# Generated by the protocol buffer compiler.  DO NOT EDIT!
# source: grr_response_proto/export.proto

import sys
_b=sys.version_info[0]<3 and (lambda x:x) or (lambda x:x.encode('latin1'))
from google.protobuf import descriptor as _descriptor
from google.protobuf import message as _message
from google.protobuf import reflection as _reflection
from google.protobuf import symbol_database as _symbol_database
from google.protobuf import descriptor_pb2
# @@protoc_insertion_point(imports)

_sym_db = _symbol_database.Default()


from grr_response_proto import anomaly_pb2 as grr__response__proto_dot_anomaly__pb2
from grr_response_proto import jobs_pb2 as grr__response__proto_dot_jobs__pb2
from grr_response_proto import sysinfo_pb2 as grr__response__proto_dot_sysinfo__pb2
from grr_response_proto import semantic_pb2 as grr__response__proto_dot_semantic__pb2


DESCRIPTOR = _descriptor.FileDescriptor(
  name='grr_response_proto/export.proto',
  package='',
  syntax='proto2',
  serialized_pb=_b('\n\x1fgrr_response_proto/export.proto\x1a grr_response_proto/anomaly.proto\x1a\x1dgrr_response_proto/jobs.proto\x1a grr_response_proto/sysinfo.proto\x1a!grr_response_proto/semantic.proto\"\xc7\t\n\rExportOptions\x12\xa3\x02\n\x15\x65xport_files_contents\x18\x01 \x01(\x08:\x05\x66\x61lseB\xfc\x01\xe2\xfc\xe3\xc4\x01\xf5\x01\x12\xf2\x01If this is true, open files and export their full or partial contents. Note: this may require additional datastore roundtrips and slow down the export process, also exporting file contents may significantly increase size of the exported data.\x12\xf4\x01\n\x0b\x66ollow_urns\x18\x02 \x01(\x08:\x05\x66\x61lseB\xd7\x01\xe2\xfc\xe3\xc4\x01\xd0\x01\x12\xcd\x01If this is true, follow urns and try to export not only the urns themselves, but also the data they are pointing to. Note: this may require additional datastore roundtrips and slow down the export process.\x12\xb4\x03\n\x13\x65xport_files_hashes\x18\x03 \x01(\x08:\x04trueB\x90\x03\xe2\xfc\xe3\xc4\x01\x89\x03\x12\x86\x03If this is true, export hashes when dealing with file-related values. The files won\'t be hashed during the export, hashes will only be exported if they were collected before the export. This option affects exporting VFSFile and StatEntry RDFValues. This is true by default even though it requires extra  datastore roundtrips because it\'s very useful and users expect the hashes to be there.\x12\xe1\x01\n\x0b\x61nnotations\x18\x04 \x03(\tB\xcb\x01\xe2\xfc\xe3\xc4\x01\xc4\x01\x12\xc1\x01\x41nnotations to add to exported data. This field can be used to differentiate sets of exported data inside a particular exported type. e.g. data collected by users vs. data collected by cronjob.\"\xb5\x0b\n\x10\x45xportedMetadata\x12V\n\nclient_urn\x18\x01 \x01(\tBB\xe2\xfc\xe3\xc4\x01<\n\tClientURN\x12/Client ID of a client that contains this entry.\x12*\n\x08hostname\x18\x02 \x01(\tB\x18\xe2\xfc\xe3\xc4\x01\x12\x12\x10\x43lient hostname.\x12I\n\x02os\x18\x03 \x01(\tB=\xe2\xfc\xe3\xc4\x01\x37\x12\x35\x43lient Operating System class (Windows|Darwin|Linux).\x12;\n\nclient_age\x18\x04 \x01(\x04\x42\'\xe2\xfc\xe3\xc4\x01!\n\x0bRDFDatetime\x12\x12\x41ge of the client.\x12$\n\x05uname\x18\x05 \x01(\tB\x15\xe2\xfc\xe3\xc4\x01\x0f\x12\rUname string.\x12J\n\nos_release\x18\x06 \x01(\tB6\xe2\xfc\xe3\xc4\x01\x30\x12.The OS release identifier e.g. 7, OSX, debian.\x12N\n\nos_version\x18\x07 \x01(\tB:\xe2\xfc\xe3\xc4\x01\x34\x12\x32The OS version ID e.g. 6.1.7601SP1, 10.9.2, 14.04.\x12$\n\tusernames\x18\x08 \x01(\tB\x11\xe2\xfc\xe3\xc4\x01\x0b\x12\tUsername.\x12)\n\x0bmac_address\x18\t \x01(\tB\x14\xe2\xfc\xe3\xc4\x01\x0e\x12\x0cMAC address.\x12?\n\ttimestamp\x18\n \x01(\x04\x42,\xe2\xfc\xe3\xc4\x01&\n\x0bRDFDatetime\x12\x17When data was exported.\x12R\n\x12original_timestamp\x18\x0f \x01(\x04\x42\x36\xe2\xfc\xe3\xc4\x01\x30\n\x0bRDFDatetime\x12!When original data was generated.\x12l\n\x15\x64\x65precated_session_id\x18\x0b \x01(\tBM\x18\x01\xe2\xfc\xe3\xc4\x01\x45\n\tSessionID\x12\x38\x44\x65precated session id of a hunt that collected the data.\x12\x32\n\x06labels\x18\x0c \x01(\tB\"\xe2\xfc\xe3\xc4\x01\x1c\x12\x1a\x43SV list of client labels.\x12I\n\rsystem_labels\x18\x12 \x01(\tB2\xe2\xfc\xe3\xc4\x01,\x12*Labels hardcoded into GRR clients configs.\x12H\n\x0buser_labels\x18\x13 \x01(\tB3\xe2\xfc\xe3\xc4\x01-\x12+Labels assigned by GRR uses via the UI/API.\x12\x45\n\nsource_urn\x18\r \x01(\tB1\xe2\xfc\xe3\xc4\x01+\n\x06RDFURN\x12!URN of a source of exported data.\x12\xe3\x01\n\x0b\x61nnotations\x18\x0e \x01(\tB\xcd\x01\xe2\xfc\xe3\xc4\x01\xc6\x01\x12\xc3\x01\x43SV list of annotations for this data. This field can be used to differentiate sets of exported data inside a particular exported type. e.g. data collected by users vs. data collected by cronjob.\x12Q\n\rhardware_info\x18\x10 \x01(\x0b\x32\r.HardwareInfoB+\xe2\xfc\xe3\xc4\x01%\x12#Hardware information of the client.\x12\x36\n\x0ekernel_version\x18\x11 \x01(\tB\x1e\xe2\xfc\xe3\xc4\x01\x18\x12\x16\x43lient kernel version.\"5\n\x0e\x45xportedClient\x12#\n\x08metadata\x18\x01 \x01(\x0b\x32\x11.ExportedMetadata\"\x92\x01\n\x18\x45xportedNetworkInterface\x12#\n\x08metadata\x18\x01 \x01(\x0b\x32\x11.ExportedMetadata\x12\x13\n\x0bmac_address\x18\x02 \x01(\t\x12\x0e\n\x06ifname\x18\x03 \x01(\t\x12\x15\n\rip4_addresses\x18\x04 \x01(\t\x12\x15\n\rip6_addresses\x18\x05 \x01(\t\"p\n\x1e\x45xportedDNSClientConfiguration\x12#\n\x08metadata\x18\x01 \x01(\x0b\x32\x11.ExportedMetadata\x12\x13\n\x0b\x64ns_servers\x18\x02 \x01(\t\x12\x14\n\x0c\x64ns_suffixes\x18\x03 \x01(\t\"\x9e\x08\n\x0c\x45xportedFile\x12#\n\x08metadata\x18\x01 \x01(\x0b\x32\x11.ExportedMetadata\x12I\n\x03urn\x18\x02 \x01(\tB<\xe2\xfc\xe3\xc4\x01\x36\n\x06RDFURN\x12,The location of this file in the AFF4 space.\x12/\n\x08\x62\x61sename\x18\x03 \x01(\tB\x1d\xe2\xfc\xe3\xc4\x01\x17\x12\x15\x42\x61sename of the file.\x12?\n\x07st_mode\x18\x04 \x01(\x04\x42.\xe2\xfc\xe3\xc4\x01(\n\x08StatMode\x12\x1c\x41 unix file permission mode.\x12\x0e\n\x06st_ino\x18\x05 \x01(\r\x12\x0e\n\x06st_dev\x18\x06 \x01(\r\x12\x10\n\x08st_nlink\x18\x07 \x01(\r\x12\x0e\n\x06st_uid\x18\x08 \x01(\r\x12\x0e\n\x06st_gid\x18\t \x01(\r\x12\x0f\n\x07st_size\x18\n \x01(\x04\x12?\n\x08st_atime\x18\x0b \x01(\x04\x42-\xe2\xfc\xe3\xc4\x01\'\n\x12RDFDatetimeSeconds\x12\x11Last access time.\x12\x41\n\x08st_mtime\x18\x0c \x01(\x04\x42/\xe2\xfc\xe3\xc4\x01)\n\x12RDFDatetimeSeconds\x12\x13Last modified time.\x12\x45\n\x08st_ctime\x18\r \x01(\x04\x42\x33\xe2\xfc\xe3\xc4\x01-\n\x12RDFDatetimeSeconds\x12\x17Last inode change time.\x12\x11\n\tst_blocks\x18\x0e \x01(\r\x12\x12\n\nst_blksize\x18\x0f \x01(\r\x12\x0f\n\x07st_rdev\x18\x10 \x01(\r\x12\x0f\n\x07symlink\x18\x11 \x01(\t\x12\x41\n\x07\x63ontent\x18\x12 \x01(\x0c\x42\x30\xe2\xfc\xe3\xc4\x01*\x12(Actual content of the file if available.\x12\x31\n\x0e\x63ontent_sha256\x18\x13 \x01(\tB\x19\xe2\xfc\xe3\xc4\x01\x13\x12\x11SHA256 of content\x12\x10\n\x08hash_md5\x18\x14 \x01(\t\x12\x11\n\thash_sha1\x18\x15 \x01(\t\x12\x13\n\x0bhash_sha256\x18\x16 \x01(\t\x12\x17\n\x0fpecoff_hash_md5\x18\x17 \x01(\t\x12\x18\n\x10pecoff_hash_sha1\x18\x18 \x01(\t\x12\x18\n\x10\x63\x65rt_hasher_name\x18\x19 \x01(\t\x12\x19\n\x11\x63\x65rt_program_name\x18\x1a \x01(\t\x12\x18\n\x10\x63\x65rt_program_url\x18\x1b \x01(\t\x12\x17\n\x0f\x63\x65rt_signing_id\x18\x1c \x01(\t\x12\x1e\n\x16\x63\x65rt_chain_head_issuer\x18\x1d \x01(\t\x12/\n\'cert_countersignature_chain_head_issuer\x18\x1e \x01(\t\x12\x19\n\x11\x63\x65rt_certificates\x18\x1f \x01(\t\"\xf3\x01\n\x13\x45xportedRegistryKey\x12#\n\x08metadata\x18\x01 \x01(\x0b\x32\x11.ExportedMetadata\x12\x35\n\x03urn\x18\x02 \x01(\tB(\xe2\xfc\xe3\xc4\x01\"\n\x06RDFURN\x12\x18URN of the registry key.\x12K\n\rlast_modified\x18\x03 \x01(\x04\x42\x34\xe2\xfc\xe3\xc4\x01.\n\x12RDFDatetimeSeconds\x12\x18Last modified timestamp.\x12%\n\x04type\x18\x04 \x01(\x0e\x32\x17.StatEntry.RegistryType\x12\x0c\n\x04\x64\x61ta\x18\x05 \x01(\x0c\"\xe9\x03\n\x0f\x45xportedProcess\x12#\n\x08metadata\x18\x01 \x01(\x0b\x32\x11.ExportedMetadata\x12\x0b\n\x03pid\x18\x02 \x01(\r\x12\x0c\n\x04ppid\x18\x03 \x01(\r\x12\x0c\n\x04name\x18\x04 \x01(\t\x12\x0b\n\x03\x65xe\x18\x05 \x01(\t\x12\x0f\n\x07\x63mdline\x18\x06 \x01(\t\x12\r\n\x05\x63time\x18\x07 \x01(\x04\x12\x10\n\x08real_uid\x18\x08 \x01(\r\x12\x15\n\reffective_uid\x18\t \x01(\r\x12\x11\n\tsaved_uid\x18\n \x01(\r\x12\x10\n\x08real_gid\x18\x0b \x01(\r\x12\x15\n\reffective_gid\x18\x0c \x01(\r\x12\x11\n\tsaved_gid\x18\r \x01(\r\x12\x10\n\x08username\x18\x0e \x01(\t\x12\x10\n\x08terminal\x18\x0f \x01(\t\x12\x0e\n\x06status\x18\x10 \x01(\t\x12\x0c\n\x04nice\x18\x11 \x01(\x05\x12\x0b\n\x03\x63wd\x18\x12 \x01(\t\x12\x13\n\x0bnum_threads\x18\x13 \x01(\r\x12\x15\n\ruser_cpu_time\x18\x14 \x01(\x02\x12\x17\n\x0fsystem_cpu_time\x18\x15 \x01(\x02\x12\x13\n\x0b\x63pu_percent\x18\x16 \x01(\x02\x12\x10\n\x08rss_size\x18\x17 \x01(\x04\x12\x10\n\x08vms_size\x18\x18 \x01(\x04\x12\x16\n\x0ememory_percent\x18\x19 \x01(\x02\"\xc3\x02\n\x19\x45xportedNetworkConnection\x12#\n\x08metadata\x18\x01 \x01(\x0b\x32\x11.ExportedMetadata\x12)\n\x06\x66\x61mily\x18\x02 \x01(\x0e\x32\x19.NetworkConnection.Family\x12\x35\n\x04type\x18\x03 \x01(\x0e\x32\x17.NetworkConnection.Type:\x0eUNKNOWN_SOCKET\x12\'\n\rlocal_address\x18\x04 \x01(\x0b\x32\x10.NetworkEndpoint\x12(\n\x0eremote_address\x18\x05 \x01(\x0b\x32\x10.NetworkEndpoint\x12\x30\n\x05state\x18\x06 \x01(\x0e\x32\x18.NetworkConnection.State:\x07UNKNOWN\x12\x0b\n\x03pid\x18\x07 \x01(\r\x12\r\n\x05\x63time\x18\x08 \x01(\x04\"\x9b\x06\n\x0f\x45xportedAnomaly\x12L\n\x04type\x18\x01 \x01(\x0e\x32\x14.Anomaly.AnomalyTypeB(\xe2\xfc\xe3\xc4\x01\"\x12 Type of anomaly this represents.\x12\x62\n\x08severity\x18\x02 \x01(\x0e\x32\x15.Anomaly.AnomalyLevelB9\xe2\xfc\xe3\xc4\x01\x33\x12\x31Severity of the anomaly if it is a true positive.\x12\x62\n\nconfidence\x18\x03 \x01(\x0e\x32\x15.Anomaly.AnomalyLevelB7\xe2\xfc\xe3\xc4\x01\x31\x12/Confidence that the anomaly is a true positive.\x12<\n\x07symptom\x18\x04 \x01(\tB+\xe2\xfc\xe3\xc4\x01%\x12#A description of what is anomalous.\x12{\n\x0b\x65xplanation\x18\x05 \x01(\tBf\xe2\xfc\xe3\xc4\x01`\x12^A description of possible explanations for the anomaly if additional information is available.\x12~\n\x0cgenerated_by\x18\x06 \x01(\tBh\xe2\xfc\xe3\xc4\x01\x62\x12`String describing what generated the anomaly, this is normally the name of a parser or artifact.\x12\x65\n\x14\x61nomaly_reference_id\x18\x08 \x01(\tBG\xe2\xfc\xe3\xc4\x01\x41\x12?A string used to reference the anomaly in the Anomaly database.\x12P\n\x07\x66inding\x18\t \x01(\tB?\xe2\xfc\xe3\xc4\x01\x39\x12\x37String descriptions of data that triggered the Anomaly.\"\xe5\x01\n\x13\x45xportedCheckResult\x12#\n\x08metadata\x18\x01 \x01(\x0b\x32\x11.ExportedMetadata\x12P\n\x08\x63heck_id\x18\x02 \x01(\tB>\xe2\xfc\xe3\xc4\x01\x38\x12\x36The check id, identifies what check is being reported.\x12W\n\x07\x61nomaly\x18\x03 \x01(\x0b\x32\x10.ExportedAnomalyB4\xe2\xfc\xe3\xc4\x01.\x12,Specific finding indicating an issue exists.\"R\n\x10\x45xportedOpenFile\x12#\n\x08metadata\x18\x01 \x01(\x0b\x32\x11.ExportedMetadata\x12\x0b\n\x03pid\x18\x02 \x01(\r\x12\x0c\n\x04path\x18\x03 \x01(\t\"\x9b\x01\n\x15\x45xportedFileStoreHash\x12#\n\x08metadata\x18\x01 \x01(\x0b\x32\x11.ExportedMetadata\x12\x0c\n\x04hash\x18\x02 \x01(\t\x12\x11\n\thash_type\x18\x03 \x01(\t\x12\x18\n\x10\x66ingerprint_type\x18\x04 \x01(\t\x12\"\n\ntarget_urn\x18\x05 \x01(\tB\x0e\xe2\xfc\xe3\xc4\x01\x08\n\x06RDFURN\"\xad\x01\n\rExportedMatch\x12#\n\x08metadata\x18\x01 \x01(\x0b\x32\x11.ExportedMetadata\x12\x0e\n\x06offset\x18\x02 \x01(\x04\x12\x0e\n\x06length\x18\x03 \x01(\x04\x12\x0c\n\x04\x64\x61ta\x18\x04 \x01(\x0c\x12I\n\x03urn\x18\x05 \x01(\tB<\xe2\xfc\xe3\xc4\x01\x36\n\x06RDFURN\x12,The location of this file in the AFF4 space.\"R\n\rExportedBytes\x12#\n\x08metadata\x18\x01 \x01(\x0b\x32\x11.ExportedMetadata\x12\x0c\n\x04\x64\x61ta\x18\x02 \x01(\x0c\x12\x0e\n\x06length\x18\x03 \x01(\x04\"C\n\x0e\x45xportedString\x12#\n\x08metadata\x18\x01 \x01(\x0b\x32\x11.ExportedMetadata\x12\x0c\n\x04\x64\x61ta\x18\x02 \x01(\t\"S\n\x10\x45xportedDictItem\x12#\n\x08metadata\x18\x01 \x01(\x0b\x32\x11.ExportedMetadata\x12\x0b\n\x03key\x18\x02 \x01(\t\x12\r\n\x05value\x18\x03 \x01(\t\"\xe3\x01\n%ExportedArtifactFilesDownloaderResult\x12#\n\x08metadata\x18\x01 \x01(\x0b\x32\x11.ExportedMetadata\x12\x33\n\x15original_registry_key\x18\x02 \x01(\x0b\x32\x14.ExportedRegistryKey\x12$\n\roriginal_file\x18\x05 \x01(\x0b\x32\r.ExportedFile\x12\x12\n\nfound_path\x18\x03 \x01(\t\x12&\n\x0f\x64ownloaded_file\x18\x04 \x01(\x0b\x32\r.ExportedFile\"\x99\x02\n\x1c\x45xportedYaraProcessScanMatch\x12#\n\x08metadata\x18\x01 \x01(\x0b\x32\x11.ExportedMetadata\x12\x44\n\x07process\x18\x02 \x01(\x0b\x32\x10.ExportedProcessB!\xe2\xfc\xe3\xc4\x01\x1b\x12\x19Matching process details.\x12?\n\trule_name\x18\x03 \x01(\tB,\xe2\xfc\xe3\xc4\x01&\x12$The name of the rule that triggered.\x12M\n\x0cscan_time_us\x18\x04 \x01(\x04\x42\x37\xe2\xfc\xe3\xc4\x01\x31\x12/Time in microseconds taken to perform the scan.\"\x8a\x01\n\x1a\x45xportedYaraSignatureMatch\x12#\n\x08metadata\x18\x01 \x01(\x0b\x32\x11.ExportedMetadata\x12\'\n\x07process\x18\x02 \x01(\x0b\x32\x16.ExportedRekallProcess\x12\x0c\n\x04rule\x18\x03 \x01(\t\x12\x10\n\x08hex_dump\x18\x04 \x01(\t\"\xdb\x06\n\x15\x45xportedRekallProcess\x12#\n\x08metadata\x18\x01 \x01(\x0b\x32\x11.ExportedMetadata\x12\x37\n\x03pid\x18\x02 \x01(\x04\x42*\xe2\xfc\xe3\xc4\x01$\x12\"Unique process ID of this process.\x12\'\n\x04name\x18\x03 \x01(\tB\x19\xe2\xfc\xe3\xc4\x01\x13\x12\x11The process name.\x12g\n\x08\x66ullpath\x18\x04 \x01(\tBU\xe2\xfc\xe3\xc4\x01O\x12MThe full path of the executable that was loaded when the process was started.\x12o\n\rcreation_time\x18\x05 \x01(\x04\x42X\xe2\xfc\xe3\xc4\x01R\n\x0bRDFDatetime\x12\x43When the process was created. In microseconds from UNIX epoch. UTC.\x12g\n\texit_time\x18\x06 \x01(\x04\x42T\xe2\xfc\xe3\xc4\x01N\n\x0bRDFDatetime\x12?When the process exitted. In microseconds from UNIX epoch. UTC.\x12\x44\n\nparent_pid\x18\x07 \x01(\x04\x42\x30\xe2\xfc\xe3\xc4\x01*\x12(Unique process ID of the parent process.\x12I\n\x0b\x63ommandline\x18\x08 \x01(\tB4\xe2\xfc\xe3\xc4\x01.\x12,The commandline used to launch this process.\x12\xe6\x01\n\x10trusted_fullpath\x18\t \x01(\tB\xcb\x01\xe2\xfc\xe3\xc4\x01\xc4\x01\x12\xc1\x01The full path of the executable that was loaded when the process was started. Obtained via a trusted method that\'s not easily tampered with. If no such method exists, do not fill in this field.\"\xad\x07\n!ExportedRekallWindowsLoadedModule\x12#\n\x08metadata\x18\x01 \x01(\x0b\x32\x11.ExportedMetadata\x12\'\n\x07process\x18\x02 \x01(\x0b\x32\x16.ExportedRekallProcess\x12H\n\x08\x66ullpath\x18\x03 \x01(\tB6\xe2\xfc\xe3\xc4\x01\x30\x12.The full path of the file backing this module.\x12\x41\n\x07\x61\x64\x64ress\x18\x04 \x01(\x04\x42\x30\xe2\xfc\xe3\xc4\x01*\x12(Base address where the module is loaded.\x12)\n\x04size\x18\x05 \x01(\x04\x42\x1b\xe2\xfc\xe3\xc4\x01\x15\x12\x13Size of the module.\x12\x8a\x01\n\x0fis_in_load_list\x18\x06 \x01(\x08\x42q\xe2\xfc\xe3\xc4\x01k\x12iWhether the module is referenced in the InLoadOrderLinksInLoadOrderModuleList of the Process Environment.\x12K\n\x10in_load_fullpath\x18\x07 \x01(\tB1\xe2\xfc\xe3\xc4\x01+\x12)The full path of the module in this list.\x12\x8a\x01\n\x0fis_in_init_list\x18\x08 \x01(\x08\x42q\xe2\xfc\xe3\xc4\x01k\x12iWhether the module is referenced in the InInitializationOrderModuleList of the Process Environment Block.\x12K\n\x10in_init_fullpath\x18\t \x01(\tB1\xe2\xfc\xe3\xc4\x01+\x12)The full path of the module in this list.\x12\x81\x01\n\x0eis_in_mem_list\x18\n \x01(\x08\x42i\xe2\xfc\xe3\xc4\x01\x63\x12\x61Whether the module is referenced in the InMemoryOrderModuleList of the Process Environment Block.\x12J\n\x0fin_mem_fullpath\x18\x0b \x01(\tB1\xe2\xfc\xe3\xc4\x01+\x12)The full path of the module in this list.\"\xb2\x02\n\x15\x45xportedWindowsHandle\x12#\n\x08metadata\x18\x01 \x01(\x0b\x32\x11.ExportedMetadata\x12\'\n\x07process\x18\x02 \x01(\x0b\x32\x16.ExportedRekallProcess\x12H\n\x07\x61\x64\x64ress\x18\x03 \x01(\x04\x42\x37\xe2\xfc\xe3\xc4\x01\x31\x12/The address of the OBJECT_HEADER of the handle.\x12R\n\x04type\x18\x04 \x01(\tBD\xe2\xfc\xe3\xc4\x01>\x12<The type of handle (Process, Thread, Key, Event, Mutant...).\x12-\n\x04name\x18\x05 \x01(\tB\x1f\xe2\xfc\xe3\xc4\x01\x19\x12\x17The name of the handle.\"\xf5\x02\n\x1e\x45xportedLinuxSyscallTableEntry\x12#\n\x08metadata\x18\x01 \x01(\x0b\x32\x11.ExportedMetadata\x12\x35\n\x05table\x18\x02 \x01(\tB&\xe2\xfc\xe3\xc4\x01 \x12\x1eThe name of the syscall table.\x12X\n\x05index\x18\x03 \x01(\x04\x42I\xe2\xfc\xe3\xc4\x01\x43\x12\x41The index within the table. It\'s equivalent to the syscall number\x12\x44\n\x0fhandler_address\x18\x04 \x01(\x04\x42+\xe2\xfc\xe3\xc4\x01%\x12#The address of the syscall handler.\x12W\n\x06symbol\x18\x05 \x01(\tBG\xe2\xfc\xe3\xc4\x01\x41\x12?The resolved symbol name for the handler (i.e: linux!sys_read).\"\x96\x05\n\x17\x45xportedRekallLinuxTask\x12#\n\x08metadata\x18\x01 \x01(\x0b\x32\x11.ExportedMetadata\x12@\n\x07\x61\x64\x64ress\x18\x02 \x01(\x04\x42/\xe2\xfc\xe3\xc4\x01)\x12\'The kernel address of this task_struct.\x12\x37\n\x03pid\x18\x03 \x01(\x04\x42*\xe2\xfc\xe3\xc4\x01$\x12\"Unique process ID of this process.\x12\'\n\x04name\x18\x04 \x01(\tB\x19\xe2\xfc\xe3\xc4\x01\x13\x12\x11The process name.\x12o\n\rcreation_time\x18\x05 \x01(\x04\x42X\xe2\xfc\xe3\xc4\x01R\n\x0bRDFDatetime\x12\x43When the process was created. In microseconds from UNIX epoch. UTC.\x12\x44\n\nparent_pid\x18\x06 \x01(\x04\x42\x30\xe2\xfc\xe3\xc4\x01*\x12(Unique process ID of the parent process.\x12I\n\x0b\x63ommandline\x18\x07 \x01(\tB4\xe2\xfc\xe3\xc4\x01.\x12,The commandline used to launch this process.\x12%\n\x03uid\x18\x08 \x01(\x04\x42\x18\xe2\xfc\xe3\xc4\x01\x12\x12\x10The current UID.\x12%\n\x03gid\x18\t \x01(\x04\x42\x18\xe2\xfc\xe3\xc4\x01\x12\x12\x10The current GID.\x12\x30\n\x04\x65uid\x18\n \x01(\x04\x42\"\xe2\xfc\xe3\xc4\x01\x1c\x12\x1aThe current effective UID.\x12\x30\n\x04\x65gid\x18\x0b \x01(\x04\x42\"\xe2\xfc\xe3\xc4\x01\x1c\x12\x1aThe current effective GID.\"\x9e\x03\n\x19\x45xportedRekallLinuxTaskOp\x12#\n\x08metadata\x18\x01 \x01(\x0b\x32\x11.ExportedMetadata\x12S\n\x04task\x18\x02 \x01(\x0b\x32\x18.ExportedRekallLinuxTaskB+\xe2\xfc\xe3\xc4\x01%\x12#The task this operation applies to.\x12\x35\n\toperation\x18\x03 \x01(\tB\"\xe2\xfc\xe3\xc4\x01\x1c\x12\x1aThe name of the operation.\x12<\n\x0fhandler_address\x18\x04 \x01(\x04\x42#\xe2\xfc\xe3\xc4\x01\x1d\x12\x1bThe address of the handler.\x12N\n\x06module\x18\x05 \x01(\tB>\xe2\xfc\xe3\xc4\x01\x38\x12\x36The name of the kernel module that holds the callback.\x12\x42\n\x06symbol\x18\x06 \x01(\tB2\xe2\xfc\xe3\xc4\x01,\x12*The name of the symbol at handler_address.\"\x9e\x03\n\x19\x45xportedRekallLinuxProcOp\x12#\n\x08metadata\x18\x01 \x01(\x0b\x32\x11.ExportedMetadata\x12S\n\x08\x66ullpath\x18\x02 \x01(\tBA\xe2\xfc\xe3\xc4\x01;\x12\x39The fullpath to the proc entry this operation belongs to.\x12\x35\n\toperation\x18\x03 \x01(\tB\"\xe2\xfc\xe3\xc4\x01\x1c\x12\x1aThe name of the operation.\x12<\n\x0fhandler_address\x18\x04 \x01(\x04\x42#\xe2\xfc\xe3\xc4\x01\x1d\x12\x1bThe address of the handler.\x12N\n\x06module\x18\x05 \x01(\tB>\xe2\xfc\xe3\xc4\x01\x38\x12\x36The name of the kernel module that holds the callback.\x12\x42\n\x06symbol\x18\x06 \x01(\tB2\xe2\xfc\xe3\xc4\x01,\x12*The name of the symbol at handler_address.\"\x97\x01\n\x1a\x45xportedRekallKernelObject\x12#\n\x08metadata\x18\x01 \x01(\x0b\x32\x11.ExportedMetadata\x12)\n\x04type\x18\x02 \x01(\tB\x1b\xe2\xfc\xe3\xc4\x01\x15\x12\x13Kernel object type.\x12)\n\x04name\x18\x03 \x01(\tB\x1b\xe2\xfc\xe3\xc4\x01\x15\x12\x13Kernel object name.')
  ,
  dependencies=[grr__response__proto_dot_anomaly__pb2.DESCRIPTOR,grr__response__proto_dot_jobs__pb2.DESCRIPTOR,grr__response__proto_dot_sysinfo__pb2.DESCRIPTOR,grr__response__proto_dot_semantic__pb2.DESCRIPTOR,])




_EXPORTOPTIONS = _descriptor.Descriptor(
  name='ExportOptions',
  full_name='ExportOptions',
  filename=None,
  file=DESCRIPTOR,
  containing_type=None,
  fields=[
    _descriptor.FieldDescriptor(
      name='export_files_contents', full_name='ExportOptions.export_files_contents', index=0,
      number=1, type=8, cpp_type=7, label=1,
      has_default_value=True, default_value=False,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001\365\001\022\362\001If this is true, open files and export their full or partial contents. Note: this may require additional datastore roundtrips and slow down the export process, also exporting file contents may significantly increase size of the exported data.'))),
    _descriptor.FieldDescriptor(
      name='follow_urns', full_name='ExportOptions.follow_urns', index=1,
      number=2, type=8, cpp_type=7, label=1,
      has_default_value=True, default_value=False,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001\320\001\022\315\001If this is true, follow urns and try to export not only the urns themselves, but also the data they are pointing to. Note: this may require additional datastore roundtrips and slow down the export process.'))),
    _descriptor.FieldDescriptor(
      name='export_files_hashes', full_name='ExportOptions.export_files_hashes', index=2,
      number=3, type=8, cpp_type=7, label=1,
      has_default_value=True, default_value=True,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001\211\003\022\206\003If this is true, export hashes when dealing with file-related values. The files won\'t be hashed during the export, hashes will only be exported if they were collected before the export. This option affects exporting VFSFile and StatEntry RDFValues. This is true by default even though it requires extra  datastore roundtrips because it\'s very useful and users expect the hashes to be there.'))),
    _descriptor.FieldDescriptor(
      name='annotations', full_name='ExportOptions.annotations', index=3,
      number=4, type=9, cpp_type=9, label=3,
      has_default_value=False, default_value=[],
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001\304\001\022\301\001Annotations to add to exported data. This field can be used to differentiate sets of exported data inside a particular exported type. e.g. data collected by users vs. data collected by cronjob.'))),
  ],
  extensions=[
  ],
  nested_types=[],
  enum_types=[
  ],
  options=None,
  is_extendable=False,
  syntax='proto2',
  extension_ranges=[],
  oneofs=[
  ],
  serialized_start=170,
  serialized_end=1393,
)


_EXPORTEDMETADATA = _descriptor.Descriptor(
  name='ExportedMetadata',
  full_name='ExportedMetadata',
  filename=None,
  file=DESCRIPTOR,
  containing_type=None,
  fields=[
    _descriptor.FieldDescriptor(
      name='client_urn', full_name='ExportedMetadata.client_urn', index=0,
      number=1, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001<\n\tClientURN\022/Client ID of a client that contains this entry.'))),
    _descriptor.FieldDescriptor(
      name='hostname', full_name='ExportedMetadata.hostname', index=1,
      number=2, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001\022\022\020Client hostname.'))),
    _descriptor.FieldDescriptor(
      name='os', full_name='ExportedMetadata.os', index=2,
      number=3, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\0017\0225Client Operating System class (Windows|Darwin|Linux).'))),
    _descriptor.FieldDescriptor(
      name='client_age', full_name='ExportedMetadata.client_age', index=3,
      number=4, type=4, cpp_type=4, label=1,
      has_default_value=False, default_value=0,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001!\n\013RDFDatetime\022\022Age of the client.'))),
    _descriptor.FieldDescriptor(
      name='uname', full_name='ExportedMetadata.uname', index=4,
      number=5, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001\017\022\rUname string.'))),
    _descriptor.FieldDescriptor(
      name='os_release', full_name='ExportedMetadata.os_release', index=5,
      number=6, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\0010\022.The OS release identifier e.g. 7, OSX, debian.'))),
    _descriptor.FieldDescriptor(
      name='os_version', full_name='ExportedMetadata.os_version', index=6,
      number=7, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\0014\0222The OS version ID e.g. 6.1.7601SP1, 10.9.2, 14.04.'))),
    _descriptor.FieldDescriptor(
      name='usernames', full_name='ExportedMetadata.usernames', index=7,
      number=8, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001\013\022\tUsername.'))),
    _descriptor.FieldDescriptor(
      name='mac_address', full_name='ExportedMetadata.mac_address', index=8,
      number=9, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001\016\022\014MAC address.'))),
    _descriptor.FieldDescriptor(
      name='timestamp', full_name='ExportedMetadata.timestamp', index=9,
      number=10, type=4, cpp_type=4, label=1,
      has_default_value=False, default_value=0,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001&\n\013RDFDatetime\022\027When data was exported.'))),
    _descriptor.FieldDescriptor(
      name='original_timestamp', full_name='ExportedMetadata.original_timestamp', index=10,
      number=15, type=4, cpp_type=4, label=1,
      has_default_value=False, default_value=0,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\0010\n\013RDFDatetime\022!When original data was generated.'))),
    _descriptor.FieldDescriptor(
      name='deprecated_session_id', full_name='ExportedMetadata.deprecated_session_id', index=11,
      number=11, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\030\001\342\374\343\304\001E\n\tSessionID\0228Deprecated session id of a hunt that collected the data.'))),
    _descriptor.FieldDescriptor(
      name='labels', full_name='ExportedMetadata.labels', index=12,
      number=12, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001\034\022\032CSV list of client labels.'))),
    _descriptor.FieldDescriptor(
      name='system_labels', full_name='ExportedMetadata.system_labels', index=13,
      number=18, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001,\022*Labels hardcoded into GRR clients configs.'))),
    _descriptor.FieldDescriptor(
      name='user_labels', full_name='ExportedMetadata.user_labels', index=14,
      number=19, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001-\022+Labels assigned by GRR uses via the UI/API.'))),
    _descriptor.FieldDescriptor(
      name='source_urn', full_name='ExportedMetadata.source_urn', index=15,
      number=13, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001+\n\006RDFURN\022!URN of a source of exported data.'))),
    _descriptor.FieldDescriptor(
      name='annotations', full_name='ExportedMetadata.annotations', index=16,
      number=14, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001\306\001\022\303\001CSV list of annotations for this data. This field can be used to differentiate sets of exported data inside a particular exported type. e.g. data collected by users vs. data collected by cronjob.'))),
    _descriptor.FieldDescriptor(
      name='hardware_info', full_name='ExportedMetadata.hardware_info', index=17,
      number=16, type=11, cpp_type=10, label=1,
      has_default_value=False, default_value=None,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001%\022#Hardware information of the client.'))),
    _descriptor.FieldDescriptor(
      name='kernel_version', full_name='ExportedMetadata.kernel_version', index=18,
      number=17, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001\030\022\026Client kernel version.'))),
  ],
  extensions=[
  ],
  nested_types=[],
  enum_types=[
  ],
  options=None,
  is_extendable=False,
  syntax='proto2',
  extension_ranges=[],
  oneofs=[
  ],
  serialized_start=1396,
  serialized_end=2857,
)


_EXPORTEDCLIENT = _descriptor.Descriptor(
  name='ExportedClient',
  full_name='ExportedClient',
  filename=None,
  file=DESCRIPTOR,
  containing_type=None,
  fields=[
    _descriptor.FieldDescriptor(
      name='metadata', full_name='ExportedClient.metadata', index=0,
      number=1, type=11, cpp_type=10, label=1,
      has_default_value=False, default_value=None,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
  ],
  extensions=[
  ],
  nested_types=[],
  enum_types=[
  ],
  options=None,
  is_extendable=False,
  syntax='proto2',
  extension_ranges=[],
  oneofs=[
  ],
  serialized_start=2859,
  serialized_end=2912,
)


_EXPORTEDNETWORKINTERFACE = _descriptor.Descriptor(
  name='ExportedNetworkInterface',
  full_name='ExportedNetworkInterface',
  filename=None,
  file=DESCRIPTOR,
  containing_type=None,
  fields=[
    _descriptor.FieldDescriptor(
      name='metadata', full_name='ExportedNetworkInterface.metadata', index=0,
      number=1, type=11, cpp_type=10, label=1,
      has_default_value=False, default_value=None,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='mac_address', full_name='ExportedNetworkInterface.mac_address', index=1,
      number=2, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='ifname', full_name='ExportedNetworkInterface.ifname', index=2,
      number=3, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='ip4_addresses', full_name='ExportedNetworkInterface.ip4_addresses', index=3,
      number=4, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='ip6_addresses', full_name='ExportedNetworkInterface.ip6_addresses', index=4,
      number=5, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
  ],
  extensions=[
  ],
  nested_types=[],
  enum_types=[
  ],
  options=None,
  is_extendable=False,
  syntax='proto2',
  extension_ranges=[],
  oneofs=[
  ],
  serialized_start=2915,
  serialized_end=3061,
)


_EXPORTEDDNSCLIENTCONFIGURATION = _descriptor.Descriptor(
  name='ExportedDNSClientConfiguration',
  full_name='ExportedDNSClientConfiguration',
  filename=None,
  file=DESCRIPTOR,
  containing_type=None,
  fields=[
    _descriptor.FieldDescriptor(
      name='metadata', full_name='ExportedDNSClientConfiguration.metadata', index=0,
      number=1, type=11, cpp_type=10, label=1,
      has_default_value=False, default_value=None,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='dns_servers', full_name='ExportedDNSClientConfiguration.dns_servers', index=1,
      number=2, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='dns_suffixes', full_name='ExportedDNSClientConfiguration.dns_suffixes', index=2,
      number=3, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
  ],
  extensions=[
  ],
  nested_types=[],
  enum_types=[
  ],
  options=None,
  is_extendable=False,
  syntax='proto2',
  extension_ranges=[],
  oneofs=[
  ],
  serialized_start=3063,
  serialized_end=3175,
)


_EXPORTEDFILE = _descriptor.Descriptor(
  name='ExportedFile',
  full_name='ExportedFile',
  filename=None,
  file=DESCRIPTOR,
  containing_type=None,
  fields=[
    _descriptor.FieldDescriptor(
      name='metadata', full_name='ExportedFile.metadata', index=0,
      number=1, type=11, cpp_type=10, label=1,
      has_default_value=False, default_value=None,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='urn', full_name='ExportedFile.urn', index=1,
      number=2, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\0016\n\006RDFURN\022,The location of this file in the AFF4 space.'))),
    _descriptor.FieldDescriptor(
      name='basename', full_name='ExportedFile.basename', index=2,
      number=3, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001\027\022\025Basename of the file.'))),
    _descriptor.FieldDescriptor(
      name='st_mode', full_name='ExportedFile.st_mode', index=3,
      number=4, type=4, cpp_type=4, label=1,
      has_default_value=False, default_value=0,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001(\n\010StatMode\022\034A unix file permission mode.'))),
    _descriptor.FieldDescriptor(
      name='st_ino', full_name='ExportedFile.st_ino', index=4,
      number=5, type=13, cpp_type=3, label=1,
      has_default_value=False, default_value=0,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='st_dev', full_name='ExportedFile.st_dev', index=5,
      number=6, type=13, cpp_type=3, label=1,
      has_default_value=False, default_value=0,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='st_nlink', full_name='ExportedFile.st_nlink', index=6,
      number=7, type=13, cpp_type=3, label=1,
      has_default_value=False, default_value=0,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='st_uid', full_name='ExportedFile.st_uid', index=7,
      number=8, type=13, cpp_type=3, label=1,
      has_default_value=False, default_value=0,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='st_gid', full_name='ExportedFile.st_gid', index=8,
      number=9, type=13, cpp_type=3, label=1,
      has_default_value=False, default_value=0,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='st_size', full_name='ExportedFile.st_size', index=9,
      number=10, type=4, cpp_type=4, label=1,
      has_default_value=False, default_value=0,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='st_atime', full_name='ExportedFile.st_atime', index=10,
      number=11, type=4, cpp_type=4, label=1,
      has_default_value=False, default_value=0,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001\'\n\022RDFDatetimeSeconds\022\021Last access time.'))),
    _descriptor.FieldDescriptor(
      name='st_mtime', full_name='ExportedFile.st_mtime', index=11,
      number=12, type=4, cpp_type=4, label=1,
      has_default_value=False, default_value=0,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001)\n\022RDFDatetimeSeconds\022\023Last modified time.'))),
    _descriptor.FieldDescriptor(
      name='st_ctime', full_name='ExportedFile.st_ctime', index=12,
      number=13, type=4, cpp_type=4, label=1,
      has_default_value=False, default_value=0,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001-\n\022RDFDatetimeSeconds\022\027Last inode change time.'))),
    _descriptor.FieldDescriptor(
      name='st_blocks', full_name='ExportedFile.st_blocks', index=13,
      number=14, type=13, cpp_type=3, label=1,
      has_default_value=False, default_value=0,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='st_blksize', full_name='ExportedFile.st_blksize', index=14,
      number=15, type=13, cpp_type=3, label=1,
      has_default_value=False, default_value=0,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='st_rdev', full_name='ExportedFile.st_rdev', index=15,
      number=16, type=13, cpp_type=3, label=1,
      has_default_value=False, default_value=0,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='symlink', full_name='ExportedFile.symlink', index=16,
      number=17, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='content', full_name='ExportedFile.content', index=17,
      number=18, type=12, cpp_type=9, label=1,
      has_default_value=False, default_value=_b(""),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001*\022(Actual content of the file if available.'))),
    _descriptor.FieldDescriptor(
      name='content_sha256', full_name='ExportedFile.content_sha256', index=18,
      number=19, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001\023\022\021SHA256 of content'))),
    _descriptor.FieldDescriptor(
      name='hash_md5', full_name='ExportedFile.hash_md5', index=19,
      number=20, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='hash_sha1', full_name='ExportedFile.hash_sha1', index=20,
      number=21, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='hash_sha256', full_name='ExportedFile.hash_sha256', index=21,
      number=22, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='pecoff_hash_md5', full_name='ExportedFile.pecoff_hash_md5', index=22,
      number=23, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='pecoff_hash_sha1', full_name='ExportedFile.pecoff_hash_sha1', index=23,
      number=24, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='cert_hasher_name', full_name='ExportedFile.cert_hasher_name', index=24,
      number=25, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='cert_program_name', full_name='ExportedFile.cert_program_name', index=25,
      number=26, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='cert_program_url', full_name='ExportedFile.cert_program_url', index=26,
      number=27, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='cert_signing_id', full_name='ExportedFile.cert_signing_id', index=27,
      number=28, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='cert_chain_head_issuer', full_name='ExportedFile.cert_chain_head_issuer', index=28,
      number=29, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='cert_countersignature_chain_head_issuer', full_name='ExportedFile.cert_countersignature_chain_head_issuer', index=29,
      number=30, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='cert_certificates', full_name='ExportedFile.cert_certificates', index=30,
      number=31, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
  ],
  extensions=[
  ],
  nested_types=[],
  enum_types=[
  ],
  options=None,
  is_extendable=False,
  syntax='proto2',
  extension_ranges=[],
  oneofs=[
  ],
  serialized_start=3178,
  serialized_end=4232,
)


_EXPORTEDREGISTRYKEY = _descriptor.Descriptor(
  name='ExportedRegistryKey',
  full_name='ExportedRegistryKey',
  filename=None,
  file=DESCRIPTOR,
  containing_type=None,
  fields=[
    _descriptor.FieldDescriptor(
      name='metadata', full_name='ExportedRegistryKey.metadata', index=0,
      number=1, type=11, cpp_type=10, label=1,
      has_default_value=False, default_value=None,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='urn', full_name='ExportedRegistryKey.urn', index=1,
      number=2, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001\"\n\006RDFURN\022\030URN of the registry key.'))),
    _descriptor.FieldDescriptor(
      name='last_modified', full_name='ExportedRegistryKey.last_modified', index=2,
      number=3, type=4, cpp_type=4, label=1,
      has_default_value=False, default_value=0,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001.\n\022RDFDatetimeSeconds\022\030Last modified timestamp.'))),
    _descriptor.FieldDescriptor(
      name='type', full_name='ExportedRegistryKey.type', index=3,
      number=4, type=14, cpp_type=8, label=1,
      has_default_value=False, default_value=0,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='data', full_name='ExportedRegistryKey.data', index=4,
      number=5, type=12, cpp_type=9, label=1,
      has_default_value=False, default_value=_b(""),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
  ],
  extensions=[
  ],
  nested_types=[],
  enum_types=[
  ],
  options=None,
  is_extendable=False,
  syntax='proto2',
  extension_ranges=[],
  oneofs=[
  ],
  serialized_start=4235,
  serialized_end=4478,
)


_EXPORTEDPROCESS = _descriptor.Descriptor(
  name='ExportedProcess',
  full_name='ExportedProcess',
  filename=None,
  file=DESCRIPTOR,
  containing_type=None,
  fields=[
    _descriptor.FieldDescriptor(
      name='metadata', full_name='ExportedProcess.metadata', index=0,
      number=1, type=11, cpp_type=10, label=1,
      has_default_value=False, default_value=None,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='pid', full_name='ExportedProcess.pid', index=1,
      number=2, type=13, cpp_type=3, label=1,
      has_default_value=False, default_value=0,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='ppid', full_name='ExportedProcess.ppid', index=2,
      number=3, type=13, cpp_type=3, label=1,
      has_default_value=False, default_value=0,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='name', full_name='ExportedProcess.name', index=3,
      number=4, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='exe', full_name='ExportedProcess.exe', index=4,
      number=5, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='cmdline', full_name='ExportedProcess.cmdline', index=5,
      number=6, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='ctime', full_name='ExportedProcess.ctime', index=6,
      number=7, type=4, cpp_type=4, label=1,
      has_default_value=False, default_value=0,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='real_uid', full_name='ExportedProcess.real_uid', index=7,
      number=8, type=13, cpp_type=3, label=1,
      has_default_value=False, default_value=0,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='effective_uid', full_name='ExportedProcess.effective_uid', index=8,
      number=9, type=13, cpp_type=3, label=1,
      has_default_value=False, default_value=0,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='saved_uid', full_name='ExportedProcess.saved_uid', index=9,
      number=10, type=13, cpp_type=3, label=1,
      has_default_value=False, default_value=0,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='real_gid', full_name='ExportedProcess.real_gid', index=10,
      number=11, type=13, cpp_type=3, label=1,
      has_default_value=False, default_value=0,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='effective_gid', full_name='ExportedProcess.effective_gid', index=11,
      number=12, type=13, cpp_type=3, label=1,
      has_default_value=False, default_value=0,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='saved_gid', full_name='ExportedProcess.saved_gid', index=12,
      number=13, type=13, cpp_type=3, label=1,
      has_default_value=False, default_value=0,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='username', full_name='ExportedProcess.username', index=13,
      number=14, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='terminal', full_name='ExportedProcess.terminal', index=14,
      number=15, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='status', full_name='ExportedProcess.status', index=15,
      number=16, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='nice', full_name='ExportedProcess.nice', index=16,
      number=17, type=5, cpp_type=1, label=1,
      has_default_value=False, default_value=0,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='cwd', full_name='ExportedProcess.cwd', index=17,
      number=18, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='num_threads', full_name='ExportedProcess.num_threads', index=18,
      number=19, type=13, cpp_type=3, label=1,
      has_default_value=False, default_value=0,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='user_cpu_time', full_name='ExportedProcess.user_cpu_time', index=19,
      number=20, type=2, cpp_type=6, label=1,
      has_default_value=False, default_value=float(0),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='system_cpu_time', full_name='ExportedProcess.system_cpu_time', index=20,
      number=21, type=2, cpp_type=6, label=1,
      has_default_value=False, default_value=float(0),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='cpu_percent', full_name='ExportedProcess.cpu_percent', index=21,
      number=22, type=2, cpp_type=6, label=1,
      has_default_value=False, default_value=float(0),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='rss_size', full_name='ExportedProcess.rss_size', index=22,
      number=23, type=4, cpp_type=4, label=1,
      has_default_value=False, default_value=0,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='vms_size', full_name='ExportedProcess.vms_size', index=23,
      number=24, type=4, cpp_type=4, label=1,
      has_default_value=False, default_value=0,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='memory_percent', full_name='ExportedProcess.memory_percent', index=24,
      number=25, type=2, cpp_type=6, label=1,
      has_default_value=False, default_value=float(0),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
  ],
  extensions=[
  ],
  nested_types=[],
  enum_types=[
  ],
  options=None,
  is_extendable=False,
  syntax='proto2',
  extension_ranges=[],
  oneofs=[
  ],
  serialized_start=4481,
  serialized_end=4970,
)


_EXPORTEDNETWORKCONNECTION = _descriptor.Descriptor(
  name='ExportedNetworkConnection',
  full_name='ExportedNetworkConnection',
  filename=None,
  file=DESCRIPTOR,
  containing_type=None,
  fields=[
    _descriptor.FieldDescriptor(
      name='metadata', full_name='ExportedNetworkConnection.metadata', index=0,
      number=1, type=11, cpp_type=10, label=1,
      has_default_value=False, default_value=None,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='family', full_name='ExportedNetworkConnection.family', index=1,
      number=2, type=14, cpp_type=8, label=1,
      has_default_value=False, default_value=2,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='type', full_name='ExportedNetworkConnection.type', index=2,
      number=3, type=14, cpp_type=8, label=1,
      has_default_value=True, default_value=0,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='local_address', full_name='ExportedNetworkConnection.local_address', index=3,
      number=4, type=11, cpp_type=10, label=1,
      has_default_value=False, default_value=None,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='remote_address', full_name='ExportedNetworkConnection.remote_address', index=4,
      number=5, type=11, cpp_type=10, label=1,
      has_default_value=False, default_value=None,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='state', full_name='ExportedNetworkConnection.state', index=5,
      number=6, type=14, cpp_type=8, label=1,
      has_default_value=True, default_value=0,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='pid', full_name='ExportedNetworkConnection.pid', index=6,
      number=7, type=13, cpp_type=3, label=1,
      has_default_value=False, default_value=0,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='ctime', full_name='ExportedNetworkConnection.ctime', index=7,
      number=8, type=4, cpp_type=4, label=1,
      has_default_value=False, default_value=0,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
  ],
  extensions=[
  ],
  nested_types=[],
  enum_types=[
  ],
  options=None,
  is_extendable=False,
  syntax='proto2',
  extension_ranges=[],
  oneofs=[
  ],
  serialized_start=4973,
  serialized_end=5296,
)


_EXPORTEDANOMALY = _descriptor.Descriptor(
  name='ExportedAnomaly',
  full_name='ExportedAnomaly',
  filename=None,
  file=DESCRIPTOR,
  containing_type=None,
  fields=[
    _descriptor.FieldDescriptor(
      name='type', full_name='ExportedAnomaly.type', index=0,
      number=1, type=14, cpp_type=8, label=1,
      has_default_value=False, default_value=0,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001\"\022 Type of anomaly this represents.'))),
    _descriptor.FieldDescriptor(
      name='severity', full_name='ExportedAnomaly.severity', index=1,
      number=2, type=14, cpp_type=8, label=1,
      has_default_value=False, default_value=0,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\0013\0221Severity of the anomaly if it is a true positive.'))),
    _descriptor.FieldDescriptor(
      name='confidence', full_name='ExportedAnomaly.confidence', index=2,
      number=3, type=14, cpp_type=8, label=1,
      has_default_value=False, default_value=0,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\0011\022/Confidence that the anomaly is a true positive.'))),
    _descriptor.FieldDescriptor(
      name='symptom', full_name='ExportedAnomaly.symptom', index=3,
      number=4, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001%\022#A description of what is anomalous.'))),
    _descriptor.FieldDescriptor(
      name='explanation', full_name='ExportedAnomaly.explanation', index=4,
      number=5, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001`\022^A description of possible explanations for the anomaly if additional information is available.'))),
    _descriptor.FieldDescriptor(
      name='generated_by', full_name='ExportedAnomaly.generated_by', index=5,
      number=6, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001b\022`String describing what generated the anomaly, this is normally the name of a parser or artifact.'))),
    _descriptor.FieldDescriptor(
      name='anomaly_reference_id', full_name='ExportedAnomaly.anomaly_reference_id', index=6,
      number=8, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001A\022?A string used to reference the anomaly in the Anomaly database.'))),
    _descriptor.FieldDescriptor(
      name='finding', full_name='ExportedAnomaly.finding', index=7,
      number=9, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\0019\0227String descriptions of data that triggered the Anomaly.'))),
  ],
  extensions=[
  ],
  nested_types=[],
  enum_types=[
  ],
  options=None,
  is_extendable=False,
  syntax='proto2',
  extension_ranges=[],
  oneofs=[
  ],
  serialized_start=5299,
  serialized_end=6094,
)


_EXPORTEDCHECKRESULT = _descriptor.Descriptor(
  name='ExportedCheckResult',
  full_name='ExportedCheckResult',
  filename=None,
  file=DESCRIPTOR,
  containing_type=None,
  fields=[
    _descriptor.FieldDescriptor(
      name='metadata', full_name='ExportedCheckResult.metadata', index=0,
      number=1, type=11, cpp_type=10, label=1,
      has_default_value=False, default_value=None,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='check_id', full_name='ExportedCheckResult.check_id', index=1,
      number=2, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\0018\0226The check id, identifies what check is being reported.'))),
    _descriptor.FieldDescriptor(
      name='anomaly', full_name='ExportedCheckResult.anomaly', index=2,
      number=3, type=11, cpp_type=10, label=1,
      has_default_value=False, default_value=None,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001.\022,Specific finding indicating an issue exists.'))),
  ],
  extensions=[
  ],
  nested_types=[],
  enum_types=[
  ],
  options=None,
  is_extendable=False,
  syntax='proto2',
  extension_ranges=[],
  oneofs=[
  ],
  serialized_start=6097,
  serialized_end=6326,
)


_EXPORTEDOPENFILE = _descriptor.Descriptor(
  name='ExportedOpenFile',
  full_name='ExportedOpenFile',
  filename=None,
  file=DESCRIPTOR,
  containing_type=None,
  fields=[
    _descriptor.FieldDescriptor(
      name='metadata', full_name='ExportedOpenFile.metadata', index=0,
      number=1, type=11, cpp_type=10, label=1,
      has_default_value=False, default_value=None,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='pid', full_name='ExportedOpenFile.pid', index=1,
      number=2, type=13, cpp_type=3, label=1,
      has_default_value=False, default_value=0,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='path', full_name='ExportedOpenFile.path', index=2,
      number=3, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
  ],
  extensions=[
  ],
  nested_types=[],
  enum_types=[
  ],
  options=None,
  is_extendable=False,
  syntax='proto2',
  extension_ranges=[],
  oneofs=[
  ],
  serialized_start=6328,
  serialized_end=6410,
)


_EXPORTEDFILESTOREHASH = _descriptor.Descriptor(
  name='ExportedFileStoreHash',
  full_name='ExportedFileStoreHash',
  filename=None,
  file=DESCRIPTOR,
  containing_type=None,
  fields=[
    _descriptor.FieldDescriptor(
      name='metadata', full_name='ExportedFileStoreHash.metadata', index=0,
      number=1, type=11, cpp_type=10, label=1,
      has_default_value=False, default_value=None,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='hash', full_name='ExportedFileStoreHash.hash', index=1,
      number=2, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='hash_type', full_name='ExportedFileStoreHash.hash_type', index=2,
      number=3, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='fingerprint_type', full_name='ExportedFileStoreHash.fingerprint_type', index=3,
      number=4, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='target_urn', full_name='ExportedFileStoreHash.target_urn', index=4,
      number=5, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001\010\n\006RDFURN'))),
  ],
  extensions=[
  ],
  nested_types=[],
  enum_types=[
  ],
  options=None,
  is_extendable=False,
  syntax='proto2',
  extension_ranges=[],
  oneofs=[
  ],
  serialized_start=6413,
  serialized_end=6568,
)


_EXPORTEDMATCH = _descriptor.Descriptor(
  name='ExportedMatch',
  full_name='ExportedMatch',
  filename=None,
  file=DESCRIPTOR,
  containing_type=None,
  fields=[
    _descriptor.FieldDescriptor(
      name='metadata', full_name='ExportedMatch.metadata', index=0,
      number=1, type=11, cpp_type=10, label=1,
      has_default_value=False, default_value=None,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='offset', full_name='ExportedMatch.offset', index=1,
      number=2, type=4, cpp_type=4, label=1,
      has_default_value=False, default_value=0,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='length', full_name='ExportedMatch.length', index=2,
      number=3, type=4, cpp_type=4, label=1,
      has_default_value=False, default_value=0,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='data', full_name='ExportedMatch.data', index=3,
      number=4, type=12, cpp_type=9, label=1,
      has_default_value=False, default_value=_b(""),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='urn', full_name='ExportedMatch.urn', index=4,
      number=5, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\0016\n\006RDFURN\022,The location of this file in the AFF4 space.'))),
  ],
  extensions=[
  ],
  nested_types=[],
  enum_types=[
  ],
  options=None,
  is_extendable=False,
  syntax='proto2',
  extension_ranges=[],
  oneofs=[
  ],
  serialized_start=6571,
  serialized_end=6744,
)


_EXPORTEDBYTES = _descriptor.Descriptor(
  name='ExportedBytes',
  full_name='ExportedBytes',
  filename=None,
  file=DESCRIPTOR,
  containing_type=None,
  fields=[
    _descriptor.FieldDescriptor(
      name='metadata', full_name='ExportedBytes.metadata', index=0,
      number=1, type=11, cpp_type=10, label=1,
      has_default_value=False, default_value=None,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='data', full_name='ExportedBytes.data', index=1,
      number=2, type=12, cpp_type=9, label=1,
      has_default_value=False, default_value=_b(""),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='length', full_name='ExportedBytes.length', index=2,
      number=3, type=4, cpp_type=4, label=1,
      has_default_value=False, default_value=0,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
  ],
  extensions=[
  ],
  nested_types=[],
  enum_types=[
  ],
  options=None,
  is_extendable=False,
  syntax='proto2',
  extension_ranges=[],
  oneofs=[
  ],
  serialized_start=6746,
  serialized_end=6828,
)


_EXPORTEDSTRING = _descriptor.Descriptor(
  name='ExportedString',
  full_name='ExportedString',
  filename=None,
  file=DESCRIPTOR,
  containing_type=None,
  fields=[
    _descriptor.FieldDescriptor(
      name='metadata', full_name='ExportedString.metadata', index=0,
      number=1, type=11, cpp_type=10, label=1,
      has_default_value=False, default_value=None,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='data', full_name='ExportedString.data', index=1,
      number=2, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
  ],
  extensions=[
  ],
  nested_types=[],
  enum_types=[
  ],
  options=None,
  is_extendable=False,
  syntax='proto2',
  extension_ranges=[],
  oneofs=[
  ],
  serialized_start=6830,
  serialized_end=6897,
)


_EXPORTEDDICTITEM = _descriptor.Descriptor(
  name='ExportedDictItem',
  full_name='ExportedDictItem',
  filename=None,
  file=DESCRIPTOR,
  containing_type=None,
  fields=[
    _descriptor.FieldDescriptor(
      name='metadata', full_name='ExportedDictItem.metadata', index=0,
      number=1, type=11, cpp_type=10, label=1,
      has_default_value=False, default_value=None,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='key', full_name='ExportedDictItem.key', index=1,
      number=2, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='value', full_name='ExportedDictItem.value', index=2,
      number=3, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
  ],
  extensions=[
  ],
  nested_types=[],
  enum_types=[
  ],
  options=None,
  is_extendable=False,
  syntax='proto2',
  extension_ranges=[],
  oneofs=[
  ],
  serialized_start=6899,
  serialized_end=6982,
)


_EXPORTEDARTIFACTFILESDOWNLOADERRESULT = _descriptor.Descriptor(
  name='ExportedArtifactFilesDownloaderResult',
  full_name='ExportedArtifactFilesDownloaderResult',
  filename=None,
  file=DESCRIPTOR,
  containing_type=None,
  fields=[
    _descriptor.FieldDescriptor(
      name='metadata', full_name='ExportedArtifactFilesDownloaderResult.metadata', index=0,
      number=1, type=11, cpp_type=10, label=1,
      has_default_value=False, default_value=None,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='original_registry_key', full_name='ExportedArtifactFilesDownloaderResult.original_registry_key', index=1,
      number=2, type=11, cpp_type=10, label=1,
      has_default_value=False, default_value=None,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='original_file', full_name='ExportedArtifactFilesDownloaderResult.original_file', index=2,
      number=5, type=11, cpp_type=10, label=1,
      has_default_value=False, default_value=None,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='found_path', full_name='ExportedArtifactFilesDownloaderResult.found_path', index=3,
      number=3, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='downloaded_file', full_name='ExportedArtifactFilesDownloaderResult.downloaded_file', index=4,
      number=4, type=11, cpp_type=10, label=1,
      has_default_value=False, default_value=None,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
  ],
  extensions=[
  ],
  nested_types=[],
  enum_types=[
  ],
  options=None,
  is_extendable=False,
  syntax='proto2',
  extension_ranges=[],
  oneofs=[
  ],
  serialized_start=6985,
  serialized_end=7212,
)


_EXPORTEDYARAPROCESSSCANMATCH = _descriptor.Descriptor(
  name='ExportedYaraProcessScanMatch',
  full_name='ExportedYaraProcessScanMatch',
  filename=None,
  file=DESCRIPTOR,
  containing_type=None,
  fields=[
    _descriptor.FieldDescriptor(
      name='metadata', full_name='ExportedYaraProcessScanMatch.metadata', index=0,
      number=1, type=11, cpp_type=10, label=1,
      has_default_value=False, default_value=None,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='process', full_name='ExportedYaraProcessScanMatch.process', index=1,
      number=2, type=11, cpp_type=10, label=1,
      has_default_value=False, default_value=None,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001\033\022\031Matching process details.'))),
    _descriptor.FieldDescriptor(
      name='rule_name', full_name='ExportedYaraProcessScanMatch.rule_name', index=2,
      number=3, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001&\022$The name of the rule that triggered.'))),
    _descriptor.FieldDescriptor(
      name='scan_time_us', full_name='ExportedYaraProcessScanMatch.scan_time_us', index=3,
      number=4, type=4, cpp_type=4, label=1,
      has_default_value=False, default_value=0,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\0011\022/Time in microseconds taken to perform the scan.'))),
  ],
  extensions=[
  ],
  nested_types=[],
  enum_types=[
  ],
  options=None,
  is_extendable=False,
  syntax='proto2',
  extension_ranges=[],
  oneofs=[
  ],
  serialized_start=7215,
  serialized_end=7496,
)


_EXPORTEDYARASIGNATUREMATCH = _descriptor.Descriptor(
  name='ExportedYaraSignatureMatch',
  full_name='ExportedYaraSignatureMatch',
  filename=None,
  file=DESCRIPTOR,
  containing_type=None,
  fields=[
    _descriptor.FieldDescriptor(
      name='metadata', full_name='ExportedYaraSignatureMatch.metadata', index=0,
      number=1, type=11, cpp_type=10, label=1,
      has_default_value=False, default_value=None,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='process', full_name='ExportedYaraSignatureMatch.process', index=1,
      number=2, type=11, cpp_type=10, label=1,
      has_default_value=False, default_value=None,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='rule', full_name='ExportedYaraSignatureMatch.rule', index=2,
      number=3, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='hex_dump', full_name='ExportedYaraSignatureMatch.hex_dump', index=3,
      number=4, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
  ],
  extensions=[
  ],
  nested_types=[],
  enum_types=[
  ],
  options=None,
  is_extendable=False,
  syntax='proto2',
  extension_ranges=[],
  oneofs=[
  ],
  serialized_start=7499,
  serialized_end=7637,
)


_EXPORTEDREKALLPROCESS = _descriptor.Descriptor(
  name='ExportedRekallProcess',
  full_name='ExportedRekallProcess',
  filename=None,
  file=DESCRIPTOR,
  containing_type=None,
  fields=[
    _descriptor.FieldDescriptor(
      name='metadata', full_name='ExportedRekallProcess.metadata', index=0,
      number=1, type=11, cpp_type=10, label=1,
      has_default_value=False, default_value=None,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='pid', full_name='ExportedRekallProcess.pid', index=1,
      number=2, type=4, cpp_type=4, label=1,
      has_default_value=False, default_value=0,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001$\022\"Unique process ID of this process.'))),
    _descriptor.FieldDescriptor(
      name='name', full_name='ExportedRekallProcess.name', index=2,
      number=3, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001\023\022\021The process name.'))),
    _descriptor.FieldDescriptor(
      name='fullpath', full_name='ExportedRekallProcess.fullpath', index=3,
      number=4, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001O\022MThe full path of the executable that was loaded when the process was started.'))),
    _descriptor.FieldDescriptor(
      name='creation_time', full_name='ExportedRekallProcess.creation_time', index=4,
      number=5, type=4, cpp_type=4, label=1,
      has_default_value=False, default_value=0,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001R\n\013RDFDatetime\022CWhen the process was created. In microseconds from UNIX epoch. UTC.'))),
    _descriptor.FieldDescriptor(
      name='exit_time', full_name='ExportedRekallProcess.exit_time', index=5,
      number=6, type=4, cpp_type=4, label=1,
      has_default_value=False, default_value=0,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001N\n\013RDFDatetime\022?When the process exitted. In microseconds from UNIX epoch. UTC.'))),
    _descriptor.FieldDescriptor(
      name='parent_pid', full_name='ExportedRekallProcess.parent_pid', index=6,
      number=7, type=4, cpp_type=4, label=1,
      has_default_value=False, default_value=0,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001*\022(Unique process ID of the parent process.'))),
    _descriptor.FieldDescriptor(
      name='commandline', full_name='ExportedRekallProcess.commandline', index=7,
      number=8, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001.\022,The commandline used to launch this process.'))),
    _descriptor.FieldDescriptor(
      name='trusted_fullpath', full_name='ExportedRekallProcess.trusted_fullpath', index=8,
      number=9, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001\304\001\022\301\001The full path of the executable that was loaded when the process was started. Obtained via a trusted method that\'s not easily tampered with. If no such method exists, do not fill in this field.'))),
  ],
  extensions=[
  ],
  nested_types=[],
  enum_types=[
  ],
  options=None,
  is_extendable=False,
  syntax='proto2',
  extension_ranges=[],
  oneofs=[
  ],
  serialized_start=7640,
  serialized_end=8499,
)


_EXPORTEDREKALLWINDOWSLOADEDMODULE = _descriptor.Descriptor(
  name='ExportedRekallWindowsLoadedModule',
  full_name='ExportedRekallWindowsLoadedModule',
  filename=None,
  file=DESCRIPTOR,
  containing_type=None,
  fields=[
    _descriptor.FieldDescriptor(
      name='metadata', full_name='ExportedRekallWindowsLoadedModule.metadata', index=0,
      number=1, type=11, cpp_type=10, label=1,
      has_default_value=False, default_value=None,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='process', full_name='ExportedRekallWindowsLoadedModule.process', index=1,
      number=2, type=11, cpp_type=10, label=1,
      has_default_value=False, default_value=None,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='fullpath', full_name='ExportedRekallWindowsLoadedModule.fullpath', index=2,
      number=3, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\0010\022.The full path of the file backing this module.'))),
    _descriptor.FieldDescriptor(
      name='address', full_name='ExportedRekallWindowsLoadedModule.address', index=3,
      number=4, type=4, cpp_type=4, label=1,
      has_default_value=False, default_value=0,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001*\022(Base address where the module is loaded.'))),
    _descriptor.FieldDescriptor(
      name='size', full_name='ExportedRekallWindowsLoadedModule.size', index=4,
      number=5, type=4, cpp_type=4, label=1,
      has_default_value=False, default_value=0,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001\025\022\023Size of the module.'))),
    _descriptor.FieldDescriptor(
      name='is_in_load_list', full_name='ExportedRekallWindowsLoadedModule.is_in_load_list', index=5,
      number=6, type=8, cpp_type=7, label=1,
      has_default_value=False, default_value=False,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001k\022iWhether the module is referenced in the InLoadOrderLinksInLoadOrderModuleList of the Process Environment.'))),
    _descriptor.FieldDescriptor(
      name='in_load_fullpath', full_name='ExportedRekallWindowsLoadedModule.in_load_fullpath', index=6,
      number=7, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001+\022)The full path of the module in this list.'))),
    _descriptor.FieldDescriptor(
      name='is_in_init_list', full_name='ExportedRekallWindowsLoadedModule.is_in_init_list', index=7,
      number=8, type=8, cpp_type=7, label=1,
      has_default_value=False, default_value=False,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001k\022iWhether the module is referenced in the InInitializationOrderModuleList of the Process Environment Block.'))),
    _descriptor.FieldDescriptor(
      name='in_init_fullpath', full_name='ExportedRekallWindowsLoadedModule.in_init_fullpath', index=8,
      number=9, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001+\022)The full path of the module in this list.'))),
    _descriptor.FieldDescriptor(
      name='is_in_mem_list', full_name='ExportedRekallWindowsLoadedModule.is_in_mem_list', index=9,
      number=10, type=8, cpp_type=7, label=1,
      has_default_value=False, default_value=False,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001c\022aWhether the module is referenced in the InMemoryOrderModuleList of the Process Environment Block.'))),
    _descriptor.FieldDescriptor(
      name='in_mem_fullpath', full_name='ExportedRekallWindowsLoadedModule.in_mem_fullpath', index=10,
      number=11, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001+\022)The full path of the module in this list.'))),
  ],
  extensions=[
  ],
  nested_types=[],
  enum_types=[
  ],
  options=None,
  is_extendable=False,
  syntax='proto2',
  extension_ranges=[],
  oneofs=[
  ],
  serialized_start=8502,
  serialized_end=9443,
)


_EXPORTEDWINDOWSHANDLE = _descriptor.Descriptor(
  name='ExportedWindowsHandle',
  full_name='ExportedWindowsHandle',
  filename=None,
  file=DESCRIPTOR,
  containing_type=None,
  fields=[
    _descriptor.FieldDescriptor(
      name='metadata', full_name='ExportedWindowsHandle.metadata', index=0,
      number=1, type=11, cpp_type=10, label=1,
      has_default_value=False, default_value=None,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='process', full_name='ExportedWindowsHandle.process', index=1,
      number=2, type=11, cpp_type=10, label=1,
      has_default_value=False, default_value=None,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='address', full_name='ExportedWindowsHandle.address', index=2,
      number=3, type=4, cpp_type=4, label=1,
      has_default_value=False, default_value=0,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\0011\022/The address of the OBJECT_HEADER of the handle.'))),
    _descriptor.FieldDescriptor(
      name='type', full_name='ExportedWindowsHandle.type', index=3,
      number=4, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001>\022<The type of handle (Process, Thread, Key, Event, Mutant...).'))),
    _descriptor.FieldDescriptor(
      name='name', full_name='ExportedWindowsHandle.name', index=4,
      number=5, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001\031\022\027The name of the handle.'))),
  ],
  extensions=[
  ],
  nested_types=[],
  enum_types=[
  ],
  options=None,
  is_extendable=False,
  syntax='proto2',
  extension_ranges=[],
  oneofs=[
  ],
  serialized_start=9446,
  serialized_end=9752,
)


_EXPORTEDLINUXSYSCALLTABLEENTRY = _descriptor.Descriptor(
  name='ExportedLinuxSyscallTableEntry',
  full_name='ExportedLinuxSyscallTableEntry',
  filename=None,
  file=DESCRIPTOR,
  containing_type=None,
  fields=[
    _descriptor.FieldDescriptor(
      name='metadata', full_name='ExportedLinuxSyscallTableEntry.metadata', index=0,
      number=1, type=11, cpp_type=10, label=1,
      has_default_value=False, default_value=None,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='table', full_name='ExportedLinuxSyscallTableEntry.table', index=1,
      number=2, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001 \022\036The name of the syscall table.'))),
    _descriptor.FieldDescriptor(
      name='index', full_name='ExportedLinuxSyscallTableEntry.index', index=2,
      number=3, type=4, cpp_type=4, label=1,
      has_default_value=False, default_value=0,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001C\022AThe index within the table. It\'s equivalent to the syscall number'))),
    _descriptor.FieldDescriptor(
      name='handler_address', full_name='ExportedLinuxSyscallTableEntry.handler_address', index=3,
      number=4, type=4, cpp_type=4, label=1,
      has_default_value=False, default_value=0,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001%\022#The address of the syscall handler.'))),
    _descriptor.FieldDescriptor(
      name='symbol', full_name='ExportedLinuxSyscallTableEntry.symbol', index=4,
      number=5, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001A\022?The resolved symbol name for the handler (i.e: linux!sys_read).'))),
  ],
  extensions=[
  ],
  nested_types=[],
  enum_types=[
  ],
  options=None,
  is_extendable=False,
  syntax='proto2',
  extension_ranges=[],
  oneofs=[
  ],
  serialized_start=9755,
  serialized_end=10128,
)


_EXPORTEDREKALLLINUXTASK = _descriptor.Descriptor(
  name='ExportedRekallLinuxTask',
  full_name='ExportedRekallLinuxTask',
  filename=None,
  file=DESCRIPTOR,
  containing_type=None,
  fields=[
    _descriptor.FieldDescriptor(
      name='metadata', full_name='ExportedRekallLinuxTask.metadata', index=0,
      number=1, type=11, cpp_type=10, label=1,
      has_default_value=False, default_value=None,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='address', full_name='ExportedRekallLinuxTask.address', index=1,
      number=2, type=4, cpp_type=4, label=1,
      has_default_value=False, default_value=0,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001)\022\'The kernel address of this task_struct.'))),
    _descriptor.FieldDescriptor(
      name='pid', full_name='ExportedRekallLinuxTask.pid', index=2,
      number=3, type=4, cpp_type=4, label=1,
      has_default_value=False, default_value=0,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001$\022\"Unique process ID of this process.'))),
    _descriptor.FieldDescriptor(
      name='name', full_name='ExportedRekallLinuxTask.name', index=3,
      number=4, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001\023\022\021The process name.'))),
    _descriptor.FieldDescriptor(
      name='creation_time', full_name='ExportedRekallLinuxTask.creation_time', index=4,
      number=5, type=4, cpp_type=4, label=1,
      has_default_value=False, default_value=0,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001R\n\013RDFDatetime\022CWhen the process was created. In microseconds from UNIX epoch. UTC.'))),
    _descriptor.FieldDescriptor(
      name='parent_pid', full_name='ExportedRekallLinuxTask.parent_pid', index=5,
      number=6, type=4, cpp_type=4, label=1,
      has_default_value=False, default_value=0,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001*\022(Unique process ID of the parent process.'))),
    _descriptor.FieldDescriptor(
      name='commandline', full_name='ExportedRekallLinuxTask.commandline', index=6,
      number=7, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001.\022,The commandline used to launch this process.'))),
    _descriptor.FieldDescriptor(
      name='uid', full_name='ExportedRekallLinuxTask.uid', index=7,
      number=8, type=4, cpp_type=4, label=1,
      has_default_value=False, default_value=0,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001\022\022\020The current UID.'))),
    _descriptor.FieldDescriptor(
      name='gid', full_name='ExportedRekallLinuxTask.gid', index=8,
      number=9, type=4, cpp_type=4, label=1,
      has_default_value=False, default_value=0,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001\022\022\020The current GID.'))),
    _descriptor.FieldDescriptor(
      name='euid', full_name='ExportedRekallLinuxTask.euid', index=9,
      number=10, type=4, cpp_type=4, label=1,
      has_default_value=False, default_value=0,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001\034\022\032The current effective UID.'))),
    _descriptor.FieldDescriptor(
      name='egid', full_name='ExportedRekallLinuxTask.egid', index=10,
      number=11, type=4, cpp_type=4, label=1,
      has_default_value=False, default_value=0,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001\034\022\032The current effective GID.'))),
  ],
  extensions=[
  ],
  nested_types=[],
  enum_types=[
  ],
  options=None,
  is_extendable=False,
  syntax='proto2',
  extension_ranges=[],
  oneofs=[
  ],
  serialized_start=10131,
  serialized_end=10793,
)


_EXPORTEDREKALLLINUXTASKOP = _descriptor.Descriptor(
  name='ExportedRekallLinuxTaskOp',
  full_name='ExportedRekallLinuxTaskOp',
  filename=None,
  file=DESCRIPTOR,
  containing_type=None,
  fields=[
    _descriptor.FieldDescriptor(
      name='metadata', full_name='ExportedRekallLinuxTaskOp.metadata', index=0,
      number=1, type=11, cpp_type=10, label=1,
      has_default_value=False, default_value=None,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='task', full_name='ExportedRekallLinuxTaskOp.task', index=1,
      number=2, type=11, cpp_type=10, label=1,
      has_default_value=False, default_value=None,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001%\022#The task this operation applies to.'))),
    _descriptor.FieldDescriptor(
      name='operation', full_name='ExportedRekallLinuxTaskOp.operation', index=2,
      number=3, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001\034\022\032The name of the operation.'))),
    _descriptor.FieldDescriptor(
      name='handler_address', full_name='ExportedRekallLinuxTaskOp.handler_address', index=3,
      number=4, type=4, cpp_type=4, label=1,
      has_default_value=False, default_value=0,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001\035\022\033The address of the handler.'))),
    _descriptor.FieldDescriptor(
      name='module', full_name='ExportedRekallLinuxTaskOp.module', index=4,
      number=5, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\0018\0226The name of the kernel module that holds the callback.'))),
    _descriptor.FieldDescriptor(
      name='symbol', full_name='ExportedRekallLinuxTaskOp.symbol', index=5,
      number=6, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001,\022*The name of the symbol at handler_address.'))),
  ],
  extensions=[
  ],
  nested_types=[],
  enum_types=[
  ],
  options=None,
  is_extendable=False,
  syntax='proto2',
  extension_ranges=[],
  oneofs=[
  ],
  serialized_start=10796,
  serialized_end=11210,
)


_EXPORTEDREKALLLINUXPROCOP = _descriptor.Descriptor(
  name='ExportedRekallLinuxProcOp',
  full_name='ExportedRekallLinuxProcOp',
  filename=None,
  file=DESCRIPTOR,
  containing_type=None,
  fields=[
    _descriptor.FieldDescriptor(
      name='metadata', full_name='ExportedRekallLinuxProcOp.metadata', index=0,
      number=1, type=11, cpp_type=10, label=1,
      has_default_value=False, default_value=None,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='fullpath', full_name='ExportedRekallLinuxProcOp.fullpath', index=1,
      number=2, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001;\0229The fullpath to the proc entry this operation belongs to.'))),
    _descriptor.FieldDescriptor(
      name='operation', full_name='ExportedRekallLinuxProcOp.operation', index=2,
      number=3, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001\034\022\032The name of the operation.'))),
    _descriptor.FieldDescriptor(
      name='handler_address', full_name='ExportedRekallLinuxProcOp.handler_address', index=3,
      number=4, type=4, cpp_type=4, label=1,
      has_default_value=False, default_value=0,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001\035\022\033The address of the handler.'))),
    _descriptor.FieldDescriptor(
      name='module', full_name='ExportedRekallLinuxProcOp.module', index=4,
      number=5, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\0018\0226The name of the kernel module that holds the callback.'))),
    _descriptor.FieldDescriptor(
      name='symbol', full_name='ExportedRekallLinuxProcOp.symbol', index=5,
      number=6, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001,\022*The name of the symbol at handler_address.'))),
  ],
  extensions=[
  ],
  nested_types=[],
  enum_types=[
  ],
  options=None,
  is_extendable=False,
  syntax='proto2',
  extension_ranges=[],
  oneofs=[
  ],
  serialized_start=11213,
  serialized_end=11627,
)


_EXPORTEDREKALLKERNELOBJECT = _descriptor.Descriptor(
  name='ExportedRekallKernelObject',
  full_name='ExportedRekallKernelObject',
  filename=None,
  file=DESCRIPTOR,
  containing_type=None,
  fields=[
    _descriptor.FieldDescriptor(
      name='metadata', full_name='ExportedRekallKernelObject.metadata', index=0,
      number=1, type=11, cpp_type=10, label=1,
      has_default_value=False, default_value=None,
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=None),
    _descriptor.FieldDescriptor(
      name='type', full_name='ExportedRekallKernelObject.type', index=1,
      number=2, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001\025\022\023Kernel object type.'))),
    _descriptor.FieldDescriptor(
      name='name', full_name='ExportedRekallKernelObject.name', index=2,
      number=3, type=9, cpp_type=9, label=1,
      has_default_value=False, default_value=_b("").decode('utf-8'),
      message_type=None, enum_type=None, containing_type=None,
      is_extension=False, extension_scope=None,
      options=_descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001\025\022\023Kernel object name.'))),
  ],
  extensions=[
  ],
  nested_types=[],
  enum_types=[
  ],
  options=None,
  is_extendable=False,
  syntax='proto2',
  extension_ranges=[],
  oneofs=[
  ],
  serialized_start=11630,
  serialized_end=11781,
)

_EXPORTEDMETADATA.fields_by_name['hardware_info'].message_type = grr__response__proto_dot_sysinfo__pb2._HARDWAREINFO
_EXPORTEDCLIENT.fields_by_name['metadata'].message_type = _EXPORTEDMETADATA
_EXPORTEDNETWORKINTERFACE.fields_by_name['metadata'].message_type = _EXPORTEDMETADATA
_EXPORTEDDNSCLIENTCONFIGURATION.fields_by_name['metadata'].message_type = _EXPORTEDMETADATA
_EXPORTEDFILE.fields_by_name['metadata'].message_type = _EXPORTEDMETADATA
_EXPORTEDREGISTRYKEY.fields_by_name['metadata'].message_type = _EXPORTEDMETADATA
_EXPORTEDREGISTRYKEY.fields_by_name['type'].enum_type = grr__response__proto_dot_jobs__pb2._STATENTRY_REGISTRYTYPE
_EXPORTEDPROCESS.fields_by_name['metadata'].message_type = _EXPORTEDMETADATA
_EXPORTEDNETWORKCONNECTION.fields_by_name['metadata'].message_type = _EXPORTEDMETADATA
_EXPORTEDNETWORKCONNECTION.fields_by_name['family'].enum_type = grr__response__proto_dot_sysinfo__pb2._NETWORKCONNECTION_FAMILY
_EXPORTEDNETWORKCONNECTION.fields_by_name['type'].enum_type = grr__response__proto_dot_sysinfo__pb2._NETWORKCONNECTION_TYPE
_EXPORTEDNETWORKCONNECTION.fields_by_name['local_address'].message_type = grr__response__proto_dot_sysinfo__pb2._NETWORKENDPOINT
_EXPORTEDNETWORKCONNECTION.fields_by_name['remote_address'].message_type = grr__response__proto_dot_sysinfo__pb2._NETWORKENDPOINT
_EXPORTEDNETWORKCONNECTION.fields_by_name['state'].enum_type = grr__response__proto_dot_sysinfo__pb2._NETWORKCONNECTION_STATE
_EXPORTEDANOMALY.fields_by_name['type'].enum_type = grr__response__proto_dot_anomaly__pb2._ANOMALY_ANOMALYTYPE
_EXPORTEDANOMALY.fields_by_name['severity'].enum_type = grr__response__proto_dot_anomaly__pb2._ANOMALY_ANOMALYLEVEL
_EXPORTEDANOMALY.fields_by_name['confidence'].enum_type = grr__response__proto_dot_anomaly__pb2._ANOMALY_ANOMALYLEVEL
_EXPORTEDCHECKRESULT.fields_by_name['metadata'].message_type = _EXPORTEDMETADATA
_EXPORTEDCHECKRESULT.fields_by_name['anomaly'].message_type = _EXPORTEDANOMALY
_EXPORTEDOPENFILE.fields_by_name['metadata'].message_type = _EXPORTEDMETADATA
_EXPORTEDFILESTOREHASH.fields_by_name['metadata'].message_type = _EXPORTEDMETADATA
_EXPORTEDMATCH.fields_by_name['metadata'].message_type = _EXPORTEDMETADATA
_EXPORTEDBYTES.fields_by_name['metadata'].message_type = _EXPORTEDMETADATA
_EXPORTEDSTRING.fields_by_name['metadata'].message_type = _EXPORTEDMETADATA
_EXPORTEDDICTITEM.fields_by_name['metadata'].message_type = _EXPORTEDMETADATA
_EXPORTEDARTIFACTFILESDOWNLOADERRESULT.fields_by_name['metadata'].message_type = _EXPORTEDMETADATA
_EXPORTEDARTIFACTFILESDOWNLOADERRESULT.fields_by_name['original_registry_key'].message_type = _EXPORTEDREGISTRYKEY
_EXPORTEDARTIFACTFILESDOWNLOADERRESULT.fields_by_name['original_file'].message_type = _EXPORTEDFILE
_EXPORTEDARTIFACTFILESDOWNLOADERRESULT.fields_by_name['downloaded_file'].message_type = _EXPORTEDFILE
_EXPORTEDYARAPROCESSSCANMATCH.fields_by_name['metadata'].message_type = _EXPORTEDMETADATA
_EXPORTEDYARAPROCESSSCANMATCH.fields_by_name['process'].message_type = _EXPORTEDPROCESS
_EXPORTEDYARASIGNATUREMATCH.fields_by_name['metadata'].message_type = _EXPORTEDMETADATA
_EXPORTEDYARASIGNATUREMATCH.fields_by_name['process'].message_type = _EXPORTEDREKALLPROCESS
_EXPORTEDREKALLPROCESS.fields_by_name['metadata'].message_type = _EXPORTEDMETADATA
_EXPORTEDREKALLWINDOWSLOADEDMODULE.fields_by_name['metadata'].message_type = _EXPORTEDMETADATA
_EXPORTEDREKALLWINDOWSLOADEDMODULE.fields_by_name['process'].message_type = _EXPORTEDREKALLPROCESS
_EXPORTEDWINDOWSHANDLE.fields_by_name['metadata'].message_type = _EXPORTEDMETADATA
_EXPORTEDWINDOWSHANDLE.fields_by_name['process'].message_type = _EXPORTEDREKALLPROCESS
_EXPORTEDLINUXSYSCALLTABLEENTRY.fields_by_name['metadata'].message_type = _EXPORTEDMETADATA
_EXPORTEDREKALLLINUXTASK.fields_by_name['metadata'].message_type = _EXPORTEDMETADATA
_EXPORTEDREKALLLINUXTASKOP.fields_by_name['metadata'].message_type = _EXPORTEDMETADATA
_EXPORTEDREKALLLINUXTASKOP.fields_by_name['task'].message_type = _EXPORTEDREKALLLINUXTASK
_EXPORTEDREKALLLINUXPROCOP.fields_by_name['metadata'].message_type = _EXPORTEDMETADATA
_EXPORTEDREKALLKERNELOBJECT.fields_by_name['metadata'].message_type = _EXPORTEDMETADATA
DESCRIPTOR.message_types_by_name['ExportOptions'] = _EXPORTOPTIONS
DESCRIPTOR.message_types_by_name['ExportedMetadata'] = _EXPORTEDMETADATA
DESCRIPTOR.message_types_by_name['ExportedClient'] = _EXPORTEDCLIENT
DESCRIPTOR.message_types_by_name['ExportedNetworkInterface'] = _EXPORTEDNETWORKINTERFACE
DESCRIPTOR.message_types_by_name['ExportedDNSClientConfiguration'] = _EXPORTEDDNSCLIENTCONFIGURATION
DESCRIPTOR.message_types_by_name['ExportedFile'] = _EXPORTEDFILE
DESCRIPTOR.message_types_by_name['ExportedRegistryKey'] = _EXPORTEDREGISTRYKEY
DESCRIPTOR.message_types_by_name['ExportedProcess'] = _EXPORTEDPROCESS
DESCRIPTOR.message_types_by_name['ExportedNetworkConnection'] = _EXPORTEDNETWORKCONNECTION
DESCRIPTOR.message_types_by_name['ExportedAnomaly'] = _EXPORTEDANOMALY
DESCRIPTOR.message_types_by_name['ExportedCheckResult'] = _EXPORTEDCHECKRESULT
DESCRIPTOR.message_types_by_name['ExportedOpenFile'] = _EXPORTEDOPENFILE
DESCRIPTOR.message_types_by_name['ExportedFileStoreHash'] = _EXPORTEDFILESTOREHASH
DESCRIPTOR.message_types_by_name['ExportedMatch'] = _EXPORTEDMATCH
DESCRIPTOR.message_types_by_name['ExportedBytes'] = _EXPORTEDBYTES
DESCRIPTOR.message_types_by_name['ExportedString'] = _EXPORTEDSTRING
DESCRIPTOR.message_types_by_name['ExportedDictItem'] = _EXPORTEDDICTITEM
DESCRIPTOR.message_types_by_name['ExportedArtifactFilesDownloaderResult'] = _EXPORTEDARTIFACTFILESDOWNLOADERRESULT
DESCRIPTOR.message_types_by_name['ExportedYaraProcessScanMatch'] = _EXPORTEDYARAPROCESSSCANMATCH
DESCRIPTOR.message_types_by_name['ExportedYaraSignatureMatch'] = _EXPORTEDYARASIGNATUREMATCH
DESCRIPTOR.message_types_by_name['ExportedRekallProcess'] = _EXPORTEDREKALLPROCESS
DESCRIPTOR.message_types_by_name['ExportedRekallWindowsLoadedModule'] = _EXPORTEDREKALLWINDOWSLOADEDMODULE
DESCRIPTOR.message_types_by_name['ExportedWindowsHandle'] = _EXPORTEDWINDOWSHANDLE
DESCRIPTOR.message_types_by_name['ExportedLinuxSyscallTableEntry'] = _EXPORTEDLINUXSYSCALLTABLEENTRY
DESCRIPTOR.message_types_by_name['ExportedRekallLinuxTask'] = _EXPORTEDREKALLLINUXTASK
DESCRIPTOR.message_types_by_name['ExportedRekallLinuxTaskOp'] = _EXPORTEDREKALLLINUXTASKOP
DESCRIPTOR.message_types_by_name['ExportedRekallLinuxProcOp'] = _EXPORTEDREKALLLINUXPROCOP
DESCRIPTOR.message_types_by_name['ExportedRekallKernelObject'] = _EXPORTEDREKALLKERNELOBJECT
_sym_db.RegisterFileDescriptor(DESCRIPTOR)

ExportOptions = _reflection.GeneratedProtocolMessageType('ExportOptions', (_message.Message,), dict(
  DESCRIPTOR = _EXPORTOPTIONS,
  __module__ = 'grr_response_proto.export_pb2'
  # @@protoc_insertion_point(class_scope:ExportOptions)
  ))
_sym_db.RegisterMessage(ExportOptions)

ExportedMetadata = _reflection.GeneratedProtocolMessageType('ExportedMetadata', (_message.Message,), dict(
  DESCRIPTOR = _EXPORTEDMETADATA,
  __module__ = 'grr_response_proto.export_pb2'
  # @@protoc_insertion_point(class_scope:ExportedMetadata)
  ))
_sym_db.RegisterMessage(ExportedMetadata)

ExportedClient = _reflection.GeneratedProtocolMessageType('ExportedClient', (_message.Message,), dict(
  DESCRIPTOR = _EXPORTEDCLIENT,
  __module__ = 'grr_response_proto.export_pb2'
  # @@protoc_insertion_point(class_scope:ExportedClient)
  ))
_sym_db.RegisterMessage(ExportedClient)

ExportedNetworkInterface = _reflection.GeneratedProtocolMessageType('ExportedNetworkInterface', (_message.Message,), dict(
  DESCRIPTOR = _EXPORTEDNETWORKINTERFACE,
  __module__ = 'grr_response_proto.export_pb2'
  # @@protoc_insertion_point(class_scope:ExportedNetworkInterface)
  ))
_sym_db.RegisterMessage(ExportedNetworkInterface)

ExportedDNSClientConfiguration = _reflection.GeneratedProtocolMessageType('ExportedDNSClientConfiguration', (_message.Message,), dict(
  DESCRIPTOR = _EXPORTEDDNSCLIENTCONFIGURATION,
  __module__ = 'grr_response_proto.export_pb2'
  # @@protoc_insertion_point(class_scope:ExportedDNSClientConfiguration)
  ))
_sym_db.RegisterMessage(ExportedDNSClientConfiguration)

ExportedFile = _reflection.GeneratedProtocolMessageType('ExportedFile', (_message.Message,), dict(
  DESCRIPTOR = _EXPORTEDFILE,
  __module__ = 'grr_response_proto.export_pb2'
  # @@protoc_insertion_point(class_scope:ExportedFile)
  ))
_sym_db.RegisterMessage(ExportedFile)

ExportedRegistryKey = _reflection.GeneratedProtocolMessageType('ExportedRegistryKey', (_message.Message,), dict(
  DESCRIPTOR = _EXPORTEDREGISTRYKEY,
  __module__ = 'grr_response_proto.export_pb2'
  # @@protoc_insertion_point(class_scope:ExportedRegistryKey)
  ))
_sym_db.RegisterMessage(ExportedRegistryKey)

ExportedProcess = _reflection.GeneratedProtocolMessageType('ExportedProcess', (_message.Message,), dict(
  DESCRIPTOR = _EXPORTEDPROCESS,
  __module__ = 'grr_response_proto.export_pb2'
  # @@protoc_insertion_point(class_scope:ExportedProcess)
  ))
_sym_db.RegisterMessage(ExportedProcess)

ExportedNetworkConnection = _reflection.GeneratedProtocolMessageType('ExportedNetworkConnection', (_message.Message,), dict(
  DESCRIPTOR = _EXPORTEDNETWORKCONNECTION,
  __module__ = 'grr_response_proto.export_pb2'
  # @@protoc_insertion_point(class_scope:ExportedNetworkConnection)
  ))
_sym_db.RegisterMessage(ExportedNetworkConnection)

ExportedAnomaly = _reflection.GeneratedProtocolMessageType('ExportedAnomaly', (_message.Message,), dict(
  DESCRIPTOR = _EXPORTEDANOMALY,
  __module__ = 'grr_response_proto.export_pb2'
  # @@protoc_insertion_point(class_scope:ExportedAnomaly)
  ))
_sym_db.RegisterMessage(ExportedAnomaly)

ExportedCheckResult = _reflection.GeneratedProtocolMessageType('ExportedCheckResult', (_message.Message,), dict(
  DESCRIPTOR = _EXPORTEDCHECKRESULT,
  __module__ = 'grr_response_proto.export_pb2'
  # @@protoc_insertion_point(class_scope:ExportedCheckResult)
  ))
_sym_db.RegisterMessage(ExportedCheckResult)

ExportedOpenFile = _reflection.GeneratedProtocolMessageType('ExportedOpenFile', (_message.Message,), dict(
  DESCRIPTOR = _EXPORTEDOPENFILE,
  __module__ = 'grr_response_proto.export_pb2'
  # @@protoc_insertion_point(class_scope:ExportedOpenFile)
  ))
_sym_db.RegisterMessage(ExportedOpenFile)

ExportedFileStoreHash = _reflection.GeneratedProtocolMessageType('ExportedFileStoreHash', (_message.Message,), dict(
  DESCRIPTOR = _EXPORTEDFILESTOREHASH,
  __module__ = 'grr_response_proto.export_pb2'
  # @@protoc_insertion_point(class_scope:ExportedFileStoreHash)
  ))
_sym_db.RegisterMessage(ExportedFileStoreHash)

ExportedMatch = _reflection.GeneratedProtocolMessageType('ExportedMatch', (_message.Message,), dict(
  DESCRIPTOR = _EXPORTEDMATCH,
  __module__ = 'grr_response_proto.export_pb2'
  # @@protoc_insertion_point(class_scope:ExportedMatch)
  ))
_sym_db.RegisterMessage(ExportedMatch)

ExportedBytes = _reflection.GeneratedProtocolMessageType('ExportedBytes', (_message.Message,), dict(
  DESCRIPTOR = _EXPORTEDBYTES,
  __module__ = 'grr_response_proto.export_pb2'
  # @@protoc_insertion_point(class_scope:ExportedBytes)
  ))
_sym_db.RegisterMessage(ExportedBytes)

ExportedString = _reflection.GeneratedProtocolMessageType('ExportedString', (_message.Message,), dict(
  DESCRIPTOR = _EXPORTEDSTRING,
  __module__ = 'grr_response_proto.export_pb2'
  # @@protoc_insertion_point(class_scope:ExportedString)
  ))
_sym_db.RegisterMessage(ExportedString)

ExportedDictItem = _reflection.GeneratedProtocolMessageType('ExportedDictItem', (_message.Message,), dict(
  DESCRIPTOR = _EXPORTEDDICTITEM,
  __module__ = 'grr_response_proto.export_pb2'
  # @@protoc_insertion_point(class_scope:ExportedDictItem)
  ))
_sym_db.RegisterMessage(ExportedDictItem)

ExportedArtifactFilesDownloaderResult = _reflection.GeneratedProtocolMessageType('ExportedArtifactFilesDownloaderResult', (_message.Message,), dict(
  DESCRIPTOR = _EXPORTEDARTIFACTFILESDOWNLOADERRESULT,
  __module__ = 'grr_response_proto.export_pb2'
  # @@protoc_insertion_point(class_scope:ExportedArtifactFilesDownloaderResult)
  ))
_sym_db.RegisterMessage(ExportedArtifactFilesDownloaderResult)

ExportedYaraProcessScanMatch = _reflection.GeneratedProtocolMessageType('ExportedYaraProcessScanMatch', (_message.Message,), dict(
  DESCRIPTOR = _EXPORTEDYARAPROCESSSCANMATCH,
  __module__ = 'grr_response_proto.export_pb2'
  # @@protoc_insertion_point(class_scope:ExportedYaraProcessScanMatch)
  ))
_sym_db.RegisterMessage(ExportedYaraProcessScanMatch)

ExportedYaraSignatureMatch = _reflection.GeneratedProtocolMessageType('ExportedYaraSignatureMatch', (_message.Message,), dict(
  DESCRIPTOR = _EXPORTEDYARASIGNATUREMATCH,
  __module__ = 'grr_response_proto.export_pb2'
  # @@protoc_insertion_point(class_scope:ExportedYaraSignatureMatch)
  ))
_sym_db.RegisterMessage(ExportedYaraSignatureMatch)

ExportedRekallProcess = _reflection.GeneratedProtocolMessageType('ExportedRekallProcess', (_message.Message,), dict(
  DESCRIPTOR = _EXPORTEDREKALLPROCESS,
  __module__ = 'grr_response_proto.export_pb2'
  # @@protoc_insertion_point(class_scope:ExportedRekallProcess)
  ))
_sym_db.RegisterMessage(ExportedRekallProcess)

ExportedRekallWindowsLoadedModule = _reflection.GeneratedProtocolMessageType('ExportedRekallWindowsLoadedModule', (_message.Message,), dict(
  DESCRIPTOR = _EXPORTEDREKALLWINDOWSLOADEDMODULE,
  __module__ = 'grr_response_proto.export_pb2'
  # @@protoc_insertion_point(class_scope:ExportedRekallWindowsLoadedModule)
  ))
_sym_db.RegisterMessage(ExportedRekallWindowsLoadedModule)

ExportedWindowsHandle = _reflection.GeneratedProtocolMessageType('ExportedWindowsHandle', (_message.Message,), dict(
  DESCRIPTOR = _EXPORTEDWINDOWSHANDLE,
  __module__ = 'grr_response_proto.export_pb2'
  # @@protoc_insertion_point(class_scope:ExportedWindowsHandle)
  ))
_sym_db.RegisterMessage(ExportedWindowsHandle)

ExportedLinuxSyscallTableEntry = _reflection.GeneratedProtocolMessageType('ExportedLinuxSyscallTableEntry', (_message.Message,), dict(
  DESCRIPTOR = _EXPORTEDLINUXSYSCALLTABLEENTRY,
  __module__ = 'grr_response_proto.export_pb2'
  # @@protoc_insertion_point(class_scope:ExportedLinuxSyscallTableEntry)
  ))
_sym_db.RegisterMessage(ExportedLinuxSyscallTableEntry)

ExportedRekallLinuxTask = _reflection.GeneratedProtocolMessageType('ExportedRekallLinuxTask', (_message.Message,), dict(
  DESCRIPTOR = _EXPORTEDREKALLLINUXTASK,
  __module__ = 'grr_response_proto.export_pb2'
  # @@protoc_insertion_point(class_scope:ExportedRekallLinuxTask)
  ))
_sym_db.RegisterMessage(ExportedRekallLinuxTask)

ExportedRekallLinuxTaskOp = _reflection.GeneratedProtocolMessageType('ExportedRekallLinuxTaskOp', (_message.Message,), dict(
  DESCRIPTOR = _EXPORTEDREKALLLINUXTASKOP,
  __module__ = 'grr_response_proto.export_pb2'
  # @@protoc_insertion_point(class_scope:ExportedRekallLinuxTaskOp)
  ))
_sym_db.RegisterMessage(ExportedRekallLinuxTaskOp)

ExportedRekallLinuxProcOp = _reflection.GeneratedProtocolMessageType('ExportedRekallLinuxProcOp', (_message.Message,), dict(
  DESCRIPTOR = _EXPORTEDREKALLLINUXPROCOP,
  __module__ = 'grr_response_proto.export_pb2'
  # @@protoc_insertion_point(class_scope:ExportedRekallLinuxProcOp)
  ))
_sym_db.RegisterMessage(ExportedRekallLinuxProcOp)

ExportedRekallKernelObject = _reflection.GeneratedProtocolMessageType('ExportedRekallKernelObject', (_message.Message,), dict(
  DESCRIPTOR = _EXPORTEDREKALLKERNELOBJECT,
  __module__ = 'grr_response_proto.export_pb2'
  # @@protoc_insertion_point(class_scope:ExportedRekallKernelObject)
  ))
_sym_db.RegisterMessage(ExportedRekallKernelObject)


_EXPORTOPTIONS.fields_by_name['export_files_contents'].has_options = True
_EXPORTOPTIONS.fields_by_name['export_files_contents']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001\365\001\022\362\001If this is true, open files and export their full or partial contents. Note: this may require additional datastore roundtrips and slow down the export process, also exporting file contents may significantly increase size of the exported data.'))
_EXPORTOPTIONS.fields_by_name['follow_urns'].has_options = True
_EXPORTOPTIONS.fields_by_name['follow_urns']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001\320\001\022\315\001If this is true, follow urns and try to export not only the urns themselves, but also the data they are pointing to. Note: this may require additional datastore roundtrips and slow down the export process.'))
_EXPORTOPTIONS.fields_by_name['export_files_hashes'].has_options = True
_EXPORTOPTIONS.fields_by_name['export_files_hashes']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001\211\003\022\206\003If this is true, export hashes when dealing with file-related values. The files won\'t be hashed during the export, hashes will only be exported if they were collected before the export. This option affects exporting VFSFile and StatEntry RDFValues. This is true by default even though it requires extra  datastore roundtrips because it\'s very useful and users expect the hashes to be there.'))
_EXPORTOPTIONS.fields_by_name['annotations'].has_options = True
_EXPORTOPTIONS.fields_by_name['annotations']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001\304\001\022\301\001Annotations to add to exported data. This field can be used to differentiate sets of exported data inside a particular exported type. e.g. data collected by users vs. data collected by cronjob.'))
_EXPORTEDMETADATA.fields_by_name['client_urn'].has_options = True
_EXPORTEDMETADATA.fields_by_name['client_urn']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001<\n\tClientURN\022/Client ID of a client that contains this entry.'))
_EXPORTEDMETADATA.fields_by_name['hostname'].has_options = True
_EXPORTEDMETADATA.fields_by_name['hostname']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001\022\022\020Client hostname.'))
_EXPORTEDMETADATA.fields_by_name['os'].has_options = True
_EXPORTEDMETADATA.fields_by_name['os']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\0017\0225Client Operating System class (Windows|Darwin|Linux).'))
_EXPORTEDMETADATA.fields_by_name['client_age'].has_options = True
_EXPORTEDMETADATA.fields_by_name['client_age']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001!\n\013RDFDatetime\022\022Age of the client.'))
_EXPORTEDMETADATA.fields_by_name['uname'].has_options = True
_EXPORTEDMETADATA.fields_by_name['uname']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001\017\022\rUname string.'))
_EXPORTEDMETADATA.fields_by_name['os_release'].has_options = True
_EXPORTEDMETADATA.fields_by_name['os_release']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\0010\022.The OS release identifier e.g. 7, OSX, debian.'))
_EXPORTEDMETADATA.fields_by_name['os_version'].has_options = True
_EXPORTEDMETADATA.fields_by_name['os_version']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\0014\0222The OS version ID e.g. 6.1.7601SP1, 10.9.2, 14.04.'))
_EXPORTEDMETADATA.fields_by_name['usernames'].has_options = True
_EXPORTEDMETADATA.fields_by_name['usernames']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001\013\022\tUsername.'))
_EXPORTEDMETADATA.fields_by_name['mac_address'].has_options = True
_EXPORTEDMETADATA.fields_by_name['mac_address']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001\016\022\014MAC address.'))
_EXPORTEDMETADATA.fields_by_name['timestamp'].has_options = True
_EXPORTEDMETADATA.fields_by_name['timestamp']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001&\n\013RDFDatetime\022\027When data was exported.'))
_EXPORTEDMETADATA.fields_by_name['original_timestamp'].has_options = True
_EXPORTEDMETADATA.fields_by_name['original_timestamp']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\0010\n\013RDFDatetime\022!When original data was generated.'))
_EXPORTEDMETADATA.fields_by_name['deprecated_session_id'].has_options = True
_EXPORTEDMETADATA.fields_by_name['deprecated_session_id']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\030\001\342\374\343\304\001E\n\tSessionID\0228Deprecated session id of a hunt that collected the data.'))
_EXPORTEDMETADATA.fields_by_name['labels'].has_options = True
_EXPORTEDMETADATA.fields_by_name['labels']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001\034\022\032CSV list of client labels.'))
_EXPORTEDMETADATA.fields_by_name['system_labels'].has_options = True
_EXPORTEDMETADATA.fields_by_name['system_labels']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001,\022*Labels hardcoded into GRR clients configs.'))
_EXPORTEDMETADATA.fields_by_name['user_labels'].has_options = True
_EXPORTEDMETADATA.fields_by_name['user_labels']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001-\022+Labels assigned by GRR uses via the UI/API.'))
_EXPORTEDMETADATA.fields_by_name['source_urn'].has_options = True
_EXPORTEDMETADATA.fields_by_name['source_urn']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001+\n\006RDFURN\022!URN of a source of exported data.'))
_EXPORTEDMETADATA.fields_by_name['annotations'].has_options = True
_EXPORTEDMETADATA.fields_by_name['annotations']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001\306\001\022\303\001CSV list of annotations for this data. This field can be used to differentiate sets of exported data inside a particular exported type. e.g. data collected by users vs. data collected by cronjob.'))
_EXPORTEDMETADATA.fields_by_name['hardware_info'].has_options = True
_EXPORTEDMETADATA.fields_by_name['hardware_info']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001%\022#Hardware information of the client.'))
_EXPORTEDMETADATA.fields_by_name['kernel_version'].has_options = True
_EXPORTEDMETADATA.fields_by_name['kernel_version']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001\030\022\026Client kernel version.'))
_EXPORTEDFILE.fields_by_name['urn'].has_options = True
_EXPORTEDFILE.fields_by_name['urn']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\0016\n\006RDFURN\022,The location of this file in the AFF4 space.'))
_EXPORTEDFILE.fields_by_name['basename'].has_options = True
_EXPORTEDFILE.fields_by_name['basename']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001\027\022\025Basename of the file.'))
_EXPORTEDFILE.fields_by_name['st_mode'].has_options = True
_EXPORTEDFILE.fields_by_name['st_mode']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001(\n\010StatMode\022\034A unix file permission mode.'))
_EXPORTEDFILE.fields_by_name['st_atime'].has_options = True
_EXPORTEDFILE.fields_by_name['st_atime']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001\'\n\022RDFDatetimeSeconds\022\021Last access time.'))
_EXPORTEDFILE.fields_by_name['st_mtime'].has_options = True
_EXPORTEDFILE.fields_by_name['st_mtime']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001)\n\022RDFDatetimeSeconds\022\023Last modified time.'))
_EXPORTEDFILE.fields_by_name['st_ctime'].has_options = True
_EXPORTEDFILE.fields_by_name['st_ctime']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001-\n\022RDFDatetimeSeconds\022\027Last inode change time.'))
_EXPORTEDFILE.fields_by_name['content'].has_options = True
_EXPORTEDFILE.fields_by_name['content']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001*\022(Actual content of the file if available.'))
_EXPORTEDFILE.fields_by_name['content_sha256'].has_options = True
_EXPORTEDFILE.fields_by_name['content_sha256']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001\023\022\021SHA256 of content'))
_EXPORTEDREGISTRYKEY.fields_by_name['urn'].has_options = True
_EXPORTEDREGISTRYKEY.fields_by_name['urn']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001\"\n\006RDFURN\022\030URN of the registry key.'))
_EXPORTEDREGISTRYKEY.fields_by_name['last_modified'].has_options = True
_EXPORTEDREGISTRYKEY.fields_by_name['last_modified']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001.\n\022RDFDatetimeSeconds\022\030Last modified timestamp.'))
_EXPORTEDANOMALY.fields_by_name['type'].has_options = True
_EXPORTEDANOMALY.fields_by_name['type']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001\"\022 Type of anomaly this represents.'))
_EXPORTEDANOMALY.fields_by_name['severity'].has_options = True
_EXPORTEDANOMALY.fields_by_name['severity']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\0013\0221Severity of the anomaly if it is a true positive.'))
_EXPORTEDANOMALY.fields_by_name['confidence'].has_options = True
_EXPORTEDANOMALY.fields_by_name['confidence']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\0011\022/Confidence that the anomaly is a true positive.'))
_EXPORTEDANOMALY.fields_by_name['symptom'].has_options = True
_EXPORTEDANOMALY.fields_by_name['symptom']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001%\022#A description of what is anomalous.'))
_EXPORTEDANOMALY.fields_by_name['explanation'].has_options = True
_EXPORTEDANOMALY.fields_by_name['explanation']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001`\022^A description of possible explanations for the anomaly if additional information is available.'))
_EXPORTEDANOMALY.fields_by_name['generated_by'].has_options = True
_EXPORTEDANOMALY.fields_by_name['generated_by']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001b\022`String describing what generated the anomaly, this is normally the name of a parser or artifact.'))
_EXPORTEDANOMALY.fields_by_name['anomaly_reference_id'].has_options = True
_EXPORTEDANOMALY.fields_by_name['anomaly_reference_id']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001A\022?A string used to reference the anomaly in the Anomaly database.'))
_EXPORTEDANOMALY.fields_by_name['finding'].has_options = True
_EXPORTEDANOMALY.fields_by_name['finding']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\0019\0227String descriptions of data that triggered the Anomaly.'))
_EXPORTEDCHECKRESULT.fields_by_name['check_id'].has_options = True
_EXPORTEDCHECKRESULT.fields_by_name['check_id']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\0018\0226The check id, identifies what check is being reported.'))
_EXPORTEDCHECKRESULT.fields_by_name['anomaly'].has_options = True
_EXPORTEDCHECKRESULT.fields_by_name['anomaly']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001.\022,Specific finding indicating an issue exists.'))
_EXPORTEDFILESTOREHASH.fields_by_name['target_urn'].has_options = True
_EXPORTEDFILESTOREHASH.fields_by_name['target_urn']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001\010\n\006RDFURN'))
_EXPORTEDMATCH.fields_by_name['urn'].has_options = True
_EXPORTEDMATCH.fields_by_name['urn']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\0016\n\006RDFURN\022,The location of this file in the AFF4 space.'))
_EXPORTEDYARAPROCESSSCANMATCH.fields_by_name['process'].has_options = True
_EXPORTEDYARAPROCESSSCANMATCH.fields_by_name['process']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001\033\022\031Matching process details.'))
_EXPORTEDYARAPROCESSSCANMATCH.fields_by_name['rule_name'].has_options = True
_EXPORTEDYARAPROCESSSCANMATCH.fields_by_name['rule_name']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001&\022$The name of the rule that triggered.'))
_EXPORTEDYARAPROCESSSCANMATCH.fields_by_name['scan_time_us'].has_options = True
_EXPORTEDYARAPROCESSSCANMATCH.fields_by_name['scan_time_us']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\0011\022/Time in microseconds taken to perform the scan.'))
_EXPORTEDREKALLPROCESS.fields_by_name['pid'].has_options = True
_EXPORTEDREKALLPROCESS.fields_by_name['pid']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001$\022\"Unique process ID of this process.'))
_EXPORTEDREKALLPROCESS.fields_by_name['name'].has_options = True
_EXPORTEDREKALLPROCESS.fields_by_name['name']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001\023\022\021The process name.'))
_EXPORTEDREKALLPROCESS.fields_by_name['fullpath'].has_options = True
_EXPORTEDREKALLPROCESS.fields_by_name['fullpath']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001O\022MThe full path of the executable that was loaded when the process was started.'))
_EXPORTEDREKALLPROCESS.fields_by_name['creation_time'].has_options = True
_EXPORTEDREKALLPROCESS.fields_by_name['creation_time']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001R\n\013RDFDatetime\022CWhen the process was created. In microseconds from UNIX epoch. UTC.'))
_EXPORTEDREKALLPROCESS.fields_by_name['exit_time'].has_options = True
_EXPORTEDREKALLPROCESS.fields_by_name['exit_time']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001N\n\013RDFDatetime\022?When the process exitted. In microseconds from UNIX epoch. UTC.'))
_EXPORTEDREKALLPROCESS.fields_by_name['parent_pid'].has_options = True
_EXPORTEDREKALLPROCESS.fields_by_name['parent_pid']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001*\022(Unique process ID of the parent process.'))
_EXPORTEDREKALLPROCESS.fields_by_name['commandline'].has_options = True
_EXPORTEDREKALLPROCESS.fields_by_name['commandline']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001.\022,The commandline used to launch this process.'))
_EXPORTEDREKALLPROCESS.fields_by_name['trusted_fullpath'].has_options = True
_EXPORTEDREKALLPROCESS.fields_by_name['trusted_fullpath']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001\304\001\022\301\001The full path of the executable that was loaded when the process was started. Obtained via a trusted method that\'s not easily tampered with. If no such method exists, do not fill in this field.'))
_EXPORTEDREKALLWINDOWSLOADEDMODULE.fields_by_name['fullpath'].has_options = True
_EXPORTEDREKALLWINDOWSLOADEDMODULE.fields_by_name['fullpath']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\0010\022.The full path of the file backing this module.'))
_EXPORTEDREKALLWINDOWSLOADEDMODULE.fields_by_name['address'].has_options = True
_EXPORTEDREKALLWINDOWSLOADEDMODULE.fields_by_name['address']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001*\022(Base address where the module is loaded.'))
_EXPORTEDREKALLWINDOWSLOADEDMODULE.fields_by_name['size'].has_options = True
_EXPORTEDREKALLWINDOWSLOADEDMODULE.fields_by_name['size']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001\025\022\023Size of the module.'))
_EXPORTEDREKALLWINDOWSLOADEDMODULE.fields_by_name['is_in_load_list'].has_options = True
_EXPORTEDREKALLWINDOWSLOADEDMODULE.fields_by_name['is_in_load_list']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001k\022iWhether the module is referenced in the InLoadOrderLinksInLoadOrderModuleList of the Process Environment.'))
_EXPORTEDREKALLWINDOWSLOADEDMODULE.fields_by_name['in_load_fullpath'].has_options = True
_EXPORTEDREKALLWINDOWSLOADEDMODULE.fields_by_name['in_load_fullpath']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001+\022)The full path of the module in this list.'))
_EXPORTEDREKALLWINDOWSLOADEDMODULE.fields_by_name['is_in_init_list'].has_options = True
_EXPORTEDREKALLWINDOWSLOADEDMODULE.fields_by_name['is_in_init_list']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001k\022iWhether the module is referenced in the InInitializationOrderModuleList of the Process Environment Block.'))
_EXPORTEDREKALLWINDOWSLOADEDMODULE.fields_by_name['in_init_fullpath'].has_options = True
_EXPORTEDREKALLWINDOWSLOADEDMODULE.fields_by_name['in_init_fullpath']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001+\022)The full path of the module in this list.'))
_EXPORTEDREKALLWINDOWSLOADEDMODULE.fields_by_name['is_in_mem_list'].has_options = True
_EXPORTEDREKALLWINDOWSLOADEDMODULE.fields_by_name['is_in_mem_list']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001c\022aWhether the module is referenced in the InMemoryOrderModuleList of the Process Environment Block.'))
_EXPORTEDREKALLWINDOWSLOADEDMODULE.fields_by_name['in_mem_fullpath'].has_options = True
_EXPORTEDREKALLWINDOWSLOADEDMODULE.fields_by_name['in_mem_fullpath']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001+\022)The full path of the module in this list.'))
_EXPORTEDWINDOWSHANDLE.fields_by_name['address'].has_options = True
_EXPORTEDWINDOWSHANDLE.fields_by_name['address']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\0011\022/The address of the OBJECT_HEADER of the handle.'))
_EXPORTEDWINDOWSHANDLE.fields_by_name['type'].has_options = True
_EXPORTEDWINDOWSHANDLE.fields_by_name['type']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001>\022<The type of handle (Process, Thread, Key, Event, Mutant...).'))
_EXPORTEDWINDOWSHANDLE.fields_by_name['name'].has_options = True
_EXPORTEDWINDOWSHANDLE.fields_by_name['name']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001\031\022\027The name of the handle.'))
_EXPORTEDLINUXSYSCALLTABLEENTRY.fields_by_name['table'].has_options = True
_EXPORTEDLINUXSYSCALLTABLEENTRY.fields_by_name['table']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001 \022\036The name of the syscall table.'))
_EXPORTEDLINUXSYSCALLTABLEENTRY.fields_by_name['index'].has_options = True
_EXPORTEDLINUXSYSCALLTABLEENTRY.fields_by_name['index']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001C\022AThe index within the table. It\'s equivalent to the syscall number'))
_EXPORTEDLINUXSYSCALLTABLEENTRY.fields_by_name['handler_address'].has_options = True
_EXPORTEDLINUXSYSCALLTABLEENTRY.fields_by_name['handler_address']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001%\022#The address of the syscall handler.'))
_EXPORTEDLINUXSYSCALLTABLEENTRY.fields_by_name['symbol'].has_options = True
_EXPORTEDLINUXSYSCALLTABLEENTRY.fields_by_name['symbol']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001A\022?The resolved symbol name for the handler (i.e: linux!sys_read).'))
_EXPORTEDREKALLLINUXTASK.fields_by_name['address'].has_options = True
_EXPORTEDREKALLLINUXTASK.fields_by_name['address']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001)\022\'The kernel address of this task_struct.'))
_EXPORTEDREKALLLINUXTASK.fields_by_name['pid'].has_options = True
_EXPORTEDREKALLLINUXTASK.fields_by_name['pid']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001$\022\"Unique process ID of this process.'))
_EXPORTEDREKALLLINUXTASK.fields_by_name['name'].has_options = True
_EXPORTEDREKALLLINUXTASK.fields_by_name['name']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001\023\022\021The process name.'))
_EXPORTEDREKALLLINUXTASK.fields_by_name['creation_time'].has_options = True
_EXPORTEDREKALLLINUXTASK.fields_by_name['creation_time']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001R\n\013RDFDatetime\022CWhen the process was created. In microseconds from UNIX epoch. UTC.'))
_EXPORTEDREKALLLINUXTASK.fields_by_name['parent_pid'].has_options = True
_EXPORTEDREKALLLINUXTASK.fields_by_name['parent_pid']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001*\022(Unique process ID of the parent process.'))
_EXPORTEDREKALLLINUXTASK.fields_by_name['commandline'].has_options = True
_EXPORTEDREKALLLINUXTASK.fields_by_name['commandline']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001.\022,The commandline used to launch this process.'))
_EXPORTEDREKALLLINUXTASK.fields_by_name['uid'].has_options = True
_EXPORTEDREKALLLINUXTASK.fields_by_name['uid']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001\022\022\020The current UID.'))
_EXPORTEDREKALLLINUXTASK.fields_by_name['gid'].has_options = True
_EXPORTEDREKALLLINUXTASK.fields_by_name['gid']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001\022\022\020The current GID.'))
_EXPORTEDREKALLLINUXTASK.fields_by_name['euid'].has_options = True
_EXPORTEDREKALLLINUXTASK.fields_by_name['euid']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001\034\022\032The current effective UID.'))
_EXPORTEDREKALLLINUXTASK.fields_by_name['egid'].has_options = True
_EXPORTEDREKALLLINUXTASK.fields_by_name['egid']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001\034\022\032The current effective GID.'))
_EXPORTEDREKALLLINUXTASKOP.fields_by_name['task'].has_options = True
_EXPORTEDREKALLLINUXTASKOP.fields_by_name['task']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001%\022#The task this operation applies to.'))
_EXPORTEDREKALLLINUXTASKOP.fields_by_name['operation'].has_options = True
_EXPORTEDREKALLLINUXTASKOP.fields_by_name['operation']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001\034\022\032The name of the operation.'))
_EXPORTEDREKALLLINUXTASKOP.fields_by_name['handler_address'].has_options = True
_EXPORTEDREKALLLINUXTASKOP.fields_by_name['handler_address']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001\035\022\033The address of the handler.'))
_EXPORTEDREKALLLINUXTASKOP.fields_by_name['module'].has_options = True
_EXPORTEDREKALLLINUXTASKOP.fields_by_name['module']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\0018\0226The name of the kernel module that holds the callback.'))
_EXPORTEDREKALLLINUXTASKOP.fields_by_name['symbol'].has_options = True
_EXPORTEDREKALLLINUXTASKOP.fields_by_name['symbol']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001,\022*The name of the symbol at handler_address.'))
_EXPORTEDREKALLLINUXPROCOP.fields_by_name['fullpath'].has_options = True
_EXPORTEDREKALLLINUXPROCOP.fields_by_name['fullpath']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001;\0229The fullpath to the proc entry this operation belongs to.'))
_EXPORTEDREKALLLINUXPROCOP.fields_by_name['operation'].has_options = True
_EXPORTEDREKALLLINUXPROCOP.fields_by_name['operation']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001\034\022\032The name of the operation.'))
_EXPORTEDREKALLLINUXPROCOP.fields_by_name['handler_address'].has_options = True
_EXPORTEDREKALLLINUXPROCOP.fields_by_name['handler_address']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001\035\022\033The address of the handler.'))
_EXPORTEDREKALLLINUXPROCOP.fields_by_name['module'].has_options = True
_EXPORTEDREKALLLINUXPROCOP.fields_by_name['module']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\0018\0226The name of the kernel module that holds the callback.'))
_EXPORTEDREKALLLINUXPROCOP.fields_by_name['symbol'].has_options = True
_EXPORTEDREKALLLINUXPROCOP.fields_by_name['symbol']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001,\022*The name of the symbol at handler_address.'))
_EXPORTEDREKALLKERNELOBJECT.fields_by_name['type'].has_options = True
_EXPORTEDREKALLKERNELOBJECT.fields_by_name['type']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001\025\022\023Kernel object type.'))
_EXPORTEDREKALLKERNELOBJECT.fields_by_name['name'].has_options = True
_EXPORTEDREKALLKERNELOBJECT.fields_by_name['name']._options = _descriptor._ParseOptions(descriptor_pb2.FieldOptions(), _b('\342\374\343\304\001\025\022\023Kernel object name.'))
# @@protoc_insertion_point(module_scope)
