ListDeviceEvents

This Script is part of the Chronicle Pack.

List all of the events discovered within your enterprise on a particular device within 2 hours earlier than the current time.

Script Data

---

Name	Description
Script Type	python3
Tags	enhancement
Cortex XSOAR Version	5.0.0

Dependencies

---

This script uses the following commands and scripts.

• gcb-list-events

Inputs

---

Argument Name	Description
asset_identifier	Host Name, IP Address or MAC Address of the asset.

Outputs

---

Path	Description	Type
GoogleChronicleBackstory.Events.eventType	Specifies the type of the event.	String
GoogleChronicleBackstory.Events.eventTimestamp	The GMT timestamp when the event was generated.	Date
GoogleChronicleBackstory.Events.collectedTimestamp	The GMT timestamp when the event was collected by the vendor's local collection infrastructure.	Date
GoogleChronicleBackstory.Events.description	Human-readable description of the event.	String
GoogleChronicleBackstory.Events.productEventType	Short, descriptive, human-readable, and product-specific event name or type.	String
GoogleChronicleBackstory.Events.productLogId	A vendor-specific event identifier to uniquely identify the event (a GUID). Users might use this identifier to search the vendor's proprietary console for the event in question.	String
GoogleChronicleBackstory.Events.productName	Specifies the name of the product.	String
GoogleChronicleBackstory.Events.productVersion	Specifies the version of the product.	String
GoogleChronicleBackstory.Events.urlBackToProduct	URL linking to a relevant website where you can view more information about this specific event or the general event category.	String
GoogleChronicleBackstory.Events.vendorName	Specifies the product vendor's name.	String
GoogleChronicleBackstory.Events.principal.assetId	Vendor-specific unique device identifier.	String
GoogleChronicleBackstory.Events.principal.email	Email address.	String
GoogleChronicleBackstory.Events.principal.hostname	Client hostname or domain name field.	String
GoogleChronicleBackstory.Events.principal.platform	Platform operating system.	String
GoogleChronicleBackstory.Events.principal.platformPatchLevel	Platform operating system patch level.	String
GoogleChronicleBackstory.Events.principal.platformVersion	Platform operating system version.	String
GoogleChronicleBackstory.Events.principal.ip	IP address associated with a network connection.	String
GoogleChronicleBackstory.Events.principal.port	Source or destination network port number when a specific network connection is described within an event.	String
GoogleChronicleBackstory.Events.principal.mac	MAC addresses associated with a device.	String
GoogleChronicleBackstory.Events.principal.administrativeDomain	Domain which the device belongs to (for example, the Windows domain).	String
GoogleChronicleBackstory.Events.principal.url	Standard URL.	String
GoogleChronicleBackstory.Events.principal.file.fileMetadata	Metadata associated with the file.	String
GoogleChronicleBackstory.Events.principal.file.fullPath	Full path identifying the location of the file on the system.	String
GoogleChronicleBackstory.Events.principal.file.md5	MD5 hash value of the file.	String
GoogleChronicleBackstory.Events.principal.file.mimeType	Multipurpose Internet Mail Extensions (MIME) type of the file.	String
GoogleChronicleBackstory.Events.principal.file.sha1	SHA-1 hash value of the file.	String
GoogleChronicleBackstory.Events.principal.file.sha256	SHA-256 hash value of the file.	String
GoogleChronicleBackstory.Events.principal.file.size	Size of the file.	String
GoogleChronicleBackstory.Events.principal.process.commandLine	Stores the command line string for the process.	String
GoogleChronicleBackstory.Events.principal.process.productSpecificProcessId	Stores the product specific process ID.	String
GoogleChronicleBackstory.Events.principal.process.productSpecificParentProcessId	Stores the product specific process ID for the parent process.	String
GoogleChronicleBackstory.Events.principal.process.file	Stores the file name of the file in use by the process.	String
GoogleChronicleBackstory.Events.principal.process.file.fileMetadata	Metadata associated with the file.	String
GoogleChronicleBackstory.Events.principal.process.file.fullPath	Full path identifying the location of the file on the system.	String
GoogleChronicleBackstory.Events.principal.process.file.md5	MD5 hash value of the file.	String
GoogleChronicleBackstory.Events.principal.process.file.mimeType	Multipurpose Internet Mail Extensions (MIME) type of the file.	String
GoogleChronicleBackstory.Events.principal.process.file.sha1	SHA-1 hash value of the file.	String
GoogleChronicleBackstory.Events.principal.process.file.sha256	SHA-256 hash value of the file.	String
GoogleChronicleBackstory.Events.principal.process.file.size	Size of the file.	String
GoogleChronicleBackstory.Events.principal.process.parentPid	Stores the process ID for the parent process.	String
GoogleChronicleBackstory.Events.principal.process.pid	Stores the process ID.	String
GoogleChronicleBackstory.Events.principal.registry.registryKey	Stores the registry key associated with an application or system component.	String
GoogleChronicleBackstory.Events.principal.registry.registryValueName	Stores the name of the registry value associated with an application or system component.	String
GoogleChronicleBackstory.Events.principal.registry.registryValueData	Stores the data associated with a registry value.	String
GoogleChronicleBackstory.Events.principal.user.emailAddresses	Stores the email addresses for the user.	String
GoogleChronicleBackstory.Events.principal.user.employeeId	Stores the human resources employee ID for the user.	String
GoogleChronicleBackstory.Events.principal.user.firstName	Stores the first name for the user.	String
GoogleChronicleBackstory.Events.principal.user.middleName	Stores the middle name for the user.	String
GoogleChronicleBackstory.Events.principal.user.lastName	Stores the last name for the user.	String
GoogleChronicleBackstory.Events.principal.user.groupid	Stores the group ID associated with a user.	String
GoogleChronicleBackstory.Events.principal.user.phoneNumbers	Stores the phone numbers for the user.	String
GoogleChronicleBackstory.Events.principal.user.title	Stores the job title for the user.	String
GoogleChronicleBackstory.Events.principal.user.userDisplayName	Stores the display name for the user.	String
GoogleChronicleBackstory.Events.principal.user.userid	Stores the user ID.	String
GoogleChronicleBackstory.Events.principal.user.windowsSid	Stores the Microsoft Windows security identifier (SID) associated with a user.	String
GoogleChronicleBackstory.Events.target.assetId	Vendor-specific unique device identifier.	String
GoogleChronicleBackstory.Events.target.email	Email address.	String
GoogleChronicleBackstory.Events.target.hostname	Client hostname or domain name field.	String
GoogleChronicleBackstory.Events.target.platform	Platform operating system.	String
GoogleChronicleBackstory.Events.target.platformPatchLevel	Platform operating system patch level.	String
GoogleChronicleBackstory.Events.target.platformVersion	Platform operating system version.	String
GoogleChronicleBackstory.Events.target.ip	IP address associated with a network connection.	String
GoogleChronicleBackstory.Events.target.port	Source or destination network port number when a specific network connection is described within an event.	String
GoogleChronicleBackstory.Events.target.mac	One or more MAC addresses associated with a device.	String
GoogleChronicleBackstory.Events.target.administrativeDomain	Domain which the device belongs to (for example, the Windows domain).	String
GoogleChronicleBackstory.Events.target.url	Standard URL.	String
GoogleChronicleBackstory.Events.target.file.fileMetadata	Metadata associated with the file.	String
GoogleChronicleBackstory.Events.target.file.fullPath	Full path identifying the location of the file on the system.	String
GoogleChronicleBackstory.Events.target.file.md5	MD5 hash value of the file.	String
GoogleChronicleBackstory.Events.target.file.mimeType	Multipurpose Internet Mail Extensions (MIME) type of the file.	String
GoogleChronicleBackstory.Events.target.file.sha1	SHA-1 hash value of the file.	String
GoogleChronicleBackstory.Events.target.file.sha256	SHA-256 hash value of the file.	String
GoogleChronicleBackstory.Events.target.file.size	Size of the file.	String
GoogleChronicleBackstory.Events.target.process.commandLine	Stores the command line string for the process.	String
GoogleChronicleBackstory.Events.target.process.productSpecificProcessId	Stores the product specific process ID.	String
GoogleChronicleBackstory.Events.target.process.productSpecificParentProcessId	Stores the product specific process ID for the parent process.	String
GoogleChronicleBackstory.Events.target.process.file	Stores the file name of the file in use by the process.	String
GoogleChronicleBackstory.Events.target.process.file.fileMetadata	Metadata associated with the file.	String
GoogleChronicleBackstory.Events.target.process.file.fullPath	Full path identifying the location of the file on the system.	String
GoogleChronicleBackstory.Events.target.process.file.md5	MD5 hash value of the file.	String
GoogleChronicleBackstory.Events.target.process.file.mimeType	Multipurpose Internet Mail Extensions (MIME) type of the file.	String
GoogleChronicleBackstory.Events.target.process.file.sha1	SHA-1 hash value of the file.	String
GoogleChronicleBackstory.Events.target.process.file.sha256	SHA-256 hash value of the file.	String
GoogleChronicleBackstory.Events.target.process.file.size	Size of the file.	String
GoogleChronicleBackstory.Events.target.process.parentPid	Stores the process ID for the parent process.	String
GoogleChronicleBackstory.Events.target.process.pid	Stores the process ID.	String
GoogleChronicleBackstory.Events.target.registry.registryKey	Stores the registry key associated with an application or system component.	String
GoogleChronicleBackstory.Events.target.registry.registryValueName	Stores the name of the registry value associated with an application or system component.	String
GoogleChronicleBackstory.Events.target.registry.registryValueData	Stores the data associated with a registry value.	String
GoogleChronicleBackstory.Events.target.user.emailAddresses	Stores the email addresses for the user.	String
GoogleChronicleBackstory.Events.target.user.employeeId	Stores the human resources employee ID for the user.	String
GoogleChronicleBackstory.Events.target.user.firstName	Stores the first name for the user.	String
GoogleChronicleBackstory.Events.target.user.middleName	Stores the middle name for the user.	String
GoogleChronicleBackstory.Events.target.user.lastName	Stores the last name for the user.	String
GoogleChronicleBackstory.Events.target.user.groupid	Stores the group ID associated with a user.	String
GoogleChronicleBackstory.Events.target.user.phoneNumbers	Stores the phone numbers for the user.	String
GoogleChronicleBackstory.Events.target.user.title	Stores the job title for the user.	String
GoogleChronicleBackstory.Events.target.user.userDisplayName	Stores the display name for the user.	String
GoogleChronicleBackstory.Events.target.user.userid	Stores the user ID.	String
GoogleChronicleBackstory.Events.target.user.windowsSid	Stores the Microsoft Windows security identifier (SID) associated with a user.	String
GoogleChronicleBackstory.Events.intermediary.assetId	Vendor-specific unique device identifier.	String
GoogleChronicleBackstory.Events.intermediary.email	Email address.	String
GoogleChronicleBackstory.Events.intermediary.hostname	Client hostname or domain name field.	String
GoogleChronicleBackstory.Events.intermediary.platform	Platform operating system.	String
GoogleChronicleBackstory.Events.intermediary.platformPatchLevel	Platform operating system patch level.	String
GoogleChronicleBackstory.Events.intermediary.platformVersion	Platform operating system version.	String
GoogleChronicleBackstory.Events.intermediary.ip	IP address associated with a network connection.	String
GoogleChronicleBackstory.Events.intermediary.port	Source or destination network port number when a specific network connection is described within an event.	String
GoogleChronicleBackstory.Events.intermediary.mac	One or more MAC addresses associated with a device.	String
GoogleChronicleBackstory.Events.intermediary.administrativeDomain	Domain which the device belongs to (for example, the Windows domain).	String
GoogleChronicleBackstory.Events.intermediary.url	Standard URL.	String
GoogleChronicleBackstory.Events.intermediary.file.fileMetadata	Metadata associated with the file.	String
GoogleChronicleBackstory.Events.intermediary.file.fullPath	Full path identifying the location of the file on the system.	String
GoogleChronicleBackstory.Events.intermediary.file.md5	MD5 hash value of the file.	String
GoogleChronicleBackstory.Events.intermediary.file.mimeType	Multipurpose Internet Mail Extensions (MIME) type of the file.	String
GoogleChronicleBackstory.Events.intermediary.file.sha1	SHA-1 hash value of the file.	String
GoogleChronicleBackstory.Events.intermediary.file.sha256	SHA-256 hash value of the file.	String
GoogleChronicleBackstory.Events.intermediary.file.size	Size of the file.	String
GoogleChronicleBackstory.Events.intermediary.process.commandLine	Stores the command line string for the process.	String
GoogleChronicleBackstory.Events.intermediary.process.productSpecificProcessId	Stores the product specific process ID.	String
GoogleChronicleBackstory.Events.intermediary.process.productSpecificParentProcessId	Stores the product specific process ID for the parent process.	String
GoogleChronicleBackstory.Events.intermediary.process.file	Stores the file name of the file in use by the process.	String
GoogleChronicleBackstory.Events.intermediary.process.file.fileMetadata	Metadata associated with the file.	String
GoogleChronicleBackstory.Events.intermediary.process.file.fullPath	Full path identifying the location of the file on the system.	String
GoogleChronicleBackstory.Events.intermediary.process.file.md5	MD5 hash value of the file.	String
GoogleChronicleBackstory.Events.intermediary.process.file.mimeType	Multipurpose Internet Mail Extensions (MIME) type of the file.	String
GoogleChronicleBackstory.Events.intermediary.process.file.sha1	SHA-1 hash value of the file.	String
GoogleChronicleBackstory.Events.intermediary.process.file.sha256	SHA-256 hash value of the file.	String
GoogleChronicleBackstory.Events.intermediary.process.file.size	Size of the file.	String
GoogleChronicleBackstory.Events.intermediary.process.parentPid	Stores the process ID for the parent process.	String
GoogleChronicleBackstory.Events.intermediary.process.pid	Stores the process ID.	String
GoogleChronicleBackstory.Events.intermediary.registry.registryKey	Stores the registry key associated with an application or system component.	String
GoogleChronicleBackstory.Events.intermediary.registry.registryValueName	Stores the name of the registry value associated with an application or system component.	String
GoogleChronicleBackstory.Events.intermediary.registry.registryValueData	Stores the data associated with a registry value.	String
GoogleChronicleBackstory.Events.intermediary.user.emailAddresses	Stores the email addresses for the user.	String
GoogleChronicleBackstory.Events.intermediary.user.employeeId	Stores the human resources employee ID for the user.	String
GoogleChronicleBackstory.Events.intermediary.user.firstName	Stores the first name for the user.	String
GoogleChronicleBackstory.Events.intermediary.user.middleName	Stores the middle name for the user.	String
GoogleChronicleBackstory.Events.intermediary.user.lastName	Stores the last name for the user.	String
GoogleChronicleBackstory.Events.intermediary.user.groupid	Stores the group ID associated with a user.	String
GoogleChronicleBackstory.Events.intermediary.user.phoneNumbers	Stores the phone numbers for the user.	String
GoogleChronicleBackstory.Events.intermediary.user.title	Stores the job title for the user.	String
GoogleChronicleBackstory.Events.intermediary.user.userDisplayName	Stores the display name for the user.	String
GoogleChronicleBackstory.Events.intermediary.user.userid	Stores the user ID.	String
GoogleChronicleBackstory.Events.intermediary.user.windowsSid	Stores the Microsoft Windows security identifier (SID) associated with a user.	String
GoogleChronicleBackstory.Events.src.assetId	Vendor-specific unique device identifier.	String
GoogleChronicleBackstory.Events.src.email	Email address.	String
GoogleChronicleBackstory.Events.src.hostname	Client hostname or domain name field.	String
GoogleChronicleBackstory.Events.src.platform	Platform operating system.	String
GoogleChronicleBackstory.Events.src.platformPatchLevel	Platform operating system patch level.	String
GoogleChronicleBackstory.Events.src.platformVersion	Platform operating system version.	String
GoogleChronicleBackstory.Events.src.ip	IP address associated with a network connection.	String
GoogleChronicleBackstory.Events.src.port	Source or destination network port number when a specific network connection is described within an event.	String
GoogleChronicleBackstory.Events.src.mac	One or more MAC addresses associated with a device.	String
GoogleChronicleBackstory.Events.src.administrativeDomain	Domain which the device belongs to (for example, the Windows domain).	String
GoogleChronicleBackstory.Events.src.url	Standard URL.	String
GoogleChronicleBackstory.Events.src.file.fileMetadata	Metadata associated with the file.	String
GoogleChronicleBackstory.Events.src.file.fullPath	Full path identifying the location of the file on the system.	String
GoogleChronicleBackstory.Events.src.file.md5	MD5 hash value of the file.	String
GoogleChronicleBackstory.Events.src.file.mimeType	Multipurpose Internet Mail Extensions (MIME) type of the file.	String
GoogleChronicleBackstory.Events.src.file.sha1	SHA-1 hash value of the file.	String
GoogleChronicleBackstory.Events.src.file.sha256	SHA-256 hash value of the file.	String
GoogleChronicleBackstory.Events.src.file.size	Size of the file.	String
GoogleChronicleBackstory.Events.src.process.commandLine	Stores the command line string for the process.	String
GoogleChronicleBackstory.Events.src.process.productSpecificProcessId	Stores the product specific process ID.	String
GoogleChronicleBackstory.Events.src.process.productSpecificParentProcessId	Stores the product specific process ID for the parent process.	String
GoogleChronicleBackstory.Events.src.process.file	Stores the file name of the file in use by the process.	String
GoogleChronicleBackstory.Events.src.process.file.fileMetadata	Metadata associated with the file.	String
GoogleChronicleBackstory.Events.src.process.file.fullPath	Full path identifying the location of the file on the system.	String
GoogleChronicleBackstory.Events.src.process.file.md5	MD5 hash value of the file.	String
GoogleChronicleBackstory.Events.src.process.file.mimeType	Multipurpose Internet Mail Extensions (MIME) type of the file.	String
GoogleChronicleBackstory.Events.src.process.file.sha1	SHA-1 hash value of the file.	String
GoogleChronicleBackstory.Events.src.process.file.sha256	SHA-256 hash value of the file.	String
GoogleChronicleBackstory.Events.src.process.file.size	Size of the file.	String
GoogleChronicleBackstory.Events.src.process.parentPid	Stores the process ID for the parent process.	String
GoogleChronicleBackstory.Events.src.process.pid	Stores the process ID.	String
GoogleChronicleBackstory.Events.src.registry.registryKey	Stores the registry key associated with an application or system component.	String
GoogleChronicleBackstory.Events.src.registry.registryValueName	Stores the name of the registry value associated with an application or system component.	String
GoogleChronicleBackstory.Events.src.registry.registryValueData	Stores the data associated with a registry value.	String
GoogleChronicleBackstory.Events.src.user.emailAddresses	Stores the email addresses for the user.	String
GoogleChronicleBackstory.Events.src.user.employeeId	Stores the human resources employee ID for the user.	String
GoogleChronicleBackstory.Events.src.user.firstName	Stores the first name for the user.	String
GoogleChronicleBackstory.Events.src.user.middleName	Stores the middle name for the user.	String
GoogleChronicleBackstory.Events.src.user.lastName	Stores the last name for the user.	String
GoogleChronicleBackstory.Events.src.user.groupid	Stores the group ID associated with a user.	String
GoogleChronicleBackstory.Events.src.user.phoneNumbers	Stores the phone numbers for the user.	String
GoogleChronicleBackstory.Events.src.user.title	Stores the job title for the user.	String
GoogleChronicleBackstory.Events.src.user.userDisplayName	Stores the display name for the user.	String
GoogleChronicleBackstory.Events.src.user.userid	Stores the user ID.	String
GoogleChronicleBackstory.Events.src.user.windowsSid	Stores the Microsoft Windows security identifier (SID) associated with a user.	String
GoogleChronicleBackstory.Events.observer.assetId	Vendor-specific unique device identifier.	String
GoogleChronicleBackstory.Events.observer.email	Email address.	String
GoogleChronicleBackstory.Events.observer.hostname	Client hostname or domain name field.	String
GoogleChronicleBackstory.Events.observer.platform	Platform operating system.	String
GoogleChronicleBackstory.Events.observer.platformPatchLevel	Platform operating system patch level.	String
GoogleChronicleBackstory.Events.observer.platformVersion	Platform operating system version.	String
GoogleChronicleBackstory.Events.observer.ip	IP address associated with a network connection.	String
GoogleChronicleBackstory.Events.observer.port	Source or destination network port number when a specific network connection is described within an event.	String
GoogleChronicleBackstory.Events.observer.mac	One or more MAC addresses associated with a device.	String
GoogleChronicleBackstory.Events.observer.administrativeDomain	Domain which the device belongs to (for example, the Windows domain).	String
GoogleChronicleBackstory.Events.observer.url	Standard URL.	String
GoogleChronicleBackstory.Events.observer.file.fileMetadata	Metadata associated with the file.	String
GoogleChronicleBackstory.Events.observer.file.fullPath	Full path identifying the location of the file on the system.	String
GoogleChronicleBackstory.Events.observer.file.md5	MD5 hash value of the file.	String
GoogleChronicleBackstory.Events.observer.file.mimeType	Multipurpose Internet Mail Extensions (MIME) type of the file.	String
GoogleChronicleBackstory.Events.observer.file.sha1	SHA-1 hash value of the file.	String
GoogleChronicleBackstory.Events.observer.file.sha256	SHA-256 hash value of the file.	String
GoogleChronicleBackstory.Events.observer.file.size	Size of the file.	String
GoogleChronicleBackstory.Events.observer.process.commandLine	Stores the command line string for the process.	String
GoogleChronicleBackstory.Events.observer.process.productSpecificProcessId	Stores the product specific process ID.	String
GoogleChronicleBackstory.Events.observer.process.productSpecificParentProcessId	Stores the product specific process ID for the parent process.	String
GoogleChronicleBackstory.Events.observer.process.file	Stores the file name of the file in use by the process.	String
GoogleChronicleBackstory.Events.observer.process.file.fileMetadata	Metadata associated with the file.	String
GoogleChronicleBackstory.Events.observer.process.file.fullPath	Full path identifying the location of the file on the system.	String
GoogleChronicleBackstory.Events.observer.process.file.md5	MD5 hash value of the file.	String
GoogleChronicleBackstory.Events.observer.process.file.mimeType	Multipurpose Internet Mail Extensions (MIME) type of the file.	String
GoogleChronicleBackstory.Events.observer.process.file.sha1	SHA-1 hash value of the file.	String
GoogleChronicleBackstory.Events.observer.process.file.sha256	SHA-256 hash value of the file.	String
GoogleChronicleBackstory.Events.observer.process.file.size	Size of the file.	String
GoogleChronicleBackstory.Events.observer.process.parentPid	Stores the process ID for the parent process.	String
GoogleChronicleBackstory.Events.observer.process.pid	Stores the process ID.	String
GoogleChronicleBackstory.Events.observer.registry.registryKey	Stores the registry key associated with an application or system component.	String
GoogleChronicleBackstory.Events.observer.registry.registryValueName	Stores the name of the registry value associated with an application or system component.	String
GoogleChronicleBackstory.Events.observer.registry.registryValueData	Stores the data associated with a registry value.	String
GoogleChronicleBackstory.Events.observer.user.emailAddresses	Stores the email addresses for the user.	String
GoogleChronicleBackstory.Events.observer.user.employeeId	Stores the human resources employee ID for the user.	String
GoogleChronicleBackstory.Events.observer.user.firstName	Stores the first name for the user.	String
GoogleChronicleBackstory.Events.observer.user.middleName	Stores the middle name for the user.	String
GoogleChronicleBackstory.Events.observer.user.lastName	Stores the last name for the user.	String
GoogleChronicleBackstory.Events.observer.user.groupid	Stores the group ID associated with a user.	String
GoogleChronicleBackstory.Events.observer.user.phoneNumbers	Stores the phone numbers for the user.	String
GoogleChronicleBackstory.Events.observer.user.title	Stores the job title for the user.	String
GoogleChronicleBackstory.Events.observer.user.userDisplayName	Stores the display name for the user.	String
GoogleChronicleBackstory.Events.observer.user.userid	Stores the user ID.	String
GoogleChronicleBackstory.Events.observer.user.windowsSid	Stores the Microsoft Windows security identifier (SID) associated with a user.	String
GoogleChronicleBackstory.Events.about.assetId	Vendor-specific unique device identifier.	String
GoogleChronicleBackstory.Events.about.email	Email address.	String
GoogleChronicleBackstory.Events.about.hostname	Client hostname or domain name field.	String
GoogleChronicleBackstory.Events.about.platform	Platform operating system.	String
GoogleChronicleBackstory.Events.about.platformPatchLevel	Platform operating system patch level.	String
GoogleChronicleBackstory.Events.about.platformVersion	Platform operating system version.	String
GoogleChronicleBackstory.Events.about.ip	IP address associated with a network connection.	String
GoogleChronicleBackstory.Events.about.port	Source or destination network port number when a specific network connection is described within an event.	String
GoogleChronicleBackstory.Events.about.mac	One or more MAC addresses associated with a device.	String
GoogleChronicleBackstory.Events.about.administrativeDomain	Domain which the device belongs to (for example, the Windows domain).	String
GoogleChronicleBackstory.Events.about.url	Standard URL.	String
GoogleChronicleBackstory.Events.about.file.fileMetadata	Metadata associated with the file.	String
GoogleChronicleBackstory.Events.about.file.fullPath	Full path identifying the location of the file on the system.	String
GoogleChronicleBackstory.Events.about.file.md5	MD5 hash value of the file.	String
GoogleChronicleBackstory.Events.about.file.mimeType	Multipurpose Internet Mail Extensions (MIME) type of the file.	String
GoogleChronicleBackstory.Events.about.file.sha1	SHA-1 hash value of the file.	String
GoogleChronicleBackstory.Events.about.file.sha256	SHA-256 hash value of the file.	String
GoogleChronicleBackstory.Events.about.file.size	Size of the file.	String
GoogleChronicleBackstory.Events.about.process.commandLine	Stores the command line string for the process.	String
GoogleChronicleBackstory.Events.about.process.productSpecificProcessId	Stores the product specific process ID.	String
GoogleChronicleBackstory.Events.about.process.productSpecificParentProcessId	Stores the product specific process ID for the parent process.	String
GoogleChronicleBackstory.Events.about.process.file	Stores the file name of the file in use by the process.	String
GoogleChronicleBackstory.Events.about.process.file.fileMetadata	Metadata associated with the file.	String
GoogleChronicleBackstory.Events.about.process.file.fullPath	Full path identifying the location of the file on the system.	String
GoogleChronicleBackstory.Events.about.process.file.md5	MD5 hash value of the file.	String
GoogleChronicleBackstory.Events.about.process.file.mimeType	Multipurpose Internet Mail Extensions (MIME) type of the file.	String
GoogleChronicleBackstory.Events.about.process.file.sha1	SHA-1 hash value of the file.	String
GoogleChronicleBackstory.Events.about.process.file.sha256	SHA-256 hash value of the file.	String
GoogleChronicleBackstory.Events.about.process.file.size	Size of the file.	String
GoogleChronicleBackstory.Events.about.process.parentPid	Stores the process ID for the parent process.	String
GoogleChronicleBackstory.Events.about.process.pid	Stores the process ID.	String
GoogleChronicleBackstory.Events.about.registry.registryKey	Stores the registry key associated with an application or system component.	String
GoogleChronicleBackstory.Events.about.registry.registryValueName	Stores the name of the registry value associated with an application or system component.	String
GoogleChronicleBackstory.Events.about.registry.registryValueData	Stores the data associated with a registry value.	String
GoogleChronicleBackstory.Events.about.user.emailAddresses	Stores the email addresses for the user.	String
GoogleChronicleBackstory.Events.about.user.employeeId	Stores the human resources employee ID for the user.	String
GoogleChronicleBackstory.Events.about.user.firstName	Stores the first name for the user.	String
GoogleChronicleBackstory.Events.about.user.middleName	Stores the middle name for the user.	String
GoogleChronicleBackstory.Events.about.user.lastName	Stores the last name for the user.	String
GoogleChronicleBackstory.Events.about.user.groupid	Stores the group ID associated with a user.	String
GoogleChronicleBackstory.Events.about.user.phoneNumbers	Stores the phone numbers for the user.	String
GoogleChronicleBackstory.Events.about.user.title	Stores the job title for the user.	String
GoogleChronicleBackstory.Events.about.user.userDisplayName	Stores the display name for the user.	String
GoogleChronicleBackstory.Events.about.user.userid	Stores the user ID.	String
GoogleChronicleBackstory.Events.about.user.windowsSid	Stores the Microsoft Windows security identifier (SID) associated with a user.	String
GoogleChronicleBackstory.Events.network.applicationProtocol	Indicates the network application protocol.	String
GoogleChronicleBackstory.Events.network.direction	Indicates the direction of network traffic.	String
GoogleChronicleBackstory.Events.network.email	Specifies the email address for the sender/recipient.	String
GoogleChronicleBackstory.Events.network.ipProtocol	Indicates the IP protocol.	String
GoogleChronicleBackstory.Events.network.receivedBytes	Specifies the number of bytes received.	String
GoogleChronicleBackstory.Events.network.sentBytes	Specifies the number of bytes sent.	String
GoogleChronicleBackstory.Events.network.dhcp.clientHostname	Hostname for the client.	String
GoogleChronicleBackstory.Events.network.dhcp.clientIdentifier	Client identifier.	String
GoogleChronicleBackstory.Events.network.dhcp.file	Filename for the boot image.	String
GoogleChronicleBackstory.Events.network.dhcp.flags	Value for the DHCP flags field.	String
GoogleChronicleBackstory.Events.network.dhcp.hlen	Hardware address length.	String
GoogleChronicleBackstory.Events.network.dhcp.hops	DHCP hop count.	String
GoogleChronicleBackstory.Events.network.dhcp.htype	Hardware address type.	String
GoogleChronicleBackstory.Events.network.dhcp.leaseTimeSeconds	Client-requested lease time for an IP address in seconds.	String
GoogleChronicleBackstory.Events.network.dhcp.opcode	BOOTP op code.	String
GoogleChronicleBackstory.Events.network.dhcp.requestedAddress	Client identifier.	String
GoogleChronicleBackstory.Events.network.dhcp.seconds	Seconds elapsed since the client began the address acquisition/renewal process.	String
GoogleChronicleBackstory.Events.network.dhcp.sname	Name of the server which the client has requested to boot from.	String
GoogleChronicleBackstory.Events.network.dhcp.transactionId	Client transaction ID.	String
GoogleChronicleBackstory.Events.network.dhcp.type	DHCP message type.	String
GoogleChronicleBackstory.Events.network.dhcp.chaddr	IP address for the client hardware.	String
GoogleChronicleBackstory.Events.network.dhcp.ciaddr	IP address for the client.	String
GoogleChronicleBackstory.Events.network.dhcp.giaddr	IP address for the relay agent.	String
GoogleChronicleBackstory.Events.network.dhcp.siaddr	IP address for the next bootstrap server.	String
GoogleChronicleBackstory.Events.network.dhcp.yiaddr	Your IP address.	String
GoogleChronicleBackstory.Events.network.dns.authoritative	Set to true for authoritative DNS servers.	String
GoogleChronicleBackstory.Events.network.dns.id	Stores the DNS query identifier.	String
GoogleChronicleBackstory.Events.network.dns.response	Set to true if the event is a DNS response.	String
GoogleChronicleBackstory.Events.network.dns.opcode	Stores the DNS OpCode used to specify the type of DNS query (standard, inverse, server status, etc.).	String
GoogleChronicleBackstory.Events.network.dns.recursionAvailable	Set to true if a recursive DNS lookup is available.	String
GoogleChronicleBackstory.Events.network.dns.recursionDesired	Set to true if a recursive DNS lookup is requested.	String
GoogleChronicleBackstory.Events.network.dns.responseCode	Stores the DNS response code as defined by RFC 1035, Domain Names - Implementation and Specification.	String
GoogleChronicleBackstory.Events.network.dns.truncated	Set to true if this is a truncated DNS response.	String
GoogleChronicleBackstory.Events.network.dns.questions.name	Stores the domain name.	String
GoogleChronicleBackstory.Events.network.dns.questions.class	Stores the code specifying the class of the query.	String
GoogleChronicleBackstory.Events.network.dns.questions.type	Stores the code specifying the type of the query.	String
GoogleChronicleBackstory.Events.network.dns.answers.binaryData	Stores the raw bytes of any non-UTF8 strings that might be included as part of a DNS response.	String
GoogleChronicleBackstory.Events.network.dns.answers.class	Stores the code specifying the class of the resource record.	String
GoogleChronicleBackstory.Events.network.dns.answers.data	Stores the payload or response to the DNS question for all responses encoded in UTF-8 format.	String
GoogleChronicleBackstory.Events.network.dns.answers.name	Stores the name of the owner of the resource record.	String
GoogleChronicleBackstory.Events.network.dns.answers.ttl	Stores the time interval for which the resource record can be cached before the source of the information should again be queried.	String
GoogleChronicleBackstory.Events.network.dns.answers.type	Stores the code specifying the type of the resource record.	String
GoogleChronicleBackstory.Events.network.dns.authority.binaryData	Stores the raw bytes of any non-UTF8 strings that might be included as part of a DNS response.	String
GoogleChronicleBackstory.Events.network.dns.authority.class	Stores the code specifying the class of the resource record.	String
GoogleChronicleBackstory.Events.network.dns.authority.data	Stores the payload or response to the DNS question for all responses encoded in UTF-8 format.	String
GoogleChronicleBackstory.Events.network.dns.authority.name	Stores the name of the owner of the resource record.	String
GoogleChronicleBackstory.Events.network.dns.authority.ttl	Stores the time interval for which the resource record can be cached before the source of the information should again be queried.	String
GoogleChronicleBackstory.Events.network.dns.authority.type	Stores the code specifying the type of the resource record.	String
GoogleChronicleBackstory.Events.network.dns.additional.binaryData	Stores the raw bytes of any non-UTF8 strings that might be included as part of a DNS response.	String
GoogleChronicleBackstory.Events.network.dns.additional.class	Stores the code specifying the class of the resource record.	String
GoogleChronicleBackstory.Events.network.dns.additional.data	Stores the payload or response to the DNS question for all responses encoded in UTF-8 format.	String
GoogleChronicleBackstory.Events.network.dns.additional.name	Stores the name of the owner of the resource record.	String
GoogleChronicleBackstory.Events.network.dns.additional.ttl	Stores the time interval for which the resource record can be cached before the source of the information should again be queried.	String
GoogleChronicleBackstory.Events.network.dns.additional.type	Stores the code specifying the type of the resource record.	String
GoogleChronicleBackstory.Events.network.email.from	Stores the from email address.	String
GoogleChronicleBackstory.Events.network.email.replyTo	Stores the reply_to email address.	String
GoogleChronicleBackstory.Events.network.email.to	Stores the to email addresses.	String
GoogleChronicleBackstory.Events.network.email.cc	Stores the cc email addresses.	String
GoogleChronicleBackstory.Events.network.email.bcc	Stores the bcc email addresses.	String
GoogleChronicleBackstory.Events.network.email.mailId	Stores the mail (or message) ID.	String
GoogleChronicleBackstory.Events.network.email.subject	Stores the email subject line.	String
GoogleChronicleBackstory.Events.network.ftp.command	Stores the FTP command.	String
GoogleChronicleBackstory.Events.network.http.method	Stores the HTTP request method.	String
GoogleChronicleBackstory.Events.network.http.referralUrl	Stores the URL for the HTTP referer.	String
GoogleChronicleBackstory.Events.network.http.responseCode	Stores the HTTP response status code, which indicates whether a specific HTTP request has been successfully completed.	String
GoogleChronicleBackstory.Events.network.http.useragent	Stores the User-Agent request header which includes the application type, operating system, software vendor or software version of the requesting software user agent.	String
GoogleChronicleBackstory.Events.authentication.authType	Type of system an authentication event is associated with (Chronicle UDM).	String
GoogleChronicleBackstory.Events.authentication.mechanism	Mechanism(s) used for authentication.	String
GoogleChronicleBackstory.Events.securityResult.about	Provide a description of the security result.	String
GoogleChronicleBackstory.Events.securityResult.action	Specify a security action.	String
GoogleChronicleBackstory.Events.securityResult.category	Specify a security category.	String
GoogleChronicleBackstory.Events.securityResult.confidence	Specify a confidence with regards to a security event as estimated by the product.	String
GoogleChronicleBackstory.Events.securityResult.confidenceDetails	Additional detail with regards to the confidence of a security event as estimated by the product vendor.	String
GoogleChronicleBackstory.Events.securityResult.priority	Specify a priority with regards to a security event as estimated by the product vendor.	String
GoogleChronicleBackstory.Events.securityResult.priorityDetails	Vendor-specific information about the security result priority.	String
GoogleChronicleBackstory.Events.securityResult.ruleId	Identifier for the security rule.	String
GoogleChronicleBackstory.Events.securityResult.ruleName	Name of the security rule.	String
GoogleChronicleBackstory.Events.securityResult.severity	Severity of a security event as estimated by the product vendor using values defined by the Chronicle UDM.	String
GoogleChronicleBackstory.Events.securityResult.severityDetails	Severity for a security event as estimated by the product vendor.	String
GoogleChronicleBackstory.Events.securityResult.threatName	Name of the security threat.	String
GoogleChronicleBackstory.Events.securityResult.urlBackToProduct	URL to direct you to the source product console for this security event.	String

There are no outputs for this script.

Script Example

!ListDeviceEvents asset_identifier="ray-xxx-laptop"

Context Example

{

"GoogleChronicleBackstory.Events": [

{

"principal": {

"ip": [

"10.0.XX.XX"

],

"mac": [

"88:a6:XX:XX:XX:XX"

],

"hostname": "ray-xxx-laptop"

},

"target": {

"ip": [

"8.8.8.8"

]

},

"network": {

"applicationProtocol": "DNS",

"dns": {

"questions": [

{

"type": 1,

"name": "is5-ssl.mzstatic.com"

}

],

"answers": [

{

"type": 1,

"data": "104.118.212.43",

"name": "is5-ssl.mzstatic.com",

"ttl": 11111

}

],

"response": true

}

},

"collectedTimestamp": "2020-01-02T00:00:00Z",

"productName": "ExtraHop",

"eventTimestamp": "2020-01-01T23:59:38Z",

"eventType": "NETWORK_DNS"

}

]

}

Human Readable Output

Event(s) Details

Event Timestamp	Event Type	Principal Asset Identifier	Target Asset Identifier	Queried Domain
2020-01-01T23:59:38Z	NETWORK_DNS	ray-xxx-laptop	8.8.8.8	ninthdecimal.com

View events in Chronicle

Maximum number of events specified in page_size has been returned. There might still be more events in your Chronicle account. >To fetch the next set of events, execute the command with the start time as 2020-01-01T23:59:38Z