\x18\n \x01(\t\x12\x31\n\x10ingestion_labels\x18\x0c \x03(\x0b\x32\x17.google.backstory.Label\x12$\n\x04tags\x18\r \x01(\x0b\x32\x16.google.backstory.Tags\x12\x44\n\x10\x65nrichment_state\x18\x10 \x01(\x0e\x32*.google.backstory.Metadata.EnrichmentState\x12\x10\n\x08log_type\x18\x11 \x01(\t\x12\x37\n\x0b\x62\x61se_labels\x18\x12 \x01(\x0b\x32\".google.backstory.DataAccessLabels\x12=\n\x11\x65nrichment_labels\x18\x13 \x01(\x0b\x32\".google.backstory.DataAccessLabels\x12\x36\n\x11structured_fields\x18\x14 \x01(\x0b\x32\x17.google.protobuf.StructB\x02\x18\x01\x12\x16\n\x0eparser_version\x18\x16 \x01(\t\"\x83\x0b\n\x17\x45ventTimestampAttribute\x12)\n%EVENT_TIMESTAMP_ATTRIBUTE_UNSPECIFIED\x10\x00\x12\x1d\n\x15\x46ILE_LAST_ACCESS_TIME\x10\x01\x1a\x02\x08\x01\x12\x1f\n\x17\x46ILE_LAST_MODIFIED_TIME\x10\x02\x1a\x02\x08\x01\x12&\n\x1e\x46ILE_METADATA_LAST_CHANGE_TIME\x10\x03\x1a\x02\x08\x01\x12\x1a\n\x12\x46ILE_CREATION_TIME\x10\x04\x1a\x02\x08\x01\x12\x16\n\x0e\x43OLLECTED_TIME\x10\x05\x1a\x02\x08\x01\x12\r\n\tCOLLECTED\x10\x06\x12\x0c\n\x08\x41\x43\x43\x45SSED\x10\x07\x12\x0b\n\x07\x43HANGED\x10\x08\x12\x0b\n\x07\x43REATED\x10\t\x12\x16\n\x12\x46ILE_NAME_ACCESSED\x10\n\x12\x15\n\x11\x46ILE_NAME_CHANGED\x10\x0b\x12\x15\n\x11\x46ILE_NAME_CREATED\x10\x0c\x12\x1b\n\x17\x46ILE_NAME_LAST_ACCESSED\x10\r\x12\x1b\n\x17\x46ILE_NAME_LAST_MODIFIED\x10\x0e\x12#\n\x1f\x46ILE_NAME_METADATA_LAST_CHANGED\x10\x0f\x12\x16\n\x12\x46ILE_NAME_MODIFIED\x10\x10\x12\x11\n\rLAST_ACCESSED\x10\x11\x12\x11\n\rLAST_MODIFIED\x10\x12\x12\x19\n\x15METADATA_LAST_CHANGED\x10\x13\x12\x0c\n\x08MODIFIED\x10\x14\x12\t\n\x05\x41\x44\x44\x45\x44\x10\x15\x12\r\n\tBACKED_UP\x10\x16\x12\x12\n\x0eLAST_CONNECTED\x10\x17\x12\x0b\n\x07\x44\x45LETED\x10\x18\x12\t\n\x05\x45NDED\x10\x19\x12\n\n\x06\x45XITED\x10\x1a\x12\x0b\n\x07\x45XPIRED\x10\x1b\x12\x12\n\x0e\x46IRST_ACCESSED\x10\x1c\x12\x0c\n\x08\x41PPEARED\x10\x1d\x12\r\n\tINSTALLED\x10\x1e\x12\x0f\n\x0bLAST_ACTIVE\x10\x1f\x12\x12\n\x0eLAST_LOGGED_IN\x10 \x12\x16\n\x12LAST_LOGIN_ATTEMPT\x10!\x12\x15\n\x11LAST_PASSWORD_SET\x10\"\x12\x10\n\x0cLAST_PRINTED\x10#\x12\x10\n\x0cLAST_RESUMED\x10$\x12\x11\n\rLAST_EXECUTED\x10%\x12\r\n\tLAST_SEEN\x10&\x12\x11\n\rLAST_SHUTDOWN\x10\'\x12\x10\n\x0cLAST_UPDATED\x10(\x12\r\n\tLAST_USED\x10)\x12\x10\n\x0cLAST_VISITED\x10*\x12\n\n\x06LINKED\x10+\x12\x15\n\x11METADATA_MODIFIED\x10,\x12\x14\n\x10\x43ONTENT_MODIFIED\x10-\x12\r\n\tPURCHASED\x10.\x12\x0c\n\x08RECORDED\x10/\x12\x14\n\x10REQUEST_RECEIVED\x10\x30\x12\x11\n\rRESPONSE_SENT\x10\x31\x12\x14\n\x10SCHEDULED_TO_END\x10\x32\x12\x16\n\x12SCHEDULED_TO_START\x10\x33\x12\x08\n\x04SENT\x10\x34\x12\x0b\n\x07STARTED\x10\x35\x12\x0b\n\x07UPDATED\x10\x36\x12\r\n\tVALIDATED\x10\x37\x12\x13\n\x0fMOST_RECENT_RUN\x10\x38\x12\x0c\n\x08NEXT_RUN\x10\x39\x12\x0b\n\x07VISITED\x10:\x12\x12\n\x0eTARGET_CREATED\x10;\x12\x12\n\x0eVOLUME_CREATED\x10<\x12\x10\n\x0cPOST_CHECKED\x10=\x12\x10\n\x0cSYNCHRONIZED\x10>\x12\x10\n\x0cITEM_CREATED\x10?\x12\x11\n\rITEM_MODIFIED\x10@\x12\x17\n\x13\x44OCUMENT_LAST_SAVED\x10\x41\x12\x13\n\x0fLAST_REGISTERED\x10\x42\x12\x0c\n\x08LAUNCHED\x10\x43\x12\x11\n\rFIRST_VISITED\x10\x44\x12\x0e\n\nFIRST_SEEN\x10\x45\x12\x0e\n\nDOWNLOADED\x10\x46\"\xf0\x14\n\tEventType\x12\x19\n\x15\x45VENTTYPE_UNSPECIFIED\x10\x00\x12\x1a\n\x15PROCESS_UNCATEGORIZED\x10\x90N\x12\x13\n\x0ePROCESS_LAUNCH\x10\x91N\x12\x16\n\x11PROCESS_INJECTION\x10\x92N\x12!\n\x1cPROCESS_PRIVILEGE_ESCALATION\x10\x93N\x12\x18\n\x13PROCESS_TERMINATION\x10\x94N\x12\x11\n\x0cPROCESS_OPEN\x10\x95N\x12\x18\n\x13PROCESS_MODULE_LOAD\x10\x96N\x12\x1b\n\x16REGISTRY_UNCATEGORIZED\x10\xf8U\x12\x16\n\x11REGISTRY_CREATION\x10\xf9U\x12\x1a\n\x15REGISTRY_MODIFICATION\x10\xfaU\x12\x16\n\x11REGISTRY_DELETION\x10\xfbU\x12\x1a\n\x15SETTING_UNCATEGORIZED\x10\xe0]\x12\x15\n\x10SETTING_CREATION\x10\xe1]\x12\x19\n\x14SETTING_MODIFICATION\x10\xe2]\x12\x15\n\x10SETTING_DELETION\x10\xe3]\x12\x18\n\x13MUTEX_UNCATEGORIZED\x10\xc8\x65\x12\x13\n\x0eMUTEX_CREATION\x10\xc9\x65\x12\x17\n\x12\x46ILE_UNCATEGORIZED\x10\xb0m\x12\x12\n\rFILE_CREATION\x10\xb1m\x12\x12\n\rFILE_DELETION\x10\xb2m\x12\x16\n\x11\x46ILE_MODIFICATION\x10\xb3m\x12\x0e\n\tFILE_READ\x10\xb4m\x12\x0e\n\tFILE_COPY\x10\xb5m\x12\x0e\n\tFILE_OPEN\x10\xb6m\x12\x0e\n\tFILE_MOVE\x10\xb7m\x12\x0e\n\tFILE_SYNC\x10\xb8m\x12\x17\n\x12USER_UNCATEGORIZED\x10\x98u\x12\x0f\n\nUSER_LOGIN\x10\x99u\x12\x10\n\x0bUSER_LOGOUT\x10\x9au\x12\x12\n\rUSER_CREATION\x10\x9bu\x12\x19\n\x14USER_CHANGE_PASSWORD\x10\x9cu\x12\x1c\n\x17USER_CHANGE_PERMISSIONS\x10\x9du\x12\x13\n\nUSER_STATS\x10\x9eu\x1a\x02\x08\x01\x12\x12\n\rUSER_BADGE_IN\x10\x9fu\x12\x12\n\rUSER_DELETION\x10\xa0u\x12\x1b\n\x16USER_RESOURCE_CREATION\x10\xa1u\x12!\n\x1cUSER_RESOURCE_UPDATE_CONTENT\x10\xa2u\x12%\n USER_RESOURCE_UPDATE_PERMISSIONS\x10\xa3u\x12\x17\n\x12USER_COMMUNICATION\x10\xa4u\x12\x19\n\x14USER_RESOURCE_ACCESS\x10\xa5u\x12\x1b\n\x16USER_RESOURCE_DELETION\x10\xa6u\x12\x19\n\x13GROUP_UNCATEGORIZED\x10\xd8\xb3\x01\x12\x14\n\x0eGROUP_CREATION\x10\xd9\xb3\x01\x12\x14\n\x0eGROUP_DELETION\x10\xda\xb3\x01\x12\x18\n\x12GROUP_MODIFICATION\x10\xdb\xb3\x01\x12\x19\n\x13\x45MAIL_UNCATEGORIZED\x10\xb8\x94\x01\x12\x17\n\x11\x45MAIL_TRANSACTION\x10\xb9\x94\x01\x12\x19\n\x0f\x45MAIL_URL_CLICK\x10\xba\x94\x01\x1a\x02\x08\x01\x12\x1a\n\x15NETWORK_UNCATEGORIZED\x10\x80}\x12\x11\n\x0cNETWORK_FLOW\x10\x81}\x12\x17\n\x12NETWORK_CONNECTION\x10\x82}\x12\x10\n\x0bNETWORK_FTP\x10\x83}\x12\x11\n\x0cNETWORK_DHCP\x10\x84}\x12\x10\n\x0bNETWORK_DNS\x10\x85}\x12\x11\n\x0cNETWORK_HTTP\x10\x86}\x12\x11\n\x0cNETWORK_SMTP\x10\x87}\x12\x1a\n\x14STATUS_UNCATEGORIZED\x10\xe8\x84\x01\x12\x16\n\x10STATUS_HEARTBEAT\x10\xe9\x84\x01\x12\x14\n\x0eSTATUS_STARTUP\x10\xea\x84\x01\x12\x15\n\x0fSTATUS_SHUTDOWN\x10\xeb\x84\x01\x12\x13\n\rSTATUS_UPDATE\x10\xec\x84\x01\x12\x18\n\x12SCAN_UNCATEGORIZED\x10\xd0\x8c\x01\x12\x0f\n\tSCAN_FILE\x10\xd1\x8c\x01\x12 \n\x16SCAN_PROCESS_BEHAVIORS\x10\xd2\x8c\x01\x1a\x02\x08\x01\x12\x12\n\x0cSCAN_PROCESS\x10\xd3\x8c\x01\x12\x0f\n\tSCAN_HOST\x10\xd4\x8c\x01\x12\x14\n\x0eSCAN_VULN_HOST\x10\xd5\x8c\x01\x12\x17\n\x11SCAN_VULN_NETWORK\x10\xd6\x8c\x01\x12\x12\n\x0cSCAN_NETWORK\x10\xd7\x8c\x01\x12\"\n\x1cSCHEDULED_TASK_UNCATEGORIZED\x10\xa0\x9c\x01\x12\x1d\n\x17SCHEDULED_TASK_CREATION\x10\xa1\x9c\x01\x12\x1d\n\x17SCHEDULED_TASK_DELETION\x10\xa2\x9c\x01\x12\x1b\n\x15SCHEDULED_TASK_ENABLE\x10\xa3\x9c\x01\x12\x1c\n\x16SCHEDULED_TASK_DISABLE\x10\xa4\x9c\x01\x12!\n\x1bSCHEDULED_TASK_MODIFICATION\x10\xa5\x9c\x01\x12$\n\x1eSYSTEM_AUDIT_LOG_UNCATEGORIZED\x10\x88\xa4\x01\x12\x1b\n\x15SYSTEM_AUDIT_LOG_WIPE\x10\x89\xa4\x01\x12\x19\n\x13SERVICE_UNSPECIFIED\x10\xf0\xab\x01\x12\x16\n\x10SERVICE_CREATION\x10\xf1\xab\x01\x12\x16\n\x10SERVICE_DELETION\x10\xf2\xab\x01\x12\x13\n\rSERVICE_START\x10\xf3\xab\x01\x12\x12\n\x0cSERVICE_STOP\x10\xf4\xab\x01\x12\x1a\n\x14SERVICE_MODIFICATION\x10\xf5\xab\x01\x12\x13\n\rGENERIC_EVENT\x10\xa0\x8d\x06\x12\x15\n\x11RESOURCE_CREATION\x10\x01\x12\x15\n\x11RESOURCE_DELETION\x10\x02\x12\x1f\n\x1bRESOURCE_PERMISSIONS_CHANGE\x10\x03\x12\x11\n\rRESOURCE_READ\x10\x04\x12\x14\n\x10RESOURCE_WRITTEN\x10\x05\x12\x1c\n\x16\x44\x45VICE_FIRMWARE_UPDATE\x10\xa8\xc3\x01\x12\x1a\n\x14\x44\x45VICE_CONFIG_UPDATE\x10\xa9\xc3\x01\x12\x1b\n\x15\x44\x45VICE_PROGRAM_UPLOAD\x10\xaa\xc3\x01\x12\x1d\n\x17\x44\x45VICE_PROGRAM_DOWNLOAD\x10\xab\xc3\x01\x12\x1c\n\x16\x41NALYST_UPDATE_VERDICT\x10\xc0\xbb\x01\x12\x1f\n\x19\x41NALYST_UPDATE_REPUTATION\x10\xc1\xbb\x01\x12#\n\x1d\x41NALYST_UPDATE_SEVERITY_SCORE\x10\xc2\xbb\x01\x12\x1b\n\x15\x41NALYST_UPDATE_STATUS\x10\xc7\xbb\x01\x12\x19\n\x13\x41NALYST_ADD_COMMENT\x10\xc8\xbb\x01\x12\x1d\n\x17\x41NALYST_UPDATE_PRIORITY\x10\xc9\xbb\x01\x12\x1f\n\x19\x41NALYST_UPDATE_ROOT_CAUSE\x10\xca\xbb\x01\x12\x1b\n\x15\x41NALYST_UPDATE_REASON\x10\xcb\xbb\x01\x12\x1f\n\x19\x41NALYST_UPDATE_RISK_SCORE\x10\xcc\xbb\x01\x12\x18\n\x12\x45NTITY_RISK_CHANGE\x10\x90\xcb\x01\x12\'\n!TRIAGE_AGENT_UPDATE_INVESTIGATION\x10\xf8\xd2\x01\"Q\n\x0f\x45nrichmentState\x12 \n\x1c\x45NRICHMENT_STATE_UNSPECIFIED\x10\x00\x12\x0c\n\x08\x45NRICHED\x10\x01\x12\x0e\n\nUNENRICHED\x10\x02\"\xa0\x02\n\tAttribute\x12&\n\x05\x63loud\x18\x01 \x01(\x0b\x32\x17.google.backstory.Cloud\x12\'\n\x06labels\x18\x02 \x03(\x0b\x32\x17.google.backstory.Label\x12\x32\n\x0bpermissions\x18\xc1\x05 \x03(\x0b\x32\x1c.google.backstory.Permission\x12%\n\x05roles\x18\x03 \x03(\x0b\x32\x16.google.backstory.Role\x12\x31\n\rcreation_time\x18\x04 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x34\n\x10last_update_time\x18\x05 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\"\xc3\x12\n\x07Network\x12\x12\n\nsent_bytes\x18\x01 \x01(\x04\x12\x16\n\x0ereceived_bytes\x18\x02 \x01(\x04\x12\x13\n\x0btotal_bytes\x18\x1b \x01(\x03\x12\x14\n\x0csent_packets\x18\x16 \x01(\x03\x12\x18\n\x10received_packets\x18\x17 \x01(\x03\x12\x33\n\x10session_duration\x18\r \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x12\n\nsession_id\x18\x0e \x01(\t\x12\x19\n\x11parent_session_id\x18\x14 \x01(\t\x12$\n\x1c\x61pplication_protocol_version\x18\x15 \x01(\t\x12\x14\n\x0c\x63ommunity_id\x18\x0f \x01(\t\x12\x36\n\tdirection\x18\x0c \x01(\x0e\x32#.google.backstory.Network.Direction\x12\x39\n\x0bip_protocol\x18\x03 \x01(\x0e\x32$.google.backstory.Network.IpProtocol\x12\x0c\n\x04ipv6\x18\x1d \x01(\x08\x12K\n\x14\x61pplication_protocol\x18\x04 \x01(\x0e\x32-.google.backstory.Network.ApplicationProtocol\x12\"\n\x03\x66tp\x18\x05 \x01(\x0b\x32\x15.google.backstory.Ftp\x12&\n\x05\x65mail\x18\x06 \x01(\x0b\x32\x17.google.backstory.Email\x12\"\n\x03\x64ns\x18\x07 \x01(\x0b\x32\x15.google.backstory.Dns\x12$\n\x04\x64hcp\x18\x08 \x01(\x0b\x32\x16.google.backstory.Dhcp\x12$\n\x04http\x18\t \x01(\x0b\x32\x16.google.backstory.Http\x12\"\n\x03tls\x18\n \x01(\x0b\x32\x15.google.backstory.Tls\x12$\n\x04smtp\x18\x0b \x01(\x0b\x32\x16.google.backstory.Smtp\x12\x0b\n\x03\x61sn\x18\x10 \x01(\t\x12\x12\n\ndns_domain\x18\x11 \x01(\t\x12\x14\n\x0c\x63\x61rrier_name\x18\x12 \x01(\t\x12\x19\n\x11organization_name\x18\x13 \x01(\t\x12\x17\n\x0fip_subnet_range\x18\x18 \x01(\t\x12\x10\n\x08is_proxy\x18\x19 \x01(\x08\x12/\n\nproxy_info\x18\x1a \x01(\x0b\x32\x1b.google.backstory.ProxyInfo\x12\x43\n\x10\x63onnection_state\x18\x1c \x01(\x0e\x32).google.backstory.Network.ConnectionState\"L\n\tDirection\x12\x15\n\x11UNKNOWN_DIRECTION\x10\x00\x12\x0b\n\x07INBOUND\x10\x01\x12\x0c\n\x08OUTBOUND\x10\x02\x12\r\n\tBROADCAST\x10\x03\"\xaa\x01\n\nIpProtocol\x12\x17\n\x13UNKNOWN_IP_PROTOCOL\x10\x00\x12\x08\n\x04ICMP\x10\x01\x12\x08\n\x04IGMP\x10\x02\x12\x07\n\x03TCP\x10\x06\x12\x07\n\x03UDP\x10\x11\x12\n\n\x06IP6IN4\x10)\x12\x07\n\x03GRE\x10/\x12\x07\n\x03\x45SP\x10\x32\x12\t\n\x05ICMP6\x10:\x12\t\n\x05\x45IGRP\x10X\x12\x0b\n\x07\x45THERIP\x10\x61\x12\x07\n\x03PIM\x10g\x12\x08\n\x04VRRP\x10p\x12\t\n\x04SCTP\x10\x84\x01\"\x97\x07\n\x13\x41pplicationProtocol\x12 \n\x1cUNKNOWN_APPLICATION_PROTOCOL\x10\x00\x12\x07\n\x03\x41\x46P\x10\x01\x12\x08\n\x04\x41PPC\x10\x02\x12\x08\n\x04\x41MQP\x10\x03\x12\x08\n\x04\x41TOM\x10\x04\x12\x08\n\x04\x42\x45\x45P\x10\x05\x12\x0b\n\x07\x42ITCOIN\x10\x06\x12\x0f\n\x0b\x42IT_TORRENT\x10\x07\x12\x08\n\x04\x43\x46\x44P\x10\x08\x12\x07\n\x03\x43IP\x10\x43\x12\x08\n\x04\x43OAP\x10\t\x12\x08\n\x04\x43OTP\x10\x44\x12\n\n\x06\x44\x43\x45RPC\x10\x42\x12\x07\n\x03\x44\x44S\x10\n\x12\x0e\n\nDEVICE_NET\x10\x0b\x12\t\n\x04\x44HCP\x10\xa0\x1f\x12\t\n\x05\x44ICOM\x10\x45\x12\x08\n\x04\x44NP3\x10\x46\x12\x08\n\x03\x44NS\x10\xb8\x17\x12\x0c\n\x08\x45_DONKEY\x10\x0c\x12\x08\n\x04\x45NRP\x10\r\x12\x0e\n\nFAST_TRACK\x10\x0e\x12\n\n\x06\x46INGER\x10\x0f\x12\x0b\n\x07\x46REENET\x10\x10\x12\x08\n\x04\x46TAM\x10\x11\x12\t\n\x05GOOSE\x10G\x12\n\n\x06GOPHER\x10\x12\x12\x08\n\x04GRPC\x10M\x12\x07\n\x03HL7\x10\x13\x12\x08\n\x04H323\x10\x14\x12\t\n\x04HTTP\x10\xd0\x0f\x12\n\n\x05HTTPS\x10\xd1\x0f\x12\n\n\x06IEC104\x10H\x12\x08\n\x04IRCP\x10\x15\x12\x0c\n\x08KADEMLIA\x10\x16\x12\x08\n\x04KRB5\x10\x41\x12\x08\n\x04LDAP\x10\x17\x12\x07\n\x03LPD\x10\x18\x12\x08\n\x04MIME\x10\x19\x12\x07\n\x03MMS\x10I\x12\n\n\x06MODBUS\x10\x1a\x12\x08\n\x04MQTT\x10\x1b\x12\x0b\n\x07NETCONF\x10\x1c\x12\x07\n\x03NFS\x10\x1d\x12\x07\n\x03NIS\x10\x1e\x12\x08\n\x04NNTP\x10\x1f\x12\t\n\x05NTCIP\x10 \x12\x07\n\x03NTP\x10!\x12\t\n\x05OSCAR\x10\"\x12\x08\n\x04PNRP\x10#\x12\x07\n\x03PTP\x10J\x12\t\n\x04QUIC\x10\xe8\x07\x12\x07\n\x03RDP\x10$\x12\x08\n\x04RELP\x10%\x12\x07\n\x03RIP\x10&\x12\n\n\x06RLOGIN\x10\'\x12\x07\n\x03RPC\x10(\x12\x08\n\x04RTMP\x10)\x12\x07\n\x03RTP\x10*\x12\x08\n\x04RTPS\x10+\x12\x08\n\x04RTSP\x10,\x12\x07\n\x03SAP\x10-\x12\x07\n\x03SDP\x10.\x12\x07\n\x03SIP\x10/\x12\x07\n\x03SLP\x10\x30\x12\x07\n\x03SMB\x10\x31\x12\x08\n\x04SMTP\x10\x32\x12\x08\n\x04SNMP\x10K\x12\x08\n\x04SNTP\x10\x33\x12\x07\n\x03SSH\x10\x34\x12\x08\n\x04SSMS\x10\x35\x12\x08\n\x04STYX\x10\x36\x12\x06\n\x02SV\x10L\x12\x08\n\x04TCAP\x10\x37\x12\x07\n\x03TDS\x10\x38\x12\x07\n\x03TOR\x10\x39\x12\x07\n\x03TSP\x10:\x12\x07\n\x03VTP\x10;\x12\t\n\x05WHOIS\x10<\x12\x0b\n\x07WEB_DAV\x10=\x12\x08\n\x04X400\x10>\x12\x08\n\x04X500\x10?\x12\x08\n\x04XMPP\x10@\x12\x07\n\x03\x46TP\x10N\"\xca\x01\n\x0f\x43onnectionState\x12 \n\x1c\x43ONNECTION_STATE_UNSPECIFIED\x10\x00\x12\r\n\tLISTENING\x10\x01\x12\x0f\n\x0b\x45STABLISHED\x10\x02\x12\r\n\tTIME_WAIT\x10\x03\x12\x0e\n\nCLOSE_WAIT\x10\x04\x12\n\n\x06\x43LOSED\x10\x05\x12\x0c\n\x08SYN_SENT\x10\x06\x12\x10\n\x0cSYN_RECEIVED\x10\x07\x12\r\n\tFIN_WAIT1\x10\x08\x12\r\n\tFIN_WAIT2\x10\t\x12\x0c\n\x08LAST_ACK\x10\n\"\x8f\x02\n\tProxyInfo\x12\x11\n\tanonymous\x18\x01 \x01(\x08\x12\x15\n\ranonymous_vpn\x18\x02 \x01(\x08\x12\x14\n\x0cpublic_proxy\x18\x03 \x01(\x08\x12\x15\n\rtor_exit_node\x18\x04 \x01(\x08\x12\x17\n\x0fsmart_dns_proxy\x18\x05 \x01(\x08\x12\x18\n\x10hosting_provider\x18\x06 \x01(\x08\x12\x16\n\x0evpn_datacenter\x18\x07 \x01(\x08\x12\x19\n\x11residential_proxy\x18\x08 \x01(\x08\x12\x18\n\x10vpn_service_name\x18\t \x01(\t\x12\x16\n\x0eproxy_over_vpn\x18\n \x01(\x08\x12\x13\n\x0brelay_proxy\x18\x0b \x01(\x08\"\xa3\x04\n\nExtensions\x12.\n\x04\x61uth\x18\x01 \x01(\x0b\x32 .google.backstory.Authentication\x12\x30\n\x05vulns\x18\x02 \x01(\x0b\x32!.google.backstory.Vulnerabilities\x12\x31\n\x0b\x65ntity_risk\x18\x03 \x01(\x0b\x32\x1c.google.backstory.EntityRisk\x12/\n\nlinux_utmp\x18\x04 \x01(\x0b\x32\x1b.google.backstory.LinuxUtmp\x12<\n\x11windows_event_log\x18\x05 \x01(\x0b\x32!.google.backstory.WindowsEventLog\x12\x37\n\x0eresource_usage\x18\x06 \x01(\x0b\x32\x1f.google.backstory.ResourceUsage\x12\x42\n\x14system_event_details\x18\x07 \x01(\x0b\x32$.google.backstory.SystemEventDetails\x12;\n\x10outlook_metadata\x18\x08 \x01(\x0b\x32!.google.backstory.OutlookMetadata\x12$\n\x04srum\x18\t \x01(\x0b\x32\x16.google.backstory.Srum\x12\x31\n\x0buser_assist\x18\n \x01(\x0b\x32\x1c.google.backstory.UserAssist\"\xfb\x06\n\x0e\x41uthentication\x12\x37\n\x04type\x18\x01 \x01(\x0e\x32).google.backstory.Authentication.AuthType\x12=\n\tmechanism\x18\x02 \x03(\x0e\x32*.google.backstory.Authentication.Mechanism\x12\x14\n\x0c\x61uth_details\x18\x03 \x01(\t\x12\x39\n\x07outcome\x18\x04 \x01(\x0e\x32(.google.backstory.Authentication.Outcome\"]\n\x08\x41uthType\x12\x18\n\x14\x41UTHTYPE_UNSPECIFIED\x10\x00\x12\x0b\n\x07MACHINE\x10\x01\x12\x07\n\x03SSO\x10\x02\x12\x07\n\x03VPN\x10\x03\x12\x0c\n\x08PHYSICAL\x10\x04\x12\n\n\x06TACACS\x10\x05\"\x84\x03\n\tMechanism\x12\x19\n\x15MECHANISM_UNSPECIFIED\x10\x00\x12\x15\n\x11USERNAME_PASSWORD\x10\x01\x12\x07\n\x03OTP\x10\x02\x12\x10\n\x0cHARDWARE_KEY\x10\x03\x12\t\n\x05LOCAL\x10\x04\x12\n\n\x06REMOTE\x10\x05\x12\x16\n\x12REMOTE_INTERACTIVE\x10\x06\x12\x13\n\x0fMECHANISM_OTHER\x10\x07\x12\x10\n\x0c\x42\x41\x44GE_READER\x10\x08\x12\x0b\n\x07NETWORK\x10\t\x12\t\n\x05\x42\x41TCH\x10\n\x12\x0b\n\x07SERVICE\x10\x0b\x12\n\n\x06UNLOCK\x10\x0c\x12\x16\n\x12NETWORK_CLEAR_TEXT\x10\r\x12\x13\n\x0fNEW_CREDENTIALS\x10\x0e\x12\x0f\n\x0bINTERACTIVE\x10\x0f\x12\x16\n\x12\x43\x41\x43HED_INTERACTIVE\x10\x10\x12\x1d\n\x19\x43\x41\x43HED_REMOTE_INTERACTIVE\x10\x11\x12\x11\n\rCACHED_UNLOCK\x10\x12\x12\r\n\tBIOMETRIC\x10\x13\x12\x0c\n\x08WEARABLE\x10\x14\"|\n\x14\x41uthenticationStatus\x12!\n\x1dUNKNOWN_AUTHENTICATION_STATUS\x10\x00\x12\n\n\x06\x41\x43TIVE\x10\x01\x12\r\n\tSUSPENDED\x10\x02\x12\x19\n\x15NO_ACTIVE_CREDENTIALS\x10\x03\x12\x0b\n\x07\x44\x45LETED\x10\x04\"<\n\x07Outcome\x12\x17\n\x13OUTCOME_UNSPECIFIED\x10\x00\x12\x0b\n\x07SUCCESS\x10\x01\x12\x0b\n\x07\x46\x41ILURE\x10\x02\"\x85\x02\n\tLinuxUtmp\x12;\n\x0brecord_type\x18\x01 \x01(\x0e\x32&.google.backstory.LinuxUtmp.RecordType\"\xba\x01\n\nRecordType\x12\x1b\n\x17RECORD_TYPE_UNSPECIFIED\x10\x00\x12\x0b\n\x07RUN_LVL\x10\x01\x12\r\n\tBOOT_TIME\x10\x02\x12\x0c\n\x08NEW_TIME\x10\x03\x12\x0c\n\x08OLD_TIME\x10\x04\x12\x10\n\x0cINIT_PROCESS\x10\x05\x12\x11\n\rLOGIN_PROCESS\x10\x06\x12\x10\n\x0cUSER_PROCESS\x10\x07\x12\x10\n\x0c\x44\x45\x41\x44_PROCESS\x10\x08\x12\x0e\n\nACCOUNTING\x10\t\"\xef\x01\n\x0fWindowsEventLog\x12:\n\x07\x63hannel\x18\x01 \x01(\x0e\x32).google.backstory.WindowsEventLog.Channel\x12\x10\n\x08\x65vent_id\x18\x02 \x01(\t\x12\x13\n\x0b\x61\x63tivity_id\x18\x03 \x01(\t\"y\n\x07\x43hannel\x12\x17\n\x13\x43HANNEL_UNSPECIFIED\x10\x00\x12\x0c\n\x08SECURITY\x10\x01\x12\n\n\x06SYSTEM\x10\x02\x12\x0f\n\x0b\x41PPLICATION\x10\x03\x12\t\n\x05SETUP\x10\x04\x12\x14\n\x10\x46ORWARDED_EVENTS\x10\x05\x12\t\n\x05OTHER\x10\x06\"<\n\rResourceUsage\x12\x13\n\x0bused_entity\x18\x01 \x01(\t\x12\x16\n\x0eused_entity_id\x18\x02 \x01(\t\"V\n\x12SystemEventDetails\x12\x14\n\x0cmessage_type\x18\x01 \x01(\t\x12\x17\n\x0fsender_image_id\x18\x02 \x01(\t\x12\x11\n\tsubsystem\x18\x03 \x01(\t\"a\n\x0fOutlookMetadata\x12\x0f\n\x07\x63omment\x18\x01 \x01(\t\x12\x10\n\x08template\x18\x02 \x01(\t\x12\r\n\x05title\x18\x03 \x01(\t\x12\x1c\n\x14security_flags_count\x18\x04 \x01(\x05\"\x9b\x02\n\x04Srum\x12\n\n\x02id\x18\x01 \x01(\t\x12\x1d\n\x15\x62\x61\x63kground_bytes_read\x18\x02 \x01(\x03\x12 \n\x18\x62\x61\x63kground_bytes_written\x18\x03 \x01(\x03\x12#\n\x1b\x62\x61\x63kground_context_switches\x18\x04 \x01(\x03\x12\x1e\n\x16\x62\x61\x63kground_cycle_count\x18\x05 \x01(\x03\x12 \n\x18\x62\x61\x63kground_flushes_count\x18\x06 \x01(\x03\x12\"\n\x1a\x62\x61\x63kground_read_operations\x18\x07 \x01(\x03\x12#\n\x1b\x62\x61\x63kground_write_operations\x18\x08 \x01(\x03\x12\x16\n\x0einterface_luid\x18\t \x01(\t\"\x9b\x01\n\nUserAssist\x12\x1f\n\x17\x61pplication_focus_count\x18\x01 \x01(\x03\x12=\n\x1a\x61pplication_focus_duration\x18\x02 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x18\n\x10\x65xecutions_count\x18\x03 \x01(\x03\x12\x13\n\x0b\x65ntry_index\x18\x04 \x01(\x03\"O\n\x0fVulnerabilities\x12<\n\x0fvulnerabilities\x18\x01 \x03(\x0b\x32\x1f.google.backstory.VulnerabilityB\x02\x10\x00\"\x8f\x05\n\rVulnerability\x12%\n\x05\x61\x62out\x18\x01 \x01(\x0b\x32\x16.google.backstory.Noun\x12\x0c\n\x04name\x18\x02 \x01(\t\x12\x13\n\x0b\x64\x65scription\x18\x03 \x01(\t\x12\x0e\n\x06vendor\x18\r \x01(\t\x12\x33\n\x0fscan_start_time\x18\x04 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x31\n\rscan_end_time\x18\x05 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12/\n\x0b\x66irst_found\x18\x06 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12.\n\nlast_found\x18\x07 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12:\n\x08severity\x18\x08 \x01(\x0e\x32(.google.backstory.Vulnerability.Severity\x12\x18\n\x10severity_details\x18\t \x01(\t\x12\x17\n\x0f\x63vss_base_score\x18\n \x01(\x02\x12\x13\n\x0b\x63vss_vector\x18\x0b \x01(\t\x12\x14\n\x0c\x63vss_version\x18\x0c \x01(\t\x12\x0e\n\x06\x63ve_id\x18\x0e \x01(\t\x12\x17\n\x0f\x63ve_description\x18\x0f \x01(\t\x12\x1f\n\x17vendor_vulnerability_id\x18\x10 \x01(\t\x12(\n vendor_knowledge_base_article_id\x18\x11 \x01(\t\"M\n\x08Severity\x12\x14\n\x10UNKNOWN_SEVERITY\x10\x00\x12\x07\n\x03LOW\x10\x01\x12\n\n\x06MEDIUM\x10\x02\x12\x08\n\x04HIGH\x10\x03\x12\x0c\n\x08\x43RITICAL\x10\x04\"\x16\n\x03\x46tp\x12\x0f\n\x07\x63ommand\x18\x01 \x01(\t\"\x8b\x01\n\x04Smtp\x12\x0c\n\x04helo\x18\x01 \x01(\t\x12\x11\n\tmail_from\x18\x02 \x01(\t\x12\x0f\n\x07rcpt_to\x18\x03 \x03(\t\x12\x17\n\x0fserver_response\x18\x04 \x03(\t\x12\x14\n\x0cmessage_path\x18\x05 \x01(\t\x12\x12\n\nis_webmail\x18\x06 \x01(\x08\x12\x0e\n\x06is_tls\x18\x07 \x01(\x08\"\x86\x01\n\x05\x45mail\x12\x0c\n\x04\x66rom\x18\x01 \x01(\t\x12\x10\n\x08reply_to\x18\x02 \x01(\t\x12\n\n\x02to\x18\x03 \x03(\t\x12\n\n\x02\x63\x63\x18\x04 \x03(\t\x12\x0b\n\x03\x62\x63\x63\x18\x05 \x03(\t\x12\x0f\n\x07mail_id\x18\x06 \x01(\t\x12\x0f\n\x07subject\x18\x07 \x03(\t\x12\x16\n\x0e\x62ounce_address\x18\x08 \x01(\t\"\xf4\x07\n\x07Process\x12\x0b\n\x03pid\x18\x01 \x01(\t\x12\x16\n\nparent_pid\x18\x02 \x01(\tB\x02\x18\x01\x12\x31\n\x0eparent_process\x18\x07 \x01(\x0b\x32\x19.google.backstory.Process\x12$\n\x04\x66ile\x18\x03 \x01(\x0b\x32\x16.google.backstory.File\x12\x14\n\x0c\x63ommand_line\x18\x04 \x01(\t\x12\x1c\n\x14\x63ommand_line_history\x18\t \x03(\t\x12#\n\x1bproduct_specific_process_id\x18\x05 \x01(\t\x12\x13\n\x0b\x61\x63\x63\x65ss_mask\x18\x08 \x01(\x04\x12\x1b\n\x13integrity_level_rid\x18\x0b \x01(\x04\x12\x0c\n\x04\x65uid\x18\x0c \x01(\t\x12\x0c\n\x04ruid\x18\r \x01(\t\x12\x0c\n\x04\x65gid\x18\x0e \x01(\t\x12\x0c\n\x04rgid\x18\x0f \x01(\t\x12\x0c\n\x04pgid\x18\x10 \x01(\t\x12\x1a\n\x12session_leader_pid\x18\x11 \x01(\t\x12\x0b\n\x03tty\x18\x12 \x01(\t\x12J\n\x14token_elevation_type\x18\n \x01(\x0e\x32,.google.backstory.Process.TokenElevationType\x12.\n\"product_specific_parent_process_id\x18\x06 \x01(\tB\x02\x18\x01\x12\x0c\n\x04ipv6\x18\x13 \x01(\x08\x12\x32\n\x0fkernel_duration\x18\x14 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x30\n\ruser_duration\x18\x15 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x30\n\rreal_duration\x18\x16 \x01(\x0b\x32\x19.google.protobuf.Duration\x12.\n\x05state\x18\x17 \x01(\x0e\x32\x1f.google.backstory.Process.State\"E\n\x12TokenElevationType\x12\x0b\n\x07UNKNOWN\x10\x00\x12\n\n\x06TYPE_1\x10\x01\x12\n\n\x06TYPE_2\x10\x02\x12\n\n\x06TYPE_3\x10\x03\"\xd7\x01\n\x05State\x12\x15\n\x11STATE_UNSPECIFIED\x10\x00\x12\x0b\n\x07RUNNING\x10\x01\x12\x0c\n\x08SLEEPING\x10\x02\x12\x0e\n\nDISK_SLEEP\x10\x03\x12\x0b\n\x07STOPPED\x10\x04\x12\x10\n\x0cTRACING_STOP\x10\x05\x12\n\n\x06ZOMBIE\x10\x06\x12\x08\n\x04\x44\x45\x41\x44\x10\x07\x12\r\n\tWAKE_KILL\x10\x08\x12\n\n\x06WAKING\x10\t\x12\n\n\x06PARKED\x10\n\x12\x08\n\x04IDLE\x10\x0b\x12\n\n\x06LOCKED\x10\x0c\x12\x0b\n\x07WAITING\x10\r\x12\r\n\tSUSPENDED\x10\x0e\"%\n\x11\x41nalyticsMetadata\x12\x10\n\x08\x61nalytic\x18\x01 \x01(\t\"\xc2\x05\n\x0f\x46indingVariable\x12\x34\n\x04type\x18\x01 \x01(\x0e\x32&.google.backstory.FindingVariable.Type\x12\r\n\x05value\x18\x02 \x01(\t\x12\x13\n\x0bsource_path\x18\x03 \x01(\t\x12\x12\n\x08\x62ool_val\x18\x04 \x01(\x08H\x00\x12\x13\n\tbytes_val\x18\x05 \x01(\x0cH\x00\x12\x14\n\ndouble_val\x18\x06 \x01(\x01H\x00\x12\x13\n\tint64_val\x18\x07 \x01(\x03H\x00\x12\x14\n\nuint64_val\x18\x08 \x01(\x04H\x00\x12\x14\n\nstring_val\x18\t \x01(\tH\x00\x12\x34\n\x0etimestamp_time\x18\x11 \x01(\x0b\x32\x1a.google.protobuf.TimestampH\x00\x12\x12\n\x08null_val\x18\n \x01(\x08H\x00\x12\x32\n\x08\x62ool_seq\x18\x0b \x01(\x0b\x32\x1e.google.backstory.BoolSequenceH\x00\x12\x34\n\tbytes_seq\x18\x0c \x01(\x0b\x32\x1f.google.backstory.BytesSequenceH\x00\x12\x36\n\ndouble_seq\x18\r \x01(\x0b\x32 .google.backstory.DoubleSequenceH\x00\x12\x34\n\tint64_seq\x18\x0e \x01(\x0b\x32\x1f.google.backstory.Int64SequenceH\x00\x12\x36\n\nuint64_seq\x18\x0f \x01(\x0b\x32 .google.backstory.Uint64SequenceH\x00\x12\x36\n\nstring_seq\x18\x10 \x01(\x0b\x32 .google.backstory.StringSequenceH\x00\"4\n\x04Type\x12\x14\n\x10TYPE_UNSPECIFIED\x10\x00\x12\t\n\x05MATCH\x10\x01\x12\x0b\n\x07OUTCOME\x10\x02\x42\r\n\x0btyped_value\"\xb5\x32\n\x0eSecurityResult\x12%\n\x05\x61\x62out\x18\x01 \x01(\x0b\x32\x16.google.backstory.Noun\x12\x43\n\x08\x63\x61tegory\x18\x02 \x03(\x0e\x32\x31.google.backstory.SecurityResult.SecurityCategory\x12\x18\n\x10\x63\x61tegory_details\x18\x03 \x03(\t\x12\x13\n\x0bthreat_name\x18\x04 \x01(\t\x12\x10\n\x08rule_set\x18\x1d \x01(\t\x12\x1d\n\x15rule_set_display_name\x18\x1e \x01(\t\x12%\n\x1druleset_category_display_name\x18) \x01(\t\x12\x0f\n\x07rule_id\x18\x10 \x01(\t\x12\x11\n\trule_name\x18\x05 \x01(\t\x12\x14\n\x0c\x64isplay_name\x18\x31 \x01(\t\x12\x14\n\x0crule_version\x18\x14 \x01(\t\x12\x11\n\trule_type\x18\x16 \x01(\t\x12\x13\n\x0brule_author\x18\x19 \x01(\t\x12,\n\x0brule_labels\x18\x1a \x03(\x0b\x32\x17.google.backstory.Label\x12@\n\x0b\x61lert_state\x18\x15 \x01(\x0e\x32+.google.backstory.SecurityResult.AlertState\x12\x31\n\x10\x64\x65tection_fields\x18\x17 \x03(\x0b\x32\x17.google.backstory.Label\x12-\n\x08outcomes\x18\x1c \x03(\x0b\x32\x17.google.backstory.LabelB\x02\x18\x01\x12\x42\n\tvariables\x18, \x03(\x0b\x32/.google.backstory.SecurityResult.VariablesEntry\x12\x0f\n\x07summary\x18\x06 \x01(\t\x12\x13\n\x0b\x64\x65scription\x18\x07 \x01(\t\x12\x37\n\x06\x61\x63tion\x18\x08 \x03(\x0e\x32\'.google.backstory.SecurityResult.Action\x12\x16\n\x0e\x61\x63tion_details\x18\x13 \x01(\t\x12\x42\n\x08severity\x18\t \x01(\x0e\x32\x30.google.backstory.SecurityResult.ProductSeverity\x12\x46\n\nconfidence\x18\n \x01(\x0e\x32\x32.google.backstory.SecurityResult.ProductConfidence\x12\x42\n\x08priority\x18\x0b \x01(\x0e\x32\x30.google.backstory.SecurityResult.ProductPriority\x12\x12\n\nrisk_score\x18\x1f \x01(\x02\x12\x18\n\x10\x63onfidence_score\x18* \x01(\x02\x12?\n\x12\x61nalytics_metadata\x18+ \x03(\x0b\x32#.google.backstory.AnalyticsMetadata\x12\x18\n\x10severity_details\x18\x0c \x01(\t\x12\x1a\n\x12\x63onfidence_details\x18\r \x01(\t\x12\x18\n\x10priority_details\x18\x0e \x01(\t\x12\x1b\n\x13url_back_to_product\x18\x0f \x01(\t\x12\x11\n\tthreat_id\x18\x11 \x01(\t\x12\x18\n\x10threat_feed_name\x18\x1b \x01(\t\x12;\n\x13threat_id_namespace\x18\x18 \x01(\x0e\x32\x1e.google.backstory.Id.Namespace\x12\x44\n\rthreat_status\x18\x12 \x01(\x0e\x32-.google.backstory.SecurityResult.ThreatStatus\x12\x37\n\x0e\x61ttack_details\x18  \x01(\x0b\x32\x1f.google.backstory.AttackDetails\x12\x39\n\x15\x66irst_discovered_time\x18! \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x42\n\x0c\x61ssociations\x18\" \x03(\x0b\x32,.google.backstory.SecurityResult.Association\x12\x15\n\tcampaigns\x18# \x03(\tB\x02\x18\x01\x12\x13\n\x07reports\x18. \x03(\tB\x02\x18\x01\x12=\n\x07verdict\x18$ \x01(\x0b\x32(.google.backstory.SecurityResult.VerdictB\x02\x18\x01\x12\x35\n\x11last_updated_time\x18% \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x42\n\x0cverdict_info\x18& \x03(\x0b\x32,.google.backstory.SecurityResult.VerdictInfo\x12\x37\n\x0ethreat_verdict\x18\' \x01(\x0e\x32\x1f.google.backstory.ThreatVerdict\x12\x38\n\x14last_discovered_time\x18( \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x17\n\x0f\x64\x65tection_depth\x18/ \x01(\x03\x12Q\n\x12threat_collections\x18\x30 \x03(\x0b\x32\x35.google.backstory.SecurityResult.ThreatCollectionItem\x1a\xb5\x06\n\x0b\x41ssociation\x12\n\n\x02id\x18\x01 \x01(\t\x12\x14\n\x0c\x63ountry_code\x18\x02 \x03(\t\x12J\n\x04type\x18\x03 \x01(\x0e\x32<.google.backstory.SecurityResult.Association.AssociationType\x12\x0c\n\x04name\x18\x04 \x01(\t\x12\x13\n\x0b\x64\x65scription\x18\x05 \x01(\t\x12\x0c\n\x04role\x18\x06 \x01(\t\x12\x1a\n\x0esource_country\x18\x07 \x01(\tB\x02\x18\x01\x12L\n\x05\x61lias\x18\x08 \x03(\x0b\x32=.google.backstory.SecurityResult.Association.AssociationAlias\x12\x38\n\x14\x66irst_reference_time\x18\t \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x37\n\x13last_reference_time\x18\n \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x1b\n\x13industries_affected\x18\x0b \x03(\t\x12G\n\x11\x61ssociated_actors\x18\x0c \x03(\x0b\x32,.google.backstory.SecurityResult.Association\x12/\n\x0bregion_code\x18\r \x01(\x0b\x32\x1a.google.backstory.Location\x12\x32\n\x0esponsor_region\x18\x0e \x01(\x0b\x32\x1a.google.backstory.Location\x12\x34\n\x10targeted_regions\x18\x0f \x03(\x0b\x32\x1a.google.backstory.Location\x12\x0c\n\x04tags\x18\x10 \x03(\t\x1a\x31\n\x10\x41ssociationAlias\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x0f\n\x07\x63ompany\x18\x02 \x01(\t\"h\n\x0f\x41ssociationType\x12 \n\x1c\x41SSOCIATION_TYPE_UNSPECIFIED\x10\x00\x12\x10\n\x0cTHREAT_ACTOR\x10\x01\x12\x0b\n\x07MALWARE\x10\x02\x12\x14\n\x10SOFTWARE_TOOLKIT\x10\x03\x1a\x86\x02\n\x06Source\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x14\n\x0c\x62\x65nign_count\x18\x02 \x01(\x05\x12\x17\n\x0fmalicious_count\x18\x03 \x01(\x05\x12\x43\n\x07quality\x18\x04 \x01(\x0e\x32\x32.google.backstory.SecurityResult.ProductConfidence\x12\x16\n\x0eresponse_count\x18\x05 \x01(\x05\x12\x14\n\x0csource_count\x18\x06 \x01(\x05\x12L\n\x1bthreat_intelligence_sources\x18\x07 \x03(\x0b\x32\'.google.backstory.SecurityResult.Source\x1a\xfe\x01\n\x11ProviderMLVerdict\x12\x17\n\x0fsource_provider\x18\x01 \x01(\t\x12\x14\n\x0c\x62\x65nign_count\x18\x02 \x01(\x05\x12\x17\n\x0fmalicious_count\x18\x03 \x01(\x05\x12\x18\n\x10\x63onfidence_score\x18\x04 \x01(\x05\x12\x41\n\x10mandiant_sources\x18\x05 \x03(\x0b\x32\'.google.backstory.SecurityResult.Source\x12\x44\n\x13third_party_sources\x18\x06 \x03(\x0b\x32\'.google.backstory.SecurityResult.Source\x1a\xa8\x01\n\x0e\x41nalystVerdict\x12\x18\n\x10\x63onfidence_score\x18\x01 \x01(\x05\x12\x30\n\x0cverdict_time\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12J\n\x10verdict_response\x18\x03 \x01(\x0e\x32\x30.google.backstory.SecurityResult.VerdictResponse\x1a\xac\x02\n\x08IoCStats\x12\x45\n\x0eioc_stats_type\x18\x01 \x01(\x0e\x32-.google.backstory.SecurityResult.IoCStatsType\x12\x1a\n\x12\x66irst_level_source\x18\x02 \x01(\t\x12\x1b\n\x13second_level_source\x18\x03 \x01(\t\x12\x14\n\x0c\x62\x65nign_count\x18\x04 \x01(\x05\x12\x43\n\x07quality\x18\x05 \x01(\x0e\x32\x32.google.backstory.SecurityResult.ProductConfidence\x12\x17\n\x0fmalicious_count\x18\x06 \x01(\x05\x12\x16\n\x0eresponse_count\x18\x07 \x01(\x05\x12\x14\n\x0csource_count\x18\x08 \x01(\x05\x1a\xd6\x04\n\x0bVerdictInfo\x12\x14\n\x0csource_count\x18\x01 \x01(\x05\x12\x16\n\x0eresponse_count\x18\x02 \x01(\x05\x12\x1b\n\x13neighbour_influence\x18\x03 \x01(\t\x12\x42\n\x0cverdict_type\x18\x04 \x01(\x0e\x32,.google.backstory.SecurityResult.VerdictType\x12\x17\n\x0fsource_provider\x18\x05 \x01(\t\x12\x14\n\x0c\x62\x65nign_count\x18\x06 \x01(\x05\x12\x17\n\x0fmalicious_count\x18\x07 \x01(\x05\x12\x18\n\x10\x63onfidence_score\x18\x08 \x01(\x05\x12<\n\tioc_stats\x18\t \x03(\x0b\x32).google.backstory.SecurityResult.IoCStats\x12\x30\n\x0cverdict_time\x18\x0b \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12J\n\x10verdict_response\x18\x0c \x01(\x0e\x32\x30.google.backstory.SecurityResult.VerdictResponse\x12\x1d\n\x15global_customer_count\x18\r \x01(\x05\x12\x19\n\x11global_hits_count\x18\x0e \x01(\x05\x12\x0b\n\x03pwn\x18\x0f \x01(\x08\x12\x18\n\x10\x63\x61tegory_details\x18\x10 \x01(\t\x12\x39\n\x15pwn_first_tagged_time\x18\x11 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x1a\xe3\x01\n\x07Verdict\x12\x14\n\x0csource_count\x18\x01 \x01(\x05\x12\x16\n\x0eresponse_count\x18\x02 \x01(\x05\x12\x1b\n\x13neighbour_influence\x18\x03 \x01(\t\x12\x43\n\x07verdict\x18\x04 \x01(\x0b\x32\x32.google.backstory.SecurityResult.ProviderMLVerdict\x12H\n\x0f\x61nalyst_verdict\x18\x05 \x01(\x0b\x32/.google.backstory.SecurityResult.AnalystVerdict\x1az\n\x14ThreatCollectionItem\x12\n\n\x02id\x18\x01 \x01(\t\x12\x43\n\x04type\x18\x02 \x01(\x0e\x32\x35.google.backstory.SecurityResult.ThreatCollectionType\x12\x11\n\talt_names\x18\x03 \x03(\t\x1aS\n\x0eVariablesEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\x30\n\x05value\x18\x02 \x01(\x0b\x32!.google.backstory.FindingVariable:\x02\x38\x01\"N\n\x0fVerdictResponse\x12 \n\x1cVERDICT_RESPONSE_UNSPECIFIED\x10\x00\x12\r\n\tMALICIOUS\x10\x01\x12\n\n\x06\x42\x45NIGN\x10\x02\"\x80\x01\n\x0cIoCStatsType\x12\x1e\n\x1aUNSPECIFIED_IOC_STATS_TYPE\x10\x00\x12\x14\n\x10MANDIANT_SOURCES\x10\x01\x12\x17\n\x13THIRD_PARTY_SOURCES\x10\x02\x12!\n\x1dTHREAT_INTELLIGENCE_IOC_STATS\x10\x03\"Y\n\x0bVerdictType\x12\x1c\n\x18VERDICT_TYPE_UNSPECIFIED\x10\x00\x12\x17\n\x13PROVIDER_ML_VERDICT\x10\x01\x12\x13\n\x0f\x41NALYST_VERDICT\x10\x02\"\xae\x04\n\x10SecurityCategory\x12\x14\n\x10UNKNOWN_CATEGORY\x10\x00\x12\x17\n\x12SOFTWARE_MALICIOUS\x10\x90N\x12\x18\n\x13SOFTWARE_SUSPICIOUS\x10\xf4N\x12\x11\n\x0cSOFTWARE_PUA\x10\xd8O\x12\x17\n\x11NETWORK_MALICIOUS\x10\xa0\x9c\x01\x12\x18\n\x12NETWORK_SUSPICIOUS\x10\x84\x9d\x01\x12!\n\x1bNETWORK_CATEGORIZED_CONTENT\x10\xe8\x9d\x01\x12\x1f\n\x19NETWORK_DENIAL_OF_SERVICE\x10\xcc\x9e\x01\x12\x13\n\rNETWORK_RECON\x10\xb0\x9f\x01\x12!\n\x1bNETWORK_COMMAND_AND_CONTROL\x10\x94\xa0\x01\x12\x13\n\rACL_VIOLATION\x10\xb0\xea\x01\x12\x14\n\x0e\x41UTH_VIOLATION\x10\xc0\xb8\x02\x12\r\n\x07\x45XPLOIT\x10\xd0\x86\x03\x12\x17\n\x11\x44\x41TA_EXFILTRATION\x10\xe0\xd4\x03\x12\x12\n\x0c\x44\x41TA_AT_REST\x10\xc4\xd5\x03\x12\x16\n\x10\x44\x41TA_DESTRUCTION\x10\xa8\xd6\x03\x12\x13\n\rTOR_EXIT_NODE\x10\x8c\xd7\x03\x12\x0f\n\tMAIL_SPAM\x10\xf0\xa2\x04\x12\x13\n\rMAIL_PHISHING\x10\xd4\xa3\x04\x12\x13\n\rMAIL_SPOOFING\x10\xb8\xa4\x04\x12\x16\n\x10POLICY_VIOLATION\x10\x80\xf1\x04\x12\x18\n\x12SOCIAL_ENGINEERING\x10\x91\xbf\x05\x12\x0e\n\x08PHISHING\x10\x92\xbf\x05\"=\n\nAlertState\x12\x0f\n\x0bUNSPECIFIED\x10\x00\x12\x10\n\x0cNOT_ALERTING\x10\x01\x12\x0c\n\x08\x41LERTING\x10\x02\"x\n\x06\x41\x63tion\x12\x12\n\x0eUNKNOWN_ACTION\x10\x00\x12\t\n\x05\x41LLOW\x10\x01\x12\t\n\x05\x42LOCK\x10\x02\x12\x1b\n\x17\x41LLOW_WITH_MODIFICATION\x10\x03\x12\x0e\n\nQUARANTINE\x10\x04\x12\x08\n\x04\x46\x41IL\x10\x05\x12\r\n\tCHALLENGE\x10\x06\"\x81\x01\n\x0fProductSeverity\x12\x14\n\x10UNKNOWN_SEVERITY\x10\x00\x12\x11\n\rINFORMATIONAL\x10\x64\x12\n\n\x05\x45RROR\x10\x96\x01\x12\x08\n\x04NONE\x10\x65\x12\x08\n\x03LOW\x10\xc8\x01\x12\x0b\n\x06MEDIUM\x10\xac\x02\x12\t\n\x04HIGH\x10\x90\x03\x12\r\n\x08\x43RITICAL\x10\xf4\x03\"n\n\x11ProductConfidence\x12\x16\n\x12UNKNOWN_CONFIDENCE\x10\x00\x12\x13\n\x0eLOW_CONFIDENCE\x10\xc8\x01\x12\x16\n\x11MEDIUM_CONFIDENCE\x10\xac\x02\x12\x14\n\x0fHIGH_CONFIDENCE\x10\x90\x03\"d\n\x0fProductPriority\x12\x14\n\x10UNKNOWN_PRIORITY\x10\x00\x12\x11\n\x0cLOW_PRIORITY\x10\xc8\x01\x12\x14\n\x0fMEDIUM_PRIORITY\x10\xac\x02\x12\x12\n\rHIGH_PRIORITY\x10\x90\x03\"Z\n\x0cThreatStatus\x12\x1d\n\x19THREAT_STATUS_UNSPECIFIED\x10\x00\x12\n\n\x06\x41\x43TIVE\x10\x01\x12\x0b\n\x07\x43LEARED\x10\x02\x12\x12\n\x0e\x46\x41LSE_POSITIVE\x10\x03\"X\n\x14ThreatCollectionType\x12&\n\"THREAT_COLLECTION_TYPE_UNSPECIFIED\x10\x00\x12\x0c\n\x08\x43\x41MPAIGN\x10\x01\x12\n\n\x06REPORT\x10\x02\"%\n\x0ePeFileMetadata\x12\x13\n\x0bimport_hash\x18\x01 \x01(\t\"@\n\x0c\x46ileMetadata\x12\x30\n\x02pe\x18\x01 \x01(\x0b\x32 .google.backstory.PeFileMetadataB\x02\x18\x01\"\xcf*\n\x04\x46ile\x12\x0e\n\x06sha256\x18\x01 \x01(\t\x12\x0b\n\x03md5\x18\x02 \x01(\t\x12\x0c\n\x04sha1\x18\x03 \x01(\t\x12\x0c\n\x04size\x18\x04 \x01(\x04\x12\x11\n\tfull_path\x18\x05 \x01(\t\x12\x11\n\tmime_type\x18\x06 \x01(\t\x12\x39\n\rfile_metadata\x18\x07 \x01(\x0b\x32\x1e.google.backstory.FileMetadataB\x02\x18\x01\x12\x39\n\x0fsecurity_result\x18$ \x01(\x0b\x32 .google.backstory.SecurityResult\x12\x31\n\x07pe_file\x18\x08 \x01(\x0b\x32 .google.backstory.FileMetadataPE\x12\x0e\n\x06ssdeep\x18\t \x01(\t\x12\r\n\x05vhash\x18\n \x01(\t\x12\x11\n\x05\x61hash\x18\x0b \x01(\tB\x02\x18\x01\x12\x14\n\x0c\x61uthentihash\x18\x14 \x01(\t\x12\x0f\n\x07symhash\x18) \x01(\t\x12\x46\n\x16prefetch_file_metadata\x18+ \x01(\x0b\x32&.google.backstory.PrefetchFileMetadata\x12\x32\n\tfile_type\x18\x0c \x01(\x0e\x32\x1f.google.backstory.File.FileType\x12\x19\n\x11\x63\x61pabilities_tags\x18\r \x03(\t\x12\r\n\x05names\x18\x0e \x03(\t\x12\x0c\n\x04tags\x18\x1b \x03(\t\x12:\n\x16last_modification_time\x18\x0f \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12/\n\x0b\x63reate_time\x18\' \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x34\n\x10last_access_time\x18( \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x30\n\nprevalence\x18\x10 \x01(\x0b\x32\x1c.google.backstory.Prevalence\x12\x33\n\x0f\x66irst_seen_time\x18\x11 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x32\n\x0elast_seen_time\x18\x12 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x11\n\tstat_mode\x18\x15 \x01(\x04\x12\x12\n\nstat_inode\x18\x16 \x01(\x04\x12\x10\n\x08stat_dev\x18\x17 \x01(\x04\x12\x12\n\nstat_nlink\x18\x18 \x01(\x04\x12\x12\n\nstat_flags\x18\x19 \x01(\r\x12\x36\n\x12last_analysis_time\x18\x1a \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x15\n\rembedded_urls\x18\x1c \x03(\t\x12\x18\n\x10\x65mbedded_domains\x18\x1d \x03(\t\x12\x14\n\x0c\x65mbedded_ips\x18\x1e \x03(\t\x12-\n\texif_info\x18\x1f \x01(\x0b\x32\x1a.google.backstory.ExifInfo\x12\x37\n\x0esignature_info\x18  \x01(\x0b\x32\x1f.google.backstory.SignatureInfo\x12+\n\x08pdf_info\x18! \x01(\x0b\x32\x19.google.backstory.PDFInfo\x12\x39\n\x15\x66irst_submission_time\x18\" \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x38\n\x14last_submission_time\x18# \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12,\n\tmain_icon\x18% \x01(\x0b\x32\x19.google.backstory.Favicon\x12\x30\n\x04ntfs\x18& \x01(\x0b\x32\".google.backstory.NtfsFileMetadata\x12=\n\x10\x61pp_compat_cache\x18* \x01(\x0b\x32#.google.backstory.AppCompatMetadata\"\xea\x1e\n\x08\x46ileType\x12\x19\n\x15\x46ILE_TYPE_UNSPECIFIED\x10\x00\x12\x14\n\x10\x46ILE_TYPE_PE_EXE\x10\x01\x12\x14\n\x10\x46ILE_TYPE_PE_DLL\x10\x02\x12\x11\n\rFILE_TYPE_MSI\x10\x03\x12\x14\n\x10\x46ILE_TYPE_NE_EXE\x10\n\x12\x14\n\x10\x46ILE_TYPE_NE_DLL\x10\x0b\x12\x15\n\x11\x46ILE_TYPE_DOS_EXE\x10\x14\x12\x15\n\x11\x46ILE_TYPE_DOS_COM\x10\x15\x12\x12\n\x0e\x46ILE_TYPE_COFF\x10\x1e\x12\x11\n\rFILE_TYPE_ELF\x10\x1f\x12\x1a\n\x16\x46ILE_TYPE_LINUX_KERNEL\x10 \x12\x11\n\rFILE_TYPE_RPM\x10!\x12\x13\n\x0f\x46ILE_TYPE_LINUX\x10\"\x12\x14\n\x10\x46ILE_TYPE_MACH_O\x10#\x12\x1b\n\x17\x46ILE_TYPE_JAVA_BYTECODE\x10$\x12\x11\n\rFILE_TYPE_DMG\x10%\x12\x11\n\rFILE_TYPE_DEB\x10&\x12\x11\n\rFILE_TYPE_PKG\x10\'\x12\x11\n\rFILE_TYPE_PYC\x10(\x12\x11\n\rFILE_TYPE_LNK\x10\x32\x12\x1b\n\x17\x46ILE_TYPE_DESKTOP_ENTRY\x10\x33\x12\x12\n\x0e\x46ILE_TYPE_JPEG\x10\x64\x12\x12\n\x0e\x46ILE_TYPE_TIFF\x10\x65\x12\x11\n\rFILE_TYPE_GIF\x10\x66\x12\x11\n\rFILE_TYPE_PNG\x10g\x12\x11\n\rFILE_TYPE_BMP\x10h\x12\x12\n\x0e\x46ILE_TYPE_GIMP\x10i\x12\x17\n\x13\x46ILE_TYPE_IN_DESIGN\x10j\x12\x11\n\rFILE_TYPE_PSD\x10k\x12\x13\n\x0f\x46ILE_TYPE_TARGA\x10l\x12\x11\n\rFILE_TYPE_XWD\x10m\x12\x11\n\rFILE_TYPE_DIB\x10n\x12\x11\n\rFILE_TYPE_JNG\x10o\x12\x11\n\rFILE_TYPE_ICO\x10p\x12\x11\n\rFILE_TYPE_FPX\x10q\x12\x11\n\rFILE_TYPE_EPS\x10r\x12\x11\n\rFILE_TYPE_SVG\x10s\x12\x11\n\rFILE_TYPE_EMF\x10t\x12\x12\n\x0e\x46ILE_TYPE_WEBP\x10u\x12\x11\n\rFILE_TYPE_DWG\x10v\x12\x11\n\rFILE_TYPE_DXF\x10w\x12\x15\n\x11\x46ILE_TYPE_THREEDS\x10x\x12\x12\n\rFILE_TYPE_OGG\x10\x96\x01\x12\x12\n\rFILE_TYPE_FLC\x10\x97\x01\x12\x12\n\rFILE_TYPE_FLI\x10\x98\x01\x12\x12\n\rFILE_TYPE_MP3\x10\x99\x01\x12\x13\n\x0e\x46ILE_TYPE_FLAC\x10\x9a\x01\x12\x12\n\rFILE_TYPE_WAV\x10\x9b\x01\x12\x13\n\x0e\x46ILE_TYPE_MIDI\x10\x9c\x01\x12\x12\n\rFILE_TYPE_AVI\x10\x9d\x01\x12\x13\n\x0e\x46ILE_TYPE_MPEG\x10\x9e\x01\x12\x18\n\x13\x46ILE_TYPE_QUICKTIME\x10\x9f\x01\x12\x12\n\rFILE_TYPE_ASF\x10\xa0\x01\x12\x13\n\x0e\x46ILE_TYPE_DIVX\x10\xa1\x01\x12\x12\n\rFILE_TYPE_FLV\x10\xa2\x01\x12\x12\n\rFILE_TYPE_WMA\x10\xa3\x01\x12\x12\n\rFILE_TYPE_WMV\x10\xa4\x01\x12\x11\n\x0c\x46ILE_TYPE_RM\x10\xa5\x01\x12\x12\n\rFILE_TYPE_MOV\x10\xa6\x01\x12\x12\n\rFILE_TYPE_MP4\x10\xa7\x01\x12\x13\n\x0e\x46ILE_TYPE_T3GP\x10\xa8\x01\x12\x13\n\x0e\x46ILE_TYPE_WEBM\x10\xa9\x01\x12\x12\n\rFILE_TYPE_MKV\x10\xaa\x01\x12\x12\n\rFILE_TYPE_PDF\x10\xc8\x01\x12\x11\n\x0c\x46ILE_TYPE_PS\x10\xc9\x01\x12\x12\n\rFILE_TYPE_DOC\x10\xca\x01\x12\x13\n\x0e\x46ILE_TYPE_DOCX\x10\xcb\x01\x12\x12\n\rFILE_TYPE_PPT\x10\xcc\x01\x12\x13\n\x0e\x46ILE_TYPE_PPTX\x10\xcd\x01\x12\x12\n\rFILE_TYPE_XLS\x10\xce\x01\x12\x13\n\x0e\x46ILE_TYPE_XLSX\x10\xcf\x01\x12\x12\n\rFILE_TYPE_RTF\x10\xd0\x01\x12\x13\n\x0e\x46ILE_TYPE_PPSX\x10\xd1\x01\x12\x12\n\rFILE_TYPE_ODP\x10\xfa\x01\x12\x12\n\rFILE_TYPE_ODS\x10\xfb\x01\x12\x12\n\rFILE_TYPE_ODT\x10\xfc\x01\x12\x12\n\rFILE_TYPE_HWP\x10\xfd\x01\x12\x12\n\rFILE_TYPE_GUL\x10\xfe\x01\x12\x12\n\rFILE_TYPE_ODF\x10\xff\x01\x12\x12\n\rFILE_TYPE_ODG\x10\x80\x02\x12\x17\n\x12\x46ILE_TYPE_ONE_NOTE\x10\x81\x02\x12\x14\n\x0f\x46ILE_TYPE_OOXML\x10\x82\x02\x12\x12\n\rFILE_TYPE_SLK\x10\x83\x02\x12\x14\n\x0f\x46ILE_TYPE_EBOOK\x10\x84\x02\x12\x14\n\x0f\x46ILE_TYPE_LATEX\x10\x85\x02\x12\x12\n\rFILE_TYPE_TTF\x10\x86\x02\x12\x12\n\rFILE_TYPE_EOT\x10\x87\x02\x12\x13\n\x0e\x46ILE_TYPE_WOFF\x10\x88\x02\x12\x12\n\rFILE_TYPE_CHM\x10\x89\x02\x12\x12\n\rFILE_TYPE_ZIP\x10\xac\x02\x12\x13\n\x0e\x46ILE_TYPE_GZIP\x10\xad\x02\x12\x13\n\x0e\x46ILE_TYPE_BZIP\x10\xae\x02\x12\x13\n\x0e\x46ILE_TYPE_RZIP\x10\xaf\x02\x12\x13\n\x0e\x46ILE_TYPE_DZIP\x10\xb0\x02\x12\x17\n\x12\x46ILE_TYPE_SEVENZIP\x10\xb1\x02\x12\x12\n\rFILE_TYPE_CAB\x10\xb2\x02\x12\x12\n\rFILE_TYPE_JAR\x10\xb3\x02\x12\x12\n\rFILE_TYPE_RAR\x10\xb4\x02\x12\x19\n\x14\x46ILE_TYPE_MSCOMPRESS\x10\xb5\x02\x12\x12\n\rFILE_TYPE_ACE\x10\xb6\x02\x12\x12\n\rFILE_TYPE_ARC\x10\xb7\x02\x12\x12\n\rFILE_TYPE_ARJ\x10\xb8\x02\x12\x12\n\rFILE_TYPE_ASD\x10\xb9\x02\x12\x18\n\x13\x46ILE_TYPE_BLACKHOLE\x10\xba\x02\x12\x12\n\rFILE_TYPE_KGB\x10\xbb\x02\x12\x13\n\x0e\x46ILE_TYPE_ZLIB\x10\xbc\x02\x12\x12\n\rFILE_TYPE_TAR\x10\xbd\x02\x12\x12\n\rFILE_TYPE_ZST\x10\xbe\x02\x12\x14\n\x0f\x46ILE_TYPE_LZFSE\x10\xbf\x02\x12\x19\n\x14\x46ILE_TYPE_PYTHON_WHL\x10\xc0\x02\x12\x19\n\x14\x46ILE_TYPE_PYTHON_PKG\x10\xc1\x02\x12\x13\n\x0e\x46ILE_TYPE_MSIX\x10\xc2\x02\x12\x13\n\x0e\x46ILE_TYPE_TEXT\x10\x90\x03\x12\x15\n\x10\x46ILE_TYPE_SCRIPT\x10\x91\x03\x12\x12\n\rFILE_TYPE_PHP\x10\x92\x03\x12\x15\n\x10\x46ILE_TYPE_PYTHON\x10\x93\x03\x12\x13\n\x0e\x46ILE_TYPE_PERL\x10\x94\x03\x12\x13\n\x0e\x46ILE_TYPE_RUBY\x10\x95\x03\x12\x10\n\x0b\x46ILE_TYPE_C\x10\x96\x03\x12\x12\n\rFILE_TYPE_CPP\x10\x97\x03\x12\x13\n\x0e\x46ILE_TYPE_JAVA\x10\x98\x03\x12\x1a\n\x15\x46ILE_TYPE_SHELLSCRIPT\x10\x99\x03\x12\x15\n\x10\x46ILE_TYPE_PASCAL\x10\x9a\x03\x12\x12\n\rFILE_TYPE_AWK\x10\x9b\x03\x12\x15\n\x10\x46ILE_TYPE_DYALOG\x10\x9c\x03\x12\x16\n\x11\x46ILE_TYPE_FORTRAN\x10\x9d\x03\x12\x19\n\x14\x46ILE_TYPE_JAVASCRIPT\x10\x9e\x03\x12\x19\n\x14\x46ILE_TYPE_POWERSHELL\x10\x9f\x03\x12\x12\n\rFILE_TYPE_VBA\x10\xa0\x03\x12\x11\n\x0c\x46ILE_TYPE_M4\x10\xa1\x03\x12\x18\n\x13\x46ILE_TYPE_OBJETIVEC\x10\xa2\x03\x12\x13\n\x0e\x46ILE_TYPE_JMOD\x10\xa3\x03\x12\x17\n\x12\x46ILE_TYPE_MAKEFILE\x10\xa4\x03\x12\x12\n\rFILE_TYPE_INI\x10\xa5\x03\x12\x12\n\rFILE_TYPE_CLJ\x10\xa6\x03\x12\x12\n\rFILE_TYPE_PDB\x10\xa9\x03\x12\x12\n\rFILE_TYPE_SQL\x10\xaa\x03\x12\x13\n\x0e\x46ILE_TYPE_NEKO\x10\xab\x03\x12\x12\n\rFILE_TYPE_WER\x10\xac\x03\x12\x15\n\x10\x46ILE_TYPE_GOLANG\x10\xad\x03\x12\x12\n\rFILE_TYPE_M3U\x10\xae\x03\x12\x12\n\rFILE_TYPE_BAT\x10\xaf\x03\x12\x12\n\rFILE_TYPE_MSC\x10\xb0\x03\x12\x12\n\rFILE_TYPE_RDP\x10\xb1\x03\x12\x16\n\x11\x46ILE_TYPE_SYMBIAN\x10\xf4\x03\x12\x15\n\x10\x46ILE_TYPE_PALMOS\x10\xf5\x03\x12\x14\n\x0f\x46ILE_TYPE_WINCE\x10\xf6\x03\x12\x16\n\x11\x46ILE_TYPE_ANDROID\x10\xf7\x03\x12\x15\n\x10\x46ILE_TYPE_IPHONE\x10\xf8\x03\x12\x13\n\x0e\x46ILE_TYPE_HTML\x10\xd8\x04\x12\x12\n\rFILE_TYPE_XML\x10\xd9\x04\x12\x12\n\rFILE_TYPE_SWF\x10\xda\x04\x12\x12\n\rFILE_TYPE_FLA\x10\xdb\x04\x12\x15\n\x10\x46ILE_TYPE_COOKIE\x10\xdc\x04\x12\x16\n\x11\x46ILE_TYPE_TORRENT\x10\xdd\x04\x12\x19\n\x14\x46ILE_TYPE_EMAIL_TYPE\x10\xde\x04\x12\x16\n\x11\x46ILE_TYPE_OUTLOOK\x10\xdf\x04\x12\x13\n\x0e\x46ILE_TYPE_SGML\x10\xe0\x04\x12\x13\n\x0e\x46ILE_TYPE_JSON\x10\xe1\x04\x12\x12\n\rFILE_TYPE_CSV\x10\xe2\x04\x12\x12\n\rFILE_TYPE_HTA\x10\xe3\x04\x12 \n\x1b\x46ILE_TYPE_INTERNET_SHORTCUT\x10\xe4\x04\x12\x12\n\rFILE_TYPE_CAP\x10\xbc\x05\x12\x17\n\x12\x46ILE_TYPE_ISOIMAGE\x10\xa0\x06\x12\x17\n\x12\x46ILE_TYPE_SQUASHFS\x10\xa1\x06\x12\x12\n\rFILE_TYPE_VHD\x10\xa2\x06\x12\x14\n\x0f\x46ILE_TYPE_APPLE\x10\xe8\x07\x12\x18\n\x13\x46ILE_TYPE_MACINTOSH\x10\xe9\x07\x12\x1a\n\x15\x46ILE_TYPE_APPLESINGLE\x10\xea\x07\x12\x1a\n\x15\x46ILE_TYPE_APPLEDOUBLE\x10\xeb\x07\x12\x1c\n\x17\x46ILE_TYPE_MACINTOSH_HFS\x10\xec\x07\x12\x1a\n\x15\x46ILE_TYPE_APPLE_PLIST\x10\xed\x07\x12\x1c\n\x17\x46ILE_TYPE_MACINTOSH_LIB\x10\xee\x07\x12\x1a\n\x15\x46ILE_TYPE_APPLESCRIPT\x10\xef\x07\x12#\n\x1e\x46ILE_TYPE_APPLESCRIPT_COMPILED\x10\xf0\x07\x12\x12\n\rFILE_TYPE_CRX\x10\xcc\x08\x12\x12\n\rFILE_TYPE_XPI\x10\xcd\x08\x12\x12\n\rFILE_TYPE_ROM\x10\xb0\t\x12\x12\n\rFILE_TYPE_IPS\x10\xb1\t\x12\x12\n\rFILE_TYPE_PEM\x10\x94\n\x12\x12\n\rFILE_TYPE_PGP\x10\x95\n\x12\x12\n\rFILE_TYPE_CRT\x10\x96\n\"\xde\x02\n\x10NtfsFileMetadata\x12/\n\x0b\x63hange_time\x18\x01 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x38\n\x14\x66ilename_create_time\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x38\n\x14\x66ilename_modify_time\x18\x03 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x38\n\x14\x66ilename_access_time\x18\x04 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x38\n\x14\x66ilename_change_time\x18\x05 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x31\n\x0busn_journal\x18\x06 \x03(\x0b\x32\x1c.google.backstory.UsnJournal\"@\n\x14PrefetchFileMetadata\x12\x11\n\trun_count\x18\x01 \x01(\x03\x12\x15\n\rprefetch_hash\x18\x02 \x01(\t\"\xbc\t\n\nUsnJournal\x12\x17\n\x0f\x61ttributes_flag\x18\x01 \x01(\t\x12>\n\nattributes\x18\x02 \x01(\x0e\x32&.google.backstory.UsnJournal.AttributeB\x02\x18\x01\x12?\n\x0f\x66ile_attributes\x18\x05 \x03(\x0e\x32&.google.backstory.UsnJournal.Attribute\x12\x11\n\tallocated\x18\x03 \x01(\x08\x12\x37\n\x06reason\x18\x04 \x01(\x0e\x32#.google.backstory.UsnJournal.ReasonB\x02\x18\x01\x12\x34\n\x07reasons\x18\x06 \x03(\x0e\x32#.google.backstory.UsnJournal.Reason\"\xa1\x03\n\tAttribute\x12\x19\n\x15\x41TTRIBUTE_UNSPECIFIED\x10\x00\x12\r\n\tREAD_ONLY\x10\x01\x12\n\n\x06HIDDEN\x10\x02\x12\n\n\x06SYSTEM\x10\x03\x12\x0b\n\x07\x41RCHIVE\x10\x04\x12\x0e\n\nCOMPRESSED\x10\x05\x12\r\n\tENCRYPTED\x10\x06\x12\r\n\tDIRECTORY\x10\x07\x12\n\n\x06\x44\x45VICE\x10\x08\x12\n\n\x06NORMAL\x10\t\x12\r\n\tTEMPORARY\x10\n\x12\x0f\n\x0bSPARSE_FILE\x10\x0b\x12\x11\n\rREPARSE_POINT\x10\x0c\x12\x0b\n\x07OFFLINE\x10\r\x12\x17\n\x13NOT_CONTENT_INDEXED\x10\x0e\x12\x1b\n\x13NON_CONTENT_INDEXED\x10\x0e\x1a\x02\x08\x01\x12\x14\n\x10INTEGRITY_STREAM\x10\x0f\x12\x0b\n\x07VIRTUAL\x10\x10\x12\x11\n\rNO_SCRUB_DATA\x10\x11\x12\x06\n\x02\x45\x41\x10\x12\x12\n\n\x06PINNED\x10\x13\x12\x0c\n\x08UNPINNED\x10\x14\x12\x12\n\x0eRECALL_ON_OPEN\x10\x15\x12\x19\n\x15RECALL_ON_DATA_ACCESS\x10\x16\x1a\x02\x10\x01\"\xed\x03\n\x06Reason\x12\x16\n\x12REASON_UNSPECIFIED\x10\x00\x12\x12\n\x0e\x44\x41TA_OVERWRITE\x10\x01\x12\x0f\n\x0b\x44\x41TA_EXTEND\x10\x02\x12\x13\n\x0f\x44\x41TA_TRUNCATION\x10\x03\x12\x18\n\x14NAMED_DATA_OVERWRITE\x10\x04\x12\x15\n\x11NAMED_DATA_EXTEND\x10\x05\x12\x19\n\x15NAMED_DATA_TRUNCATION\x10\x06\x12\x0f\n\x0b\x46ILE_CREATE\x10\x07\x12\x0f\n\x0b\x46ILE_DELETE\x10\x08\x12\r\n\tEA_CHANGE\x10\t\x12\x13\n\x0fSECURITY_CHANGE\x10\n\x12\x13\n\x0fRENAME_OLD_NAME\x10\x0b\x12\x13\n\x0fRENAME_NEW_NAME\x10\x0c\x12\x14\n\x10INDEXABLE_CHANGE\x10\r\x12\x15\n\x11\x42\x41SIC_INFO_CHANGE\x10\x0e\x12\x14\n\x10HARD_LINK_CHANGE\x10\x0f\x12\x16\n\x12\x43OMPRESSION_CHANGE\x10\x10\x12\x15\n\x11\x45NCRYPTION_CHANGE\x10\x11\x12\x14\n\x10OBJECT_ID_CHANGE\x10\x12\x12\x18\n\x14REPARSE_POINT_CHANGE\x10\x13\x12\x11\n\rSTREAM_CHANGE\x10\x14\x12\x15\n\x11TRANSACTED_CHANGE\x10\x15\x12\t\n\x05\x43LOSE\x10\x16\"L\n\x11\x41ppCompatMetadata\x12\x10\n\x08sequence\x18\x01 \x01(\x05\x12\x10\n\x08\x65xecuted\x18\x02 \x01(\x08\x12\x13\n\x0b\x63ontrol_set\x18\x03 \x01(\t\"\xd6\x05\n\x0e\x46ileMetadataPE\x12\x0f\n\x07imphash\x18\x01 \x01(\t\x12\x13\n\x0b\x65ntry_point\x18\x02 \x01(\x03\x12\x1c\n\x14\x65ntry_point_exiftool\x18\t \x01(\x03\x12\x34\n\x10\x63ompilation_time\x18\n \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12=\n\x19\x63ompilation_exiftool_time\x18\x0b \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x36\n\x07section\x18\x03 \x03(\x0b\x32%.google.backstory.FileMetadataSection\x12\x36\n\x07imports\x18\x04 \x03(\x0b\x32%.google.backstory.FileMetadataImports\x12>\n\x08resource\x18\x05 \x03(\x0b\x32,.google.backstory.FileMetadataPeResourceInfo\x12I\n\x14resources_type_count\x18\x06 \x03(\x0b\x32\'.google.backstory.StringToInt64MapEntryB\x02\x18\x01\x12M\n\x18resources_language_count\x18\x07 \x03(\x0b\x32\'.google.backstory.StringToInt64MapEntryB\x02\x18\x01\x12\x39\n\x18resources_type_count_str\x18\x0c \x03(\x0b\x32\x17.google.backstory.Label\x12=\n\x1cresources_language_count_str\x18\r \x03(\x0b\x32\x17.google.backstory.Label\x12G\n\x0esignature_info\x18\x08 \x01(\x0b\x32+.google.backstory.FileMetadataSignatureInfoB\x02\x18\x01\"\x83\x01\n\x1a\x46ileMetadataPeResourceInfo\x12\x12\n\nsha256_hex\x18\x01 \x01(\t\x12\x16\n\x0e\x66iletype_magic\x18\x02 \x01(\t\x12\x15\n\rlanguage_code\x18\x04 \x01(\t\x12\x0f\n\x07\x65ntropy\x18\x05 \x01(\x01\x12\x11\n\tfile_type\x18\x06 \x01(\t\"\x88\x01\n\rSignatureInfo\x12=\n\x08sigcheck\x18\x01 \x01(\x0b\x32+.google.backstory.FileMetadataSignatureInfo\x12\x38\n\x08\x63odesign\x18\x02 \x01(\x0b\x32&.google.backstory.FileMetadataCodesign\"\xb4\x01\n\x19\x46ileMetadataSignatureInfo\x12\x1c\n\x14verification_message\x18\x01 \x01(\t\x12\x10\n\x08verified\x18\x02 \x01(\x08\x12\x12\n\x06signer\x18\x03 \x03(\tB\x02\x18\x01\x12-\n\x07signers\x18\x04 \x03(\x0b\x32\x1c.google.backstory.SignerInfo\x12$\n\x04x509\x18\x05 \x03(\x0b\x32\x16.google.backstory.X509\"\x9c\x01\n\nSignerInfo\x12\x11\n\x04name\x18\x01 \x01(\tH\x00\x88\x01\x01\x12\x13\n\x06status\x18\x02 \x01(\tH\x01\x88\x01\x01\x12\x18\n\x0bvalid_usage\x18\x03 \x01(\tH\x02\x88\x01\x01\x12\x18\n\x0b\x63\x65rt_issuer\x18\x04 \x01(\tH\x03\x88\x01\x01\x42\x07\n\x05_nameB\t\n\x07_statusB\x0e\n\x0c_valid_usageB\x0e\n\x0c_cert_issuer\"y\n\x14\x46ileMetadataCodesign\x12\n\n\x02id\x18\x01 \x01(\t\x12\x0e\n\x06\x66ormat\x18\x02 \x01(\t\x12\x34\n\x10\x63ompilation_time\x18\x03 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x0f\n\x07team_id\x18\x04 \x01(\t\"g\n\x04X509\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x11\n\talgorithm\x18\x02 \x01(\t\x12\x12\n\nthumbprint\x18\x03 \x01(\t\x12\x13\n\x0b\x63\x65rt_issuer\x18\x04 \x01(\t\x12\x15\n\rserial_number\x18\x05 \x01(\t\"\xc7\x03\n\x07PDFInfo\x12\n\n\x02js\x18\x01 \x01(\x03\x12\x12\n\njavascript\x18\x02 \x01(\x03\x12\x1b\n\x13launch_action_count\x18\x03 \x01(\x03\x12\x1b\n\x13object_stream_count\x18\x04 \x01(\x03\x12\x14\n\x0c\x65ndobj_count\x18\x05 \x01(\x03\x12\x0e\n\x06header\x18\x06 \x01(\t\x12\x10\n\x08\x61\x63roform\x18\x07 \x01(\x03\x12\x12\n\nautoaction\x18\x08 \x01(\x03\x12\x15\n\rembedded_file\x18\t \x01(\x03\x12\x11\n\tencrypted\x18\n \x01(\x03\x12\r\n\x05\x66lash\x18\x0b \x01(\x03\x12\x19\n\x11jbig2_compression\x18\x0c \x01(\x03\x12\x11\n\tobj_count\x18\r \x01(\x03\x12\x17\n\x0f\x65ndstream_count\x18\x0e \x01(\x03\x12\x12\n\npage_count\x18\x0f \x01(\x03\x12\x14\n\x0cstream_count\x18\x10 \x01(\x03\x12\x12\n\nopenaction\x18\x11 \x01(\x03\x12\x11\n\tstartxref\x18\x12 \x01(\x03\x12\x19\n\x11suspicious_colors\x18\x13 \x01(\x03\x12\x0f\n\x07trailer\x18\x14 \x01(\x03\x12\x0b\n\x03xfa\x18\x15 \x01(\x03\x12\x0c\n\x04xref\x18\x16 \x01(\x03\"O\n\x15StringToInt64MapEntry\x12\x10\n\x03key\x18\x01 \x01(\tH\x00\x88\x01\x01\x12\x12\n\x05value\x18\x02 \x01(\x03H\x01\x88\x01\x01\x42\x06\n\x04_keyB\x08\n\x06_value\"y\n\x13\x46ileMetadataSection\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x0f\n\x07\x65ntropy\x18\x02 \x01(\x01\x12\x16\n\x0eraw_size_bytes\x18\x03 \x01(\x03\x12\x1a\n\x12virtual_size_bytes\x18\x04 \x01(\x03\x12\x0f\n\x07md5_hex\x18\x05 \x01(\t\"9\n\x13\x46ileMetadataImports\x12\x0f\n\x07library\x18\x01 \x01(\t\x12\x11\n\tfunctions\x18\x02 \x03(\t\"\xa8\x01\n\x08\x45xifInfo\x12\x15\n\roriginal_file\x18\x01 \x01(\t\x12\x0f\n\x07product\x18\x02 \x01(\t\x12\x0f\n\x07\x63ompany\x18\x03 \x01(\t\x12\x18\n\x10\x66ile_description\x18\x04 \x01(\t\x12\x13\n\x0b\x65ntry_point\x18\x05 \x01(\x03\x12\x34\n\x10\x63ompilation_time\x18\x06 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\"\x83\x01\n\nPrevalence\x12\x13\n\x0brolling_max\x18\x01 \x01(\x05\x12\x11\n\tday_count\x18\x02 \x01(\x05\x12\x1f\n\x17rolling_max_sub_domains\x18\x03 \x01(\x05\x12\x0f\n\x07\x64\x61y_max\x18\x04 \x01(\x05\x12\x1b\n\x13\x64\x61y_max_sub_domains\x18\x05 \x01(\x05\"\xdf\x04\n\x03\x44ns\x12\n\n\x02id\x18\x06 \x01(\r\x12\x10\n\x08response\x18\x07 \x01(\x08\x12\x0e\n\x06opcode\x18\x08 \x01(\r\x12\x15\n\rauthoritative\x18\t \x01(\x08\x12\x11\n\ttruncated\x18\n \x01(\x08\x12\x19\n\x11recursion_desired\x18\x0b \x01(\x08\x12\x1b\n\x13recursion_available\x18\x0c \x01(\x08\x12\x15\n\rresponse_code\x18\r \x01(\r\x12\x31\n\tquestions\x18\x01 \x03(\x0b\x32\x1e.google.backstory.Dns.Question\x12\x35\n\x07\x61nswers\x18\x02 \x03(\x0b\x32$.google.backstory.Dns.ResourceRecord\x12\x37\n\tauthority\x18\x03 \x03(\x0b\x32$.google.backstory.Dns.ResourceRecord\x12\x38\n\nadditional\x18\x04 \x03(\x0b\x32$.google.backstory.Dns.ResourceRecord\x1ag\n\x08Question\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x0c\n\x04type\x18\x02 \x01(\r\x12\r\n\x05\x63lass\x18\x03 \x01(\r\x12\x30\n\nprevalence\x18\x04 \x01(\x0b\x32\x1c.google.backstory.Prevalence\x1ak\n\x0eResourceRecord\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x0c\n\x04type\x18\x02 \x01(\r\x12\r\n\x05\x63lass\x18\x03 \x01(\r\x12\x0b\n\x03ttl\x18\x04 \x01(\r\x12\x0c\n\x04\x64\x61ta\x18\x05 \x01(\t\x12\x13\n\x0b\x62inary_data\x18\x06 \x01(\x0c\"\x82\x06\n\x04\x44hcp\x12-\n\x06opcode\x18\x01 \x01(\x0e\x32\x1d.google.backstory.Dhcp.OpCode\x12\r\n\x05htype\x18\x02 \x01(\r\x12\x0c\n\x04hlen\x18\x03 \x01(\r\x12\x0c\n\x04hops\x18\x04 \x01(\r\x12\x16\n\x0etransaction_id\x18\x05 \x01(\r\x12\x0f\n\x07seconds\x18\x06 \x01(\r\x12\r\n\x05\x66lags\x18\x07 \x01(\r\x12\x0e\n\x06\x63iaddr\x18\x08 \x01(\t\x12\x0e\n\x06yiaddr\x18\t \x01(\t\x12\x0e\n\x06siaddr\x18\n \x01(\t\x12\x0e\n\x06giaddr\x18\x0b \x01(\t\x12\x0e\n\x06\x63haddr\x18\x0c \x01(\t\x12\r\n\x05sname\x18\r \x01(\t\x12\x0c\n\x04\x66ile\x18\x0e \x01(\t\x12.\n\x07options\x18\x0f \x03(\x0b\x32\x1d.google.backstory.Dhcp.Option\x12\x30\n\x04type\x18\x10 \x01(\x0e\x32\".google.backstory.Dhcp.MessageType\x12\x1a\n\x12lease_time_seconds\x18\x11 \x01(\r\x12\x17\n\x0f\x63lient_hostname\x18\x12 \x01(\t\x12\x19\n\x11\x63lient_identifier\x18\x13 \x01(\x0c\x12\x19\n\x11requested_address\x18\x14 \x01(\t\x12 \n\x18\x63lient_identifier_string\x18\x15 \x01(\t\x1a$\n\x06Option\x12\x0c\n\x04\x63ode\x18\x01 \x01(\r\x12\x0c\n\x04\x64\x61ta\x18\x02 \x01(\x0c\"<\n\x06OpCode\x12\x12\n\x0eUNKNOWN_OPCODE\x10\x00\x12\x0f\n\x0b\x42OOTREQUEST\x10\x01\x12\r\n\tBOOTREPLY\x10\x02\"\xa7\x01\n\x0bMessageType\x12\x18\n\x14UNKNOWN_MESSAGE_TYPE\x10\x00\x12\x0c\n\x08\x44ISCOVER\x10\x01\x12\t\n\x05OFFER\x10\x02\x12\x0b\n\x07REQUEST\x10\x03\x12\x0b\n\x07\x44\x45\x43LINE\x10\x04\x12\x07\n\x03\x41\x43K\x10\x05\x12\x07\n\x03NAK\x10\x06\x12\x0b\n\x07RELEASE\x10\x07\x12\n\n\x06INFORM\x10\x08\x12\x0f\n\x0bWIN_DELETED\x10\x64\x12\x0f\n\x0bWIN_EXPIRED\x10\x65\"\xd9\x01\n\x0b\x43\x65rtificate\x12\x0f\n\x07version\x18\x01 \x01(\t\x12\x0e\n\x06serial\x18\x02 \x01(\t\x12\x0f\n\x07subject\x18\x03 \x01(\t\x12\x0e\n\x06issuer\x18\x04 \x01(\t\x12\x0b\n\x03md5\x18\x05 \x01(\t\x12\x0c\n\x04sha1\x18\x06 \x01(\t\x12\x0e\n\x06sha256\x18\x07 \x01(\t\x12.\n\nnot_before\x18\x08 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12-\n\tnot_after\x18\t \x01(\x0b\x32\x1a.google.protobuf.Timestamp\"\xcb\x03\n\x03Tls\x12,\n\x06\x63lient\x18\x01 \x01(\x0b\x32\x1c.google.backstory.Tls.Client\x12,\n\x06server\x18\x02 \x01(\x0b\x32\x1c.google.backstory.Tls.Server\x12\x0e\n\x06\x63ipher\x18\x03 \x01(\t\x12\r\n\x05\x63urve\x18\x04 \x01(\t\x12\x0f\n\x07version\x18\x05 \x01(\t\x12\x18\n\x10version_protocol\x18\x06 \x01(\t\x12\x13\n\x0b\x65stablished\x18\x07 \x01(\x08\x12\x15\n\rnext_protocol\x18\x08 \x01(\t\x12\x0f\n\x07resumed\x18\t \x01(\x08\x1a\x86\x01\n\x06\x43lient\x12\x32\n\x0b\x63\x65rtificate\x18\x01 \x01(\x0b\x32\x1d.google.backstory.Certificate\x12\x0b\n\x03ja3\x18\x02 \x01(\t\x12\x13\n\x0bserver_name\x18\x03 \x01(\t\x12\x19\n\x11supported_ciphers\x18\x04 \x03(\t\x12\x0b\n\x03ja4\x18\x05 \x01(\t\x1aX\n\x06Server\x12\x32\n\x0b\x63\x65rtificate\x18\x01 \x01(\x0b\x32\x1d.google.backstory.Certificate\x12\x0c\n\x04ja3s\x18\x02 \x01(\t\x12\x0c\n\x04ja4s\x18\x03 \x01(\t\"]\n\x04Http\x12\x0e\n\x06method\x18\x01 \x01(\t\x12\x14\n\x0creferral_url\x18\x02 \x01(\t\x12\x12\n\nuser_agent\x18\x03 \x01(\t\x12\x15\n\rresponse_code\x18\x04 \x01(\x05J\x04\x08\x05\x10\x06\"\x9d\x0b\n\x07\x42rowser\x12;\n\x0c\x62rowser_type\x18\x01 \x01(\x0e\x32%.google.backstory.Browser.BrowserType\x12\x17\n\x0f\x62rowser_version\x18\x02 \x01(\t\x12\x34\n\x10\x66irst_visit_time\x18\x03 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x33\n\x0flast_visit_time\x18\x04 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x0f\n\x07profile\x18\x05 \x01(\t\x12\r\n\x05typed\x18\x06 \x01(\x08\x12:\n\nvisit_type\x18\x07 \x01(\x0e\x32&.google.backstory.Browser.UrlVisitType\x12\x0e\n\x06hidden\x18\x08 \x01(\x08\x12\x1a\n\x12request_origin_uri\x18\t \x01(\t\x12\x13\n\x0bvisit_count\x18\n \x01(\x03\x12\x1c\n\x14visit_count_criteria\x18\x0b \x01(\t\x12\x17\n\x0findexed_content\x18\x0c \x01(\t\x12\x39\n\x15\x66irst_bookmarked_time\x18\r \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x31\n\x07\x63ookies\x18\x0e \x03(\x0b\x32 .google.backstory.Browser.Cookie\x12\x13\n\x0btyped_count\x18\x0f \x01(\x03\x12;\n\x0cvisit_source\x18\x10 \x01(\x0e\x32%.google.backstory.Browser.VisitSource\x1a\xe9\x02\n\x06\x43ookie\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t\x12\x0e\n\x06\x64omain\x18\x03 \x01(\t\x12\x0c\n\x04path\x18\x04 \x01(\t\x12\x33\n\x0f\x65xpiration_time\x18\x05 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x11\n\thttp_only\x18\x06 \x01(\x08\x12\x0e\n\x06secure\x18\x07 \x01(\x08\x12\x0f\n\x07max_age\x18\x08 \x01(\x03\x12\x42\n\tsame_site\x18\t \x01(\x0e\x32/.google.backstory.Browser.Cookie.CookieSameSite\x12\x0f\n\x07session\x18\n \x01(\x08\x12\x13\n\x0bpartitioned\x18\x0b \x01(\x08\"Q\n\x0e\x43ookieSameSite\x12 \n\x1c\x43OOKIE_SAME_SITE_UNSPECIFIED\x10\x00\x12\n\n\x06STRICT\x10\x01\x12\x07\n\x03LAX\x10\x02\x12\x08\n\x04NONE\x10\x03\"|\n\x0b\x42rowserType\x12\x1c\n\x18\x42ROWSER_TYPE_UNSPECIFIED\x10\x00\x12\n\n\x06\x43HROME\x10\x01\x12\x0b\n\x07\x46IREFOX\x10\x02\x12\n\n\x06SAFARI\x10\x03\x12\x15\n\x11INTERNET_EXPLORER\x10\x04\x12\x08\n\x04\x45\x44GE\x10\x05\x12\t\n\x05OPERA\x10\x06\"\xef\x01\n\x0cUrlVisitType\x12\x1e\n\x1aURL_VISIT_TYPE_UNSPECIFIED\x10\x00\x12\x08\n\x04LINK\x10\x01\x12\t\n\x05TYPED\x10\x02\x12\x11\n\rAUTO_BOOKMARK\x10\x03\x12\x11\n\rAUTO_SUBFRAME\x10\x04\x12\x13\n\x0fMANUAL_SUBFRAME\x10\x05\x12\r\n\tGENERATED\x10\x06\x12\x11\n\rAUTO_TOPLEVEL\x10\x07\x12\x0f\n\x0b\x46ORM_SUBMIT\x10\x08\x12\n\n\x06RELOAD\x10\t\x12\x0b\n\x07KEYWORD\x10\n\x12\x15\n\x11KEYWORD_GENERATED\x10\x0b\x12\x0c\n\x08REDIRECT\x10\x0c\"a\n\x0bVisitSource\x12\x1c\n\x18VISIT_SOURCE_UNSPECIFIED\x10\x00\x12\n\n\x06SYNCED\x10\x01\x12\x0b\n\x07\x42ROWSER\x10\x02\x12\r\n\tEXTENSION\x10\x03\x12\x0c\n\x08IMPORTED\x10\x04\"\xcc\x01\n\x08Hardware\x12\x15\n\rserial_number\x18\x01 \x01(\t\x12\x14\n\x0cmanufacturer\x18\x02 \x01(\t\x12\r\n\x05model\x18\x03 \x01(\t\x12\x14\n\x0c\x63pu_platform\x18\x04 \x01(\t\x12\x11\n\tcpu_model\x18\x05 \x01(\t\x12\x17\n\x0f\x63pu_clock_speed\x18\x06 \x01(\x04\x12\x1b\n\x13\x63pu_max_clock_speed\x18\x07 \x01(\x04\x12\x18\n\x10\x63pu_number_cores\x18\x08 \x01(\x04\x12\x0b\n\x03ram\x18\t \x01(\x04\"}\n\x10PlatformSoftware\x12\x31\n\x08platform\x18\x01 \x01(\x0e\x32\x1f.google.backstory.Noun.Platform\x12\x18\n\x10platform_version\x18\x02 \x01(\t\x12\x1c\n\x14platform_patch_level\x18\x03 \x01(\t\"\x86\x01\n\x08Software\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x0f\n\x07version\x18\x02 \x01(\t\x12\x31\n\x0bpermissions\x18\x03 \x03(\x0b\x32\x1c.google.backstory.Permission\x12\x13\n\x0b\x64\x65scription\x18\x04 \x01(\t\x12\x13\n\x0bvendor_name\x18\x05 \x01(\t\"\x9c\n\n\x05\x41sset\x12\x19\n\x11product_object_id\x18\x01 \x01(\t\x12\x10\n\x08hostname\x18\x02 \x01(\t\x12\x10\n\x08\x61sset_id\x18\x03 \x01(\t\x12\n\n\x02ip\x18\x04 \x03(\t\x12\x0b\n\x03mac\x18\x05 \x03(\t\x12\x0e\n\x06nat_ip\x18\x16 \x03(\t\x12\x33\n\x0f\x66irst_seen_time\x18\x17 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12,\n\x08hardware\x18\x06 \x03(\x0b\x32\x1a.google.backstory.Hardware\x12=\n\x11platform_software\x18\x07 \x01(\x0b\x32\".google.backstory.PlatformSoftware\x12,\n\x08software\x18\x11 \x03(\x0b\x32\x1a.google.backstory.Software\x12,\n\x08location\x18\x08 \x01(\x0b\x32\x1a.google.backstory.Location\x12\x10\n\x08\x63\x61tegory\x18\t \x01(\t\x12/\n\x04type\x18\x12 \x01(\x0e\x32!.google.backstory.Asset.AssetType\x12\x16\n\x0enetwork_domain\x18\n \x01(\t\x12\x35\n\rcreation_time\x18\x0b \x01(\x0b\x32\x1a.google.protobuf.TimestampB\x02\x18\x01\x12\x37\n\x13\x66irst_discover_time\x18\x0c \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x36\n\x12last_discover_time\x18\r \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12;\n\x17system_last_update_time\x18\x0e \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x32\n\x0elast_boot_time\x18\x0f \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12+\n\x06labels\x18\x10 \x03(\x0b\x32\x17.google.backstory.LabelB\x02\x18\x01\x12\x43\n\x11\x64\x65ployment_status\x18\x13 \x01(\x0e\x32(.google.backstory.Asset.DeploymentStatus\x12\x38\n\x0fvulnerabilities\x18\x15 \x03(\x0b\x32\x1f.google.backstory.Vulnerability\x12.\n\tattribute\x18\x14 \x01(\x0b\x32\x1b.google.backstory.Attribute\x12\x42\n\x14wmi_persistence_item\x18\x18 \x01(\x0b\x32$.google.backstory.WmiPersistenceItem\"\xa9\x01\n\tAssetType\x12\x14\n\x10ROLE_UNSPECIFIED\x10\x00\x12\x0f\n\x0bWORKSTATION\x10\x01\x12\n\n\x06LAPTOP\x10\x02\x12\x07\n\x03IOT\x10\x03\x12\x1c\n\x18NETWORK_ATTACHED_STORAGE\x10\x04\x12\x0b\n\x07PRINTER\x10\x05\x12\x0b\n\x07SCANNER\x10\x06\x12\n\n\x06SERVER\x10\x07\x12\x10\n\x0cTAPE_LIBRARY\x10\x08\x12\n\n\x06MOBILE\x10\t\"m\n\x10\x44\x65ploymentStatus\x12!\n\x1d\x44\x45PLOYMENT_STATUS_UNSPECIFIED\x10\x00\x12\n\n\x06\x41\x43TIVE\x10\x01\x12\x17\n\x13PENDING_DECOMISSION\x10\x02\x12\x11\n\rDECOMISSIONED\x10\x03\"\xc5\x0c\n\x04User\x12\x19\n\x11product_object_id\x18\x07 \x01(\t\x12\x0e\n\x06userid\x18\x01 \x01(\t\x12\x19\n\x11user_display_name\x18\x03 \x01(\t\x12\x12\n\nfirst_name\x18\x64 \x01(\t\x12\x13\n\x0bmiddle_name\x18\x65 \x01(\t\x12\x11\n\tlast_name\x18\x66 \x01(\t\x12\x15\n\rphone_numbers\x18g \x03(\t\x12\x34\n\x10personal_address\x18h \x01(\x0b\x32\x1a.google.backstory.Location\x12.\n\tattribute\x18\x08 \x01(\x0b\x32\x1b.google.backstory.Attribute\x12\x33\n\x0f\x66irst_seen_time\x18\n \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x38\n\x0c\x61\x63\x63ount_type\x18\t \x01(\x0e\x32\".google.backstory.User.AccountType\x12\x13\n\x07groupid\x18\x02 \x01(\tB\x02\x18\x01\x12\x1a\n\x11group_identifiers\x18\xc8\x01 \x03(\t\x12\x13\n\x0bwindows_sid\x18\x04 \x01(\t\x12\x17\n\x0f\x65mail_addresses\x18\x05 \x03(\t\x12\x13\n\x0b\x65mployee_id\x18\x06 \x01(\t\x12\x0e\n\x05title\x18\xd9\x04 \x01(\t\x12\x15\n\x0c\x63ompany_name\x18\xda\x04 \x01(\t\x12\x13\n\ndepartment\x18\xdb\x04 \x03(\t\x12\x33\n\x0eoffice_address\x18\xdc\x04 \x01(\x0b\x32\x1a.google.backstory.Location\x12)\n\x08managers\x18\xdd\x04 \x03(\x0b\x32\x16.google.backstory.User\x12.\n\thire_date\x18\xde\x04 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x35\n\x10termination_date\x18\xdf\x04 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12,\n\x08time_off\x18\xe0\x04 \x03(\x0b\x32\x19.google.backstory.TimeOff\x12\x34\n\x0flast_login_time\x18\xe1\x04 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12>\n\x19last_password_change_time\x18\xe2\x04 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12=\n\x18password_expiration_time\x18\xe3\x04 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12<\n\x17\x61\x63\x63ount_expiration_time\x18\xe4\x04 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x39\n\x14\x61\x63\x63ount_lockout_time\x18\xe5\x04 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x43\n\x1elast_bad_password_attempt_time\x18\xe6\x04 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12Z\n\x1auser_authentication_status\x18\xbd\x05 \x01(\x0e\x32\x35.google.backstory.Authentication.AuthenticationStatus\x12\x16\n\trole_name\x18\xbe\x05 \x01(\tB\x02\x18\x01\x12\x1d\n\x10role_description\x18\xbf\x05 \x01(\tB\x02\x18\x01\x12\x33\n\tuser_role\x18\xc0\x05 \x01(\x0e\x32\x1b.google.backstory.User.RoleB\x02\x18\x01\"\xa8\x01\n\x0b\x41\x63\x63ountType\x12\x1c\n\x18\x41\x43\x43OUNT_TYPE_UNSPECIFIED\x10\x00\x12\x17\n\x13\x44OMAIN_ACCOUNT_TYPE\x10\x01\x12\x16\n\x12LOCAL_ACCOUNT_TYPE\x10\x02\x12\x16\n\x12\x43LOUD_ACCOUNT_TYPE\x10\x03\x12\x18\n\x14SERVICE_ACCOUNT_TYPE\x10\x04\x12\x18\n\x14\x44\x45\x46\x41ULT_ACCOUNT_TYPE\x10\x05\"D\n\x04Role\x12\x10\n\x0cUNKNOWN_ROLE\x10\x00\x12\x11\n\rADMINISTRATOR\x10\x01\x12\x17\n\x0fSERVICE_ACCOUNT\x10\x02\x1a\x02\x08\x01\"G\n\x07TimeOff\x12\'\n\x08interval\x18\x01 \x01(\x0b\x32\x15.google.type.Interval\x12\x13\n\x0b\x64\x65scription\x18\x02 \x01(\t\"\xd9\x01\n\nPermission\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x13\n\x0b\x64\x65scription\x18\x02 \x01(\t\x12\x39\n\x04type\x18\x03 \x01(\x0e\x32+.google.backstory.Permission.PermissionType\"m\n\x0ePermissionType\x12\x1b\n\x17UNKNOWN_PERMISSION_TYPE\x10\x00\x12\x0f\n\x0b\x41\x44MIN_WRITE\x10\x01\x12\x0e\n\nADMIN_READ\x10\x02\x12\x0e\n\nDATA_WRITE\x10\x03\x12\r\n\tDATA_READ\x10\x04\"\x9a\x01\n\x04Role\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x13\n\x0b\x64\x65scription\x18\x02 \x01(\t\x12)\n\x04type\x18\x03 \x01(\x0e\x32\x1b.google.backstory.Role.Type\"D\n\x04Type\x12\x14\n\x10TYPE_UNSPECIFIED\x10\x00\x12\x11\n\rADMINISTRATOR\x10\x01\x12\x13\n\x0fSERVICE_ACCOUNT\x10\x02\"\xd3\x01\n\x05Group\x12\x19\n\x11product_object_id\x18\x01 \x01(\t\x12\x35\n\rcreation_time\x18\x64 \x01(\x0b\x32\x1a.google.protobuf.TimestampB\x02\x18\x01\x12\x1a\n\x12group_display_name\x18\x65 \x01(\t\x12.\n\tattribute\x18\x04 \x01(\x0b\x32\x1b.google.backstory.Attribute\x12\x17\n\x0f\x65mail_addresses\x18\x02 \x03(\t\x12\x13\n\x0bwindows_sid\x18\x03 \x01(\t\"\x91\x03\n\x08Registry\x12\x14\n\x0cregistry_key\x18\x01 \x01(\t\x12\x1b\n\x13registry_value_name\x18\x02 \x01(\t\x12\x1b\n\x13registry_value_data\x18\x03 \x01(\t\x12<\n\x13registry_value_type\x18\x04 \x01(\x0e\x32\x1f.google.backstory.Registry.Type\x12\"\n\x1aregistry_value_binary_data\x18\x05 \x01(\x0c\"\xd2\x01\n\x04Type\x12\x14\n\x10TYPE_UNSPECIFIED\x10\x00\x12\x08\n\x04NONE\x10\x01\x12\x06\n\x02SZ\x10\x02\x12\r\n\tEXPAND_SZ\x10\x03\x12\n\n\x06\x42INARY\x10\x04\x12\t\n\x05\x44WORD\x10\x05\x12\x17\n\x13\x44WORD_LITTLE_ENDIAN\x10\x06\x12\x14\n\x10\x44WORD_BIG_ENDIAN\x10\x07\x12\x08\n\x04LINK\x10\x08\x12\x0c\n\x08MULTI_SZ\x10\t\x12\x11\n\rRESOURCE_LIST\x10\n\x12\t\n\x05QWORD\x10\x0b\x12\x17\n\x13QWORD_LITTLE_ENDIAN\x10\x0c\"\xd1\x01\n\x12WmiPersistenceItem\x12\x0f\n\x07\x63\x61ption\x18\x01 \x01(\t\x12\x0c\n\x04name\x18\x02 \x01(\t\x12\x12\n\nsetting_id\x18\x03 \x01(\t\x12\x12\n\nderivation\x18\x04 \x01(\t\x12\x16\n\x0eproperty_count\x18\x05 \x01(\x03\x12\x10\n\x08rel_path\x18\x06 \x01(\t\x12\x0f\n\x07\x64ynasty\x18\x07 \x01(\t\x12\x17\n\x0fwmi_super_class\x18\x08 \x01(\t\x12\x11\n\twmi_class\x18\t \x01(\t\x12\r\n\x05genus\x18\n \x01(\x03\"\xe3\x01\n\x08Location\x12\x0c\n\x04\x63ity\x18\x01 \x01(\t\x12\r\n\x05state\x18\x02 \x01(\t\x12\x19\n\x11\x63ountry_or_region\x18\x03 \x01(\t\x12\x0c\n\x04name\x18\x04 \x01(\t\x12\x11\n\tdesk_name\x18\x05 \x01(\t\x12\x12\n\nfloor_name\x18\x06 \x01(\t\x12\x1b\n\x0fregion_latitude\x18\x07 \x01(\x02\x42\x02\x18\x01\x12\x1c\n\x10region_longitude\x18\x08 \x01(\x02\x42\x02\x18\x01\x12/\n\x12region_coordinates\x18\t \x01(\x0b\x32\x13.google.type.LatLng\"\x86\x01\n\rScheduledTask\x12\x0e\n\x06minute\x18\x01 \x01(\x05\x12\x0c\n\x04hour\x18\x02 \x01(\x05\x12\x11\n\tmonth_day\x18\x03 \x01(\x05\x12\r\n\x05month\x18\x04 \x01(\x05\x12\x10\n\x08week_day\x18\x05 \x01(\x05\x12\x0f\n\x07\x63omment\x18\x06 \x01(\t\x12\x0e\n\x06\x61uthor\x18\x07 \x01(\t:\x02\x18\x01\"\xa6\n\n\x14WindowsScheduledTask\x12\x0e\n\x06\x61uthor\x18\x01 \x01(\t\x12\x14\n\x0cvirtual_path\x18\x02 \x01(\t\x12\x11\n\texit_code\x18\x03 \x01(\x05\x12?\n\x05state\x18\x04 \x01(\x0e\x32\x30.google.backstory.WindowsScheduledTask.TaskState\x12H\n\nlogon_type\x18\x05 \x01(\x0e\x32\x34.google.backstory.WindowsScheduledTask.TaskLogonType\x12G\n\x0ctask_actions\x18\x06 \x03(\x0b\x32\x31.google.backstory.WindowsScheduledTask.TaskAction\x12I\n\rtask_triggers\x18\x07 \x03(\x0b\x32\x32.google.backstory.WindowsScheduledTask.TaskTrigger\x1a\xa7\x02\n\nTaskAction\x12Q\n\x0b\x61\x63tion_type\x18\x01 \x01(\x0e\x32<.google.backstory.WindowsScheduledTask.TaskAction.ActionType\x12\x16\n\x0e\x65xec_arguments\x18\x02 \x03(\t\x12\x1e\n\x16\x65xec_working_directory\x18\x03 \x01(\t\x12\x14\n\x0c\x63om_class_id\x18\x04 \x01(\t\x12\x10\n\x08\x63om_data\x18\x05 \x01(\t\"f\n\nActionType\x12\x1b\n\x17\x41\x43TION_TYPE_UNSPECIFIED\x10\x00\x12\x08\n\x04\x45XEC\x10\x01\x12\x0f\n\x0b\x43OM_HANDLER\x10\x02\x12\x0e\n\nSEND_EMAIL\x10\x03\x12\x10\n\x0cSHOW_MESSAGE\x10\x04\x1a\x8b\x03\n\x0bTaskTrigger\x12\x0f\n\x07\x65nabled\x18\x01 \x01(\x08\x12+\n\x08\x64uration\x18\x02 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x10\n\x08interval\x18\x03 \x01(\t\x12T\n\x0ctrigger_type\x18\x04 \x01(\x0e\x32>.google.backstory.WindowsScheduledTask.TaskTrigger.TriggerType\"\xd5\x01\n\x0bTriggerType\x12\x1c\n\x18TRIGGER_TYPE_UNSPECIFIED\x10\x00\x12\t\n\x05\x45VENT\x10\x01\x12\x08\n\x04TIME\x10\x02\x12\t\n\x05\x44\x41ILY\x10\x03\x12\n\n\x06WEEKLY\x10\x04\x12\x0b\n\x07MONTHLY\x10\x05\x12\x0e\n\nMONTHLYDOW\x10\x06\x12\x08\n\x04IDLE\x10\x07\x12\x10\n\x0cREGISTRATION\x10\x08\x12\x08\n\x04\x42OOT\x10\t\x12\t\n\x05LOGON\x10\n\x12\x18\n\x14SESSION_STATE_CHANGE\x10\x0b\x12\x14\n\x10\x43USTOM_TRIGGER01\x10\x0c\"Z\n\tTaskState\x12\x1a\n\x16TASK_STATE_UNSPECIFIED\x10\x00\x12\x0c\n\x08\x44ISABLED\x10\x01\x12\n\n\x06QUEUED\x10\x02\x12\n\n\x06\x41\x43TIVE\x10\x03\x12\x0b\n\x07RUNNING\x10\x04\"\xa1\x01\n\rTaskLogonType\x12\x1f\n\x1bTASK_LOGON_TYPE_UNSPECIFIED\x10\x00\x12\x0c\n\x08PASSWORD\x10\x01\x12\x07\n\x03S4U\x10\x02\x12\x15\n\x11INTERACTIVE_TOKEN\x10\x03\x12\t\n\x05GROUP\x10\x04\x12\x13\n\x0fSERVICE_ACCOUNT\x10\x05\x12!\n\x1dINTERACTIVE_TOKEN_OR_PASSWORD\x10\x06\"\xa3\x01\n\x11ScheduledCronTask\x12\x0e\n\x06minute\x18\x01 \x01(\t\x12\x0c\n\x04hour\x18\x02 \x01(\t\x12\x11\n\tmonth_day\x18\x03 \x01(\t\x12\r\n\x05month\x18\x04 \x01(\t\x12\x10\n\x08week_day\x18\x05 \x01(\t\x12\x0f\n\x07\x63omment\x18\x06 \x01(\t\x12\x0e\n\x06\x61uthor\x18\x07 \x01(\t\x12\r\n\x05\x65vent\x18\x08 \x01(\t\x12\x0c\n\x04path\x18\t \x01(\t\"p\n\x14ScheduledAnacronTask\x12\x0e\n\x06period\x18\x01 \x01(\t\x12\x15\n\rdelay_minutes\x18\x02 \x01(\x03\x12\x0e\n\x06job_id\x18\x03 \x01(\t\x12\x0c\n\x04path\x18\x04 \x01(\t\x12\x13\n\x0bsource_line\x18\x05 \x01(\t\"\x7f\n\x06Volume\x12\x13\n\x0b\x66ile_system\x18\x01 \x01(\t\x12\x13\n\x0bmount_point\x18\x02 \x01(\t\x12\x13\n\x0b\x64\x65vice_path\x18\x03 \x01(\t\x12\x12\n\nis_mounted\x18\x04 \x01(\x08\x12\x14\n\x0cis_read_only\x18\x05 \x01(\x08\x12\x0c\n\x04name\x18\x06 \x01(\t\"\xcb\x05\n\x07Service\x12\x14\n\x0c\x64isplay_name\x18\x01 \x01(\t\x12?\n\x0cservice_type\x18\x03 \x01(\x0e\x32%.google.backstory.Service.ServiceTypeB\x02\x18\x01\x12<\n\rservice_types\x18\x06 \x03(\x0e\x32%.google.backstory.Service.ServiceType\x12;\n\x0cstartup_type\x18\x04 \x01(\x0e\x32%.google.backstory.Service.StartupType\x12.\n\x05state\x18\x05 \x01(\x0e\x32\x1f.google.backstory.Service.State\"\xc3\x01\n\x0bServiceType\x12\x1c\n\x18SERVICE_TYPE_UNSPECIFIED\x10\x00\x12\x11\n\rKERNEL_DRIVER\x10\x01\x12\x16\n\x12\x46ILE_SYSTEM_DRIVER\x10\x02\x12\x15\n\x11WIN32_OWN_PROCESS\x10\x03\x12\x17\n\x13WIN32_SHARE_PROCESS\x10\x04\x12\x0b\n\x07\x41\x44\x41PTER\x10\x05\x12\x15\n\x11RECOGNIZER_DRIVER\x10\x06\x12\x17\n\x13INTERACTIVE_PROCESS\x10\x07\"T\n\x0bStartupType\x12\x1c\n\x18STARTUP_TYPE_UNSPECIFIED\x10\x00\x12\r\n\tAUTOMATIC\x10\x01\x12\n\n\x06MANUAL\x10\x02\x12\x0c\n\x08\x44ISABLED\x10\x03\"\xa1\x01\n\x05State\x12\x15\n\x11STATE_UNSPECIFIED\x10\x00\x12\x0b\n\x07RUNNING\x10\x01\x12\x0b\n\x07STOPPED\x10\x02\x12\n\n\x06PAUSED\x10\x03\x12\r\n\tCOMPLETED\x10\x04\x12\x11\n\rSTART_PENDING\x10\x05\x12\x10\n\x0cSTOP_PENDING\x10\x06\x12\x11\n\rPAUSE_PENDING\x10\x07\x12\x14\n\x10\x43ONTINUE_PENDING\x10\x08\"\x97\t\n\x08Resource\x12\x10\n\x04type\x18\x01 \x01(\tB\x02\x18\x01\x12>\n\rresource_type\x18\x05 \x01(\x0e\x32\'.google.backstory.Resource.ResourceType\x12\x18\n\x10resource_subtype\x18\x06 \x01(\t\x12\x0e\n\x02id\x18\x02 \x01(\tB\x02\x18\x01\x12\x0c\n\x04name\x18\x03 \x01(\t\x12\x12\n\x06parent\x18\x04 \x01(\tB\x02\x18\x01\x12\x19\n\x11product_object_id\x18\x08 \x01(\t\x12.\n\tattribute\x18\x07 \x01(\x0b\x32\x1b.google.backstory.Attribute\x12;\n\x0escheduled_task\x18\t \x01(\x0b\x32\x1f.google.backstory.ScheduledTaskB\x02\x18\x01\x12@\n\x13scheduled_cron_task\x18\x0c \x01(\x0b\x32#.google.backstory.ScheduledCronTask\x12\x46\n\x16scheduled_anacron_task\x18\r \x01(\x0b\x32&.google.backstory.ScheduledAnacronTask\x12\x46\n\x16windows_scheduled_task\x18\x0e \x01(\x0b\x32&.google.backstory.WindowsScheduledTask\x12(\n\x06volume\x18\n \x01(\x0b\x32\x18.google.backstory.Volume\x12*\n\x07service\x18\x0b \x01(\x0b\x32\x19.google.backstory.Service\"\xbc\x04\n\x0cResourceType\x12\x0f\n\x0bUNSPECIFIED\x10\x00\x12\t\n\x05MUTEX\x10\x01\x12\x08\n\x04TASK\x10\x02\x12\x08\n\x04PIPE\x10\x03\x12\n\n\x06\x44\x45VICE\x10\x04\x12\x11\n\rFIREWALL_RULE\x10\x05\x12\x12\n\x0eMAILBOX_FOLDER\x10\x06\x12\x0f\n\x0bVPC_NETWORK\x10\x07\x12\x13\n\x0fVIRTUAL_MACHINE\x10\x08\x12\x12\n\x0eSTORAGE_BUCKET\x10\t\x12\x12\n\x0eSTORAGE_OBJECT\x10\n\x12\x0c\n\x08\x44\x41TABASE\x10\x0b\x12\t\n\x05TABLE\x10\x0c\x12\x11\n\rCLOUD_PROJECT\x10\r\x12\x16\n\x12\x43LOUD_ORGANIZATION\x10\x0e\x12\x13\n\x0fSERVICE_ACCOUNT\x10\x0f\x12\x11\n\rACCESS_POLICY\x10\x10\x12\x0b\n\x07\x43LUSTER\x10\x11\x12\x0b\n\x07SETTING\x10\x12\x12\x0b\n\x07\x44\x41TASET\x10\x13\x12\x13\n\x0f\x42\x41\x43KEND_SERVICE\x10\x14\x12\x07\n\x03POD\x10\x15\x12\r\n\tCONTAINER\x10\x16\x12\x0c\n\x08\x46UNCTION\x10\x17\x12\x0b\n\x07RUNTIME\x10\x18\x12\x0e\n\nIP_ADDRESS\x10\x19\x12\x08\n\x04\x44ISK\x10\x1a\x12\n\n\x06VOLUME\x10\x1b\x12\t\n\x05IMAGE\x10\x1c\x12\x0c\n\x08SNAPSHOT\x10\x1d\x12\x0e\n\nREPOSITORY\x10\x1e\x12\x0e\n\nCREDENTIAL\x10\x1f\x12\x11\n\rLOAD_BALANCER\x10 \x12\x0b\n\x07GATEWAY\x10!\x12\n\n\x06SUBNET\x10\"\x12\x08\n\x04USER\x10#\x12\x0b\n\x07SERVICE\x10$\"I\n\x05Label\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t\x12\x0e\n\x06source\x18\x03 \x01(\t\x12\x14\n\x0crbac_enabled\x18\x04 \x01(\x08\"\xbf\x02\n\x05\x43loud\x12=\n\x0b\x65nvironment\x18\x01 \x01(\x0e\x32(.google.backstory.Cloud.CloudEnvironment\x12+\n\x03vpc\x18\x02 \x01(\x0b\x32\x1a.google.backstory.ResourceB\x02\x18\x01\x12/\n\x07project\x18\x03 \x01(\x0b\x32\x1a.google.backstory.ResourceB\x02\x18\x01\x12\x19\n\x11\x61vailability_zone\x18\x04 \x01(\t\"~\n\x10\x43loudEnvironment\x12!\n\x1dUNSPECIFIED_CLOUD_ENVIRONMENT\x10\x00\x12\x19\n\x15GOOGLE_CLOUD_PLATFORM\x10\x01\x12\x17\n\x13\x41MAZON_WEB_SERVICES\x10\x02\x12\x13\n\x0fMICROSOFT_AZURE\x10\x03\"\xb5\x05\n\x08\x41rtifact\x12\n\n\x02ip\x18\x01 \x01(\t\x12\x30\n\nprevalence\x18\x02 \x01(\x0b\x32\x1c.google.backstory.Prevalence\x12\x33\n\x0f\x66irst_seen_time\x18\x03 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x32\n\x0elast_seen_time\x18\x04 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12,\n\x08location\x18\x05 \x01(\x0b\x32\x1a.google.backstory.Location\x12*\n\x07network\x18\x06 \x01(\x0b\x32\x19.google.backstory.Network\x12\x10\n\x08\x61s_owner\x18\x07 \x01(\t\x12\x0b\n\x03\x61sn\x18\x08 \x01(\x03\x12\x0c\n\x04jarm\x18\t \x01(\t\x12@\n\x16last_https_certificate\x18\n \x01(\x0b\x32 .google.backstory.SSLCertificate\x12?\n\x1blast_https_certificate_date\x18\x0b \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\"\n\x1aregional_internet_registry\x18\x0c \x01(\t\x12\x0c\n\x04tags\x18\r \x03(\t\x12\r\n\x05whois\x18\x0e \x01(\t\x12.\n\nwhois_date\x18\x0f \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12*\n\x07tunnels\x18\x10 \x03(\x0b\x32\x19.google.backstory.Tunnels\x12\x11\n\tanonymous\x18\x11 \x01(\x08\x12\x39\n\x0f\x61rtifact_client\x18\x12 \x01(\x0b\x32 .google.backstory.ArtifactClient\x12\r\n\x05risks\x18\x13 \x03(\t\")\n\x07Tunnels\x12\x10\n\x08provider\x18\x01 \x01(\t\x12\x0c\n\x04type\x18\x02 \x01(\t\"4\n\x0e\x41rtifactClient\x12\x11\n\tbehaviors\x18\x01 \x03(\t\x12\x0f\n\x07proxies\x18\x02 \x03(\t\")\n\x07\x46\x61vicon\x12\x0f\n\x07raw_md5\x18\x01 \x01(\t\x12\r\n\x05\x64hash\x18\x02 \x01(\t\"\x93\x02\n\tDNSRecord\x12\x0c\n\x04type\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t\x12&\n\x03ttl\x18\x03 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x10\n\x08priority\x18\x04 \x01(\x03\x12\r\n\x05retry\x18\x05 \x01(\x03\x12*\n\x07refresh\x18\x06 \x01(\x0b\x32\x19.google.protobuf.Duration\x12*\n\x07minimum\x18\x07 \x01(\x0b\x32\x19.google.protobuf.Duration\x12)\n\x06\x65xpire\x18\x08 \x01(\x0b\x32\x19.google.protobuf.Duration\x12\x0e\n\x06serial\x18\t \x01(\x03\x12\r\n\x05rname\x18\n \x01(\t\"\x8c\r\n\x0eSSLCertificate\x12\x46\n\x0e\x63\x65rt_signature\x18\x01 \x01(\x0b\x32..google.backstory.SSLCertificate.CertSignature\x12\x41\n\textension\x18\x02 \x01(\x0b\x32*.google.backstory.SSLCertificate.ExtensionB\x02\x18\x01\x12\x30\n\x0f\x63\x65rt_extensions\x18\x0e \x01(\x0b\x32\x17.google.protobuf.Struct\x12\x33\n\x0f\x66irst_seen_time\x18\x03 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x38\n\x06issuer\x18\x04 \x01(\x0b\x32(.google.backstory.SSLCertificate.Subject\x12/\n\x02\x65\x63\x18\x05 \x01(\x0b\x32#.google.backstory.SSLCertificate.EC\x12\x15\n\rserial_number\x18\x06 \x01(\t\x12\x1b\n\x13signature_algorithm\x18\x07 \x01(\t\x12\x0c\n\x04size\x18\x08 \x01(\x03\x12\x39\n\x07subject\x18\t \x01(\x0b\x32(.google.backstory.SSLCertificate.Subject\x12\x12\n\nthumbprint\x18\n \x01(\t\x12\x19\n\x11thumbprint_sha256\x18\x0b \x01(\t\x12;\n\x08validity\x18\x0c \x01(\x0b\x32).google.backstory.SSLCertificate.Validity\x12\x0f\n\x07version\x18\r \x01(\t\x12>\n\npublic_key\x18\x0f \x01(\x0b\x32*.google.backstory.SSLCertificate.PublicKey\x1a?\n\rCertSignature\x12\x11\n\tsignature\x18\x01 \x01(\t\x12\x1b\n\x13signature_algorithm\x18\x02 \x01(\t\x1a\x36\n\x0e\x41uthorityKeyId\x12\r\n\x05keyid\x18\x01 \x01(\t\x12\x15\n\rserial_number\x18\x02 \x01(\t\x1a\xb1\x03\n\tExtension\x12\n\n\x02\x63\x61\x18\x01 \x01(\x08\x12\x16\n\x0esubject_key_id\x18\x02 \x01(\t\x12I\n\x10\x61uthority_key_id\x18\x03 \x01(\x0b\x32/.google.backstory.SSLCertificate.AuthorityKeyId\x12\x11\n\tkey_usage\x18\x06 \x01(\t\x12\x16\n\x0e\x63\x61_info_access\x18\x07 \x01(\t\x12\x1f\n\x17\x63rl_distribution_points\x18\x08 \x01(\t\x12\x1a\n\x12\x65xtended_key_usage\x18\t \x01(\t\x12 \n\x18subject_alternative_name\x18\n \x01(\t\x12\x1c\n\x14\x63\x65rtificate_policies\x18\x0b \x01(\t\x12\x1d\n\x15netscape_cert_comment\x18\x0c \x01(\t\x12\x1d\n\x15\x63\x65rt_template_name_dc\x18\r \x01(\t\x12\x1c\n\x14netscape_certificate\x18\x0e \x01(\x08\x12\x13\n\x0bpe_logotype\x18\x0f \x01(\x08\x12\x1c\n\x14old_authority_key_id\x18\x10 \x01(\x08\x1a\x99\x01\n\x07Subject\x12\x14\n\x0c\x63ountry_name\x18\x01 \x01(\t\x12\x13\n\x0b\x63ommon_name\x18\x02 \x01(\t\x12\x10\n\x08locality\x18\x03 \x01(\t\x12\x14\n\x0corganization\x18\x04 \x01(\t\x12\x1b\n\x13organizational_unit\x18\x05 \x01(\t\x12\x1e\n\x16state_or_province_name\x18\x06 \x01(\t\x1a:\n\x03RSA\x12\x10\n\x08key_size\x18\x01 \x01(\x03\x12\x0f\n\x07modulus\x18\x02 \x01(\t\x12\x10\n\x08\x65xponent\x18\x03 \x01(\t\x1a\x1e\n\x02\x45\x43\x12\x0b\n\x03oid\x18\x01 \x01(\t\x12\x0b\n\x03pub\x18\x02 \x01(\t\x1aQ\n\tPublicKey\x12\x11\n\talgorithm\x18\x01 \x01(\t\x12\x31\n\x03rsa\x18\x02 \x01(\x0b\x32$.google.backstory.SSLCertificate.RSA\x1ak\n\x08Validity\x12/\n\x0b\x65xpiry_time\x18\x01 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12.\n\nissue_time\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\"a\n\x0ePopularityRank\x12\r\n\x05giver\x18\x01 \x01(\t\x12\x0c\n\x04rank\x18\x02 \x01(\x03\x12\x32\n\x0eingestion_time\x18\x03 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\"b\n\x07Tracker\x12\x0f\n\x07tracker\x18\x01 \x01(\t\x12\n\n\x02id\x18\x02 \x01(\t\x12-\n\ttimestamp\x18\x03 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x0b\n\x03url\x18\x04 \x01(\t\"\xd1\x03\n\x03Url\x12\x0b\n\x03url\x18\x01 \x01(\t\x12\x12\n\ncategories\x18\x02 \x03(\t\x12*\n\x07\x66\x61vicon\x18\x03 \x01(\x0b\x32\x19.google.backstory.Favicon\x12*\n\thtml_meta\x18\x04 \x01(\x0b\x32\x17.google.protobuf.Struct\x12\x16\n\x0elast_final_url\x18\x05 \x01(\t\x12\x1f\n\x17last_http_response_code\x18\x06 \x01(\x05\x12)\n!last_http_response_content_length\x18\x07 \x01(\x03\x12)\n!last_http_response_content_sha256\x18\x08 \x01(\t\x12;\n\x1alast_http_response_cookies\x18\t \x01(\x0b\x32\x17.google.protobuf.Struct\x12;\n\x1alast_http_response_headers\x18\n \x01(\x0b\x32\x17.google.protobuf.Struct\x12\x0c\n\x04tags\x18\x0b \x03(\t\x12\r\n\x05title\x18\x0c \x01(\t\x12+\n\x08trackers\x18\r \x03(\x0b\x32\x19.google.backstory.Tracker\"\xe3\t\n\x06\x44omain\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x30\n\nprevalence\x18\x02 \x01(\x0b\x32\x1c.google.backstory.Prevalence\x12\x33\n\x0f\x66irst_seen_time\x18\x03 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x32\n\x0elast_seen_time\x18\x04 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x11\n\tregistrar\x18\x05 \x01(\t\x12\x15\n\rcontact_email\x18\x06 \x01(\t\x12\x14\n\x0cwhois_server\x18\x07 \x01(\t\x12\x13\n\x0bname_server\x18\x08 \x03(\t\x12\x31\n\rcreation_time\x18\t \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12/\n\x0bupdate_time\x18\n \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x33\n\x0f\x65xpiration_time\x18\x0b \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x35\n\x11\x61udit_update_time\x18\x0c \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x0e\n\x06status\x18\r \x01(\t\x12*\n\nregistrant\x18\x0e \x01(\x0b\x32\x16.google.backstory.User\x12%\n\x05\x61\x64min\x18\x0f \x01(\x0b\x32\x16.google.backstory.User\x12$\n\x04tech\x18\x10 \x01(\x0b\x32\x16.google.backstory.User\x12\'\n\x07\x62illing\x18\x11 \x01(\x0b\x32\x16.google.backstory.User\x12$\n\x04zone\x18\x12 \x01(\x0b\x32\x16.google.backstory.User\x12\x1d\n\x15whois_record_raw_text\x18\x13 \x01(\x0c\x12\x1e\n\x16registry_data_raw_text\x18\x14 \x01(\x0c\x12\x19\n\x11iana_registrar_id\x18\x15 \x01(\x05\x12\x1c\n\x14private_registration\x18\x16 \x01(\x08\x12\x12\n\ncategories\x18\x17 \x03(\t\x12*\n\x07\x66\x61vicon\x18\x18 \x01(\x0b\x32\x19.google.backstory.Favicon\x12\x0c\n\x04jarm\x18\x19 \x01(\t\x12\x35\n\x10last_dns_records\x18\x1a \x03(\x0b\x32\x1b.google.backstory.DNSRecord\x12\x39\n\x15last_dns_records_time\x18\x1b \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12@\n\x16last_https_certificate\x18\x1c \x01(\x0b\x32 .google.backstory.SSLCertificate\x12?\n\x1blast_https_certificate_time\x18\x1d \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12:\n\x10popularity_ranks\x18\x1e \x03(\x0b\x32 .google.backstory.PopularityRank\x12\x0c\n\x04tags\x18\x1f \x03(\t\x12.\n\nwhois_time\x18  \x01(\x0b\x32\x1a.google.protobuf.Timestamp\"\x8d\x0c\n\x04Noun\x12\x10\n\x08hostname\x18\x01 \x01(\t\x12(\n\x06\x64omain\x18\x1e \x01(\x0b\x32\x18.google.backstory.Domain\x12,\n\x08\x61rtifact\x18  \x01(\x0b\x32\x1a.google.backstory.Artifact\x12+\n\x0curl_metadata\x18% \x01(\x0b\x32\x15.google.backstory.Url\x12*\n\x07\x62rowser\x18& \x01(\x0b\x32\x19.google.backstory.Browser\x12\x10\n\x08\x61sset_id\x18\x02 \x01(\t\x12$\n\x04user\x18\x03 \x01(\x0b\x32\x16.google.backstory.User\x12\x35\n\x15user_management_chain\x18\x1d \x03(\x0b\x32\x16.google.backstory.User\x12&\n\x05group\x18\x14 \x01(\x0b\x32\x17.google.backstory.Group\x12*\n\x07process\x18\x04 \x01(\x0b\x32\x19.google.backstory.Process\x12\x34\n\x11process_ancestors\x18\x1c \x03(\x0b\x32\x19.google.backstory.Process\x12&\n\x05\x61sset\x18\x1b \x01(\x0b\x32\x17.google.backstory.Asset\x12\n\n\x02ip\x18\x06 \x03(\t\x12\x0e\n\x06nat_ip\x18\x15 \x03(\t\x12\x0c\n\x04port\x18\x07 \x01(\x05\x12\x10\n\x08nat_port\x18\x16 \x01(\x05\x12\x0b\n\x03mac\x18\x08 \x03(\t\x12\x1d\n\x15\x61\x64ministrative_domain\x18\t \x01(\t\x12\x11\n\tnamespace\x18\x13 \x01(\t\x12\x0b\n\x03url\x18\n \x01(\t\x12$\n\x04\x66ile\x18\x0b \x01(\x0b\x32\x16.google.backstory.File\x12\r\n\x05\x65mail\x18\x0c \x01(\t\x12,\n\x08registry\x18\r \x01(\x0b\x32\x1a.google.backstory.Registry\x12\x13\n\x0b\x61pplication\x18\x0e \x01(\t\x12\x31\n\x08platform\x18\x05 \x01(\x0e\x32\x1f.google.backstory.Noun.Platform\x12\x18\n\x10platform_version\x18\x0f \x01(\t\x12\x1c\n\x14platform_patch_level\x18\x10 \x01(\t\x12*\n\x05\x63loud\x18\x18 \x01(\x0b\x32\x17.google.backstory.CloudB\x02\x18\x01\x12,\n\x08location\x18\x11 \x01(\x0b\x32\x1a.google.backstory.Location\x12\x33\n\x0bip_location\x18\" \x03(\x0b\x32\x1a.google.backstory.LocationB\x02\x18\x01\x12\x33\n\x0fip_geo_artifact\x18# \x03(\x0b\x32\x1a.google.backstory.Artifact\x12,\n\x08resource\x18\x12 \x01(\x0b\x32\x1a.google.backstory.Resource\x12\x36\n\x12resource_ancestors\x18\x1f \x03(\x0b\x32\x1a.google.backstory.Resource\x12+\n\x06labels\x18\x17 \x03(\x0b\x32\x17.google.backstory.LabelB\x02\x18\x01\x12.\n\x10object_reference\x18\x19 \x01(\x0b\x32\x14.google.backstory.Id\x12\x36\n\rinvestigation\x18\x1a \x01(\x0b\x32\x1f.google.backstory.Investigation\x12*\n\x07network\x18! \x01(\x0b\x32\x19.google.backstory.Network\x12\x39\n\x0fsecurity_result\x18$ \x03(\x0b\x32 .google.backstory.SecurityResult\"\x8f\x01\n\x08Platform\x12\x14\n\x10UNKNOWN_PLATFORM\x10\x00\x12\x0b\n\x07WINDOWS\x10\x01\x12\x07\n\x03MAC\x10\x02\x12\t\n\x05LINUX\x10\x03\x12\x0b\n\x03GCP\x10\x04\x1a\x02\x08\x01\x12\x0b\n\x03\x41WS\x10\x05\x1a\x02\x08\x01\x12\r\n\x05\x41ZURE\x10\x06\x1a\x02\x08\x01\x12\x07\n\x03IOS\x10\x07\x12\x0b\n\x07\x41NDROID\x10\x08\x12\r\n\tCHROME_OS\x10\t\"\xf0\x03\n\rInvestigation\x12/\n\x07verdict\x18\x02 \x01(\x0e\x32\x19.google.backstory.VerdictH\x00\x88\x01\x01\x12\x35\n\nreputation\x18\x03 \x01(\x0e\x32\x1c.google.backstory.ReputationH\x01\x88\x01\x01\x12\x1b\n\x0eseverity_score\x18\x04 \x01(\rH\x02\x88\x01\x01\x12-\n\x06status\x18\x05 \x01(\x0e\x32\x18.google.backstory.StatusH\x03\x88\x01\x01\x12\x10\n\x08\x63omments\x18\x06 \x03(\t\x12\x31\n\x08priority\x18\x07 \x01(\x0e\x32\x1a.google.backstory.PriorityH\x04\x88\x01\x01\x12\x17\n\nroot_cause\x18\x08 \x01(\tH\x05\x88\x01\x01\x12-\n\x06reason\x18\t \x01(\x0e\x32\x18.google.backstory.ReasonH\x06\x88\x01\x01\x12\x17\n\nrisk_score\x18\n \x01(\rH\x07\x88\x01\x01\x12\x0f\n\x02id\x18\x0b \x01(\tH\x08\x88\x01\x01\x42\n\n\x08_verdictB\r\n\x0b_reputationB\x11\n\x0f_severity_scoreB\t\n\x07_statusB\x0b\n\t_priorityB\r\n\x0b_root_causeB\t\n\x07_reasonB\r\n\x0b_risk_scoreB\x05\n\x03_id\"7\n\x04Tags\x12\x11\n\ttenant_id\x18\x01 \x03(\x0c\x12\x1c\n\x14\x64\x61ta_tap_config_name\x18\x02 \x03(\t\"\x97\x02\n\rAttackDetails\x12\x0f\n\x07version\x18\x01 \x01(\t\x12\x37\n\x07tactics\x18\x02 \x03(\x0b\x32&.google.backstory.AttackDetails.Tactic\x12=\n\ntechniques\x18\x03 \x03(\x0b\x32).google.backstory.AttackDetails.Technique\x1a\"\n\x06Tactic\x12\n\n\x02id\x18\x01 \x01(\t\x12\x0c\n\x04name\x18\x02 \x01(\t\x1aY\n\tTechnique\x12\n\n\x02id\x18\x01 \x01(\t\x12\x0c\n\x04name\x18\x02 \x01(\t\x12\x17\n\x0fsubtechnique_id\x18\x03 \x01(\t\x12\x19\n\x11subtechnique_name\x18\x04 \x01(\t\"!\n\x0c\x42oolSequence\x12\x11\n\tbool_vals\x18\x01 \x03(\x08\"#\n\rBytesSequence\x12\x12\n\nbytes_vals\x18\x01 \x03(\x0c\"%\n\x0e\x44oubleSequence\x12\x13\n\x0b\x64ouble_vals\x18\x01 \x03(\x01\"#\n\rInt64Sequence\x12\x12\n\nint64_vals\x18\x01 \x03(\x03\"%\n\x0eUint64Sequence\x12\x13\n\x0buint64_vals\x18\x01 \x03(\x04\"%\n\x0eStringSequence\x12\x13\n\x0bstring_vals\x18\x01 \x03(\t\"\x8f\x01\n\rGroupedFields\x12\n\n\x02ip\x18\x01 \x03(\t\x12\x0e\n\x06\x64omain\x18\x02 \x03(\t\x12\x10\n\x08hostname\x18\x03 \x03(\t\x12\x0c\n\x04user\x18\x04 \x03(\t\x12\r\n\x05\x65mail\x18\x05 \x03(\t\x12\x11\n\tfile_path\x18\x06 \x03(\t\x12\x0c\n\x04hash\x18\x07 \x03(\t\x12\x12\n\nprocess_id\x18\x08 \x03(\t*I\n\x07Verdict\x12\x17\n\x13VERDICT_UNSPECIFIED\x10\x00\x12\x11\n\rTRUE_POSITIVE\x10\x01\x12\x12\n\x0e\x46\x41LSE_POSITIVE\x10\x02*D\n\nReputation\x12\x1a\n\x16REPUTATION_UNSPECIFIED\x10\x00\x12\n\n\x06USEFUL\x10\x01\x12\x0e\n\nNOT_USEFUL\x10\x02*M\n\x06Status\x12\x16\n\x12STATUS_UNSPECIFIED\x10\x00\x12\x07\n\x03NEW\x10\x01\x12\x0c\n\x08REVIEWED\x10\x02\x12\n\n\x06\x43LOSED\x10\x03\x12\x08\n\x04OPEN\x10\x04*\x8c\x01\n\x08Priority\x12\x18\n\x14PRIORITY_UNSPECIFIED\x10\x00\x12\x11\n\rPRIORITY_INFO\x10\x64\x12\x11\n\x0cPRIORITY_LOW\x10\xc8\x01\x12\x14\n\x0fPRIORITY_MEDIUM\x10\xac\x02\x12\x12\n\rPRIORITY_HIGH\x10\x90\x03\x12\x16\n\x11PRIORITY_CRITICAL\x10\xf4\x03*h\n\x06Reason\x12\x16\n\x12REASON_UNSPECIFIED\x10\x00\x12\x18\n\x14REASON_NOT_MALICIOUS\x10\x01\x12\x14\n\x10REASON_MALICIOUS\x10\x02\x12\x16\n\x12REASON_MAINTENANCE\x10\x03*^\n\rThreatVerdict\x12\x1e\n\x1aTHREAT_VERDICT_UNSPECIFIED\x10\x00\x12\x0e\n\nUNDETECTED\x10\x01\x12\x0e\n\nSUSPICIOUS\x10\x02\x12\r\n\tMALICIOUS\x10\x03\x42\x89\x01\n\x14\x63om.google.backstoryP\x01Z5cloud.google.com/go/backstory/backstorypb;backstorypb\xaa\x02\x10Google.Backstory\xca\x02\x10Google\\Backstory\xea\x02\x11Google::Backstoryb\x06proto3"
 
 pool = Google::Protobuf::DescriptorPool.generated_pool
 
@@ -262,7 +262,7 @@ module Backstory
 # import "google/type/latlng.proto";
 #
 # option csharp_namespace = "Google.Backstory";
-# option go_package = "google.golang.org/genproto/googleapis/backstory;backstory";
+# option go_package = "cloud.google.com/go/backstory/backstorypb;backstorypb";
 # option java_multiple_files = true;
 # option java_package = "com.google.backstory";
 # option php_namespace = "Google\\Backstory";
