package tracee.v1beta1.datastores

Get desktop application:
View/edit binary Protocol Buffers messages

• rpc ClearSource (ClearSourceRequest, ClearSourceResponse)

  writable.proto:76

  Clear all data from a specific source

  message ClearSourceRequest

  writable.proto:48

  • string store_name = 1

  • string source = 2

    Clear all data from this source

  message ClearSourceResponse

  writable.proto:53

  • int32 deleted_count = 1

    Number of entries deleted

• rpc DeleteData (DeleteDataRequest, DeleteDataResponse)

  writable.proto:73

  Delete a data entry

  message DeleteDataRequest

  writable.proto:38

  • string store_name = 1

  • string source = 2

  • optional google.protobuf.Any key = 3

    Key remains separate for delete

  message DeleteDataResponse

  writable.proto:44

  Empty response on success

  (message has no fields)

• rpc ListSources (ListSourcesRequest, ListSourcesResponse)

  writable.proto:79

  List all sources in a datastore

  message ListSourcesRequest

  writable.proto:57

  • string store_name = 1

  message ListSourcesResponse

  writable.proto:61

  • repeated string sources = 1

• rpc WriteBatchData (WriteBatchDataRequest, WriteBatchDataResponse)

  writable.proto:70

  Write multiple data entries in a batch

  message WriteBatchDataRequest

  writable.proto:28

  • string store_name = 1

  • string source = 2

  • repeated DataEntry entries = 3

  message WriteBatchDataResponse

  writable.proto:34

  • int32 written_count = 1

    Number of entries successfully written

• rpc WriteData (WriteDataRequest, WriteDataResponse)

  writable.proto:67

  Write a single data entry

  message WriteDataRequest

  writable.proto:18

  • string store_name = 1

    Name of the target datastore

  • string source = 2

    Source identifier for this data

  • optional DataEntry entry = 3

    The data entry to write

  message WriteDataResponse

  writable.proto:24

  Empty response on success

  (message has no fields)

DataEntry represents a single key-value pair for writable datastores Keys and data are packed as google.protobuf.Any for type safety and extensibility

Used in: WriteBatchDataRequest, WriteDataRequest

• optional google.protobuf.Any key = 1

  Key as protobuf Any (e.g., IPAddressKey from ipreputation.proto)

• optional google.protobuf.Any data = 2

  Data as protobuf Any (e.g., IPReputation from ipreputation.proto)

IPAddressKey is used for IP-based lookups

• string ip = 1

  IP address (IPv4 or IPv6)

IPReputation represents threat intelligence data for an IP address

• ReputationStatus status = 1

• int32 severity = 2

  1-10 severity score

• repeated string tags = 3

  e.g., ["botnet", "malware", "c2"]

• optional google.protobuf.Timestamp last_updated = 4

• map<string, string> metadata = 5

  Additional key-value metadata

ReputationStatus indicates the reputation classification

Used in: IPReputation

• REPUTATION_UNKNOWN = 0

• REPUTATION_ALLOW = 1

• REPUTATION_DENY = 2

• REPUTATION_SUSPICIOUS = 3